Do most browsers handle mixed encrypted and unencrypted content correctly? In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear recommendation to not load it:

Here, the user is clearly notified that there is a problem and is even provided with a way to stay safe by not loading the insecure content.

In Firefox, when I go to the same page, I receive the following popup dialog, however the page then proceeds to load the insecure content anyway:

However, the above checkbox by default is left unchecked, so most users will only see this once.

In addition, both Opera and Konqueror continue to load the unencrypted content as well. In both of these browsers, the address bar remains white (the same as visiting a normal page), however neither of these browsers even give any further indication to the user that there is a problem with the site unless you manually click to view the certificate details or happen to notice the address bar change (or not change) color.

So my question is, if the unencrypted content is loaded isn't the damage already done? I know this is more a matter of opinion, but why would other browsers not provide a way to prevent this content from being loaded completely? Doesn't this add to security?

Edit: Doing a bit more searching I came across these Mozilla bugs related to this:

https://bugzilla.mozilla.org/show_bug.cgi?id=62178
https://bugzilla.mozilla.org/show_bug.cgi?id=321022

So I'm assuming that the reason this is not implemented (at least in the case of Firefox) is because it is a difficult bug to fix, but they are working on it.

Yes, it does add to security and yes it should be done but security is often neglected over usability.

For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the option to load or not load unsecure content in a manner where he understands that there are risks involved.

In such a case, the browser requires the technology to prevent HTTP content from loading and allowing HTTPS to load. This as you know can have several effects on the page. As time passes I'm sure other browsers will developer similar technology to be able to isolate HTTP and HTTPS content and then give the user an option to load or block it each time they encounter such a page.

As far as security is concerned about mixed content in technicality, it really depends on what is going through. A good example is going to a company's website doesn't require open public knowledge to be loaded in HTTPS, but your log in does.

Ultimately its is the question of user privacy, wherein HTTPS  triumphs, but the average user is unaware of this, and websites do not want the extra effort to make the entire thing HTTPS.

Firefox Similar Bug Report: https://bugzilla.mozilla.org/show_bug.cgi?id=251123


In what cases can overly strict security policies be detrimental to organisations? In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone?

I've worked at some companies where office politics were so strong and everyone was so caught up in following procedures that intelligence was completely abandoned. For example people would still deposit confidential documents in a secure waste disposal even when it was overflowing and anyone who walked by could see and grab a document from just inside the lid of the garbage can. This is really bad because now an attacker would know to go to the overflowing secure disposal bin as he would find valuable information there.

In other words, when is having "strict rules" worse than asking people to be careful? I guess it's linked to bureaucracy, which seems to happen companies when becoming large.

Anecdote: another good one is where I started working the computers are severely locked down. To get access to change anything you need the IT staff to enter their password. The IT staff could not care less about why they are entering the password and will always do it for anything asked.

What you are pointing is the difference between imposing security rules to people and involving people to get better security.

Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the difference between a few administrative people trying hopelessly to make all the "stupid users" to comply with imposed rules, and the same administrative people considering the other employees as co-workers, or even a "human IDS".

If people do not understand the goal of a security measure or do not feel it to be useful, they will never apply it (or at least they will never apply it in a sensible way).
If people have the feeling that a security measure prevents them from doing their daily job, they will just workaround it.
If people have the feeling that this security only comes in a top-down direction, they will be far from likely to raise any issue or suspicious event.

That's why security literature insists on the role of regular trainings in order to educate people. Security is not here to please management and auditors. Security is here to ensure the safety of the company, of the customers, and ultimately of the employees themselves.

Better security is not achieved by defining always stricter rules. Better security is achieved by getting people involved.


Should I store my update files with their signature included? Right now I have an automatic update server that signs the files it distributes before it sends them, so if anyone compromises my domain name all they can do with it is get "bad signature" messages bounced back at them unless they also steal my private key.

Currently it generates the signature right before sending the update file to the client, and thus has the private key on the server.

I was wondering: shouldn't I instead sign the update file before I even upload it to the server, so I can keep the key on a non web-exposed machine instead of my server? Or is there a downside to doing this that I haven't thought of?

As always, it depends on what you want to protect against.

If the threat is an attacker hijacking your domain name in some way and distributing malicious updates, your protection is good, signing files on your server does prevent that.

However, talking about the threat that an attacker compromises the update server itself, there is no protection in place currently. As the key must be accessible to the process that actually signs and sends out files, an attacker would also have access and could distribute signed, malicious content. In a sense it's even worse than if updates were not signed, because in such a scenario users would be assured by your signature that updates are in fact authentic when in reality they are not.

So yes, as you suggested, you should definitely keep signing keys offline (or at least well protected, not on the update server), and only upload already signed distributable updates. This would protect against the second threat mentioned above as well.


Why should the value of the cookie be encrypted? I am working at a SSO project right now with CAS. I am using an RESTful API for communication with desktop-applications. The value of the Ticket Granting Cookie is encrypted. At first I didn't think much about it, but now I realized that I don't really get why that is the case. Since I use HTTPS between the different nodes, the connection is secure. The cookie will be saved in the cookie database of the browser.

As far as I see it, there is a possibility of session hijacking in such cases. But since I use HTTPS I don't get how that should even be possible. Even if it is encrypted, why not just take the encrypted cookie and hijack it. As it seem to me the owner of the ticket also does not have to, and cannot decrypt the cookie value. So at the end of the day he just saves an encrypted cookie and sends it back, a hijacker could do the same if he can break through HTTPS.

Am I missing something?

Well, I guess if the information is secret it could be to protect the data "at rest". This could be against legit users of the PC, or against persons getting a copy of the PC.

Generally though the cookies should be protected against change (integrity), rather than offering confidentiality. This can however be performed by placing a MAC value over the cookie rather than encrypting it.

Sometimes people are encrypting a magic value (crib) instead of placing a MAC, so this could be a case of performing DIY cryptography.


Where would I place a sniffer to capture data in a home network with the following topology? I am aware of the various techniques that there are to sniff around a network that has Hubs or Switches (port mirroring, hubbing out, use of taps), but I am not sure which method would be more efficient in a home network that has the following architecture.

My goal is to monitor the whole network to create a baseline of a normal behaviour.
Currently I am doing the monitoring using a laptop connected on the same wireless network, using Wireshark.

Is this sufficient?

First case: Your sky router has a mirroring port / You can dedicate a port to mirroring.

Should be very simple to tap the traffic, check your router specs/doc.

Second case: you want to do it by implementing new hardware in your topology.

With the following:

You want to tap Outbound and Inbound traffic.
This sky Router is not your WAN Gateway.
You don't want to tap local traffic, (For instance: MacBook -> skyRouter -> IPCamera)

Here is how I would do it:

+--------------+  +--------------+  +-------------------+  +-----------+  +------------+
| The Internet +--+ ISP's router +--+ Transparent proxy +--+ SkyRouter +--+ Endpoints |
+--------------+  +--------------+  +-------------------+  +-----------+  +------------+

In the scheme above The transparent proxy is the sniffer.

If both cases don't suit you for some reason, there is a dirty way of doing it. You can set your MacBook Wifi NIC into promiscuous mode and tap Traffic.

Keep in mind that this method results won't be accurate. You will tap traffic that has nothing to do with your network and might miss some traffic of yours.

I don't recommend it


Help understanding CSR fields I've made a CSR (Certificate Signing Request) in order to better understand  how a PKI could be made and how it works.
Using the following commands
openssl req -new -newkey rsa:1024 -nodes -out ca.csr -keyout ca.key
openssl req -text -noout -verify -in ca.csr

I obtain the following output
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C = ca, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c2:ac:2f:7b:17:93:1c:39:07:aa:cf:8d:fd:b7:
                    2e:f4:90:76:16:d8:cf:cb:1b:02:ec:56:3d:ff:5e:
                    a2:fb:9e:8b:af:9b:3b:f8:27:4e:82:39:aa:6d:90:
                    e6:52:71:16:0d:f4:e0:fe:eb:50:31:79:3d:09:8a:
                    49:c0:b4:cb:1e:50:55:83:5f:81:58:46:03:1a:8a:
                    cf:22:56:2c:5f:30:ce:1f:cd:39:19:b4:4c:d4:8b:
                    c8:27:b2:34:62:31:e9:d2:b0:7c:f6:50:7a:12:f4:
                    1a:20:53:53:fb:46:ba:0b:b5:16:aa:ed:2d:0f:79:
                    eb:a2:7c:65:d1:3d:d1:74:87
                Exponent: 65537 (0x10001)
        Attributes:
            a0:00
    Signature Algorithm: sha256WithRSAEncryption
         4f:d7:d9:f5:fe:87:7c:fb:2d:e4:50:28:4d:b5:7a:5c:4f:87:
         f6:7a:83:59:2a:76:33:12:61:bf:c5:0d:5f:c8:41:d5:ec:b1:
         ed:01:21:98:b5:ab:3f:c0:12:78:aa:8e:c8:95:fd:e9:10:e7:
         69:8c:c3:e5:56:3d:f2:c8:b2:bb:5d:88:3f:5e:f8:f0:6b:e9:
         2c:ea:92:cb:90:60:3b:57:e7:09:6a:70:38:d1:43:0f:e6:72:
         31:99:a6:03:c4:3e:21:41:61:61:07:57:72:2a:41:ed:85:3c:
         d0:58:02:1c:81:ee:09:3c:39:02:21:fb:9b:25:4a:84:97:1b:
         c2:b6

What is not clear to me is the bytes after the "Signature Algorithm" field:

How they are calculated?
Which key is used?
Which fields of ca.csr are signed?
Is it possible to extract the signature and decode it (e.g. using openssl)?

After the CSR creation I use the following commands to create a self signed certificate
openssl x509 -trustout -signkey ca.key -req -in ca.csr -out ca.pem
openssl x509 -text -noout  -in ca.pem

Output below
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            36:e9:c2:ae:ed:b2:a6:a2:00:7a:16:33:19:b8:57:a8:d8:c6:09:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = ca, ST = Some-State, O = Internet Widgits Pty Ltd
        Validity
            Not Before: Jul  7 12:16:26 2020 GMT
            Not After : Aug  6 12:16:26 2020 GMT
        Subject: C = ca, ST = Some-State, O = Internet Widgits Pty Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c2:ac:2f:7b:17:93:1c:39:07:aa:cf:8d:fd:b7:
                    2e:f4:90:76:16:d8:cf:cb:1b:02:ec:56:3d:ff:5e:
                    a2:fb:9e:8b:af:9b:3b:f8:27:4e:82:39:aa:6d:90:
                    e6:52:71:16:0d:f4:e0:fe:eb:50:31:79:3d:09:8a:
                    49:c0:b4:cb:1e:50:55:83:5f:81:58:46:03:1a:8a:
                    cf:22:56:2c:5f:30:ce:1f:cd:39:19:b4:4c:d4:8b:
                    c8:27:b2:34:62:31:e9:d2:b0:7c:f6:50:7a:12:f4:
                    1a:20:53:53:fb:46:ba:0b:b5:16:aa:ed:2d:0f:79:
                    eb:a2:7c:65:d1:3d:d1:74:87
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha256WithRSAEncryption
         a4:91:01:17:9a:da:fe:45:5e:8d:08:1d:12:1f:63:22:81:b0:
         b5:cd:93:02:86:35:2e:e5:b4:17:6b:56:a2:f8:51:7b:98:8b:
         7d:ea:e1:16:0f:97:0c:e4:de:8f:1d:b1:d1:5b:97:aa:7a:07:
         58:db:cc:26:2f:21:f8:cc:f3:94:f9:9a:95:a3:ad:8e:53:a5:
         25:62:49:47:bf:a4:40:10:59:dd:f3:96:02:1c:d3:a9:04:82:
         ae:7d:c9:4a:27:7b:b3:41:7b:a0:35:54:79:48:dd:34:08:8a:
         dc:5e:dd:31:2c:67:9b:fb:84:b7:8c:81:9e:16:bf:4f:ab:43:
         e7:6f

In this case I have the same questions as above: why is the signature different from the one in the CSR?

RFC2986: PKCS #10: Certification Request Syntax Specification describes CSRs in detail. The overview answers most of your questions:
The process by which a certification request is constructed involves the following steps:

        1. A CertificationRequestInfo value containing a subject
           distinguished name, a subject public key, and optionally a
           set of attributes is constructed by an entity requesting
           certification.

        2. The CertificationRequestInfo value is signed with the subject
           entity's private key.  (See Section 4.2.)

        3. The CertificationRequestInfo value, a signature algorithm
           identifier, and the entity's signature are collected together
           into a CertificationRequest value, defined below.

So to take your questions one by one:

How are the bytes after the "Signature Algorithm" field calculated?

This is the signature itself, computed over the CSR data (in ASN.1 format, not the friendly text version shown by openssl) using the specified Signature Algorithm and the private key of the requester (here: Subject).

Which key is used?

The private key of the Subject is used to compute the signature. It can be verified using the public key (as found in the Subject Public Key Info field)

Which fields of ca.csr are signed?

All data in the CSR is signed. The data of course does not include the signature itself (that would be tricky).

Is it possible to extract the signature and decode it (e.g. using openssl)?

What you see is the hexadecimal representation of the signature bytes. Other than changing it into raw bytes, there is not much more to do with it.
However, you can verify it with openssl using the following:
$ openssl req -verify -in ca.csr -noout
verify OK

If I modify a single character in the CSR, the output becomes:
$ openssl req -verify -in ca.csr -noout
verify failure
140678320674112:error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:../crypto/rsa/rsa_pk1.c:66:
140678320674112:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:588:
140678320674112:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:../crypto/asn1/a_verify.c:170:

And for your final question about the certificate itself:

why is the signature different from the one in the CSR?

The signatures are different because the data itself is different (look at the fields listed in the CSR vs those in the certificate).
In normal workflows, the Subject and Issuer are separate entities with different keys (using the same key twice is just a convenient shortcut for self-signed certificates). The signature algorithm could also be different. All of these will yield different signatures.


How can I control my website's inputs when they are entered by users? I have a question and answer website like SO. I have some limitations on some of facilities. For example an user cannot vote who has less than 20 reputation. Or an user cannot close a question until earning at least 200 reputation.

Ok well, there is also somethings which don't have any limitation, like writing an answer for questions. In this case, a bad user can write multiple irrelevant answers for multiple questions and makes my database huge with useless information.

So I guess I need to check something before inserting a new answer, Am I right? Or anyway, how can I manage my website's inputs? As I mentioned, in my current algorithm, a bad user (like a spammer or hacker) can simply enter lots of useless data in my database, and then maybe I understand it after 1 day (which is too late) which in this case, it takes some times to block him and remove all his data.

In conclusion, I like to know, (for example), how a website like SO handle that? Do I need a separated query before inserting a new answer for checking? Or what?

Note: I use PHP (for server-side codes) and MySQL (for database codes).

Use rate-limiting and only allow X questions posted within Y time. That should slow down any attacker and let humans deal with the spam (through downvotes or flags for example).

Every time the user tries to post a question, query your database for their last question and check that the current time is greater than that question's post time + the minimum required delay between two posts (on some Stack Exchange sites I believe it's 30 minutes).

Depending on your performance requirements you could de-normalize your database a bit and keep the last question's time directly in the user's model - that will mean you have to update their model each time they post but saves you a query of their questions since all the info you'll need will be in their user model which you have queried anyway (your framework most likely does that for you as a side-effect of checking whether they're logged in).

You can also use Redis or Memcached to cache the models to improve performance even more.

Finally if you're worried only about automated spam but not manual spam, you can present a captcha instead of completely preventing them from posting if they attempt to post too frequently.


When using multiple operating systems, can they affect each other? Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it "leaks" into other parts of software/networking on the computer.

Is it possible for someone to enjoy the functionality and entertainment of Windows and privacy of Linux?

Windows will have full hardware device access while it is running.

If the Linux partitions are encrypted the data within them is safe from exposure that way.

However malware infections obtained while running Windows could manipulate the bootloader to produce a fake disk encryption prompt that steals your master encryption key.  This is fairly elaborate, but not inconceivable if the motivation is sufficient.

It's a trade-off.  If you dual boot, be sure to use full disk encryption on both OSes to prevent them from seeing each other's files.

If you want full separation you are better with separate hardware for each OS.

A great option proposed bt @R.. and @NathanOsman in the comments is the use of a hypervisor to run the more at-risk OS.  In practice I run Windows inside VirtualBox, but there's an even deeper solution to this called QubesOS which runs Xen on the hardware and runs apps in AppVMs using windows seamlessly integrated into a shared secure window manager.

A third option (with bare-metal perfomance for Linux, Illumos, and Solaris 10 or under native apps) is OmniOS or SmartOS with lx-branded zones and KVM.  There's no QubesOS-equivalent window manager for that approach yet so you'd have to use VNC or Spice to access the screens of the VMs.


REST API security mobile application with PIN I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved).

As part of the login flow we have been instructed to use an email/password registration flow, followed by the creation of a 5-digit pin number which would allow the user access to the application upon next opening the application.

This seems to be at odds with the majority of authentication flows available such as oAuth as there seems to be no indication of using a further pin authentication for login.

There are plenty of applications that do seem to do this however, so I wonder are they rolling their own solution? Or a combination of typical services and then hosting something themselves?

I am struggling with the concept of ensuring the unique device is also tied to the pin in order to authenticate requests correctly within the API.

Pointers welcome, but for something that I see is quite common in mobile applications, there seems to be precious little detail out there with regards to the security aspects of this kind of authentication?

With thanks

I do not completely understand the question, but it seems that you want to know a good solution to implementing this.

To implement this, I would suggest fetching a unique devide ID (Can be IMEI, but can also be some OS-dependent ID), and then concatenate this with the PIN. Then you use PBKDF2 to derive a key out of this.

You then select a number of iterations that are sufficent to prevent cracking the 5-digit pin by bruteforce, but still doesn't take awfully long time to authenticate.

Here you have 2 choices. Either you can encrypt the OAUTH token with the generated key and store inside device storage, or you can implement a verification on the server side, where you verify the PBKDF2 key when a mobile OAUTH token is used. To sense if it a mobile OAUTH token is used, you can set a flag in the login form to detect mobile logins.

A better solution, if your management allows this, is to use hardware-based storage of assymetric keys instead. (boolean KeyInfo.IsInsideSecureHardware();), where the server will verify that the correct private key exist inside secure hardware (by doing a challenge which the app signs using the hardware key). That will make it possible to strictly bind the app to a specific device, and you can skip PIN authentication, as the user's lockscreen is enough to prevent misuse of the app. (and then you give the users choice too, to not have a PIN if they want, by disabling the lockscreen).


How to ensure Nuget Packages are safe for confidential information? We deal with a lot of customer information including name, address, SSNs, etc. are we are using a new setup with Full admin machines that have access to the databases where the information is stored.

We need a way to tell if packages installed via Visual Studios Nuget Package Manager is safe to use on confidential customer information.

From what I know, is that anybody can contribute to Nuget and could possibly introduce malicious code.

Is there an trusted and well known institution/source that verifies Nuget Packages as safe, or is there a vetting process that companies can go through to ensure the safety of these packages without looking through the entire source code??

anybody can contribute to Nuget and could possibly introduce malicious code.

Anybody can contribute new packages. Only the owners of an existing package can modify it.

  Is there an trusted and well known institution/source that verifies Nuget Packages as safe

Not as far as I am aware

  is there a vetting process that companies can go through to ensure the safety of these packages without looking through the entire source code??

First of all vet the package maintainer - in the same way you would your requested "institution/source that verifies Nuget Packages as safe". If you trust the body behind the package then you can extend that to something under their control. Make sure to apply the same process to any dependencies!

If you cannot trust the package author then you have to audit the code.


How can I portscan large subnets? I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, advanced IP scanner. But they all crash out after a while and none of them complete the scans as required.

Whats the best way to identify a servers and services in a large subnet?

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans).

Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s.

The memory problems I run into are typically due to ip_conntrack and below are a couple of recommended links to tweak kernel/ip_conntrack settings that can help nmap:

  ip_conntrack: maximum limit of XXX entries exceeded (I have experimented with values of 256k+ w/apparent success)
  (also check out Tuning Linux firewall connection tracker ip_conntrack)
  Disabling ip_conntrack to save memory, restore happiness


Group password creation scheme PREVIOUS RESEARCH:
I have searched for password rulesets/schemes and password sharing, but the articles I have found deal with an individual’s passwords, not a group or team’s passwords.

SCENARIO:
I am part of a small work team of about 3 to 4 people. We have sensitive material that occasionally needs to be emailed as an attachment (typically Word documents or PDFs).

I would like to create a password ruleset/scheme for our team that would be applied to the documents that we send. This ruleset should:

Easily understood (not too complicated/difficult to create the password)
Password is not easily guessed
Password is distinct for each document we send
Easy for each of the team members to figure out (i.e. a team member can guess another team member's document's password)

The last point deserves some more explanation. It would be highly beneficial if the ruleset/scheme allowed for each of the team members to be able to figure out what the password on the document was, even if s/he did not create the password.
My idea was to create a password by combining the senders first name, the recipients last name, and the date.

EXAMPLE:
 If a team member, Bob, needs to send a document to Jim on December 7, 2017, then the password for the file would be “JimBob1272017”. Likewise, if team member Jack needs to send a document to Jill on February 23, 2018, then the password would be “JackJill2232018”. As long as the other team members know the sender, recipient, and date, then they should be able to figure out the password. Thus, if any team member is ill or resigns, then documents are still accessible.

QUESTIONS:
Does anyone have suggestions for creating a password ruleset/scheme that meets the four previously mentioned criteria? Or, can someone provide suggestions to improve the process I’ve described?

NOTES:
We do keep track of our passwords, but I was thinking this could be helpful if someone forgot to keep track of a password or if a client forgot the document’s password (and the password creator wasn’t available and the password wasn’t recorded properly).

I don’t think it would be wise to make the team repeatedly use one password for every document (e.g. The team uses “password” for each document’s password), nor would it be wise for each team member to use his/her own personal password repeatedly (e.g. Bob uses “password” for all of his documents, but Jack uses “Acme” for all of his documents).

Thanks!

Making different passwords which are easily guessable adds no real security, but it does protect against accidentally reading a document intended for someone else. If that's all you need, great! Just concatenate the recipient name with a strong password known by the team.

But if you want to make it significantly difficult for teammates to snoop in documents not intended for them, I would suggest that you use asymmetric encryption together with secret sharing:

Encrypt each document so that it can be decrypted by either of two keys. The first key is the recipient's private key, and the other is a secret that requires two (or more) team members to uncover using the above-mentioned secret sharing.

This way, only the recipient can read the document, unless two or more team members together decide that they need access to it.


Securing mobile app rest requests I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough.

This is the flow (all communication is made over SSL):

User logins to Facebook through the mobile app.
The app passes the user's Facebook short term access key to the server.
The server uses the key and makes a request to Facebook to retrieve the user details and to get Facebook long term access key.
If the request to Facebook is successful a user is created in my DB.
An object is then created for that user, which includes his Facebook ID, Facebook Token and creation date. That object is encrypted using Rijndeal (256 bits) and returned to the client. From now on all requests from the client include that token. The token is valid for 48 hours. When the token expires I once again use Facebook's access key and make a request to Facebook. If Facebook's access key is still valid, a new token is generated and returned to the client.
When the user wants his data, the client sends the token, if the decryption of the token is successful I use his Facebook Id (which is also the ID I use for the user), which is part of the token, to retrieve his info and send it back to the client.

I have two questions –

Is that flow secure?
When I encrypt the token, should I use different IV and salt for each token? (My assumption is that it is necessary, but does it mean I should store the IV and Salt in the DB, and actually retrieve it in every call the client makes – seems quite expansive).

The security of this depends on how exactly you do the encryption. If you are using CBC-mode and no integrity checking, then I see a weakness that could allow one user of your app to impersonate another user:

The attacker gets legitimately issued a token for their own Facebook account. They then wait 48 hours so the token is invalid. If they present this token to your server, they get issues a new token. Crucially, in this request, only the Facebook ID matters - the Facebook token is irrelevant.
If the encryption does not have integrity checking then they can tamper with their token to change their Facebook ID. If the encryption uses CBC-mode, then this is fairly trivial. When they present the tampered token, they then get a legitimate token for the other user's Facebook ID.

You can fix this by using integrity checking as well as encryption. In fact, you may actually want to ditch the encryption and just use integrity checking. You have SSL to encrypt everything on the wire anyway.

Another consideration: how exactly do users login with Facebook? You should use the "Log in with Facebook" button (iOS info) rather than presenting a web page directly within your app.


How do I apply a security baseline to Windows 2008 R2? I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure how to go about this.

I have downloaded and installed Security Compliance Manager tool. I think I need to use some file from this, but am unsure which one and how to apply it to the 2008 Server. I am really new to all this so step by step guides would be greatly appreciated.

Has been replaced by the SCM toolkit: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en

Over view of SCM toolkit: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm.aspx

SCM getting started guide: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm-getting-started.aspx

SCM frequently asked questions: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm-frequently-asked-questions-faq.aspx

Windows 2008 security resource book: http://www.amazon.com/Windows-Server-2008-Security-Resource/dp/0735625042/ref=sr_1_1?ie=UTF8&qid=1294339984&sr=8-1


Google Chrome folder protection during HDD forensics Is there any protection provided by Chrome browser against HDD dump and further forensics (with volatility-like tools)? For example, is it possible to extract google profile from Chrome folder and use it (with simple substitution) on other PC?
P.S And if there is totally no protection against forensics, are there other ways except full-disk encryption?

No, it is all unencrypted. You can copy the folder located at %LOCALAPPDATA%\Google\Chrome\User Data (or similar folder on other OS) and place it in the same location on another user/computer to have full access to everything in the browser's profile. This applies for most other browsers as well.
You should use disk encryption if you are worried about data being read of your computer. Alternatively you can configure Chrome to not store any data in the browser or clear it every time you exit the browser.


MTproto Proxy Security in Telegram App In Telegram messenger, latest update, there is an option to set connection type to MTProto Proxy.

Note: There is a detailed description by Telegram team on MTProto.

Now telegram officially announced that the Data encrypted in MTProto Proxy can not be deciphered by any third party due to the usage of end-to-end encryption.

Logically, Is it possible to implement a method that proxy server is not able to interpret passing data to Telegram Server at all?

Logically, Is it possible to implement a method that proxy server is not able to interpret passing data to Telegram Server at all?

That's not specific to Telegram. If you are using a HTTP or SOCKS proxy to visit site with HTTPS you still have end-to-end encryption, i.e. the proxy sees only encrypted traffic. It is different when having a SSL intercepting proxy which one usually finds in companies but also as local proxy in antivirus products. In this case the proxy will decrypt end re-encrypt the traffic in order to analyze it. But this would also mean that your client is explicitly trusting the proxy to do this, see Does https prevent man in the middle attacks by proxy server?
 for more details about SSL interception.

But even if an SSL intercepting proxy is used it would still be possible to add yet another level of end-to-end encryption on top of it with fixed information of what kind of end-system is expected, i.e. similar to certificate pinning. Even an SSL intercepting proxy will only see the encrypted traffic and might decide to pass it or block it but will not be able to look further into it.


bcrypt: random salt vs computed salt I'm pretty new to the whole password hashing business, so I might be missing something obvious.

I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be more secure to compute a unique salt for each user instead of a random salt ?

At the moment the salt and the workload (# rounds) are exposed in the hashed password string. ($2a$ + 2 digit workload + $ + 22 character salt + 31 character hashed password)
Aren't we helping potential hackers by giving them the salt (if they, for example, want to brute force the admin's password) ?

Couldn't we calculate the salt for each user by hashing (for example with MD5 or SHA1) their email address ?

If we then only save the 31 last characters of the bcrypt hashed password, leaving out the identifier, the workload (if we keep it fixed) and most importantly the salt. Wouldn't this make it a lot harder for person trying to find the password ?

(And on the plus side, we would gain some database space for large user databases, as the password is only 31 characters instead of 60)

I'm probably missing something obvious, as I can't be the first person to make this reflection.

Marc

You do not want to use a fixed salt for a given user because it could lead to salt reuse, which is bad (that's the capital sin of salts, since the whole idea of salts is not to be reused; they have no other function). Salt reuse can occur, practically, for the two following reasons:

If a user changes his password, the new password will use the same salt than the old. That's bad, because old passwords are still valuable (since users reuse passwords, the old password can be the password that the user will set next month; it can also be the password for the same user on another site), and the reuse will allow the attacker to attack both the old and new password for the cost of one brute force.
If the salt is derived from the user name, then another instance of the server software, on a distinct server, may end up with the same salts, because "Administrator" tends to always be called "Administrator". Attackers could precompute a big table (e.g. rainbow table) for "Administrator", applicable to many sites (which would make table building worth the effort).

I usually sum this up by stating that salts must be unique timewise (no reuse of an old salt value) and worldwide (no reuse of salts anywhere, even on a distinct server). Such uniqueness is hard to get, but there is nonetheless a rather simple way, which is to generate big enough salts (e.g. 128-bit salts, as bcrypt uses) at random.

Summary: not generating bcrypt salts randomly would not be more secure; at best, this would be equally secure, but, more probably, less secure.


DBus proxy Javascript binding issues Gnome 3 (under GNU/Linux, BSD or other Un*x) now offers a gnome shell with nice presentation, but where the configuration and theming are to be done via a web browser (and a public URL, on a public server).
I know that having two questions for one is not welcome there, but the link between the questions is strong.
Here are my questions:

Could this feature become a security issue?

If yes, how could I manage access (even block) this?

For example allowing or disallowing JavaScript in the browser; I would be able to allow or not JavaScript access to dbus, maybe with some limitations, like on IP or a ssl-certs list...

Yes, it can result in a security  issue.It is like any web interface accessible from the internet.If the authentication system is not proper, an attacker might bypass it.

On how to manage access.

Depending on the kind of infrastructure that you have in your network, you can setup a VPN and enable access to the interface through the VPN.( you will use a private IP address to do the configuration)

I am not sure about the ways to block the web configuration entirely.


Malware on the website codecguide.com The website codecguide.com offers a codec pack. When installing, it secretly installed a browser plugin that looks highly suspicious. The plugin is supposedly here:  http://www.codecguide.com/browsersecurity.ini
Is this safe? It installed an executable s768.exe that contains the texts:

  "TWndMethod MessageTMessage ;A ¯ÓI        ;A Message     ÔI             HÔI     (ÔI     .ÔI    PœA ðz@ øz@ ôsB 8~@ X~@ \~@ `~@ T~@ ˆx@ ¤x@ ürB œsB @sB      ELoginCredentialErrorHÔI ELoginCredentialError ÔI x¢A   System.Classes       „ÔI "TLoginCredentialService.TLoginFunc´"@ @                System.Classes ÿÿ   ØÔI #TLoginCredentialService.TLoginEvent SenderTObjectUsernamestringPasswordstringDomainstringHandledBoolean Œ@ ¸@ ¸@ ¸@  @ lÕI        Œ@ Sender ¸@ Username ¸@ Password ¸@ Domain  @ Handled   ÄÕI -TLoginCredentialService.TLoginCredentialEvent SenderTObject Callback#TLoginCredentialService.TLoginEventSuccessBoolean Œ@ ÔÔI  @ WÖI        Œ@ Sender  ÔÔI Callback  @ Success  äÖI             €×I äÖI ÿÖI     "

It seems to be collecting information and acting very suspiciously. It saves profile images from Skype in a separate folder, it contains a script called inject.js and some strange data files. I have made a folder of all the files that were changed during or after that installation and would like to send it to a security company.

Where can I have the installed program checked?

Try using VirusTotal website where you can upload your suspicious file(s) and it will scan it for malware (Max file size is 128MB). There are other online scanners as well which may catch it.

You can also try uploading to one of these online sandbox services to analyze suspicious behavior.

If the scans don't show anything, the best way  to preserve the infected machine would be to make an VM image of it using the Disk2vhd tool from Microsoft to preserve its present state so you can get back to a previous known state if you want to reproduce a certain behavior.


How can I prevent my E-mail address from being used as the sender for fraudulent/scam messages? Recently, me and at least one other person I know received an obvious scam E-mail that starts off something like this:

We considered your resume to be very attractive and we thought the vacant position in our company could be interesting for you.

Our firm specializes in consultation services in the matter of bookkeeping and business administration.
We cooperate with different countries and currently we have many clients in Europe.
Due to this fact, we need to increase the number of our destination representatives' regular staff.

This was an obvious scam E-mail, as I don't live in Europe, and have not sent my Resume or CV to anyone recently.  So I marked it as spam in Thunderbird and thought nothing more of it.

A week later (today), my inbox was deluged with about 15 E-mail "return to sender" failures over a span of about 20 minutes.  The relevant part of an example "Mail delivery failed" message is (most of them are to the .hu domain):

------ This is a copy of the message, including all the headers. ------

Return-path: <me@example.com>
Received: from [202.70.75.205]
    by autofort1.autofort.hu for victims-email@autofort.hu
    id 1XQUZr-0004iq-6L; Sun, 07 Sep 2014 06:59:51 +0200
From: <me@example.com>
To: <victims-email@autofort.hu>

I immediately changed my mail password, just to be safe.  Fortunately, I also use E-mail forwarders (aliases) for everything but personal E-mail traffic, so the listed E-mail originator (me@example.com) is actually a forwarder to the-real-me@example.com, that I normally use for professional type E-mails.  Still, I hate to delete ("burninate") this alias just because of some scam-email.

My E-mail account and domain account appear to still be secure, since they are using my forwarder, not my real address, and I checked my domain and all the settings still seem to be in order.  So it's somewhat obvious they are using made-up or forged E-mail headers.  Possibly related, I googled and found this fraud alert

Is there anything I can do to prevent them from tarnishing my good name (or E-mail address), besides just abandoning this alias/forwarder and shutting it down with a "return to sender" message on it?  Is there any way to prevent this type of scam from re-using my E-mail address in this way in the future?

Is there anything I can do to prevent them from tarnishing my [...] E-mail address

In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf.

You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone would have to send that email through one of the permitted senders for your email domain. Otherwise, in seeing an email from OgrePsalm33@psalm33.ogr, my mail server would think, "Hmmm, this email is from psalm33.ogr, so it should come to me courtesy of mail.psalm33.ogr, and instead it comes from a whorefarm in North Nowherestan..." and reject the email as forged.

And if someone sent to mail.psalm33.ogr an email pretending to be from you, that server being your own server, it should be able to verify the authentication information, and drop the email if it did not come from the approved sender.

But all this relies on my server doing checks. Mine does. Many others do not. Also, some SPF checks are more cursory than others, some SPF records are poorly maintained or not strict enough so as to accommodate lazy administrators.

So in the end, there will still be lots of servers out there that will blithely accept any email from any Tom, Dick or Harry pretending to be you.

However, usually, should the need arise, you should be able to demonstrate that with all probability some email did not originate from you; the headers would show that quite clearly.

(In theory it's still remotely possible that someone would send a "deniable" email with his own authentic name but from a forged account, in order to be able to disown the email should the need arise; sort of like forging your own signature; but that's another, completely different scenario).

Another thing you can do, but not erga omnes, is to use cryptographic signatures. Then make it known to everyone you deal with that you do so, and any correspondence not cryptographically signed is to be considered forged. Again, this will not protect your reputation among strangers who never corresponded with you and do not know you sign your emails. On the other hand, possibly one's reputation among nameless strangers is of less concern.


Suricata does not detect "self" traffic I have built two simple rules

alert tcp any any -> any any (msg: "tcp detected"; sid: 2; rev: 1;)
alert udp any any -> any any (msg: "udp detected"; sid: 1; rev: 1;)

Then from the same machine I do an nmap

nmap -sU myipaddress

Issue is, I get alerts from all other traffic but for the nmap I do not get any alerts. Does suricata have a rule to ignore the kind of traffic that destination ip = origin ip?

Please check that you are sniffing the correct interface. nmap traffic may go on loopback one (using routing information) and you may sniffing the external iface.

If interface is correct and if you are using pcap capture you may want to add '-k none' option to avoid checksum offloading related problem.
Missing alerts often comes because suricata will ignore packets with invalid checksum. And checksum offloading on the card will cause that for locally emitted packets. So when you are using local traffic to test traffic you should take care of that. Solution is to used modern capture method like af_packet or pass '-k none' to stop validating checksum.


How Do I Troubleshoot a Browser Hijack on a Mac? My Mac is getting weird redirects with Safari and Chrome, however not with Mozilla Firefox. Since I cannot find software to do malware removal on Apple products or any good information, I am at a loss as to how to proceed after uninstalling and re-installing the affected browsers and deleting all the plugins/extensions, which did not work.

If anybody can point me to next steps, I would be greatly appreciative. Otherwise I guess I'll have to wipe the hard drive and re-install everything, which would be a huge hassle.

Other information:

If I ping an affected domain in the Terminal, I get the IP of the unwanted redirect (i.e. if i paste that IP into firefox and go it brings me to the wrong website for the domain I entered).

I am running mavericks.

So... yes. How would one proceed? And... if you know... why would the issue affect two browsers and the ping command, but not Firefox?

If ping is returning an unwanted IP address for a domain, it almost certainly means something is hijacking your DNS settings.

The first step to check would be the hosts file

/etc/hosts

Then look here to determine what server or process is resolving your DNS

/etc/resolv.conf

Alternatively, you can use this command

scutil --dns

Firefox may be working because it's configured to use a SOCKS proxy, but it's impossible to know for certain without more details.


Why are AMD processors not/less vulnerable to Meltdown and Spectre? I’ve read up on Meltdown and Spectre and it’s not obvious to me why AMD would be less vulnerable. Do AMD processors simply not have speculative execution? Or do they have some way of not exploding the same side channels?

Update: I ask because AMD’s press releases claim their products are less vulnerable.

Only Meltdown is specifically an Intel vulnerability / design flaw.
update: it seems AMD is mostly resilient to Spectre.  It's not clear why that would be the case.  But according to AMD:

(from early January, now replaced, see update 2 below)
Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. Vulnerability to Variant 2 (Branch Target Injection) has not been demonstrated on AMD processors to date.

Note that it's only a "near zero", unlike the "zero" for Meltdown.  (And that the "bounds check bypass" Spectre v1 attack (conditional direct branch before an array access) still needs to be fixed in software.)
update 2: AMD may have underestimated Spectre, because they are still releasing microcode updates, and their web site now says:

GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors.

While we believe that AMD’s processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat.

It's still not clear what microarchitectural design feature / difference makes AMD CPUs any more resilient than Intel; they do still have a large out-of-order window and AFAIK are not significantly more limited in what can be in flight at once.  But their branch predictors are designed differently, and are maybe harder to mis-train or are somehow insulated across privilege boundaries?  But the latter would make them immune to Spectre v1 as well, and AMD CPUs are just as vulnerable to the bounds-check bypass version of Spectre.

Spectre (v2) affects any "normal" CPU design with branch prediction + speculative execution for indirect branches.  In Spectre, the attacker primes / trains the branch predictor to mispredict the target of an indirect branch in kernel code or in another process.  Until the mis-predict is discovered, the privileged process will speculatively execute some instructions that change the micro-architectural state of the machine in a way that depends on secret data.
(Then the attacker uses a cache-timing attack to read that microarchitectural state, the same as in Meltdown.  When attacking the kernel, you'd ideally choose a "gadget" that uses the secret data to index an array your attacking user-space code also has read privilege for.  If you can't, you might have to use a cache-eviction timing attack to look for which set of cache had a line evicted instead of looking for a line that became hot.)
Defeating Spectre in HW might take something as costly as flushing the branch-predictor caches on every transition across trust boundaries.  Or at least the indirect-branch target prediction buffers.  (kernel / user is one the HW is aware of, but into sandboxed JIT-compiled code (especially Javascript) is a problem.)

The key to Meltdown is that Intel CPUs (but apparently not ARM or AMD) don't squash under-privileged TLB hits.  The load executes, and so do following instructions, and it only actually faults when the faulting load tries to retire.  This allows unprivileged code to directly cause changes in the microarchitectural state itself, based on data it doesn't have permission to read, instead of (Spectre) tricking a privileged process into doing it.
(Note that you only get actual data if the line was already hot in L1d cache;  It seems that on CPUs even repeated Meltdown attacks on the same line won't cause the CPU to bring a line into cache if it wasn't there already.)
;; run this in user-space
;; (and suppress or catch the fault somehow so you can do it quickly/repeatedly)

;; clflush all the cache lines in local_array (which you have permission to read)

;; create a long delay before following instructions can retire, but with few uops so OoO exec can see past it
times 30  sqrtpd  xmm0, xmm0     ; high latency per uop

movzx  eax, byte [kernel_byte]    ; eventually faults, but OoO exec continues first
shl    eax, 12
mov    eax, [local_array + rax]   ; the cache-line this touches depends on the secret data
;; after the movzx faults, the cache-line touched by the mov will still be hot

; then check which cache line of local_array is already hot.

(And BTW, I emailed the authors of the Meltdown paper about this.  They were in a rush to get it published by the public disclosure date which apparently moved up by 1 week unexpectedly.  They are planning to clarify their section on the microarchitectural details to make it clear that this is the real design flaw that enables Meltdown.)
(Meltdown depends on the kernel keeping its pages mapped into the virtual address space of the process, but with a bit set in the page table entries that flag them as kernel-only mappings.  This makes system calls and interrupts cheaper, because they don't have to modify the page tables to allow access to kernel memory: the CPU just starts allowing those kernel-only mappings to work when running in ring 0.  See this Q&A for a diagram of the x86-64 page-table entry format.  The U/S bit (user/supervisor) is the one that controls whether a mapping is kernel-only or not.)
The fault that's eventually raised is either handled (catch SIGSEGV), or suppressed (run the transient sequence inside a TSX (transactional memory) transaction, or as a result of mis-speculation).  So in Meltdown, branch mispredicts are only relevant as part of making the attack efficient and reliable by suppressing the fault on the load from a kernel virtual address.  Speculative execution past a faulting load is key, though, even for dependent instruction.  (Not just for independent instructions executed before a load-address is ready or anything that simple).

Presumably AMD's load execution units / TLB are designed differently, with privilege checking for loads applied earlier or differently.  Either a load from a virtual address with a kernel-only mapping is treated the same as a load from an unmapped page, or the physical page bits used for speculative execution are set to all-zero or all-one or something.  Or maybe it just squashes the load without triggering a page-walk (like a load from an unmapped page would).
Note that x86 doesn't require TLB invalidation when changing a page table entry from invalid to valid, so the address-translation hardware isn't allowed to do "negative" caching.  Or if it does, it would have to be coherent with page table writes that make previously-invalid entries valid.  Intel CPUs do a kind of TLB shootdown to maintain coherence for TLB entries that were only speculatively loaded, going beyond what the x86 manuals require to avoid breaking old code that existed before the current TLB-invalidation rules were published (e.g. Win95 through ME).

The point is, a different microarchitectural design choice could totally block the thing that Meltdown depends on.  And such design choices are plausible on their own, not specifically to avoid Meltdown.

A related question: why does Intel's delayed permission check design choice make sense?
Until Meltdown / Spectre, CPU designers were only worried about making sure memory protection applied to the architectural state (non-speculative values in architectural registers, not physical registers used by out-of-order execution).  i.e. this side-channel wasn't on anyone's radar.  The results of instruction execution don't become architectural state until retirement, so that's the point when everything has to be correct (in pre-Meltdown thinking).
As a CPU designer, you want everything to execute as efficiently as possible, with as few special cases as possible.  Or especially, with special cases in as few components as possible.  It's simpler for the overall design if an execution unit can never stall, so that a pipelined section of logic doesn't need any flow-control, just simply always accept one new input per clock.
(Update: an alternative to stalling is to report failure.  Load uops in Intel CPUs can already report failure back to the OoO scheduler and need to be replayed.  This happens on L1d cache misses, and on detection (during address calculation) of a cache-line split (to get data from the other cache line), or if the load port tried to use the 4c latency special case for simple addressing modes but the actual address was in a different page than the base register.  And even replay of other uops dependent on a load that were dispatched in anticipation of a load producing its result in a certain cycle.  Cache misses cause that, too.  So in theory under-privileged loads could use this mechanism to effectively not produce a value.)
It looks like Intel's current load execution units don't have a way to squash the load on a TLB hit.  The TLB itself is a CAM (Content-Addressable Memory).  Managing TLB entries with speculative (prefetch) page-walks involves some more active hardware, but the TLB itself has to be fast to support 3 lookups per clock (from ports 2, 3, and 7).
Most code doesn't page-fault by trying to load from kernel addresses, so optimizing for that case wasn't a consideration.  If such loads are seen by out-of-order execution, they usually happen as a result of mis-speculation (running a load instruction with the wrong data in register).  (Not necessarily maliciously induced mis-speculation (Spectre), just the regular kind from imperfect branch prediction.)  Not doing anything about a TLB-hit faulting load until retirement is a good design decision if most of the time it never reaches retirement because a branch mispredict or other mis-speculation is detected earlier in in-order retirement.  Wasting load bandwidth and causing cache pollution is questionable, but (other than Meltdown attacks) this is probably a pretty rare case so keeping the hardware simple was the most valuable thing.
Usually page-faults happen because of access to an address which isn't mapped at all: the page table entry is marked Invalid, not just kernel-only.  Or even a higher level of the 4-level nested page tables is invalid, e.g. the page-directory entry.  As mentioned earlier, negative caching isn't architecturally allowed (and AFAIK isn't done with snooping for correctness either), so such PTEs will never appear in the TLB.  A page-fault for an unmapped page will be raised only after a page-walk (which finds the mapping for that page doesn't exist).  x86 has dedicated page-walk hardware so the page-table loads can happen in the background while the execution units run other uops.  (Skylake even has two HW page-walk units).  But anyway,
So a page-fault from trying to read a kernel-only mapping is a special case, very different microarchitecturally from the unmapped-page case.   (It's actually similar to trying to store into a read-only mapping, which presumably also has delayed faulting.  Stores don't become globally visible right away; the store buffer makes speculative store execution possible by keeping them private until after retirement, at which point they can commit to L1D).

How could Intel fix Meltdown in future hardware?
Fixing Meltdown is relatively easy (compared to Spectre), although it probably can't be done with a microcode update.  As well as setting a fault-if/when-this-reaches-retirement bit on the uop, a TLB lookup could gate the page-address bits (to all ones) with the privilege-check.  e.g. a load in user-space from any kernel page could micro-architecturally execute as a load from the very top physical page.  (And systems with less than the max amount of RAM wouldn't have any physical RAM at that physical address.)
Or a failed privilege check could maybe still allow the load to happen microarchitecturally, but mask the result to all-zero in the load port.  (Remember, the Meltdown problem isn't that an unprivileged load can bring kernel data into cache, it's that the secret data load result can be used to make another load with a data-dependent address.  Continuing speculative execution with a zero result for any under-privileged load that hits in the TLB wouldn't allow any data-dependent microarchitectural effects).
The TLB lookup happens in parallel with indexing the VIPT L1D cache, but the TLB result is needed for the tag-check part of an L1D cache load.  So requiring the TLB lookup result is already needed to select the right way from the set indexed by address bits 6 to 11.  (L1D is 8-way set associative).  So also requiring the TLB permission check to be ready this early shouldn't introduce any extra latency.  Masking with the permission result would introduce one extra gate-delay, but one clock cycle has time for many gate delays.  (e.g. 64-bit add latency is only 1 cycle, 64-bit imul latency is only 3 cycles on Intel Sandybridge-family.  http://agner.org/optimize/).

You could even design it so a load that would fault (if it reaches retirement) doesn't complete execution at all, and no load result is forwarded to dependent instructions.  Maybe even squash it so it doesn't send a memory request down the hierarchy towards outer caches if it wasn't in L1D cache.  (i.e. don't even check L1D for it).  This might be a more tricky design.
(But some CPUs do work that way, according to Henry Wong's tests: e.g. AMD CPUs don't produce a result at all for Meltdown tests, vs. some non-vulnerable CPUs like Via Nano producing zero or Pentium Pro producing some random internal value.)
This design could make it impossible(?) for a user-space process to even detect whether a kernel address was mapped or not by any kind of timing attack, because the micro-architectural effect of a load to a kernel-only mapping would be the same as to an unmapped page.  (But actually only the same if it also triggered a page-walk.  An under-privileged TLB hit wouldn't trigger a page walk, and you could probably detect that directly.)
This might be valuable to stop processes defeating KASLR, if the kernel uses anything smaller than 1G hugepages to map any of its own memory.

Further reading about CPU internals:

Modern Microprocessors
A 90-Minute Guide!.  Why out-of-order (and speculative) execution is a thing in the first place, and the difference between CPUs with / without it.
David Kanter's Haswell microarchitecture write-up
What Every Programmer Should Know About Memory by Ulrich Drepper.  And a 2017 review on minor changes since it was published in 2007.
Agner Fog's optimization guide and microarchitecture guide

Meltdown-specific details:

The Microarchitecture Behind Meltdown - Henry Wong's detailed tests.

Encouraging the CPU to perform out of order execution for a Meltdown test - I think data is only vulnerable to Meltdown when something that is allowed to read it has brought it into L1d. (Directly or via HW prefetch.)

https://stackoverflow.com/questions/50191769/does-the-meltdown-mitigation-in-combination-with-callocs-cow-lazy-allocati - speculative execution into kernel code from user-space isn't possible.  i.e. a page-fault handler can't speculatively execute, because CPUs don't rename the privilege level.  See that for more about how CPUs take exceptions.

Out-of-order execution vs. speculative execution


Website's url parameter gets returned onto page- can that be exploited? I'm currently trying to find a vulnerability in a website (yes, I have permission). I found a url with a parameter that, when I change the text in it, that text is set as the name for the background image.
Ex. when I change the url parameter text to 'anytexthere', this is what the block of code will look like:

Is it possible to exploit this? I've tried unicode brackets and normal HTML code, and the unicode/normal HTML brackets are just removed in the image name.

tldr; url parameter text gets returned into background image name in the page's code, but removes brackets/special characters. How can I exploit this?

Since you can't use ' and ", there is no way to get out of the CSS string context to achieve XSS.

If single quotes were allowed, you could have injected CSS attributes, e.g.:

'); color: red; /*

If double quotes were allowed, you could have injected an HTML attribute, e.g.:

" onmouseover="alert('Where is my bounty')

If angle brackets were allowed (but not quotes), you would still have no chance to inject custom HTML. Something like this does not trigger:

.png')">

So what you're left with is the ability to change the image path to any URL on the same domain. E.g.:

As you can guess, this has a very limited security impact. In the rare case that the site implements CSRF protection solely based on the Referer header, you might be able to use this for CSRF attacks. But otherwise, there is no obvious way to exploit this behavior.


Does a password-derived public key authentication improve security over pure password-based authentication? Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of this a bit (aside from its other benefits of course), a compromised database of one providing using TFA can still lead to another not-TFA-protected account's credentials to become cracked.
This problem would be voided by users "simply" using public key authentication instead of passwords, but let's be honest, most users won't bother with maintaining a secret key (and password authentication reset usually still means they need to access their emails which out of laziness might be protected by the same private key or still a mere password) and if they have to use Software to store their secret key they might just as well finally use a password manager...
So, what if instead of the server saltedly hashing the password to authenticate the user a client-side function would use the password to derive a PKA pair (salted and/or peppered individually per server and/or user) and the server only stores the public key (plus salt, which does not become part of the public key but part of information the user needs to recreate their private key) for use with e.g. SSH2's authentication (i.e. request a non-replayable message to be signed by the private key)?
Users would hence still need to remember only one password, but since each server's salt/pepper differs the stored public key becomes unique, as does the generated private key.

That would have been too easy, wouldn't it? While obtaining the private key from the public key itself is still nigh impossible, the method to obtain it from the too-simple password is trivial, thus all this method does is replacing the purely server-side hashing by a hash-like algorithm that puts more of the workload to client-side. The only potential benefit might thus be slowing down online attacks, but existing methods such as limit-rating are probably still better-suited and more notably already well-established...


What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase? I'm looking at two comparable pieces of software which encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds of SHA256. What's the difference? Is one preferred over the other?

The difference is that:

PBKDF2 by design is slow
SHA256 is a good hash function; it is not slow, by design

So if someone were to try a lot of different possible passphrases, say the whole dictionary, then each word with a digit appended, then each word with a different capitalisation, then two dictionary words, etc. then this process would be much slower with PBKDF2.

But if your passphrase is truly secure, that is very long, pretty random and out of reach of any systematic enumeration process, then it makes no practical difference, except that an attacker may spend more resources trying to break your passphrase (or maybe less if they decide to give up sooner).


How does XAdES-X-L compare to RFC4998 Evidence Record Syntax This SE question describes a scenario I don't fully understand the use case or how 4998 can help correct the issue.

How and when should XAdES-X-L be used, and where should RFC4998 be used?

The difference between Evidence Records and XAdES signatures is that, well, the first consist in evidence records (ensures data integrity) and the second in signatures (ensures data integrity AND authenticity).

The various XAdES formats enable persons and legal entities to sign data. In an increasing number of countries, this has the same legal value as signing a paper document, however with stronger security (forging a digital signature is theoretically impossible if you use proven, secure digest and encryption algorithms).

There are however some issues that can arise with such signatures: algorithms become weaker and revocation information for signing certificates may become unavailable (once a certificate has expired, the CA is not required to keep its related revocation information). As a result, archiving digital signatures for long periods may become impractical... unless you keep, along with the signature, all its related revocation information while also ensuring that it cannot be forged should the algorithms (that were used at its creation time) become weaker/broken.

And that's exactly what the XAdES archive/long-term formats bring: they add revocation information to the signature and then issue a new timestamp (with a stronger algorithm this time) over this updated signature. This new timestamp hence covers the original signature value, along with the added revocation information.
By issuing such archive timestamps each time an algorithm becomes weaker and/or when a signing certificate expires, you can virtually archive the original signature forever.

Evidence Records, on the other hand, are "just" evidences to which a timestamp (cfr. RFC3161) has been applied. This can be used to prove that some piece of data actually existed at a given point in time, but it misses the legal purpose of a signature (i.e. someone marked his/her agreement to something specified in a given document).

So, to sum it up: XAdES-A must be used when you need to store the archiving stuff within the signature. Otherwise, ERs can do the same job...


Can Spectre be fixed in future hardware simply by purging CPU caches? As far as I understand it, Spectre is caused by speculative execution not completely undoing all side effects of an incorrect branch prediction (specifically, not undoing a CPU cache write). Doesn't that mean that it would be relatively simple to fix in future hardware, simply by ensuring that any cache entries that appeared due to speculative execution are purged in the event of an incorrect prediction? I read on an LWN article that there might be a problem with cache eviction behavior too; if so, what would that be?

Any side-effect of speculative execution that is visible can be used. There are some (perhaps many) side-effects that don't involve the cache at all.

From the Spectre whitepaper:

  ...  In this section we explore potential combinations and conclude that virtually any observable effect of speculatively executed code can potentially lead to leaks of sensitive information

  ...

  Instruction Timing.

  Spectre vulnerabilities do not necessarily need to involve caches.  Instructions whose timing depends on the values of the operands may leak information on the operands. In the following example, the multiplier is occupied by the speculative execution of multiply R1, R2. The timing of when the multiplier  becomes  available  for multiply R3, R4 (either for out-of-order execution  or after the misprediction is recognized) could be affected by the timing of the first multiplication, revealing information about R1 and R2.

if (false but mispredicts as true)
  multiply R1, R2
multiply R3, R4


Unauthorised access to admin area of a rails app, from the company's IP As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into the admin panel and changed a status to a project, as well as leaving a message. I went to the apache access log file and looked at the time the request was made. Interestingly, the ip that made the request was the company's IP. Does this mean that it's someone from inside the company?

As an additional information, if someone put the admin panel url directly on the browser, he isn't allowed to enter if he is not logged in as a user that has the admin role.

What are the possible cases?

With respect to the IP address logged in your apache log, there are a number of possibilities that do not necessarily indicate that it came from somewhere within your network.

Firstly, if an external attacker has complete control of your server, it is possible that they could fake the log entries.  Secondly if an attacker has control of a local PC, they could use that to make it look like an internal attack. Finally how do you know who was on the local PC at the time?

Real attribution is hard, and as a result you will need more evidence to determine what really happened.  If you have other network traffic logs that are time synced you could start to build up a picture of what was happening at the time of the attack.


Can AES encryption prevent modifying bits in a wireless protocol? I'm building an application with NFC which is a wireless communication protocol. An attacker can modify bits in a wireless communication protocol. I want to prevent this. I know we can't prevent an attacker from changing the wireless signal, but it's possible to detect the modified information.

My question is: is this possible by encrypting your data with e.g. AES? I'm not 100% sure but in my thoughts AES can only be decrypted one way. So if the attacker modifies one or several bits, won't the receiving client be able to decrypt the information?

My understanding of NFC is that, as a standard, it doesn't offer any provision for encryption of data security.

This means you'll have to implement security on top of it.

So first: the important part: do not try to implement it yourself:

You do not have the understanding necessary to design it properly (as demonstrated by your question)
Even with proper design, implementing security properly is a hard problem even for experience programmers and designers
There are plenty of libraries (starting with OpenSSL) that will provide you with the necessary tools for the task, are scrutinized by the best minds in the business for potential weakness and issues (even if old implementation bugs surface from time to time).

Now for the specific part of your question: AES is a bloc cypher. In itself, it does not provide with either authentication or data integrity. All it does is describe how you can use a key to encrypt a single fixed size block of data. You need to couple it with a block cipher mode of operation to add the properties necessary to make it useful in practice: apply it on arbitrary length steam of data, protect against replay attack, data modification, authentication, etc. All these properties depends on the mode of operation you pick.


Reason for not implementing own algorithms/implementations I get that people don't want to encourage other people to implement their own algorithms/implementations of algorithms due to safety issues. But on the other hand, questions about creating your own implementation are "shut down" immediately with the words " the first problem is: you are implementing it yourself". How can one be able to learn more about security if not implementing such things himself and learning from his faults?!

Am I missing a point in this whole "you should not create your own implementation of an existing security algorithm"?

No, it doesn't matter. Every algorithm we use today was implemented by someone and then became a standard. The reason why it's not used as a practice is:

Security. A new method of hashing/encrypting/whatever needs a lot of time in order to be tested thoroughly, or even be further developed. It's not safe to launch something new in an instance if you cannot prove its safety against cryptanalysis.
Compatibility. Suppose you are a company owning credit/debit information and you co-operate with bank systems or governance infrastructures through DMZ's and other sort of mechanisms like this. Your way of hashing/encrypting/whatever information is totally different than the one used by the rest of the world, thus making information exchange very difficult when/where needed.

There are a lot of awesome, new, fast and impenetrable algorithms out there, developed by companies, organizations, PhD's, hoping they will become a standard one day. But since all of our infrastructures today are based in things that are proven to work, going the other way is a risk you take on your back, all by yourself.


Privacy-preserving authentication with unique user identification for Web applications Is it feasible to authenticate users such that they should be prevented from creating multiple accounts, and that their privacy is not impaired (i.e., no personal information should be revealed to the application).

I'm thinking client-side biometric authentication with hashing? I think biometric authentication might scare away users, though, even if it's all done at their end. The application involves voting, so I need to prevent ballot stuffing through fake accounts. If my objective is not feasible, how close can I get, and what do I need to sacrifice?

It sounds like what you really want to do IS authenticate people, then provide a method of submitting a vote which is not linked to their identity.

The whole anonymous voting crypto problem has been around for a while, and there's a lot of potential algorithms to solve it.  If you get ahold of an applied crypto textbook, there's likely an example of a similar problem in it.

There is a cryptographic technique which would allow you to authenticate a user, then could provide them a token which allows them to vote anonymously.  I think it involved 'blind signatures'.

EDIT: You may want to post in the crypto StackExchange site.


Credit card tokenization algorithm Just curious, what is the common algorithm used to tokenize a user's credit card? I know lots service use PRNG (random number). Does it just re-gen a random number when there is a confliction? What about use UUID as token? What are the pros and cons?

Tokenization just uses random number generators to generate a certain ID and link that ID to a card, there is no way you can for instance reverse engineer the token from a card number or vice versa.

Sometimes the last 4 digits are kept as part of the token to display to the user. This is useful for certains shops, like Amazon, where a user might have configured several credit cards.

Normally tokenization happens in such a way that the randomness and keyspace are so large that colliding tokens are very unlinkely. In case a token would already be present it just needs to re-generate the random number prior to commiting into the database (often databases have unique constraints on the token as well as they're used as secondary or primary keys).

The pros are that you can reduce your PCI scope significanty. For instance databases used for analytics on a person's spend needn't be part of the  PCI zone as no PAN data will be present.

There are no cons. Some con you might have is for card acquirers that do not want their helpdesk to have access to their clients card numbers. So it might be that the acquirer needs to print an additional identification number on the card of the customer so he can be identified.


Tool to prepare report of security auditing I was doing dorking on my friend's website to make sure there is no leak of information that is not meant to be. I found domains and sub-domains in search results.

Is their a tool which can help me to prepare the report? Report like domains and subdomains are represented in some graphical format something like tree structure?

And also what tools should be used for reporting during target enumeration phase?

That depends on what your report should look like.

There are a number of reporting tools. Dradis and MagicTree are two of them. They may not be the kind of reporting you seek, but its worthwhile to look at them.

Having seen a number of penetration test reports from different vendors, I know for sure that they must have some template and/or macros and/or report tooling to generate these reports (one company had a spelling mistake in their template...). These templates/macros/tools are often proprietary.

As for enumeration: nmap is of course the first tool that comes to mind, but simple nslookup, smbclient et cetera are also tools that come in handy.


Is possible to build a firewall for all I/O devices and interfaces on a PC? Lately there is a trend were input/output devices and interfaces are used for either exploits (taking advantage of their vulnerabilities) or to blatantly "copy" near by audio/video information.

So, could a firewall be build to control data input/output on these interfaces?

By interfaces I mean to all human devices used to control a personal computer, such as audio capturing devices, video capturing devices, input devices like keyboard, mouse, gamepads, etc., and output devices like sound cards, graphic cards.

High-availability operating systems which have multiple layers of software abstraction and filtering acting like input/output firewalls already exist. These operating systems leverage multiple layers of input formatting and protection at each device input area but these are generally for specialized high availability hardware. Effectively these are very good at dealing with buffer overflow problems and rewriting poorly formatted or intentionally manipulated input.

The problem with doing this on traditional PC's occurs with Direct Memory Access protocols like PCIe, Firewire, and Thunderbolt. Due to the use of these interfaces we may not be able to put appropriate software hooks in place to prevent attacks. So for traditional hardware this may be a hard problem. That said with the costs of custom hardware dropping maybe it's time this could be re-addressed. I think enough people are concerned about security at this point that the interest is certainly present now.


How can I create a secure auto-login? (java) I am writing a server-client program. When a new user installs the program and opens it for the first time, he has to enter a password. The password in combination with an email address is needed to authenticate to the server via SSLSocket.

I know how to save a password securely (store salt and hashed password), but how can I create a secure system, where the client automatically sends the password to the server? I do not want the user to type the same password every time he wants to login.

Is it possible to create a secure system like this? Because if I save the hashed and salted password in a .txt I can just read it and then login to the server? How is it possible to create something like this?

EDIT:
My client opens an ssl socket to a server.

(1) Is it safe to send the plain password via SSL after opening the connection  successfully? Or would you send the hashed and salted pw?

(2) Is it possible to store the password (either plain or hased) on client side?

I want the program to automatically send the pw hash to the server when it starts but it mudt be secure.

There are many many ways to do login mechanisms, and it's a pretty complex topic. This is too broad a question for me to give you a full answer, so just some pointers.

Mandatory "don't roll your own" warning:

If you are building this app for your own learning, then carry on good sir! But if you are building this for a real website, then please find a web framework (like springboot/springsecurity) that has implemented all the login and session management for you, because there is a lot that you can get wrong.

Normally when the user logs in (ie sends the server their username / password) the server returns some sort of session token, some sort of authentication token (which may double as a session token), and sometimes also a refresh token to get a new auth token once it expires. These can take many many many forms, but common options are cookies, JWT, and bearer tokens, and each has security landmines that you need to read about and make sure you don't do.

The important thing is that every time the client sends a request (GET or POST) to the server, this authentication/session token is attached to it to tell the server which user and session this request should be part of.

If you want users to stay logged in across restarts of the client, you can save the auth / session / refresh token to disk, and use that to resume the previous session.

The details of this are a bit too complex for a StackExchange answer, but hopefully points you in the right direction, and gives you some keywords to google.


Certificate authorities: history and registration CA's are a key part of the internet's infrastructure few people are aware of. SSL was mostly hacked together at Netscape in 1995. I'd like to understand more about the organizational structure of CA's and the history. How did the current CA's come into existence? What organization decides who can become a CA?

According to wikipedia these are some notable CA's. As far as I know there are several hundreds altogether.

Symantec 38.1% market share
Comodo Group  29.1%
Go Daddy  13.4%
GlobalSign  10%

See also this map of CA's: https://www.eff.org/files/colour_map_of_CAs.pdf

When you refer to CAs you are really talking about CAs that issue public SSL certificates.

There is no overarching organisation responsible for managing the issuance of SSL certificates. It is left to application developers to decide who they trust, and how high to set that bar. The list of trusted Root Certificates in IE and Firefox have considerable differences.

At the end of the 90's I worked for First Data Corporation, who spent considerable time and effort to get themselves added to the Internet Explorer trusted CAs, although to my knowledge they never issued certificates to third parties. It cost many hundreds of thousands of dollars to go through the formal certification process and required that they had a suite of formal PKI policy documents (covering the life cycle of certificates).

This policy was covered by RFC 2527 (later replaced by RFC 3647) although I don't recall whether Microsoft required compliance with that RFC at the time.

More generally there are many CAs that issue certificates for other purposes. I know Skype used to be one of the largest PKI providers - PKI was used to identify users, although I am not sure if this still the case. Quite a few national identity cards in Europe include PKI digital certificates which are used to enable access C2G and B2G via smartcard readers.


JS malware detection Is there a way to detect a malicious JavaScript code within a webpage before the script runs on my computer ?

I want to develop a Python script that prevents from 8 JS malwares that I can embed on my website (for test). But if the malicious script runs on my computer then I do not find it useful for my Python script to detect it. I would love to know if there is a method that can allow me to detect the JS malware before it runs.

That means you need some way to access the Javascript code after it got downloaded but before it got executed.

Depending on the web browser, there might be a browser-specific way to create an extension or plugin which is able to access the website content before the rendering engine does. Refer to the relevant documentations about your web browser for details.

A much more browser-independent solution would be to create a local proxy server and configure all your web browsers to use that proxy server to access the internet. That proxy could easily examine all html and javascript files for malicious code before relaying them to the client. There already are solutions which work that way, free or commercial.

One problem with this solution is that it is impossible for a proxy to scan any content transferred via HTTPS. With TLS, the content is encrypted between browser and server, and the proxy has no way to decrypt it. But there is also a workaround for that: SSLStrip is an example for a proxy server which handles the TLS en- and decryption itself. It then re-encrypts the connection between itself and the browser using a new certificate signed by itself. This, of course, requires that the proxy servers root certificate is added manually to the list of trusted certificate authorities of the browsers.

While TLS certificate spoofing can be used maliciously, this method isn't uncommon in corporate environments to be able to filter the web from content which might be malware or distract employees from their work in other ways (games, porn, etc.).


ASN.1 encapsulated BITSTRING type in openSSL I am currently building an ASN.1 parser which supposed to decode X.509v3 certificates and epoch files in ASN.1 DER format. The parser is working well apart from one issue which I couldn't seem to get.
If I decode the DER format I see that for the public key the following form of BITSTRING is used:

 BIT STRING, **encapsulates** {

 SEQUENCE {

 INTEGER

     // public key hex string

but when I look at the signature I see that it is represented with BITSTRING without the encapsulates tag and contains only the hex buffer of the signature:

 SEQUENCE {

 OBJECT IDENTIFIER sha256WithRSAEncryption (1 2 840 113549 1 1 11)

 NULL

 }

 BIT STRING

 // RAW signature hex buffer }

It is important for my parser to know whether the BITSTRING will only contain a buffer (like, in case of the signature) or will encapsulate some other types (like in the public key case). In the DER encoding of both I didn't find any difference that may imply usage of encapsulation.

My question being: how can I distinguish those 2 scenarios in the parser code?

You really can't know that without knowing what type of data you are parsing.

If you know what type of data you are decoding, then you should use ASN modules and related documentation to adjust your parser. In addition, you may need to make some intellectual work.

  the BITSTRING will only contain a buffer (like in case of the signature)

it is not a raw buffer, it may be a nested type as well. For example, if you look at ECDSA signatures, you will find that encoded signature is nested complex type:

ECDSA-Sig-Value ::= SEQUENCE {
    r  INTEGER,
    s  INTEGER
   }

and here is how it looks:

  or will encapsulate some other types(like in the public key case)

Again, not always. RSA key uses nested structure in BIT_STRING, EC key does not:

these are just examples where your assumptions fail. Signature may have nested structure, public key may not have it. It depends on a context and without documentation it is hard to tell what to expect. So I would suggest to use the documentation. For example, RFC5912 that contains most PKIX ASN modules.

if you don't know what data you are parsing, then you have to do a hard work to proactively check whether the current type is primitive or constructed (without CONSTRUCTED bit set). That is attempt to unroll nested type if possible.

I have a general-purpose raw parser to decode ASN binary data to discrete structures written in C#: Asn1DerParser.NET and parser class: Asn1Reader


Malware known to use port knocking to evade detection by network scanners? Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?

Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature.
Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt  this technique for opening backdoors on victimized systems" but doesn't provide any examples.


Enterprise Tracking of Devices Logged into WiFi If I have a Bring Your Own Device policy, how can I track whose device belongs to each IP address?  Do I need to collect information on all devices that use the WiFi system?

Deploy 802.1x on the WiFi controllers or WPA2-Enterprise with a RADIUS server. This will allow you to track IP assignments to usernames. You could also record MAC addresses of these devices and map them to usernames in a spreadsheet. Depends what decade you want to be in.


How Facebook recommend me a friend (no mutual friend)? For example, Facebook recommends me a friend:

We really know each other
We do not have mutual friend on Facebook
We both have whatsapp and have each other's phone number, but never chat on whatsapp before. Or we are in the same whatsapp group only. Does FB use whatsapp contacts as reference?
We are not friend on any social media apps, twitter, IG, etc.
We are from the same university, but graduate year differ in several years. And there are so many students...
I use Android phone, and I never sync my contacts online.

It happens several times to recommend a correct friend.

I feel curious, in this case, what's the data source used by FB's algorithm to recommend a likely friend?

There are many possible use cases for this. Some of them are

Location data - You told that you know this person. Both of you might have been in the same location many times.
Contact Info - You have never synced your contacts online, but the other person might have. He did have your contact information.
Same University - As you told, you both are from same university.
Profile views - As paj28 said in comments, he might have viewed your Facebook profile.

  Does FB use whatsapp contacts as reference?

No. According to WhatsApp website, They share some information including phone numbers, preferences, etc... with Facebook. But they don't share your contacts and other information.

  Importantly, WhatsApp does not share your WhatsApp contacts with
  Facebook or any other members of the Facebook Companies, and there are
  no plans to do so. WhatsApp also does not share your messages with
  Facebook


NCrack bruteforcing for http-get using -iL options How to do  NCrack bruteforcing for http-get service  using -iL (mass scan) options where server is having different port.

Without more context we won't be able to provide exact guidance. But the following sounds like what you'll need:

ncrack -U usernames.txt -P passwords.txt -iL hosts.txt -p8080

-U defines either a single user name or a file containing user names to try.
-P defines either a single password or a file containing passwords to try
-iL options allows you to define multiple hosts names in a file
-p allows you to select a different port for the hosts than default port 80(for http-get) - in this case port 8080.

Remember to only use this tool with explicit permissions from system owners.


Session id on page html source code I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code.

Why I wanted to do that?

I'm trying to share the user session between two applications, one (the main) in PHP and another in Node.js. The Node.js one is used just for real-time data, but I just want to send live data to logged in users in the PHP application.

As the session ids are stored in a Redis instance accessible for both PHP and Node, I can just send the session id from the client to the Node.js (using websockets messaging).

Why not use the cookies already present in the user browser?

The Node application is served using a different host. So the cookie is not going to be available.

YES there is a risk introduced by including the session identifier the HTML code as it will make it easier to exploit XSS vulnerabilities to hijack sessions.

First, accessing session id from JavaScript is BAD PRACTICE, cookies should have the HTTPONLY flag to prevent that.

In your case, even if the HTTPONLY flag is set, having the session identifier in page body makes it easier to access this identifier while exploiting the XSS and thus bypass the HTTPONLY.