TLS 1.3 : Base Key Meaning What is significance of following Base Key in TLS1.3 draft (28).

server_handshake_traffic_secret
client_handshake_traffic_secret
client_application_traffic_secret_N

So far I understand

server_handshake_traffic_secret should be private key using which certificate has been acquired.
client_handshake_traffic_secret ??
client_application_traffic_secret_N  should be symmetric keys established after the handshake where N denotes number of up-gradation in keys after handshake.

Please suggest correction and explanation for client_handshake_traffic_secret . Thanks.

See sections 7.2 and 7.3 of the draft.

Each secret is used by a specific endpoint (client or server) at a specific moment of the exchange: so first the handshake secrets are used then the application ones, and keys are derived from the secrets.

So the server_handshake_traffic_secret is what the server side uses to exchange data during the handshake and client_handshake_traffic_secret is the exact equivalent from the client part.


How does brainstorming look like for a team like Google's "Project Zero" The question is not necessary about technical details but more broad. I'm fascinated by the creativity involved in this process.

Since the news of Meltdown/Spectre I was wondering: How do teams like Project Zero come up with ideas to find 0-day exploits? Especially if we think of the ones mentioned which were there for decades.

Do they come in in the morning, get their coffee and say: "What would be the worst thing that could be exploited? Lets target the CPU!". And then spend an enormous amount of time studying it?

Or is it something like a coincidence: "While developing some tool I accidentally read some memory and I wondered why I was allowed to do this..."

I guess if you have a team dedicated to exploits, they wouldn't go after something by pure chance.

Edit:
I'm not sure if it is a duplicate of this question. The reason: I'm not asking about the techniques of finding the exploit. It is more general: How do they even decide on a possible "victim" software. As far as I understand Project Zero, they generally try to find exploits - no matter where.

Maybe @Overmind is right though and it is too broad to ask such a question.

Your question is too broad and not really related to security, but as a general rule, if you want to discover unique things, you must follow the special path of out-of-box thinking.

From a team's leadership perspective, each opinion is considered, each scenario checked no matter how strange it may seem. If fact, the strangest the idea, the higher the priority it should have.

From a team member's perspective, you must do exactly what noone else expects, tries or even thinks to do.

So a bunch of very good people are not enough, not even close to enough. You need members that are used to innovations, you need them to work both as a team and independently and you need to properly lead them.


Possible vulnerabilities from letting users set session values manually? I visited this site where I was able to set the language in the main page. When I clicked on the language link I got an URL like site.com/index.php?lang=us and was redirected to the home page. On the navbar I could see the USA flag, and when I looked into the HTML code I saw the session value us in the image src.

So I went back to the main page and set the lang value to test, like site.com/index.php?lang=test, got redirected, and it really changed the session value. The image on the navbar didn't exist and it was showing nothing.

Could this kind of thing affect the site in some way?

The lang=us thingy isn't a session. The parts after the ? in an URL are what is called query parameters. As any other part of the URL, modifying them changes what page you get. That is normal and totally expected. It's no stranger than me being able to "manipulate" the content Google displays by changing whats after the q in https://google.com?q=test.

It seems like things you set the lang query parameter to is echoed back into the image src attribute, even if the value is not a valid language code. That is a bit sloppy, but it is not a security problem in and of itself.

However, if you do not do any cleaning of the query parameters before you echo them back into your HTML source you will be vulnerable to reflected cross site scripting (XSS) attacks. To know if the site you visited is vulnerable, you would need to do more tests.

To learn what a session actually is, check out this article. For information about how to secure them, read OWASP.


Is there a law against one email containing both a login and a password? I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing both in one email?

If there is, it would be industry-specific. For example, the laws regulating nuclear reactors may be different from the ones regulating flower shops. As far as I know, there is no general federal law in the United States prohibiting you from sending credentials over email, even in the same message.


How to fix XSS in rails I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode brackets and back quotes.

How to solve this? What is the best method to prevent XSS in rails?

You should always validate user input.

For example, since you're expecting an URL, you could check that the submitted string starts with http:// or https://.

submitted_url.start_with?('http://', 'https://')


Preventing artificial latency or "Lag Hacking" in multiplayer games There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games.  There are at-least two ways of creating artificial latency. One method of introducing artificial latency is using a lag switch,  where the user intentionally disconnects their network cable.   Another method is using a flood of syn or udp packets to cause controlled and predictable disruption in the game so that a player can gain an unfair advantage.  Artificial latency attacks affect a large number of multiplayer games.

Some game companies have been made aware of this attack by their users,  but are ignoring this vulnerability because they don't have a solution.  The tools to carry out this attack are simple to construct,  readily available and easy to use.  They will often spoof the source IP address to make the attack difficult to trace.

So security.se, lets come up with a solution to this problem.  But first lets talk a bit about game protocols.  Online games commonly use UDP due to decreased latency and overhead,  but this also increases the susceptibility to spoofing.  Game protocols can use Latency Hiding to decrease the "perceived latency",  but this may increase the impact of artificial lag.  Multiplayer games often use a p2p architecture, for example Hydra: Peer-to-Peer architecture for games, and a peer is easy to flood.   The Unreal network architecture is well documented, and  is also vulnerable to this attack. (If there is another resource I should list,  let me know!)

I see two conceptual paths for dealing with lag attacks:

Punish lags. When an "artificial" lag is detected, evict the offender and enforce a ban period. This is hard to do in practice because there is a delicate balance to be found between people who cheat through lagging, and people who simply suffer from an occasional hiccup in their Internet connection. It is bad business practice to smite your own customers. Such kinds of solutions will necessarily end up with a threshold to distinguish between bad people and unlucky people. Cheaters will stick close to the threshold and this will probably be sufficient to gain some strategic advantage.

One promising approach along the punishment line is to apply small but cumulative penalties for each lag: whenever a packet is lost or shows up late, remove one hit point, make the player flash, whatever... this can even be integrated in the game universe (for instance, for a FPS convert the detected lag into a rifle jam). This implies that people with reliable Internet connections and big computers will be at an advantage -- and I believe that players are ready to accept that, on the basis that similar things happen in a lot of other leisure-competition situations (e.g. if your hobby is skateboarding, you know that a better skateboard will not replace talent, but will help nonetheless, and skateboarder accept that as a fact of life). Ultimately, this might incite ISP to work a bit on their latency, which would be good for everybody, not just gamers.
Don't trust clients. Massively online games are distributed computing. Most of their security issues are due to the fact that many game rules, i.e. the properties of the world in which the players act, are maintained by the client systems. The players themselves, and in particular the potential cheaters, have extensive control of their machines. Existing countermeasures tend to have limited effectiveness for the same reasons that software DRM and antivirus may fail: this is an arms race in which attackers and defenders are locked into a fast-paced battle of patches and counterpatches which is tiresome and requires expensive, continued maintenance.

The generic architectural response is to maintain the game rules server-side only; clients become "thin" and are just display interfaces. This is unfortunately hard to implement, because display performance (hence game experience) becomes very sensitive to latency, artificial and natural alike; and ADSL links will have a minimal latency close to 50 ms, which is high with regards to average gamer reflexes. Also, this means that the game servers need more CPU muscle. But the security advantage is huge: when a player induces lagging, he inherently punishes himself and none other.

Maintaining all game state and rules on the servers is not completely science-fiction either. Back in the late 1980s, one of the very first MMO games was "CarCrash", an offspring of the defunct French magazine Jeux et Stratégie; it was played over the Minitel, another old French technology where users simply had text terminals (with limited graphics) with no local computing abilities; the central server(s) maintained the game rules and computed the screen updates for everybody, and it worked. Computers at that time had far less CPU muscle than today; a 20 MHz CPU was enough to be deemed a "supercomputer". A 35$ home router of 2013 is more than ten times as powerful as a big server of that era. And yet it worked.

Maintaining game rules on the server implies departing from the way games are usually architectured. Historically, most games were local and became multiplayer by connecting clients with each other, with possibly a central server which only served as rendez-vous point. To take a political metaphor, games became multiplayer by forming confederations, but security against cheaters requires a federation.

Mixed strategies are possible, of course. The core idea is the same: give as few  sensitive data as possible to client systems; and when you must trust them for something, use a big stick or a big carrot to maintain them in line.

(If you understand that players should be handled like cattle herds, well,... there is truth in that, indeed. You don't want your cows to be unhappy, but you will not let them choose their walking direction and pace either.)

Edit: just got an insight while waiting for my tea to cool a bit. A game architecture could include several (possibly dozens) of cooperating "trusted" servers spread worldwide, which "play the game" like game clients do today. Each gamer would connect to one server which is "close by" (in a network sense) so as to have a low latency, allowing for the display-only strategy outlined above. If ISP themselves can be involved in the deal (each ISP would host a few servers in its own infrastructure) then this could make sense in a business way.


Risk of man in the middle attack on AWS S3 due to wildcard SSL certs I see that using AWS S3 with https, it comes with a wildcard SSL cert.

Does that mean man-in-the-middle attack is possible by DNS/network rogue and redirect users into another S3 link (having the same wildcard)?

Assuming that noone can acquire Amazon CA private key, thus cannot install the certs on their own host, they can only spoof another fake S3 site. E.g.

The original request is: https://good.s3.amazon.com/important.data

Can attacker redirect to: https://bad.s3.amazon.com/important.data (but actually corrupted data) with DNS/network rogue trick?

Then users instead of getting correct data, they will get corrupted data.

If somebody has access to the private key of the certificate he can use it for man in the middle attacks. Such attack can be used to redirect the user to another machine if the DNS lookup for the host given in the redirect results in the IP address of the other machine. This can be a different hostname in the same domain as in the original request and thus can be covered by the same wildcard certificate. But it can also be a different domain, for example a domain controlled by the attacker where he also has a certificate to do MITM where he controls the full server (no MITM needed).

Actually, I don't see the problem with a wildcard certificate in this case. It is enough that the attacker has access to any accepted certificate (wildcard or not) and its private key in order to sniff and modify the traffic. The attack is also not limited to redirecting to another system.

  Can attacker redirect to: bad.s3.amazon.com/important.data (but actually corrupted data) with DNS/network rogue trick?

One way is to trick the user into using the wrong URL in the first place (social attacks). Then an attacker  near the user (i.e. local network, ISP,...) might try do DNS spoofing, ARP spoofing or similar to let the user access the intended URL but on the wrong host. Only, in this case the HTTP host header of the request will show the intended domain and the HTTP based routing inside AWS will cause the request to either end up at the good bucket or to get rejected since the good bucket is not accessible using the specific IP address.


Secure memcpy for pure C Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code...

Part of the root cause, is usage of "unsafe" functions, including C++ staples such as memcpy, strcpy, strncpy, and more. These functions are considered unsafe since they directly handle unconstrained buffers, and without intensive, careful bounds checkings will typically directly overflow any target buffers.

Microsoft via SDL has banned use of those "unsafe" functions, and provides replacement functions for C++ - e.g. strcpy_s for strcpy, memcpy_s for memcpy, etc (depending on environment). Latest versions of Visual Studio will even let you do this automatically...

But what about "pure" C (i.e. not C++)?
And especially, what about non-MS platforms - including Linux and even non-VS compilers on windows...
Does anyone have safer replacement functions for these? Any recommended workarounds (besides simply doing more bounds checking...)?
Or are we all doomed to continue repeating our use of memcpy?

Let's be clear here.

insecure is a matter of context, not a case of "the use of" a specific function. If I use memcpy insecurely on a process running as a user with little to lose, no setuid or any such flags, the "worst" I can do is get a shell for that user and go from there. To achieve privilege escalation you need to attack something you can fool into giving you higher privileges.
C/C++ are not "dangerous tools". They are tools. Insert appropriate metaphor about dangerous DIY implement.

The fact is, as Rook has already said, C/C++ and other such other compiled-to-the-machine languages have a place in the world. They're for building fast systems, operating systems, system services etc. They afford you the ability to manage your own memory as you see fit. You're in control.

Unless you introduce some form of automatic memory management, there's no way of truly working out if you've gone past the allocated memory. So, ok, let's introduce a container. Now every memory access call that ever was needs to be checked. Is it in scope for that particular function? How many objects are pointing at it? Where are they in scope? Can I have pointers outside of the scope of the original reference and if so how do I keep track of it? Very quickly, you've got a virtual machine and so you have a managed language.

Also, as was demonstrated over on StackOverflow, it is possible to invoke memcpy_s in a way that is insecure anyway. It doesn't really solve the fundamental problem, just makes it a little harder to make mistakes.

That is the difference. C/C++ is fancy assembly with all the power you need to do anything. Java/Python etc protect you from that at a price: speed and power.

You've said repeatedly over the course of today (I've followed the SO version too) that you still haven't got an answer as to how you develop securely with C/C++ on other systems like Linux. Well firstly, with VS2005/2008 I pretty much habitually set CRT_SECURE_NO_DEPRECATE, but anyway, here's a few things you could do:

You ask on StackOverflow. You take note, learn, read and re-read.
Your compiler is (mostly) your friend. Listen to it. Use warnings. Turn them into errors. So cl /W4 and gcc -Wall -Werror -pedantic -std=c99. Yes, it is OTT in terms of error messages. But if you can't explain each one and justify why you're ignoring it, you don't understand your own code.
Check your memory allocation. valgrind's default invocation checks your allocations and deallocations mean you're not losing memory. If you've got memory leaks, you haven't thought enough about your code. It's a good sign you've got off-by-one errors, invalid bounds checking etc.
Use valgrind again. I've just picked this up, but look, there's an experimental over/under-run checker in valgrind. Will tell you if, for example, you crash off the end of the stack (possible, seeing as that's where most local variables are allocated) or outside the brk()'d heap.
Use splint a.k.a. secure lint, take note of its output. Again, if you can't explain any output it gives, you don't understand your code.
Inwardly digest the C Secure Coding Standard. Specifically relevant here:

  STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator.

  Copying data to a buffer that is not large enough to hold that data results in a buffer overflow. While not limited to null-terminated byte strings (NTBS), buffer overflows often occur when manipulating NTBS data. To prevent such errors, limit copies either through truncation or, preferably, ensure that the destination is of sufficient size to hold the character data to be copied and the null-termination character.

  STR35-C. Do not copy data from an unbounded source to a fixed-length array

  Functions that perform unbounded copies often rely on external input to be a reasonable size. Such assumptions may prove to be false, causing a buffer overflow to occur. For this reason, care must be taken when using functions that may perform unbounded copies.

Splint will provide you with some guidance similar to CERT. Note that memcpy is considered the compliant solution in the first example of STR35-C.

If you are using C++, use std::string and boost::shared_ptr (and related; use the appropriate one). There is absolutely no argument to be malloc'ing and memcpying strings in C++ except for interaction with C. Even then string.c_str(), please and leave the manipulations to C++.
Dynamically link where possible. If you've statically linked any 3rd party code into your app and that turns out to have a security problem, you've got it too and you have to redistribute your image too. Not only are shared objects just more convenient generally, you also get security updates by default. I know there are cases where you can't, that's why I say "where possible".
Build this into your development cycle.
Hope you didn't miss something.
Keep up with relevant security community updates that might be relevant.
Be nice to the security community. Acknowledge sec vuln's, take steps to fix them. All code has (or had them) bugs if it is worth running. Simple as that.

At the end of the day I don't think the problem is solved by "secure" functions. I think the problem is solved by the use of some decent tools, a proper development process that rejects poor code from critical versions (late betas and release candidates) and finally an awareness of good practice/current issues.

Finally, memcpy_s isn't part of the C99 standard. It's an extension to the C library (as in not part of the core) and therefore not guaranteed to be on the platform I'm using. memcpy is. For a software project that needs to be compiled cross platform, that'll probably be the deciding factor in which function to use.


Phone Applications having SSL/TLS enabled behind the scenes? Please Note: This question is slightly based on me being a tin foiled hat with the issues that has arisen from the leaks, documents, and questioning trust thanks to Edward Snowden.

Thanks to adding my VPN service to my cellphone to improve security and stop "eavesdropping" of Verizon on my data and usage, I am questioning the trust with Twitter, Facebook, Google, and all of the major social networking applications and how they are keeping our data secure as we access their applications.

There is no notice, information, or indication that they are using SSL/TLS within their applications for Android, Windows Phone, and iPhones.

Is Facebook, Twitter, Google Plus, and other major applications have SSL/TLS enabled and coded into their phone/tablet applications behind the scenes?

Short answer for your question is yes, most major (and official) social networking apps use encrypted connections.
However, if you are interested, there are ways you can find out for yourself by setting up a proxy server that allows you to forward traffic through that system and then analyze the data. There are however, some tools to do this:
1- There is an Androguard extension called MalloDroid that

facilitates static code analysis of Android applications.

Specific details are as follows:

Analyze the networking API calls, and extract valid HTTP(S) URLs from
the decompiled apps
Check the validity of the SSL certificates of all extracted HTTPS
hosts.
Identify apps containing API calls that differ from Android's default
SSL usage, e.g., contain non-default trust managers, SSL socket
factories or hostname verifiers with permissive verification
strategies.

2- ZAP by Zscaler is a

web-based tool designed to streamline the capture and analysis of
HTTP(S) traffic from mobile applications. ZAP is capable of analyzing
traffic from both iOS and Android applications.

ZAP checks the following:

Authentication: Username/password sent in clear text or using weak
encoding methods.
Device Metadata Leakage: Data that can identify an individual device,
such as the Unique Device Identifier (UDID).
Personally Identifiable Information Leakage: Data that can identify
an individual user, such as an email address, phone number or mailing
address.
Exposed content: Communication with third parties such as advertising
or analytics sites.

Sources:

http://www.techrepublic.com/blog/it-security/android-apps-and-ssl-wheres-the-padlock/
http://zap.zscaler.com/about.php
https://code.google.com/p/androguard/#Description


I don't think it will open you up to SQL Injection.

That said - while I am not an expert on Prestashop or it's code base, I got the impression that the sanitize function you linked to is not just used to prevent SQL Injection, but multiple kinds of vulnerabilities (notice the call to strip_tags on line 102).  If this is true you should be careful that you aren't opening yourself up for other types of vulnerabilities.  The first one that comes to mind by allowing . is directory traversal.

Ideally, allowing the . character as input wouldn't open you up to this type of attack, but without doing a security audit of the code I can't say for sure.

Also - if they aren't using parameterization for protection from SQL Injection I would be very concerned about the overall security of their code.  The concept of rolling your own SQL Injection protection has been discussed at great length in the security community and the consensus is that it is almost never a good idea.

So in summary - I don't think the . opens you up to SQL Injection, watch out for other vulnerabilities and be wary of Pretashop's approach to security.


Password Policy: Issue random generated passwords / Let the user choose a password I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangling rules.
Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issuing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentication is in general a good solution but will not work for us. We are a small company and implementing Two Factor Authentication comes with relatively high initial costs.

Best password policies:
Strong, managed, and kept secure.

Strong

long(12 or more characters)
full character set required(upper, lower, number, symbol)
no complete words
no personal information if based on a word

managed

kept in a secure location in case a lookup is needed
changed regularly
not the same as the previous pass
kept hashed in a database behind a completely random password(of insane strength) or on a non networked database that requires physical secure access

secure

recovery happens in person or thorough secure channels
passwords are reviewed before changing(either automatic or on a schedule)
no user knows another users password(if it's discovered they do and don't have a good reason for it, force a password change)
option for 2 factor authentication to make it more secure

these tips are the best for password security and often get used on an enterprise level.

About 2 factor and some problems with it:

Of course that option for 2 factor authentication often gets tossed around as a "Why not just use 2 factor authentication then". Well there's actually a reason for this: you probably should for accounts that deal with sensitive data. Oh wait yeah there's also some pitfalls:

For everyone else this adds a physical layer of authentication that costs money, time, and setup as well as running or hiring a service to generate, and keep the authentication in sync. With networked and off site locations possible, this can run into some problems if not handled correctly, and over time always needs upkeep. Worse yet loss of keygen is a common problem, so backups are needed on site to be handed out, and if on a business trip 2 factor leads to a huge problem if lost. Then there's training them in how to use it, and forcing them to still have secure passwords. This takes a long time to get running(depending on the size of the company, this could actually lead to an entire IT overhaul), and requires training and staff dedicated to just maintaining it.

TL,DR:

Implement secure passwords, and talk to the company about password policy and maintenance. Then offer the option of 2 factor(and force it in some places if needed). Also always review passwords(either manually or through a algorithm) to confirm they aren't easy to crack or contain personally identifiable information. These best practices are enough to keep many companies safe. However never forget that passwords are only 1 part of cyber security.

As for giving out random passwords... well initially this is fine, but eventually the need to be rotated, and if that's the case then you should let them choose so they can remember it easier. If they can't remember it they will keep failing to login, IT load will increase due to forgotten passwords, and then writing it own on sticky notes and losing them now becomes an attack vector, or keeping them in personal email wit ha weak password, all sort of bad stuff, etc.. It would be better to instruct them in how to create a secure, long, strong, and easily remembered password like the following:

R4nD0ms7@Pl312eM0/312
is a random staple remover. Good luck identifying that at a glance, or cracking it. But wait you've already memorized the base!


Verification-less signup when user has been invited? The typical signup procedure is of course:

Alice enters email address and desired password (and possibly other data).
A verification email is sent to the address Alice provided.
Alice confirms her email address via a link (with a unique token) in the email.
Alice now has access to the service.

But in the case of services where users invite others by entering their email addresses, does it make sense to streamline the signup procedure? If the new user arrives at the site via an email link, can't the verification email be skipped?

The flow would instead be:

Alice (an existing user) invites Bob to the service by entering his email address into the service's invitation function.
Bob receives the email, which has a link (again with a token) to the signup page.
The signup page is pre-filled with Bob's email address, so all he has to do is pick a password (the token also gets propagated, so Bob can't craft a request to override the pre-filled email address).
Bob has access immediately.

I wouldn't be surprised if some services already do this, I just haven't seen any (at least none I can recall).

As far as I can tell, the second flow provides the same amount of verification/confirmation as the first one; in either case, the user follows a link with a unique token that's tied to their address. Or, at any rate, an email account they have access to.

But is it the same? Does the altered flow provide some foothold for attackers?

In general it isn't necessary to require the user to re-enter their email address if the link is received via that same email address. It is important though to use SSL, expire the link as soon as a password is created, and consider expiring the link if no password has been created after a certain amount of time.

That being said, it is slightly more secure to still require the user to re-enter their email address. It's possible that an attacker could gain access to the link without the email, for example in a browser cache of a user that clicked the link from a public computer and then didn't finish setting a password. However, I would consider this scenario pretty contrived, when compared to the convenience of pre-filling the email.


Why are salted hashes better than just hashing? I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords:

Just keep them in plain text
Keep passwords in plain text, but encrypt the database
Hash a password
Use salted hashes of passwords.

The best way is supposed to be the 4th.
My main misunderstanding is about: "what do we want to protect from?" As I understand - from the case when hacker gets access to our server and gets the database and the server-side source code. In this case, I, as a developer, jeopardize accounts of those users who have the same passwords on all websites. Hacker gets a password from my database and then knows what password this user has on other websites/apps. That is why I want to to make passwords as secure as it is possible. In this case, I do not understand the difference between ways 3 and 4 (1 and 2 are obviously bad, I think).
To crack passwords in way 3 the hacker gets my hashing algorithm and just tries to hash some passwords (either brute force or maybe some db of common passwords) and compare gotten string to the database. To crack way 4 the hacker has to try passwords like in the way 3, but, when hashing, his program will just take stored random string from my base and use it when hashing. It will be a bit longer for hacker, but not a lot (I think). So why the way 4 should be a lot more secure than the 3 one, or what do not I understand in the 4th way?

Does Hash/Salted password really help when DB is compromised? really does answer your question, but there looks like there is a language issue. So I will explain in a different way.
If we only hashed passwords, and not salted them, then commonly used passwords would all look the same. The password password in MD5 on every system in the world will always be:
286755FAD04869CA523320ACCE0DC6A4

Tables and databases of hashes of these common passwords exist. For fun, look up that hash on Google. So if an attacker gets the password database, they can look these up and know your user's passwords to log into your system. It takes very little time, and very little work, to discover the password. And they can do this very quickly for each password in your database.
If more than one user uses the same password, like if they used password, then all those passwords will have the same hash, which makes it even easier for the attacker to look them up, or try to brute force the one hash to discover multiple user's passwords.
Adding a salt makes these hashes unique in your system, even if the password is still password. For instance, if you add iamasalt to password you get iamasaltpassword and that hashed in MD5 is:
B27EB5B892E89369497C2DD9749667AF

Even though the password is still password, it is stored in your password database in a unique way so that the tables and databases of common password hashes do not work. An attacker might know the salt, but now the attacker has to go through the work of figuring out what the password really is for each and every password. Knowing the hash is not so useful anymore.
By having a unique salt for each user, then even if users use the same password, that fact will not be known by the attacker unless all hashes are brute-forced. They cannot break one hash and get access to multiple accounts.
Salts stop the attacker from simply looking up the hash in a table or to crack one hash and get access to more than one account. And it forces the attacker to brute force the hash of each password.


Solution to cryptographic end-point failures? When using any cryptographic solution, the endpoints used must be secure. Malign software/exploits/bugs risk the entire security of any crypto system and forfeits any guarantees made by the software running on commodity PCs.

Considering that certain TLAs (Three Letter Agencies) and FLAB (Four Letter Abbreviated Bureaus) are on all levels an APT, it seems not that far out there that they might be inside of practically every piece of hardware out there.

I hear people talk about having a dedicated key management machine. But this is only used to generate new keys and revoke existing ones, not to encrypt data?

So why is it that I don't see people having dedicated airgapped crypto machines with validated hardware on their desk? Inconvenience? Price? Am I missing something here? Are devices like this out there that I don't know about? Is the security gained by validated hardware somehow less significant than the current ease with which malign code can be injected in open source software?

You certainly can have dedicated hardware (an HSM, or hardware security module) that both protects keys, and performs cryptographic operations such as encryption, decryption, and signing in a hardened, special purpose appliance.

The primary reason they're not more widely used is, as you have already suspected, price.  They're expensive and complicated, and the risk of compromise from a three or four letter agency (or other threat actors that would compromise a cryptosystem) is, to the average organization, not sufficient high as to justify the cost.

You also have to consider that the threat model they protect against is quite small.  Even if you're performing cryptographic operations on dedicated hardware, if the hardware communicating with your HSM (sending plaintext to be encrypted, or receiving decrypted ciphertexts) is compromised, the raw communication is still at risk...You're still only ultimately protecting the keys.  This does add a valuable layer of security, but it is still a limited layer of security.  This has to factor into the equation of whether the risk is limited to a degree that justifies the price.  In many cases (or most cases, perhaps) it does not.  The performance you can get by offloading crypto operations to dedicated hardware may justify the price, but in many (or perhaps most) cases, the security that you get will not.


AES-CTR with PBKDF2 for IV for file archiving at server. Is this ok? I have tried to grasp enough of encryption/hashing to be able to implement a secure storage for files, server side. Once I have it down to reasonably safe I'll go over it with an expert. There is no point in calling in the expert before I understand it at a reasonable level.

Please could someone tell me if I'm doing it right, and also if there are redundant parts that I don't need.

Here is my current setup:

OpenSSL
AES-128 for encryption because it's faster and supposedly as secure as -256
CTR-mode because I don't need authentication (as in CGM). And because (I think) does not need padding which might open up some for vulnerabilities (as CBC)
All stored files have a database record where I store the IV.
I also store the iteration count for the IV so I can go back and recalculate with more iterations if needed.
IV is 16 bytes to match 128 bit block size
Encryption password is hardcoded and stored in server software. Same password for all files.

How long should this random password be?

IV is calculated with pbkdf2. @100,000 iterations, sha256, random 32bit salt.

a password is needed for IV calculations as well. Can I use the same password as for encryption?

But I do wonder if pbkdf is really needed in my use case. Encryption/Decryption of files are done at the server in a queue-based manner, i.e. no user interaction is involved. So the need to slow down the hashing process doesn't seem to apply here. Or have I misunderstood something? I just need a random and unique IV, I don't need it to take time, though..

edit -->

A simpler solution would be to not use an IV (i.e. IV = 0) and instead use pbkdf to create a unique encryption password for each file. The only drawback I can see with this is that my files would be in the open if someone got to the database.

With the solution described above an attacher would need booth the IV from the database and the password from the server (and of course the file to decrypt).

Would it be considered stupid to omit the IV and just use unique, random passwords instead.

<---

edit again --->>

After contemplating a bit on Polynomials answer and comments I realize that I have to back off.

The biggest problem with the above is that it gets unsecure the moment I store the password somewhere. Only some of the files are actually sensitive. When sensible files needs encryption I'll ask the user for a password via an app both for locking and unlocking the files. The password will only be stored in memory and I'll leave it to the user to remember the password.

I'll get into some problem when more than one server can serve the app. I might solve it by not load balancing the route for the password api, so this small task is only handled by one server. Otherwise I'd have to communicate the password between the servers so all would have it in memory.

Phew.. This security thing really takes some thinking for a regular database/server/app-kind of guy. I'd better get back to some productive coding for a while and revisit this later..

<<---

Thanks in advance,
//Michael

AES-128 for encryption because it's faster and supposedly as secure as -256

Yes and no. If you plan on storing your data for a long time, and you're worried about post-quantum attacks, 256-bit might be the better option. Grover's algorithm reduces the time complexity of cracking a 128-bit key down to about 264, which is likely feasible. For 256-bit it reduces the security bound to 2128 operations which is still likely infeasible.

  CTR-mode because I don't need authentication (as in CGM).

Nitpick: It's GCM (Gallois/Counter Mode).

CTR is a reasonable option, but you really will be open to malleability attacks if someone obtains write access to your device. For example, if you were to encrypt an system disk image with GRUB installed, an attacker could guess the instruction bytes as certain positions in that bootloader area (it's a known position and bootloader code is fairly static across versons) then they could backdoor your bootloader and therefore your OS once you decrypt and restore the backup.

  And because (I think) does not need padding which might open up some for vulnerabilities (as CBC)

CBC vulnerabilities are mostly padding oracles, which mostly only apply in an interactive environment. They're almost certainly irrelevant in backup scenarios like this. If you're looking for a good block mode to use for storage, look into something like XTS or XTX. I don't know if OpenSSL supports them though.

  All stored files have a database record where I store the IV.

Personally, I'd just prepend or append the IV to the encrypted file data.

  I also store the iteration count for the IV so I can go back and recalculate with more iterations if needed.

Hmm. Ok. I don't quite understand why you need PBKDF2 to generate an IV at all.

  Encryption password is hardcoded and stored in server software. Same password for all files.

This is massively insecure. Your solution has zero security as anyone who compromises the server can simply decrypt all the files.

  IV is calculated with pbkdf2. @100,000 iterations, sha256, random 32bit salt.

Why? IVs are meant to be unique, and don't need to be random or secret. They exist only to ensure that encrypting multiple messages with the same key isn't insecure.

  a password is needed for IV calculations as well. Can I use the same password as for encryption?

Irrelevant. Your IV should just be a unique value for each file.

  But I do wonder if pbkdf is really needed in my use case. Encryption/Decryption of files are done at the server in a queue-based manner, i.e. no user interaction is involved. So the need to slow down the hashing process doesn't seem to apply here.

It really is irrelevant. Your IV does not need to be secret, and in many cases don't need to be random either, just unique.

  Or have I misunderstood something?

A few things, it seems. You seem to have invented an overly complicated backup encryption scheme where something as simple as the command line openssl tool could be used (see this StackOverflow question). Don't be Dave. You seem to have a reasonable grasp of crypto concepts, but that doesn't mean you should design your own schemes for anything.


How does openvpn work for only certain servers? I got a *.openvpn from work and I monitored the traffic on wireshark.
On my normal vpn every traffic is routed via the vpn (as expected).
But with this work vpn only the traffic that uses the work servers use the openvpn protocol.
So I'm wondering how do they detect if certain traffic should be rerouted over the work vpn and which traffic should use the "normal route" over my internet provider.
In the *.openvpn there are the following commands
nobind
remote xx.xx.com 1194 udp # xx is the work server name
remote xx.xx.com 443 tcp

I guess this remote command checks if certain traffic should be rerouted and if the server name matches it uses the vpn, but how exactly is this done? Does the vpn monitor all dns requests? How does it get the exact ip address of the work server?
Or to put it more simply: Can my work see my other internet activities(via dns queries or similar) while the vpn is connected?

This is called split-tunneling. It is done by establishing a VPN tunnel to the company but then routing only a specific network range through this tunnel. All other traffic is handled the same way as was done without VPN. Note that the commands you show are unrelated to this split-tunnel setup.

Or to put it more simply: Can my work see my other internet activities(via dns queries or similar) while the vpn is connected?

This depends on what your DNS server is. This is not visible from the config you've shown but it might be part of the config. If it is a server where the company has access to the logs then they might also monitor which sites you access.


Limit Web App Access To Specific Organizations I'm relatively new to web development and security and I'm looking to limit the access to my web app to specific companies (and/or IP addresses).

Authentication at the user level via username and password is not an option. I could set up a firewall and only allow traffic from certain IP addresses, but this doesn't seem like the most secure solution since someone could just spoof the IP.

Is there an auth pattern that would be able to handle this case? The end result would have all users belonging to a given organization having access to the app. Use a certificate or something like that?

IP Spoofing is hard. Very, very hard. You can hardly send a couple bytes on a simple protocol using IP spoofing, let alone requiring an answer/response.

Imagine talking to someone, but only being able to speak to them, and not listen to them. IP Spoofing is like that. You must predict all their answers (on protocol level) and give credible answers without ever receiving anything from them. It's not easy at all.

Your main problem is not that is easy to spoof IP (it is not), but that is easy to attack someone at those companies and use their computers as a proxy. A phishing email will end up with someone there executing a program from someone outside, and create a tunnel between the attacker and your application. Unlikely, but way more likely than a IP spoof.

You can safely use an IP whitelist, and only allow people from that list. Usually companies will have a gateway server (and proxy, and IPS/IDS, and virus scanner all in one) and every request will come from this gateway. So it's simple to create such a list.

You said login/password is not an option. Why?


Node.js static file security: What happens if hackers can control my bucket? I'm new to Node.js and I have Node.js App with Vue. I use AWS S3 to server static JS file like app.XXXX.js manifest.XXXX.js vendor.XXXXX.js
So what is the security implication if a hacker can gain access to my S3 bucket and try to modify my static JS files?
Can they execute code on my main server?

If you lose controle over your javascript files. Anything can be done with them.
If you load the files inside your node application (Ea import them or eval them or such)
So A important question is why are you serving code from a different location outside of your controle?
Would it. It be better to serve data files from s3 and serve code from your own controlled host (Ea load in JSON files from s3)


Can brute force or dictionary attacks be detected when using the WiFi protocol? Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times.

No, it is fundamentally impossible to detect a brute force or dictionary attack when using the IEEE 802.11i (WPA2) protocol. This is due to the fact that brute force attacks do not require interacting with the router at all, only passively observing existing connections. If they observe the 4-way handshake, they can attempt to brute force it offline and use it to either authenticate or passively decrypt traffic. The router has no way to know if a client connecting to it is connecting with a key legitimately obtained or with a key that has been obtained through cracking* the 4-way handshake.

The upcoming WPA3 protocol will no longer be vulnerable to offline brute force and dictionary attacks due to its use of the Dragonfly protocol. Unlike WPA2, the encryption key is generated randomly and is distinct from the password used for authentication. Attempting to authenticate with any given password requires interacting with the router, so a brute force attack will thus require actively requesting authentication from the router, which can then rate-limit requests, log failed attempts, or outright refuse to serve a client that is repeatedly failing authentication.

* A one-way hash of a the password is sent in the clear, so all the attacker has to do is run candidate passwords through the same algorithm and compare the resulting hash to the hash of the correct password.


Cookie set from a server to a client with different domain(via XHR), but not recognized by Client domain I have three domains but the  same code base (Domain X, Domain Y, Domain Z) and
Accounts website A
If a user tries to sign in accounts from domain X, I wanted to SSO in the other two domains (Browser Scenario: third party cookies blocked).
I tried the following approach,

Go to Accounts from Domain X
Sign In
Get the required authentication token info and posts an XHR request to Domain Y to create a cookie.

When I check the request in Network, the required cookie is set in the response cookies, but when I open Domain Y separately the cookie is not present in the Application Cookies.
Can anyone please tell why the created cookie via XHR request is not accessible by the main domain? Kindly help.
XHR request (withCredentials set to true):
$.ajax({
    type: "POST",
    data: result,
    url: result.uri,
    beforeSend: function (xhr) {
        xhr.withCredentials = true;
    },
    success: function (data) {
        console.log(data);
    }
});

Cookie Info:
HttpOnly: true
Secure: false
SameSite: None

From the documentation at MDN:

Note: XMLHttpRequest responses from a different domain cannot set cookie values for their own domain unless withCredentials is set to true before making the request, regardless of Access-Control- header values.

It is unknown if your request already includes withCredentials since you don't show any code in your question.
Also make sure that the cookie has the correct SameSite attribute set since browsers started change the default to Lax which might not be what you need in your use case.


OSX can't do passwordless localhost ssh I've just searched around and couldn't find any solution so here's my problem:

On my OSX 10.7.4 I'm trying to set up a passwordless localhost ssh by ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa & cat ~/.ssh/id_dsa.pub >> ~/.ssh/authorized_keys but ssh localhost keeps asking for the password. I deleted all lines in ~/.ssh/authorized_keys and the ~/.ssh/known_hosts and started over but nothing changed, it still asks. What should I do? Thank you.

Do not use DSA keys. They are fixed 1024 bits and not secure enough today. Generate a new RSA key and your steps should work:

ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

If the RSA does not work either, most probably there will be a problem with permissions (which is in the debug log of the server). Make sure that your home directory, the ~/.ssh/ and authorized_keys files are owned by you and not writable by any other user/group.


Best strategy to share some sensitive user data between Node and PHP I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I want to use usernames that people registered with. And, of course, I want people not be able to impersonate other people. So, once user enters a message, it gets socket.emited to the server, and from the server I do something like:

socket.on('message', function(msg) {
    io.emit('message', {
        username: username
        message: msg
    });
});

To broadcast that message to everyone.

My question is, how do I retrieve the username? My solution at the moment is this. I create a unique 128 chars long user_id on user sign up, store in redis something like

user_id: username,

and then I pass user_id on socket.emit and do on Node server

username: redisClient.get("user_id").

Is it a good idea? Is it secure? Or there are better solutions to this problem?

From my perspective your case fits very well with JSON Web Token (JWT) approach. You can encode all necessary data in JWT and pass it with requests. Your Node.js application should verify signature of JWT and extract all needed data from it. If something is too big / complex to put in JWT, than backend application may request for this data another backend service for it via your backend network security mechanisms.


Is it practical to pre-blacklist certain GeoIP regions? In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server.

The firewall has been set up properly to only allow connections through the ports used.

The thing is, there was brief discussion about blacklisting all IP's from certain countries that don't fit into the scope of the website, meaning the idea is to automatically blacklist anyone from several countries where some attacks originate from, but users don't.

Is it practical to auto-blacklist users by Geo-IP from regions that don't normally use the website?

We've been thinking of having this limit for at least back-end ports, meaning only the countries that house authorized people are allowed through.

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained and updated with the latest assignments, you might accidentally block legitimate users from target countries, who happen to have been given IPs from a pool previously assigned to a blocked country.

From a security point of view, it can reduce the volume of attacks, and increase the costs to an attacker of targeting your site (since they need to get machines from specific countries, rather than any machines).

It tends to make sense when you have a regionally restricted product - think of shops where goods are only shipped within a specific country, competitions which only accept entries from people in a given region, or systems which work in conjunction with physical businesses which have a limited range (e.g. deliveries to a national chain store, so there would be no way for a user elsewhere to benefit from the service). In those cases, it tends to be easier to justify the risks, since there is no way people from other countries can use the service (and it wouldn't be hard to include neighbouring countries in case of edge cases - a Portuguese business might include Spanish IP ranges, just in case, say).

It makes less sense when you have an information business, or a digital product. In these cases, you might end up getting more unwanted traffic, as people who want to obtain the product resort to VPNs within allowed countries. Think artificial restrictions such as film releases staggered around the world, TV shows with months of delay before being shown outside the country of origin, or game releases.

You can obtain country specific IP lists from sites such as http://www.ipdeny.com/ipblocks/ and then choose whether to use a whitelist approach ("we only deliver to southern Italy, so will only allow Italian and Vatican City IP addresses") or a blacklist approach ("we see lots of attacks from Australia, so will block all Australian IP addresses").

(Please note, all countries are randomly selected and should not be taken as approval or disapproval of given countries.)


What should I do if my Android was hacked? I know my Android phone was hacked and now, the hacker can take snaps with my front/back camera, register videos, view/send SMS and access everything on my phone. I can suppose he installed an .apk file but I didn't find any .apk files. What should I do?

You deal with a phone infected with malware pretty much the same way you deal with a computer infected by malware - you do a complete factory reset, wiping everything from the phone and reinstalling the OS. Don't expect that you will be able to surgically remove the malware. Most likely you will not, or at least you will not know if anything is left.

You may want to avoid using the phone before you do this, and especially avoid connecting it to anything else. You may also want to change any passwords you have entered on the infected device.


Hilton and Choice Hotel websites reported insecure but valid SSL by chrome? I was checking out hotel websites for reservations this weekend and noticed hotel giants Hilton and Choice websites are being reported to have valid but insecure SSL.

For Choice, chrome is reporting that attackers might be able to see the images you are looking at on this site and trick you by modifying them. The same message is on their signup and reservation pages.

For Hilton, chrome flat out says you should not enter any sensitive information on this site (for example passwords or credit cards) because it could be stolen by attackers. This is also reported on their signup and reservation pages.

Is there any other way a consumer could securely use these sites or is the best bet to stop doing business with them until they improve their site security?

Update

Since this post, Choice hotel site has been updated.

Here is a pic of the Hilton sign-up page showing insecure. Sign-in and room registration pages are also now showing secure.

In case of Hilton Google reports an form with an insecure URL - it seems to be the search form and not the form where you enter personal details. For Choice I currently don't see any problems reported by Chrome.

  Is there any other way a consumer could securely use these sites or is the best bet to stop doing business with them until they improve their site security?

There is no definitive answer. It depends on the specific problem and on the risks you are willing to accept in order to achieve your final goal (i.e. booking a room in a hotel).

In this specific case somebody might intercept your search, which you might consider as no big deal. Even if some personal details would be transferred in plain it might be no big deal in case these details are already widely known anyway (i.e. posted on Facebook or similar). If more secret personal data are transferred like credit card data it could be considered more of a problem.

On the other hand HTTPS does not provide 100% security either: it only protects the data against sniffing and modification during transit to the server but not afterwards. Thus for example your credit card data might still get stolen as happend in the past with Hilton but also other hotel chains.
Also, HTTPS does not protect you if the site is hacked and serves malicious content to the visitors.

Still, you might see the obvious inability to offer a fully secured connection to their public visible site as a sign that they don't care enough about security in the first place. And you might extrapolate how their internal security will be if they don't even get their public visible security right.  Given that you trust them to keep your data safe you might ask yourself if the trust is justified.


What metadata is exposed by OpenPGP? Say I have a file encrypted with GnuPG, in isolation (i.e., I don’t have the relevant keys). Can one then establish the recipients of the encryption? That is:

Name/E-Mail/Comment
Key ID

Or is this information only discernible if you have the appropriate keys?
Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

Can one then establish the recipients of the encryption?

Ordinarily, yes. The recipient's Key ID is included in the metadata.
This can be disabled if you use --throw-keyids option.

Likewise, same question for a GnuPG signed file? (i.e., Can you at least establish the signer, without authenticating their signature, without having the key in your keyring?)

Yes, and as far as I know there is no way to disable the inclusion of the signer's key ID in the signature data (it wouldn't make much sense to do so). If this information needs to be hidden, you should sign, then encrypt the signed file with the throw-keyids option.


How securely random is Oracle's java.security.SecureRandom There was a lot of news in the past year about exploitable weaknesses in cryptography which originated from weak random number generators. In some cases it was negligence on side of the developers, in others it was intelligence organisations intentionally sabotaging standards for secure RNG generation.

What about the implementation of the SecureRandom random number generator used in Oracle's JavaVM? What algorithm is it using when you don't specify one? And is that algorithm and its implementation secure enough for use in cryptography?

The JDK complete source code (not only the standard classes, but also the Sun-specific classes and the C++ native code) used to be available under a "research license", and I have a copy on my disk, for JDK 1.6 (I suppose that nowadays you would go to OpenJDK).

We see that creating a java.security.SecureRandom instance implies invoking the default PRNG which happens to be the Sun-specific class sun.security.provider.SecureRandom.

The PRNG is seeded from sun.security.provider.SeedGenerator which in turn will try to rely on what the OS provides, i.e. /dev/urandom or /dev/random on Unix-like systems (such as Linux), CryptoAPI's CryptGenRandom() on Windows. If such things are not available (or deactivated from JVM's config), then the seed will be extracted by timing the speed at which the OS can switch contexts between threads; this is a fallback mechanism which is very rarely, if ever, triggered.

The seed is expanded with what appears to be a custom, home-made PRNG based on SHA-1. It works like this:

There is a 160-bit state s, which is 20 bytes, and is also interpreted as an integer modulo 2160 by applying the little-endian convention.
Output is produced by 20-byte chunks.
To produce the next chunk c:

c = SHA-1(s)
s = s + c + 1 mod 2160

There is a mechanism which ensures that s is indeed changed at some point; if s appears to be unchanged by the update, then its first byte is incremented forcefully. This is never invoked; probability of such an occurrence is 2-160 and forcing it with a special seed would require breaking SHA-1's preimage resistance, which we don't know how to do.

Cryptographically speaking, this is not atrocious; it should reach a cycle, on average, only after about 280 chunks, and the cycle should have the same average length; that's a lot (about 24 millions of billions of gigabytes), so that's good. If SHA-1 is a random oracle then the PRNG is "obviously" secure as long as attackers cannot enumerate a 160-bit space (they realistically cannot) and a given seed is not used to produce more than 24 millions of billions of gigabytes (and it won't, not in any reasonable or even unreasonable time). We know that SHA-1 is not a random oracle, but it still looks randomish enough.

Personally, I would not deem this PRNG a problem for cryptographic usage; it has no "magic constant" and thus very unlikely to be backdoored. The one bad part of it is that it is non-standard, thus understudied.

If (when) I need to have, in Java, randomness which is good enough for formal cryptography (i.e. good, and also demonstrably good for regulatory purposes), then I use java.security.SecureRandom to generate an initial seed (at least 16 bytes), that I then run through HMAC_DRBG (specified in NIST SP800-90A)(the same publication contains the Dual_EC_DRBG of sinister fame, but HMAC_DRBG is nonetheless considered to be fine and clean by cryptographers).


Safely converting untrusted files with Microsoft Word in a web service I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert their type.

Another critical assume is that my server will meet, in some day, an infected file within the given urls.

Now, I'm wondering how I'm can secure my machine from infected files attack? How I'm can detect it after it done?

I'm thought to run MS-Word with limited user. Not have success yet... but maybe i'll in the further.

What else I can do?

Why not simply run a good virus checker against all files on the server?

Also, by default, when accessing Office documents from a network location, Office applications treat them as untrusted so continue with that. You could probably go further and write something to strip any embedded macros but this seems like a lot of effort when the basics are pretty straight-forward. Do you even have any macro enabled Office documents that you use? If not, turn off macros alltogether in Office and then you will be fine apart from the occasional, more sophisticated nastyness you might come across. For that, you need to make sure that your client PC is well protected. Avast or similar along with Microsoft EMET, if you can, configure your client PC to only run whitelisted applications.


what can a hacker do with stolen cookies? What if a hacker steals my cookies for example using BeEF or something else. What can they do with this information? Can they get any passwords or something?

Session cookies are pieces of information that allow you to maintain state across multiple HTTP requests (which is by design a stateless protocol).

In other words, what allows you to login to gmail, reboot your computer and go back to gmail without having to login is the presence of a session cookie that, on the server side, matches an active session.

So, hackers who can steal your session cookies will be able to impersonate you (within certain limitations) on the websites you are logged in to. For example Gmail, Twitter, Facebook, eBay, etc.

Can they get your passwords? Not directly, although depending on the implementation of the applications they got access to, they may be able to find hints, fragments or the actual password set to that account.


How to launch XSS code from an INPUT HTML tag upon page load? Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
However is there a way to make a javascript popup appear when the page first loads?

Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.


What's the difference between an access control method, security model, and security policy? I'm studying for the CISSP exam and I'm getting confused about the differences between access control methods, security models, and security policies.

When I was originally studying Mandatory Access Control, the video instructor seemed to closely tie it to Bell-Lapadula.  After reviewing though, here's my new understanding:

A Security Policy is the broad outline of an organization's requirements as they pertain to security. The security policy doesn't really tell you how to incorporate those guidelines.  As an example, think of it like an architectural plan for a building -- the structure is there but details are not.

A Security Model is more specific and addresses how to incorporate those guidelines.  As an example, think of it like construction plans with details of electrical, plumbing, etc.

An Access Control Method is a standard that the Security Model aligns with.

Am I way off here?

You are pretty much on the money with your understanding. My only thought is that I wouldn't necessarily class an access method as a standard, more a model which, if adhered to, gives you some rules you can implement around access.

One thing to be aware of is that although control is usually based around confidentiality, as in Bell-Lapadula, the access model may be based around integrity. I would advise a good read of the Orange Book, or for a summary, see the Biba model wikipedia entry - in this model, the key is around levels of integrity, so you prevent data being written from a lower integrity area to a higher integrity area, as that could impact the integrity in the higher area.


Is it dangerous to be within range of a compromised WiFi network, even if you don't connect to it? If a network has been compromised (e.g. someone is listening on the traffic or there has been malware implemented on it), is it safe to leave a device (PC, cell phone, gaming device, etc.) in range of the network, as long as you don't connect to it? Should I disable WiFi when I don't need it to avoid this risk?

If your device isn't connected to the network, either because WiFi is turned off or because your device isn't configured to automatically connect to the network, nothing on that network can affect your device.

However, an attacker may create a network with the same SSID and PSK as one that your device recognizes, such as the WiFi network used at your workplace. Your device will likely connect automatically in that situation.

To mitigate this risk, assume all networks have something listening, even if it is just the router itself. Make sure all your network traffic is encrypted using a VPN.


Can somebody explain why the IP address 192.168.1.1 is apparently "special" and not following the CORS rules? I asked this question: What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

The answers/comments confuse me. Am I right in interpreting them like this?

"Even though Ajax requests to 127.0.0.1 will apparently be blocked if they are made from any other domain/IP address, 192.168.1.1 will not have that protection."

Is that correct? If so, why is that? I'm very confused about how "casually" this is mentioned and how cryptically it's described. It seems like the most important point to focus on, unless I completely misunderstand something.

Why would 192.168.1.1 (and supposedly other IP addresses beginning with 192.) Ajax requests be allowed from www.evilmalwaresite.ru?

(Or in the src for an <img>, for that matter.)

They're not being treated differently.

As explained in the answers to the original question, if a malicious site had a script that requested //127.0.0.1/private.txt, they would not be able to read that file.  However, what was glossed over is that your browser would still make the request to your local web server.

The only protection that Cross-Origin Resource Sharing (CORS) provides, in the context that you're asking, is the malicious script will not be able to read the data in your file.

In the answers on the original question, we are warned that even though the malicious site could not get the data from that file, they can still cause side effects.  The example that we are given, where a router's admin panel was exploited in order to give external access, was simply an arbitrary example where someone can cause damage within the secure parts of a home network, even if they can not get data from that.

In the example, if (instead of simply trying to read sensitive information) the malicious site caused you to load //127.0.0.1/deletePrivate_txt.php, your browser will make that request to your local web server.  They won't be able to read the results of that request, but the request will still happen, and whatever side-effects that this script has (such as deleting every diary entry since 1958) will happen as well.

CORS protects sites from reading sensitive information, regardless of the IP address of the web server.  However, CORS does not (and is not designed to) protect against Cross-Site Request Forgery (CSRF).


Rails - protection against code injection and XSS I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?

I know Rails tries to prevent such attacks by sanitizing inputs but I guess this can't be infallible.

Rails 3 has some pretty good protections switched on by default which will catch a lot of common security issues.

Specifically output encoding will help mitigate XSS attacks, the CSRF tokens are enabled by default on all forms which should help here, and as long as you use it correctly ActiveRecord or other ORMs can help with mitigating SQL injection.

On the input validation front there are obviously some things to watch for.  Rails won't do input validation for you by default, so if data entered into your app is transferred to other web applications, there's still the risk of XSS attacks occurring.

That said, Rails does support validations in the model, and I'd recommend doing white-list validation of input there, if possible.

On the SQL injection front, it's still possible to use raw SQL with ActiveRecord, and if you do that, then the usual problems with SQL injection can occur, so again white-list validation of all input is useful.

Beyond that there's several things still to watch for.  the base Rails installation doesn't provide authorisation/authentication, so that either has to come from a plugin or be written by the developer.

One downside to the RESTful style URLs that a rails app will typically produce is that it's usually easy for an attacker to try to break authorization by modifying the URL.  For example a URL of http://mysite/users/1 which shows the first user, could be easily modified to have a 2 or more.  It's not that it's less secure but it makes it easier for attackers to attempt to bypass authorization controls.

There's a couple of good information sources for Rails security that are well worth reading for more information.

The OWASP rails security guide is here and there's also a book Security on Rails from Pragmatic Programmers  which although it focuses on Rails 2.3 still has a lot of good information to consider (note that Security on Rails is now out of print).


TLS Certificate domain-expectation If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?

The Web browser is indeed supposed to complain loudly if the intended server name (the one from the target URL) does not appear at a suitable place in the server certificate (normally as a Subject Alt Name extension of type dNSName). See RFC 2818, section 3.1.

In practice, modern browsers emit very conspicuous warnings, often scary and red. Some browsers allow to "click through" the warning with more or less ease (but, of course, you should not do that).


Detecting datasets that were affected by SQL injection Assuming that I know that one of my applications was attacked by an SQL injection, how can I identify edited or selected data sets?

On obvious source are webserver logs. This should allow us to identify the vulnerability and the injected code. Usually, webserver log only GET requests but no POST requests. This limits the use of webserver logs.

I know that MySQL and other DBMS have different kind of log files, e.g. for slow queries. Are there other places that might help in this case? Are there any settings or adjustments that I should apply beforehand and that would simplify the analysis?

If you already experienced an sql injection attack:

MySQL by default doesn't log all queries[1], as it would impact performance significantly. It's also not enough to just consider the tables your webapplication directly accessed.

If you don't have logging or auditing enabled, determine what tables would be considered "high value" in the main database. Think: users, user_creditcards, oauth_keys. Anything that might yield a gain (financial gain, further access, passwords) for your attacker. Those are probably compromised.
Also consider any other databases the user used by the webapplication has access to.
Use replication? [2] Find the attack period of time in the access logs and inspect the MySQL Binlogs available for that time. This will only give you modifying queries (UPDATE/INSERT/DELETE/CREATE/ALTER/DROP).
Is your network monitored? Is the database on a different host and the connection unencrypted? Ask the network security guys if they have any captures of the network traffic. Investigate captures with Wireshark [3].
Determine if LOAD DATA INFILE / INTO OUTFILE [4] was available for the database user. If so, you should also further investigate the server hosting the database for further signs of compromise.

If you're trying to design an incident response procedure/defense tactics or config guidelines:

Consider using an audit plugin [5]. Determine your high value tables. Audit access to those tables by the relevant users. The resulting log may contain highly sensitive queries, protect accordingly. Implement retention policy.
Consider deploying a WAF to atleast catch indications of attacks. See if you can flag an IP as suspicious and logging all its traffic for a period. Again, this generates sensitive data. Protect accordingly.
Limit the database user on the webapplication to the absolute minimum it should be able to access. This also means looking at if you can limit the access patterns for the database user: does it have to be able to SELECT * FROM secrets or would it make sense to limit this application user to a stored procedure ala CALL findSecretByIdentifier('MySecretIdentifier');?

Resources:

[1] http://dev.mysql.com/doc/refman/5.7/en/query-log.html

[2] http://dev.mysql.com/doc/refman/5.7/en/mysqlbinlog.html

[3] https://www.wireshark.org/docs/dfref/m/mysql.html

[4] http://dev.mysql.com/doc/refman/5.7/en/load-data-local.html

[5] https://github.com/mcafee/mysql-audit


Question about HTTPS I have a question about HTTPS, which I need help understanding.

So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who is trying to MITM attack) find out that I requested the FOOBAR resource or is everything encrypted?

TLDR; when making a HTTPS request, what will my ISP see? Just facebook.com or facebook.com/FOOBAR?

Your ISP will not see the /FOOBAR. This is because you will request facebook.com or www.facebook.com, which is a feature of DNS. This part is not encrypted and only serves recovering the IP of the webserver for the given domain name. When your browser requests this domain name it will not include /FOOBAR as this is not part of the fully qualified domain name.


Why my XSS attack's onerror method not firing? I have been able to inject an onerror event to the HTML.

In the image you can see onerror has been injected, but it never fires.

Judging by how alert(1);" onerror="alert(1); in the src attribute value got underlined I can guess that this is what you injected and that it is parsed as a string (you did not break out of tag value quotes). So there is probably no onerror attribute either, only value of alert(1);" onerror="alert(1); for data-mce-src attribute. To make sure, inspect the source code your browser receives, not some formatted dom representation.


How to compare key management strategies Are there formal security definitions or frameworks to evaluate the quality of a key management scheme? Can I state something like "the key is XYZ-protected against a polynomial adversary given that [constraint] holds"? Or "that solution has a key exposure factor of 0.72"?

For example, I can intuitively see that a key that is secret shared has better protection than a key that is not (because, for a threshold t, t shares would need to be compromised to calculate the key). Or that a key inside an HSM is harder to retrieve than a key in a plaintext file in a PC. But how harder?

How can I objectively argue that a control is critical to protect the key (or the opposite: that discarding a specific control is acceptable in a scenario)?

I realize that a definitive answer will depend on the threat model and the risks that could be accepted, but I wonder if there are terms and parameters that can be used to compare alternatives.

I doubt if there will be a nice answer to this question. There are formal methods (formal verification tools) that you can validate whether your protocol satisfy some properties under some assumptions. Thus, you can mark your (key management) protocol safe. Still, you have three question remain. (1) What were the assumptions? (2) Is the model I tested really map the actual key management protocol? (3) Even in that case, is the verification tool safe, correct and sound?

Even after formal verification, you generally end up with binary results such as safe/unsafe.


solaris equivalent of /proc/self/environ LFI I need to exploit a Solaris vulnerability for class, but we never dealt with Solaris before and I never installed it.

Does Solaris have an equivalent to Linux's /proc/self/environ, exposing a process's environment as a file, that allows local file inclusion attacks?

On Solaris, you get a process environment with these commands:

pargs $$
pargs -e $$

There is no shortcut like /proc/self with Solaris so you need to know the PID of the process, eg.:

/proc/$$/psinfo

Moreover, only the arguments are visible here, the environment is in /proc/pid/as and I doubt this file to be exploitable with LFI as it is kind of a sparse file with which you need to seek to precise locations for the read to succeed.


MAC spoof not working? I have set up our home router to only allow certain MAC addresses to connect. One way to test if the filter is working is to spoof a MAC address not in the list and trying to connect to the router. So I have used macshift already to change my MAC address. However it doesn't seem to work.

Before MAC spoofing:

After MAC spoofing:

As the above images show, the physical address stays the same despite "spoofing" the unlisted MAC address. As a result, I can still login (because my original MAC is allowed).

This behavior is the same in both Windows and Linux (macchanger also doesn't work).

+++++++ UPDATE +++++++++++++
It's an Atheros card.

In Windows vista and above, the OS allows change to specific MAC addresses only, which are, the addresses starting with 2A. However, as far as I know, there is no such limitation in Linux. I suggest you try to spoof your MAC again in windows, this time choose an address starting with 2A and see if it works this time.

EDIT:
It doesn't have to be exactly 2A. See comments below for more details.


Using Bitlocker and hidden volume feature of VeraCrypt together I'm currently using Bitlocker encrypted external hard drive. The drive is entire-encrypted and single partition.

After dividing the drive into partition A and B, I'm planning to make a hidden volume using VeraCrypt on partition B.

So partition B will be encrypted with VeraCrypt and the hidden volume will be created within it in the process, while maintaining Bitlocker entire drive encryption.

I wonder if the Bitlocker entire drive encryption and hidden volume feature of VC will work properly. Can this make some problems or collisions arise due to any inference of two encryption programs?

Yes, it will work.

You can also use VC/TC containers created on a VC/TC-encrypted partition/drive with no problem whatsoever.


how to track IP address from which mail has been sent? I am from India.
I have get few mails from some random Gmail ID.
How to get the information from which IP address it has been sent ?

The traditional method is to check the email's header for the IP address of the sendeer. But, unfortunately, GMail email headers do not contain the IP address of the sender , so you have no way to check that information even programmatically.


Certificate Verification in openssl I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server get the certificates from peer. But i was wondering if i have to call a separate api to verify the certificates? In the above link, both client and server get the certificates and print them and start exchanging data. Where exactly is the certificate verification taking place here?

Thanks

The sample code you link to does not do any kind of verification.

It fails to verify the certificate chain because it does not use SSL_CTX_set_verify to enable verification (and the default is off). This way it accepts any certificate.

It also fails to verify the hostname against the certificate. Even if chain validation would be done this would mean that the attacker could use any certificate with a valid chain (which are easy to get) to man in the middle SSL connections to any host.


Two questions about learning Linux exploit development fundamentals getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information.

First, I plan on reading "Understanding the Linux Kernel" by Bovet. This book covers Linux memory management, but just to be sure: does it cover EVERYTHING that I will need to know about how memory is laid out when programs are being run?

Riddle number two: What would be the best source of information for learning the specifics of how gcc translates C code to ASM (besides the gcc manual)?

Thanks!

First, I plan on reading "Understanding the Linux Kernel" by Bovet. This book covers Linux memory management, but just to be sure: does it cover EVERYTHING that I will need to know about how memory is laid out when programs are being run?

EVERYTHING? Unlikely.. however I've heard of the book, and suspect it is a good one and definitely get you started. As always in the computing world though... practice makes perfect and there will inevitably be a situation you haven't read about that only your practice/experience in dealing with complex scenarios can assist with.

  Riddle number two: What would be the best source of information for learning the specifics of how gcc translates C code to ASM (besides the gcc manual)?

the GCC manual would be the best source for that information.. though, I must question why you want to know this anyways?

I assume it's because of the ubiquity of gcc in applications/software that people deploy and a desire to improve your reverse-engineering skills.. if this is the case, I'd just say that brushing up on Assembly language is godsend when it comes reverse engineering. Play around with the program STRINGS (and other such tools.. a google search will yield plenty) to get an understand for how things look, and then maybe compile your own (simple) program... enumerate it's assembly and work that way. By doing that you know WHAT the program does, and you can figure out how it is doing it. (Which is knowledge you can then apply in the reverse to 'real' situations.)


Is there a option to protect a USB stick from being infected other than flash drives with hardware protection? I would like to protect my flash drives to being infected when I put it in another computers or devices. After some research, I found that I will not be able to reach this level of protection by using only software solutions (correct me if I'm wrong).

However, I don't have a flash drive with hardware protection and my only way to get one is importing (it will not be cheap). I also found that SD card's switches against writing is not in a hardware-level, so I kinda have to trust that a potentially infected computer will respect it, which is not a good idea.

So, my question is: is there a trustful way (using USB) to put my files into another computer without my USB stick (flash drive or SD card) being infected?

You cannot protect the stick from being "infected", if by "infected" you mean that the other computer writes a malware file onto it - unless you have a USB stick with a hardware write protection.

What you want to protect is your own computer against executing that file from the USB stick and thus becoming infected.

You can achieve that in several ways, depending on how you judge the risk:

Throw away the USB stick after the transaction
Re-Format the USB stick
Do a malware scan of the USB stick

Connecting the (possibly "infected") USB stick back to your computer is rather low-risk: You know for sure that it is a simple USB stick (and not some kind of active USB attacking device). Thus, the only danger would be if your OS automatically executed some file automatically - this is possible, but most modern OSes have protections against that.

If you wipe the stick by formatting it, any possible malware file will be removed.


Would it be possible for me to become infected just by opening a Facebook message? I received one of those obvious fake "is this you?" and some fake Youtube link on Facebook Messenger. I don't know what it redirected to as I didn't click it (I only hovered over it to see if it was a legit Youtube URL, which it wasn't)

Am I safe as I only read the message and didn't click the link or view it on any of my devices, or would it be possible for me to get malware just by viewing the Facebook message itself?

You are probably safe if these are true:

You didn't click the link*
Your browser is updated with the latest patches**
You aren't using any chrome or browser extensions***
Your computer is updated with the latest OS patches****

Generally, most exploits utilize well known vulnerabilities in common software like your browser, operating system, popular extensions, and common platforms. Vulnerabilities that are not well known are typically called zero-days. They cost (or sell for) a lot of money, and most people won't waste them on normal people. Nation states will buy them and use them to spy on other countries.

So, for most of us, keeping our software up to date is enough.

(*) it is possible that simply loading a message can kick off a CSRF and access other services that you use. If this was a common attack, your platform would be well known for allowing them. And so would the other site that let the CSRF through. Therefore, unlikely. Clicking a link can kick off more actions, like loading a malicious page. But even that is unlikely to affect you assume the other 3 things are in place.

(**) Your browser is your first line of defense. Keep it up to date.

(***) Browser extensions can break your browser's security model and allow attacks through. Only use them from trusted developers, or just don't use them unless you have to.

(****) Your last line of defense is your OS. Some browser exploits break out of the browser's sandbox, then need to take advantage of a vulnerability on the operating system. If you've closed the well known ones, your in the unlikely camp again, because nobody is wasting a zero-day on you.


A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates? A FIDO U2F Device relies on public/private keys. Do they expire like in regular x509 certificates ?

No, they do not expire.  Probably mainly because x509 relies usually relies on external authority, whereas in FIDO U2F you issue your own pair.


Is my ISP doing a port scan on my computer? I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically:

11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=50687 PROTO=TCP SPT=443 DPT=54102 SEQ=21105 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXZ DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=50688 PROTO=TCP SPT=443 DPT=54102 SEQ=21105 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:25 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49686 PROTO=TCP SPT=443 DPT=54100 SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXA DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49687 PROTO=TCP SPT=443 DPT=54100 SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXB DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=51681 PROTO=TCP SPT=443 DPT=54202 SEQ=21107 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

All the source IPs are from my ISP and it appears to be running some kind of HTTPS service and trying to communicate with my computer via a high port number.

Internally, I am testing a web server and I have opened up the router to accept HTTP and HTTPS connections. I am curious what these packets from the ISP mean and whether they have any security implications.

Which version of linux are you using and how is your iptables configure that is causing these messages to be logged?

I can offer an alternative possible explanation.

In the packets there seems to be the RST flag being set.

  11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXA DST=192.168.1.2
  LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49687 PROTO=TCP SPT=443 DPT=54100
  SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

This means that from 220.255 you get a RST answer back from their port 443. The increasing number of ports on your side make me assume that what you are seeing here is that the 220.255 host(s) are rejecting tcp/ip connection attempts.

Your firewall configuration is likely not relating them correctly to the syn packets you are sending out. Depending on your iptables configuration this is "normal" or the cause of a bug in older versions with the ESTABLISHED/RELATED state of connection tracking.

To investigate this further I would recommend running a tcpdump for port 443 on the respective interface and have a look if this is indeed the case, or if someone is sending unsolicited RST packets.

As a side note, I am seeing such behaviour too on some of my servers with certain ip ranges. They are all RST packets that are sent because the DNS rotation of some commonly used webservice is containing ip addresses that do not actually have a service running.


Difference openssl s_client vs stunnel I'm accessing a SSL-protected web-service.

On the one hand, if I access this web-service with openssl s_client, copying the relevant http POST request from a file html-request, I get a HTTP/1.1 200 OK response.

On the other hand, if I set up the SSL-Layer with stunnel (listening on local port 1443 and forwarding the encrypted traffic to the server) and then use

cat html-request | nc localhost 1443

the server responds with HTTP/1.1 400 Bad Request.

I assumed that both tools to not pre-process the content from the html-request-file. But this assumption seems to be wrong - otherwise I would get the same response in both cases.

Two questions:

1) how do openssl s_tunnel and nc differ in processing the input data from html-request?

2) is there a way to get a hexdump of the unencrypted traffic from openssl s_client, considering that I use Elliptic Curve private keys (so wireshark is unable to decrypt the traffic)? The -debug option seems to dump the encrypted traffic.

Neither tool modifies the traffic inside the encrypted connection. So the problem isn't related to what is happening at the HTTP layer. And thus even if there is a way to get the unencrypted data you are asking for, chances are it isn't going to help you.

There is however another possible explanation, which relates to what happens at the TLS layer. The SNI extension for TLS will allow the client to communicate the hostname unencrypted to the server before the server sends any data back to the client. This extension is needed for name based reverse proxies and for servers hosting multiple domains with different certificates from a single IP address.

For security reasons Apache (and possibly other HTTP servers as well) will verify that any client sending a hostname using SNI repeats the same hostname in the HTTP Host header. If the client does not repeat the same hostname, Apache will respond with an error code 400.

s_client does not use SNI by default, but it has an option to turn it on. And you can instruct s_client to send anything you want in the SNI field. That way you could reproduce the 400 error with s_client.

I found one report about stunnel sending an incorrect SNI header causing the same problem that you are seeing.

By inspecting the encrypted traffic using Wireshark or any other network capture utility, you can see which host name is being sent using SNI (if any) and that way verify if the problem you are seeing is due to incorrect usage of SNI as in the linked question.


How to fetch and update all my friend's keys? Where can I upload a list of my friends and get a list of their keys found on keyservers?

Here are some key servers:

http://keyserver.ubuntu.com:11371/
http://pgp.mit.edu/
https://keyserver.pgp.com/vkd/GetWelcomeScreen.event

If I had nothing to do all day, I could open my address book each week and paste in each of my friends address and import them.

How can I automatically fetch and update my friend's keys based on a list of their e-mail addresses?

Just save a very small script. You could even run it using a cron job.

This code will read a file, search for each line on the default keyserver, extract found key IDs and recieve them. Call as search-friends-keys.sh myfriendlist.txt if file names used accordingly.

If using as cron job, watch out to run the script in the correct user context (not as root)!

#!/bin/sh
while read line
do
    gpg --with-colons --batch --search $line 2>/dev/null | \
    awk 'BEGIN { FS = ":" };  $1=="pub" { print $2 }' | \
    xargs gpg --recv-keys
done < $1