Off-Facebook activities received from apps and websites NEVER logged in via Facebook Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with.

But how did those apps and websites share that data with facebook, even when I didn't use facebook to log into them? In some cases, I have just surfed a website as an anonymous user, without signing up. Yet they were able to share activity data with Facebook.

Also please note the activities are NOT shared anonymously, but to my specific Facebook account.   How did the website get access to my FB account id even when I didnt use FB to login?

622 Apps have shared data to FB

Although I used FB to login only into 5 apps.

You can access off facebook activities here https://www.facebook.com/off_facebook_activity/

Update 1:

I am concerned about other websites and apps tracking my activity. At least Facebook informed me.

For example:

+---------------------------------------------+----------+---------------------------------------------------+
|                   Portal                    | Platform |                       Auth                        |
+---------------------------------------------+----------+---------------------------------------------------+
| Godzilla (a fake popular app like facebook) | Chrome   | Signed up and logged in                           |
| Godzilla on phone                           | Android  | Godzilla on chrome (logged in). No app installed. |
| XYZ.com                                     | Chrome   | Anonymous user                                    |
| XYZ's app                                   | Android  | Anonymous app user                                |
+---------------------------------------------+----------+---------------------------------------------------+

In which of these above cases can XYZ track me?

Update 2:

FB received several activity events from these 2 android apps

Turbo VPN
Spotify

Even though I dont have facebook app on my phone. How can I prevent this?

This would be the work of Cookies, fingerprints and/or other tracking techniques.
Many sites have a Facebook (tracking) pixel for advertising purposes, or inject Facebook scripts for including feeds or a like button. This sends data to FB about your visit and possibly any interaction you have with the website.

You do not need to login to these sites using FB, the cookies are enough for Facebook to know it is your account.

Useful links:

How to limit/disable the off-facebook activity tracking
All the Ways Facebook Tracks You—and How to Limit It

Also have a look at the answers given in this thread: How does Facebook track your browsing without third party cookies?


What are you doing when you move your mouse randomly during a truecrypt volume creation? Is that called a 'round' every time you move your mouse when creating a new volume? I'm talking about the screen with the random numbers during the volume creation process. What is the purpose of doing the random movement?

I saw Lastpass is now doing '100,000 rounds', I'm not sure what that means exactly.

Brand new to the world of encryption here :)

You are creating something called "entropy".  Random number generators within computers can, if implemented within software, only be at best pseudo-random.  Pseudo-random number generators (PRNG) start with a seed.  If the seed is well-known, then anyone with knowledge of the PRNG algorithm can derive the same values you derived (this is actually really good for things like simulations and the like where you need an element of reproducability -- it is not good for crypto).  So you need to start with a non-well-known seed.  Traditionally (not for crypto!) this seed was the computer's time of day.  However, for crypto, you need much stronger randomness than this.

In many commercial environments, there is often the requirement that random number generators (RNGs) are based off of a hardware-based "noise source".  This could be things like random network packet data, the number of photons hitting a detector, the speed of air across a sensor, or any combination of things that might be considered TRULY random.

Unfortunately, these hardware-based noise sources don't usually find themselves in widespread use in consumer environments.  So the next best thing is to pull hardware-based noise from something else.  Many encryption systems use a human moving a mouse to acquire this.  Even if the human moves the mouse in circles or back and forth, there is usually still enough actual real-world randomness in the mouse path deviation to provide a reasonable level of entropy to seed the PRNG.

For real-world examples of entropy from the environment, look no further than the air-splayed balls spinning around in a lottery cage.

"Rounds" are not related to entropy gathering and are related to the number of times that a specific algorithm is run through.  There is almost always (?) a feedback mechanism allowing one round to affect later rounds.  Increasing the number of rounds increases the amount of time it takes to encrypt/decrypt data.  This is important as it can seriously de-scale any brute force decryption efforts.  Of course, it also slows down the ENCRYPTION efforts as well.


RSA relation to SSH key exchange I do not fully understand SSH. I was hoping someone could fix my confusion.

When you generate an ssh key pair, you create four files.

authorized_keys, id_rsa, id_rsa.pub and known_hosts

My confusion comes from that fact that RSA is an encryption tool, you release a public key pair (n,e) but in the id_rsa.pub file, there is no pair, it's just one gigantic string, where does it split?

Furthermore, how does SSH create a server side password check, RSA is used for encrypting messages, how does them having my public key, combining with my private key create some sort of password confirmation, RSA is used for encrypting messages not password authentication?

known_hosts has nothing to do with public key authentication.  It's a list of servers you've previously connected to and fingerprints of their SSH keys to help verify the connection to the server is not being man-in-the-middled.

authorized_keys is a file stored on the server containing the SSH public keys of users authorized to log in to the server.

id_rsa is the private key.  id_rsa.pub is the public key.  The public key is encoded according to the format in RFC 4253, but basically it's a PEM-encoded blob that contains the key type, length, and the values n and e.

Public key authentication does not involve passwords at all.  There's no "password confirmation" step at all.  When the client connect, it offers the keys it has to server.  If the server can use one of those to connect, it asks the client to sign metadata about the request, including data provided by both the client and server.  The client takes the request data, signs it with the private key, and then sends it back to the server.  The server verifies the signature of the blob, which shows that the client possess the correct private key (matching one of the public keys in authorized_keys) and grants access.


How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7) I have a newer private key I have to import into an older server.

How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?

Easiest way is probably to import it on a system that supports PKSC#12 and then export in a different format (assuming there aren't any rules in the cert about not allowing re-export, not sure if that is even possible in PKSC#12 or not though).


How to force browser to ask user to resubmit certificate after a logout We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from the cert, a lookup is done and the user is logged in.

In the case of cert auth, if a user logs out; he can just log back in without manually resubmitting the certificate. The browser will do that for him automatically. I see this being a bit undesirable because the user thinks he's logged out but on clicking the URL subsequently, the user is just sent right through.

Is there anything we can do to make the browser to re-check the certificate submission with the user after a logout or for a specific event?
We can't change browser settings because we can't go to all the end users and ask them to clear their ssl cache.

Client side certificates are currently is a mostly enterprise used feature, And it relies heavily on the web-browser to manage when to send what certificate to the server (in mostly an ugly ui element).

So currently using a login only based on the certificate means you auto-login each time you use the certificate. (the browser remembers you want to use the certificate and re-uses it when you connect).

The only way to stop the browser from doing this is client-side. the user needs to 'tell' the browser to NOT send the certificate.

a different way to facilitate both certificate login and user/password login is by having 2 different login pages, one for password login, and one for certificate login. So a end user can choose what type of login he / she / it wants to use.

There is of course also the possibility to revoke the certificate the user has and require him/her/it obtain a new certificate to login. a revoked certificate would trigger the browser to give the user a "selection box" to submit a new certificate.


How do I know the remote server is genuine the first time I connect with SSH? Imagine a scenario(don't know if it's possible):

Before I connect to my newly-bought VPS for the first time, somebody has been spying on my network connection and trying to employ MITM attack when I try to ssh a server. For the first time of ssh connection, given the server ssh public key fingerprint, how do I know it's the real server I want to connect to? How do you guys ensure this? (Everytime I connect to a new VPS, I type yes.)

Connect to the server using the administration console from the control panel of the provider, generate the server SSH keys, save the fingerprint. When you connect to it by SSH later, compare the fingerprint with the one you saved before.

But the chances of someone spying on you specifically to intercept and change the fingerprint of your recently commissioned are pretty small.


US FIPS equivalent of ISO 27001? I am familiar with the US government's FIPS standards, like FIPS 140, policies and procedures; and security controls like those enumerated in SP800-53. I am less familiar with ISO 27001.

A preview of ISO 27001 is available online, but its just a teaser with no useful information.

What is the US government's FIPS or Special Publication equivalent of ISO 27001?

There is not a single document within FISMA which maps to ISO27k1. Instead there are several publications which may be used to achieve the same as with ISO27k1. Note that generally the scope of ISO27k1 is focused on the business. I think it's less specific than FISMA, it's more business oriented. Have a look at this document from ATSEC. Below is a relevant excerpt:

  Here we compare how the two differ in some fundamental aspects. The
  scheme developed by NIST is used by Federal Agencies, their
  contractors and those involved as part of the critical infrastructure
  including utilities (electrical, nuclear, gas and oil, dams),
  transportation (air, road, rail, port, waterways), Public Health
  Systems/Emergency Services, Information and Telecommunications,
  National Defense, Banking and Finance, Postal and Shipping,
  Agriculture/Food/Water, and the Chemical industry in order to meet
  their mandatory requirements under the Act. To date a great many
  systems have been certified and accredited under the scheme. The suite
  of FISMA standards is close to completion and includes a risk
  assessment methodology (SP 199) and a detailed controls list (SP
  800-53) with objective assessment criteria (SP 800-53A). Originally it
  was characterized as adopting somewhat of a “bottom up” approach as
  the technical focus is firmly on the operational and technical aspects
  of the IT system. The focus of the framework is on the IT systems, and
  on their certification and accreditation to operate.

  FIPS Publication 199, Standards for Security Categorization of    Federal Information and Information Systems
  FIPS Publication 200, Minimum Security Requirements for Federal    Information and Federal Information Systems
  NIST Special Publication 800-18, Guide for Developing Security Plans    for Federal Information Systems
  NIST Special Publication 800-37, Guide for the Security Certification    and Accreditation of Federal Information Systems
  NIST Special Publication 800-30, Risk Management
  NIST Special Publication 800-53, Recommended Security Controls for    Federal Information Systems
  NIST Special Publication 800-53A, Guide for Assessing the Security    Controls in Federal Information Systems
  NIST Special Publication 800-59, Guide for Identifying an Information    System as a National Security System
  NIST Special Publication 800-60, Guide for Mapping Types of    Information and Information Systems to Security Categories

  As the FISMA related standards and guidelines have matured they have
  emphasized the importance of a risk management framework that can be
  used to augment the baseline control set approach.

  On the other hand, the ISO/IEC 27001 standard is aligned with ISO/IEC
  9001 (the Quality Management System) and draws from the lessons
  learned in the career of that standard, meeting needs in the
  non-Government arena for scalability and needs to ensure that an
  organizations management system meets a basic best-practices
  management system. It’s paradigm is, that by ensuring that the
  organization has an appropriately defined risk management process and
  assessment methodology, then the treatment of identified risks will
  mean that appropriate controls can be applied and hence assurance can
  be gained that the organization’s systems are also properly secured.
  This standard focuses on making sure that the organization has a
  management system that is capable of managing information security, a
  necessary approach for the non-government arena where a very wide
  variety of organizations need to be serviced. Hence, it adopts more of
  a “top down” approach. The standards included in the ISO/IEC 27000
  family include:

  ISO/IEC 27000 Fundamentals and principles
  ISO/IEC 27001 ISMS requirements
  ISO/IEC 27002 Security controls (Code of Practice for Information    Security Management)
  ISO/IEC 27003 ISMS implementation guidance ISO/IEC 27004 Information    security management   metrics and measurements ISO/IEC
  27005 ISMS    risk


How can I verify my browser/OS's top level certificate? I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's signature based on the trusted authorities stored locally. And I can follow the chain of authorities my computer trusts, verifying each certificate, until I reach one of my top level trusted CAs. Is there some way, outside the CA ecosystem, I can verify that my top level CAs are correct? Can I go visit them somewhere?

In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate.  For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.

1)  Navigate to security.stackexchange.com, and click the green padlock in the address bar
2)  Click the right arrow, next to 'Secure Connection'.
3)  Click 'More information'
4)  Click 'View Certificate'
5)  Click 'Details'

Then, look at the certificate hierarchy.  You should see the following chain:

DST Root CA X3
  + Let's Encrypt Authority X3
    + *.stackexchange.com


How secure are virtual machines really? False sense of security? I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that:

  Whichever VM you select, the VM cannot cross the software boundaries set in
  place. For example, a virus might infect a computer when executed and spread to
  other files in the OS. However, a virus executed in a VM will spread through the
  VM but not affect the underlying actual OS.

So if I'm running VMWare player and execute some malware on my virtual machine's OS, I don't have to worry about my host system being compromised, at all?

What if the virtual machine shares the network with the host machine, and shared folders are enabled?

Isn't it still possible for a worm to copy itself to the host machine that way? Isn't the user still vulnerable to AutoRun if the OS is Windows and they insert a USB storage device?

How secure are virtual machines, really? How much do they protect the host machine from malware and attacks?

VMs can definitely cross over.  Usually you have them networked, so any malware with a network component (i.e. worms) will propagate to wherever their addressing/routing allows them to.  Regular viruses tend to only operate in usermode, so while they couldn't communicate overtly, they could still set up a covert channel.  If you are sharing CPUs, a busy process on one VM can effectively communicate state to another VM (that's your prototypical timing covert channel).  Storage covert channel would be a bit harder as the virtual disks tend to have a hard limit on them, so unless you have a system that can over-commit disk space, it should not be an issue.
The most interesting approach to securing VMs is called the Separation Kernel.  It's a result of John Rushby's 1981 paper which basically states that in order to have VMs isolated in a manner that could be equivalent to physical separation, the computer must export its resources to specific VMs in a way where at no point any resource that can store state is shared between VMs.  This has deep consequences, as it requires the underlying computer architecture to be designed in a way in which this can be carried out in a non-bypassable manner.
30yrs after this paper, we finally have few products that claim to do it.  x86 isn't the greatest platform for it, as there are many instructions that cannot be virtualized, to fully support the 'no sharing' idea.  It is also not very practical for common systems, as to have four VMs, you'd need four harddrives hanging off four disk controllers, four video cards, four USB controllers with four mice, etc..
2020 update:  all the recent hardware based vulnerabilities (Meltdown,Spectre,Foreshadow,ZombieLoad,CacheOut,SPOILER,etc) family of vulnerabilities are great examples of how VM's are always going to be able to communicate, simply because they share hardware (caches, TLB, branch prediction, TSX, SGX) that were never intended or prepared to be partitioned and isolated.


What is the difference between the "sig" files and the checksum files, such as on the PuTTY download page? This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software.

For example, on the PuTTY download page both sig files and checksum files are made available for compiled Windows binaries, as shown below.

What is the functional difference between these file types? Also, while I know how to check the checksums of the downloaded files, how can the sig files be used (on Windows)?

What is the functional difference between these file types?

Checksums ensure data integrity.
Digital signatures additionally ensure data authenticity.

When downloading a file, errors may occur during that process. Malware also could modify the downloaded file if you're machine is infected. The file's fingerprint (checksum) is there to tell you that the file is not altered.

An attacker may host a malicious version of PuTTY on his website and makes it available to download. Verifying the checksum in this case is useless: the only way for you to be sure that you did not download a malicious version of PuTYY is to check its  signature(s).

  Also, while I know how to check the checksums of the downloaded
  files, how can the sig files be used (on Windows)?

This is more a Super User question. You have there the same question as yours.


is it possible to scan an umounted pendrive partition with clamav on linux? so, I dont want other applications to have a chance to try to read any files on the pendrive partition.

from here, after testing (without mounting any partition), I see I can extract the MBR for example, but I wont do that with my pendrive partition of 4GB...

so I wonder if we can scan it without mounting it? like I did with the MBR but without extracting it neither.

Is it possible? May be some other virus scanner could be an option too if clamav cant, or if I can use some linux trick to let it scan without mounting.

This question differs from: https://security.stackexchange.com/a/40008/142551
That requires it to be mounted (but even mounted I couldnt scan neither the MBR neither the partition).
As I am trying to scan WITHOUT mounting the partition.

Well you can... provided you mimic the mount of the partition!

At a low level, mounting a partition is no more that reading the raw partition to discover and load its different system tables (allocation table, root folder, etc.). From that point, the system is able to give you access to the individual files.

If for any reason you do not want the kernel to mount the partition, your application must have enough knowledge on the internals of its file system to be able to:

find and read the root folder (and any other folder once you can find it)
identify all active (plain) files and folders inside a folder
load a file from a folder

As you just want to pass clamav there, you can safely ignore all special files (devices, symlinks, unix domain sockets) and only process plain files and folders. Also, you can ignore any file attributes.

Then, you recursively walk the folders, read individually all files and pass their content to clamav

But the question is now: what is the security gain/loss regarding a normal mount of the partition?

Pros:

no risk of accidentally executing anything from the partition
no risk of hitting a security flaw in the file system driver(*) (note that you can mediate that with a FUSE driver if there is one, or by running the analysis on a virtual machine)
no risk that a third party process can access any file from the partition

Cons:

you must implement securely all the low level structures and accesses of a file system
you must trust more your code that the (highly tested) kernel and driver code
you must ensure that your code will follow all possible evolutions of the file system
you must implement all file systems that you want to be able to clamax

That being said, that is exactly what the fsck utility does: it reads a raw partition and walk along its hierarchy to discover and fix low level errors. But it is a low level system tool...

TL/DR: unless you are a file system expert, I am not sure that the security gain is worth it. IMHO the following procedure should be secure enough:

fsck the partition - if it is supported by fsck
mount it to a subdirectory of a directory with permissions 700 to make sure that no non root process can access it, with the noexec, nosymfollow, noatime flags
pass clamav on it

(*) mount man page ends with

  BUGS
       It is possible for a corrupted file system to cause a crash.


Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal? Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and Debit/Credit transactions through an e-portal.

As we're in the UK, the pending 2018 GDPR Act will have huge consequences on Data and information security for us, and as an IT dept. one of our biggest challenges is preparing the organization for the changes, and enforcing best practices on our staff.

It's recently come to light that certain vendors will often be logged on to more than one machine, with a different user performing financial transactions whilst 'borrowing' a colleagues credentials (the colleague in question is aware of this, apparently it 'speeds things up' when they're busy).

Of course this removes our ability to trace and audit transactions, but strictly speaking, is this illegal?

If so, which party would be prosecuted for this? The individual 'borrowing' the credentials, the colleague who has 'loaned' their login credentials out, or us as a company (even if we are unaware of the practice)?

I'm aware this crosses over with 'Law', but is more generally focused on IT protection practices so thought I'd post it here (don't want to cross-post). IF the community deems this off topic for this stack, could an admin kindly migrate it over to Law for me?

Article 32 states "the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk".

If a regulator looked at what you were doing and concluded that you hadn't done this, they could certainly impose a penalty on your organisation.

Their conclusion - and the penalty - would of course be very dependant on your exact circumstances.

But off the top of my head, it looks like this behaviour increases risk to the data subjects (because fraud is more possible without a good audit trail) and that you have not implemented appropriate controls (because you wouldn't be asking us for help if HR had fired people until they stopped).


Internal Server to Server Authentication Using a Single Token One of our security mandates require authentication between servers when transmitting data. These API endpoints are only accessible within the internal network and are never exposed.

Our idea is to user a single token authentication scheme. We will have a token pair between the internal servers and with each request, the calling server will submit the token in the request header over HTTPS to the target server. The target server will authenticate the token to see if it matches and if does, it processes the request. If it doesn't, it logs the invalid connection attempt.

We feel implementing OAUTH 2.0 or similar would be overkill seeing as its internal, we control both servers, there is a small group of people with access and it will be over HTTPS.

Is this an acceptable solution? The token will be generated using a secure random function and stored on each server with access right locked down. The token won't expire as it's not meant for users but for the servers.

What's acceptable to you should depends on the value of whatever you are protecting, and the risks inherent in other aspects of the system.

In many cases, your suggestion may be perfectly reasonable, but in others it may be unacceptable. Risk may be represented by consequences of a breach, times it's probability.

So if you are handling very sensitive information, but there is a very low chance that someone would get ahold of that shared secret, because you have very rigorous controls over who could gain access to it... you may be ok. But if your controls over the system are pretty lax, the probability would be higher and may be unacceptable. You could address that either with a different authentication scheme, or by reducing the chances that someone would get that token.

Some further suggestions to mitigate risks surrounding this type of authenticator:

Make the shared secret a setting, not a hard-coded string
Don't check it into source control
Make it easy to change in case of a breach (possibly have a grace period where two tokens are valid so that you can roll over without interruption)
Ensure the place where the secret is stored has correct file permissions locally, or you may use a service like Azure KeyVault Secrets so that the machine only ever has it in memory
Use a cryptographic scheme like HMAC to sign some detail of the request parameters, so that the actual secret is never passed over the connection. Azure Storage Accounts and S3 both work this way.
Also in the crypto camp, you could use TOTP, which combines a shared secret with a time-based hash; each token transmitted over the wire would be valid for a very short time, but the secret would never change
Pair the token with the IP address of the server that is allowed to use it, thus limiting it's use to the server it belongs to


Need help on understanding obfuscated code in CVE-2012-4969 exploit As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code.
Is it necessary to use obfuscation and why the obfucation was used  by the attacker? does attacker had specific reason to do this?
the part of exploit I mean is located at line 292 of http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ie_execcommand_uaf.rb

From what I can tell, the string YMjf\\u0c08\\u0c0cKDogjsiIejengNEkoPDjfiJDIWUAzdfghjAAuUFGGBSIPPPUDFJKSOQJGH in question is interesting. However, the use of \u0c08\u0c0c is the value of EDI after during the use after free. As for the rest of the string, it just looks like that is what was used in another person's 0-day before it was translated.

Some information was adapted from http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day_en/


How can I hide my logged in sessions from other websites? Most people go on browsing the web while connected to their facebook/gmail/etc. accounts. Other websites somehow know what accounts you're logged in.

For example, if you go to hide.me's torrent page, it will tell you what logins of yours were detected, even though you never (explicitly) approved this website to access your account.

I know that switching to "private browsing" and/or using extensions such as Ghostery help in some ways, but is there a more straighforward way to block this?

I think what you are noticing is a client-side acknowledgement of your sessions with Facebook, Gmail, etc. If a sharing script originates from facebook.com and you have an active session with that hostname, they will present a streamlined share button (for example) for your account. The website linking you to the script on Facebook cannot see who you are according to Facebook, or according to any hostnames that they do not control, if you do not explicitly authorize them to access that information.

In other words: if your browser currently holds a session cookie for facebook.com, then you will be able to use account-specific features of that script. It's meant as a matter of convenience, although it would give Facebook a pretty good ledger of where you've been and what you're up to (but no more than Google's tracking cookies). You can at least go incognito in Chrome or Firefox if you want to avoid leaks like that while working through a secure proxy.

Edit:

In the case of hide.me, they are doing about the most a host in their position possibly can in order to scare prospective customers into thinking they know more than they do. For instance, here's how they determine whether or not you are logged in to Facebook and Google+. In the case of Google+, they just add a new img element to the DOM and listen on a "loaded" event from the element—that is, they are literally just checking whether or not your browser is able to load an image that isn't available to non-users.


Is it safe for both client and server to use the same keypair in CurveZMQ? I make software for physics labs, and computers in the labs are exchanging all sorts of information with each other and with researcher's laptops, usually on a university network. I use ZeroMQ for most communication.

I'm working on using ZeroMQ's built in encryption to secure this communication in an upcoming version of my software.

ZMQ's security model is public key crypto based on CurveCP, and I'm following their "ironhouse" example with both clients and servers verifying each other's identity via each other's pubic keys.

The thing is though, that I don't really have well defined "clients" and "servers", the computers involved are more like 'peers'. And they can come and go at short notice, and it is not practical to distribute a new public key to every computer that a new person's laptop might want to talk to, or to distribute a new public key whenever a new raspberry pi that is set up to monitor some piece of equipment. Automating key distribution via some server and ssh is also something I can't really expect of the average physics lab.

But I think "here, copy this base64 string to your config file on every computer you want to be able to talk to each other, and treat it like the lab computer password" is a reasonable expectation.

To that end,  can I give all peers the same private/public keypair, and treat that keypair (or at least the private key) as a preshared secret? Everyone having the same keys doesn't seem much different to everyone having the login password to the lab computers (which are also all the same usually), so long as the crypto doesn't require that two peers have different keys. Of course it's broken if someone leaks the keys, but that's no different to the lab computer passwords being compromised given that that gives everyone on the network RDP access - you have to change the keys and tell everyone in either case.

I don't have to have a single keypair - it's just slightly simpler. I could have two keypairs, and have each peer decide which to use based on which calls bind()in zeromq and which calls connect() - the difference is arbitrary in zeromq but is an already broken symmetry that could allow me to define by convention which peer uses the 'client' keypair and which uses the 'server' keypair. In either case I'd be distributing the same private keys to everyone, the only question is whether I distribute one or two.

I would have used symmetric crypto with a preshared key if it were an option in ZeroMQ, but it's not, and inserting symmetric crypto at the application level means some of the info ZeroMQ sends would not be encrypted (it prepends routing information and that sort of thing) and would also leave the applications vulnerable to replay attacks, since some ZeroMQ sockets are one-way and it doesn't give you access to the underlying TCP socket, so you can't do any sort of handshake to make the symmetric crypto use a per-session salt or whatever.

So, tl;dr is ot OK for peers to use identical keypairs in CurveZMQ?

The question you should ask yourself is: what are you trying to protect?

If you distribute your key between all peers and if proper key distribution is "too complex" for your use case, then you might as well disable encryption altogether: your keys ain't safe and so your messages ain't either. Even if you enable FS, you will not protect your system against MITM attacks.

Perhaps a better direction to look into would be implementing a key distribution system: have a central CA server allow for automatic client enrollment using whatever authentication mechanism you deem sufficient for your needs and simply have everyone trust keys issued by this CA. That would keep peer-to-peer communication secure while allowing you to scale it pretty much indefinitely.


Windows 10's (Windows Defender Application guard) VS Browser Sandboxing Microsoft has introduced a new feature called  "Windows Defender Application Guard"

The video from Microsoft explained that (WDAG) allows the user to isolate the code running within one page in what is called "Container" that is based on Hyper-V.

My question is, how is that different from normal sandboxing discussed in Wikipedia

  JavaScript and the DOM provide the potential for malicious authors to
  deliver scripts to run on a client computer via the web. Browser
  authors contain this risk using two restrictions. First, scripts run
  in a sandbox in which they can only perform web-related actions, not
  general-purpose programming tasks like creating files.

Which supposed to also Isolate the code running in a page?

This type of scheme protects against other web-based threats besides JS sandboxing. JS sandboxing is mainly about securing the tab from other tabs, it's not so much about protecting the computer, even though that's a side-effect when done right.

If you look at actual breaches, it's been a long time since a browser sandbox issues hurt users. It's what happens outside of the JS sandbox that burns them: flash exploits, PDFs, word macros, jscript shell, etc. By tying all those browser "helpers" into a separate container instead of the full OS, the attack surface is minimized. Other browsers just try to make sure it never even gets to that point. Maybe MS is unsure about locking down IE/dredge, so they lock down the space around it as well. Probably can't hurt at any rate.

It's somewhat akin to booting off a DVD so that bad things from the net can't hose the hard-drive's OS.


Do ISP’s in America keep IP assignment logs forever? I read that the majority of ISP’s keep theirs for at least 180 days. However, does anyone know how long charter spectrum keeps theirs?
Do ISP’s retain their logs forever even if they are using a DHCP protocol?
And why do some major ISP’s delete their logs at all? Is it to save on money or do they not want to be held liable?

Residential service IPs are often rotated so logs are instrumental in matching a time of use with a person.  There seems to be no legislation on how long logs need to be kept and most providers keep IP logs for 6-18 months.  None keep them forever as it is a liability and takes effort to do that beyond what's useful.  It is both about saving internal operational costs and having to cooperate with law enforcement.
Spectrum is Charter Communications.  In December 2017 information published on the Charter website indicated they keep 12 months of logs, however this information is no longer available on the Spectrum site.  Spectrum site IP information request page does not indicate how long logs are kept.
https://www.spectrum.com/policies/lea.html


ROP Exploitation on ARM I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.

Are there any tools, such as mona.py for x86, for ARM? Which would generate me long chains of gadgets.

Also, if there are any resource available online on it (ROP on ARM, or simply ROP, except the corelan one), do point me to that.

You should look at the BlackHat talk ARM Exploitation ROPmap.  In short you can find ROP gadgets with any assembler variant,  just the rules are a little different for ARM.

Before tools like mona we used objdump and grep!


Why do people warn of putting unknown USBs in your device People keep saying never put a random USB in your device because it could ruin it with a virus. Hackers are able to program USBs to automatically run a virus when it is put in a device. So I decided to search how to program a USB to auto run a file. It said to use autorun.inf so I tested out autorun.inf and found out that it no longer works because laptops are no longer always checking for batch files. So it seemed like the only method to do this was patched, yet we are still warned about using random USBs. So how do hackers program USBs to auto run a file.

A USB "thumb drive" could be a keyboard interface in disguise.  A popular tool called Rubber Ducky works like this:

"While it appears to be an innocuous USB thumb drive, when it is plugged into a computer, it instead registers itself as a USB keyboard on the system and fires off a keystroke payload at lightning speed." (Tutorial)

Most commonly an encoded PowerShell script is typed in and run, creating an implant on the system which will then call out to the attacker over the network.


Command injection Windows platform Let's say there's a site which is vulnerable to user's input.

For example users can ping a specified IP.

Since the site is vulnerable to Os command injection, a user as well as an IP address
he/she decides to add the following command:

;ls

So actually what he/she inserts is: 198.71.xxx.xx ;ls

; stands for separator to commands in the same line

ls means listing the content of a directory

Of course , what I wrote above is valid if and only if the underlying server operating system is Unix-like.

My question:
in case the Os is Windows (Windows Server 2003 or whatever even a more recent version)
what an attacker should write after the IP ?

Is dir the only thing or maybe another more dangerous command?

It's just for study purposes.

Thanks a lot

Well the most destructive thing I can think of is del /f /s /q c:\*, which deletes all files on the C drive.

A good way to gain further access is to chain a group of echo commands with append redirects (e.g. echo test >> c:\commands.txt) to write a set of FTP commands into a file, then run ftp -s:c:\commands.txt [host] to run those commands on the server and download an executable. We can then do a final request to run that executable.

In general a command injection is likely to be very dangerous, because it amounts to having the same privileges as the account that runs the vulnerable service. Worse, if you're running an XP-based OS, the task scheduler allows for easy privilege escalation to SYSTEM, via the at command.


Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how? The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF cookie isn't provided.

If s.proxies is commented out so that the program isn't being run via a proxy, it works just fine without error, and Instagram.com provides a CSRF token cookie.

So my question is: how does Instagram detect that I'm running the program from a proxy?  In other words, how does it differentiate between a normal request and a request running through a proxy?

import requesocks
import requests

s = requesocks.session()
# Tor uses the 9050 port as the default socks port
s.proxies = {'https': 'socks5://127.0.0.1:9050'}
url = 'https://www.instagram.com/accounts/web_create_ajax/'
s.get(url)
tok = s.cookies['csrftoken']

#Outputs:
#Traceback (most recent call last):
#File "tor.py", line 24, in <module>
#tok = s.cookies['csrftoken']
#KeyError: 'csrftoken

It's simple =) In no-proxy case you're tracing all the redirects yourself, so it's no problem to handle it. A proxy can be tricky as the proxy itself(not Tor case, but there are programs that behave a bit weird), so the proxy component for your language can be. Especially it happens frequently with HTTP and HTTPS proxies. Use a tcpdump - it will show you the problem. If you will see no csrf token in your proxy-to-your-code dump, then take a look, maybe it's a captcha page or something. If you actually see a csrf token in a dump, but not in your code - the proxy component is a problem for sure


Reading to Decide on a career switch I have a strategy consulting and sales background, but what I read about IT and IT Security sounds fascinating as an outsider. I'm considering a career switch, but would need to know quite a bit more.

IT Security is what interests me the most, but do I need to learning a programing language? If so which? Do I need to study for and pass certifications to be taken seriously? How does one learn more and take the first step.

Reading material (books, blogs, links, or even video) or comments are much appreciated. I'm not sure if it is the right switch for me, but I can tell you I'm interested, humble moving forward, and curious. Pen testing, encryption, & networks sound the sexiest but that is a far way off. Thank you for any help in advance.

Doing IT security properly implies grasping the fine details of how a computer operates; if you have that knowledge, then learning a programming language would be a matter of a few days at most. It is not, theoretically, strictly necessary to know any programming language to "do IT security", but potentially knowing them all is basically a requirement.

There is a lot more to software development than simply "knowing the language", and we are not talking here about being able to design a big application, structure it, implement it, and being able to understand the code three months later. We are simply talking about the ability to write a 100 lines of code in order to experiment something. Every decent IT security specialist ought to be able to do that.

(Conversely, I have met some IT security "specialist" who could not, and decency prevents me from expressing in accurate terms what I think of their competence.)

Specific programming language, generally speaking, does not matter. They are all more or less the same -- I mean the programming, not the language. Ideally, learn three or four languages; then you will know them all. Potentially. Which is the important point.

There are specific situations, though, which require a bit more programming knowledge. If doing pentesting on Web applications, you should have at least rudimentary knowledge of PHP, Javascript, SQL and C#/VB (for ASP.NET).

To be taken seriously, be competent. To be competent, spend time on it. Computers in general, IT security in particular, are a field where practitioners spend a lot of time trying out things at home, on their own computers.

Certifications are great when you want to be hired, because most people who will hire an IT security specialist are not IT security specialists themselves. For them, a certification is a kind of "proof of competence". In fact, a certification is a signal: it demonstrates that you were serious enough in your craft that you deemed it worth the effort to obtain the certification (learning the skills for the certification exam, spending the money on the certification, and, biggest effort of all, navigating the administrative task of actually obtaining the paper).

Don't become an IT security specialist if your idea of fun does not include spending five hours reading through log files and network transcripts.


How serious is the Borgaonkar/Hirschi attack on 3/4g cellular security At Blackhat yesterday Ravishankar Borgaonkar and Lucca Hirschi revealed an attack on the security protocols underlying current 3/4g networks.  Parts of the tech press are have indicated this could lead to a new generation of Stingray like devices able to attack phones using the newer protocols.

What exactly have the researchers managed to achieve, and is it as bad as the press are making it out?

First of all, from your own linked article -

  While this flaw doesn’t reportedly allow attackers to intercept calls or messages, it does enable them to monitor consumption patterns and track the phone location.

I.e. they can't see what you are sending or to who. But with several monitoring devices they could triangulate your phone location and know when you are on calls / sending messages. Its also worth noting that this attack tracks a counter managed by your phone. Before you could track a users device you would have to identify which counter is them.

There are also known flaws in 3G encryption - which I would view as more of a risk than this.

The main issue here is that to use this you only need passive monitoring equipment - so it is cheap. I'd argue if you're worried about a state actor you should also be questioning if you can trust your network provider.

So the real risk is stalkers and PI's - who will also usually have a better opportunity to identify which device is you. It is also easier for these parties to identify your device - A stalker can call you and watch for the device receiving a call at exactly that time and duration. The CIA is unlikely to risk doing the same thing with a suspect and tipping them off!


Extract AES key by comparing plaintext and encrypted data Is there a kind of analysis which would enable me to get AES key which was used for encrypting arbitrary data while I have both original and encrypted version of data ?

The problem is that the AES key is burned into coprocessor but I have an interface to tell it to encrypt supplied data (therefore I can generate as much sample plaintext and encrypted data for possible analysis as it would be required).

No.  This is known as a known-plaintext attack (or a chosen-plaintext attack if you are not only aware of but can select the plaintexts), and is a type of attack that AES is highly resistant to: there are no known attacks of either type that are faster than brute force.

If you've got access to the encryption coprocessor (and a good electronics lab), you may be able to perform side-channel attacks to recover the key, by analyzing the activity of the coprocessor as it performs encryption.


Can you make your host machine appear as a virtual machine? I keep seeing how people are working to make virtual machines look more like real machines, but I have been wondering about the reverse. I have noticed a trend where viruses will automatically shut off if they think that they are in a virtual machine. Using that train of thought, couldn't you attack this from both ends and make the virtual machine look more like the host and the host more like the guest?

Presumably you could, installing e.g. fake drivers that look like VirtualBox Guest Additions, or fabricating a PCI card that looks like virtio.
But malware authors check for these things because they are indicative of security researchers trying to sandbox the malware to reverse engineer it, or antivirus trying to sandbox the malware to test its behavior—but if their techniques no longer accurately detect VMs, or if they don't want to detect VMs anymore because valued infrastructure actually runs in them (e.g. cloud hosting), then they will no longer exit on these conditions.


"Premium SSL" vs "Stanard SSL" certificates - Any reason why I would want a "Premium SSL"? Possible Duplicate:
  What are the advantages of EV Certificate?

besides the green URL bar and free security scan and whatnot.

Our website does NOT accept any personal info other than email address and passwords.
So no banking compliance needed.

But our company business revolves around subscribers logging on for information they paid for.., (xls docs, etc).

Does anyone know of any other compliance reasons why anyone really needs a Premium SSL cert instead of the basic SSL package?  both are '40-bit minimum to 256-bit SSL encryption'.

From a security perspective, you don't get any additional capabilities from the Premium vs the Standard as long as the key lengths are the same.  The difference is simply the level of validation that the CA performs and thus gives the end user more confidence in your site being legit.


Do I have a current MITM? I apologise for to terseness of this question; I have an issue. Google.co.uk is failing its HSTS on my browsers.

Is this an issue with google.co.uk or is this just me? Is someone middle-manning my internet connection?
While I can find plenty of sites that tell me google.co.uk is working I haven't been able to establish if the HSTS issue is me or Google. I suspect it's me but would like some 3rd party confirmation.
P.S.: This appears so far just for google.co.uk, and unfortunately snuck.me doesn't seem to be working to clarify other sites' non-HSTS certificates either.

Update:
After ten minutes of being down, google.co.uk now works again, however by using snuck.me I find the following:

Fingerprint according to the browser:

D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43

finger print according to snuck.me:

42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

Does this confirm I have a MITM?

Your browser rejected a certificate, but this doesn't have to be caused by an attack.

  Google.co.uk is failing its HSTS on my browsers.

The warning you see doesn't indicate a problem with HSTS in particular. It's just Firefox saying: "The certificate appears invalid. And by the way, we won't let you add a manual exception because the site uses HSTS." 1

There are many plausible reasons why you got served an invalid certificate for a short amount of time. It could be a hickup at your ISP, a problem with your router, SSL interception by a captive portal (as mentioned by @FedericoPoloni) or, theoretically, a poor attempt at an MITM attack. The first step of investigation would be to check which certificate you were actually served.

Afterwards, you didn't correctly compare the certificates: You connected to www.google.co.uk but ran the third-party test against google.co.uk. These are technically different domains that serve different certificates depending on the indicated server name.

Here I'm testing each -servername with openssl and you should recognize both fingerprints:

$ openssl s_client -servername www.google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=D1:8F:DE:83:4A:68:88:32:DD:CF:C8:6B:0C:74:94:33:02:75:BC:43
$ openssl s_client -servername google.co.uk -connect www.google.co.uk:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
SHA1 Fingerprint=42:38:CE:6C:AA:C5:FE:13:A0:5A:56:88:F3:F2:E7:E4:D7:14:07:DA

1HSTS (HTTP Strict Transport Security) is a header which  web servers can send to indicate that clients should never connect to the site over plain HTTP (for a specified amount of time). Your browser picked up that header during one of your previous visits to www.google.co.uk or preloaded it. One of the header's side effects is that the UI wont't allow you to ignore certificate warnings anymore by adding an exception.


LUKS - Too large detached header size when large offset I find cryptsetup to have an inconsistent way of dealing with headers, I'm tempted to call it a bug
I would like to achieve a very large LUKS offset without resulting in a very bulky detached header
Here is what I've tried:

$ cryptsetup --version
cryptsetup 2.2.0

$ # First let's establish the default header size
$ cryptsetup --header header_default luksFormat /dev/sdc
$ stat -c '%s' header_default
16777216
$ # it is exactly 16 MiB

$ # I try now with offset zero
$ cryptsetup --header header_0 --offset 0 luksFormat /dev/sdc
$ stat -c '%s' header_0
16777216
$ # very good, all needed data is still stored in a 16 MiB header

$ # Let's see what happens with a very small offset of 1 MiB
$ cryptsetup --header header_1MiB --offset $((2**11)) luksFormat /dev/sdc
WARNING: keyslots area (1015808 bytes) is very small, available LUKS2 keyslot count is very limited.
$ stat -c '%s' header_1MiB
1048576
$ # header size is very small, matching exactly with offset given, but I got a warning
$ # I wish I could set any offset I like without resulting in a detached header with limitations

$ # Let's try again with a slightly larger offset of 4 MiB
$ cryptsetup --header header_4MiB --offset $((2**11*4)) luksFormat /dev/sdc
$ stat -c '%s' header_4MiB
4194304
$ # again header size matches exactly with offset given, cryptsetup exited with no error or warning
$ # it seems that a proper header can be achieved with a size smaller than the default one

$ # Now let's try with a very large offset
$ cryptsetup --header header_1GiB --offset $((2**21)) luksFormat /dev/sdc
$ stat -c '%s' header_1GiB
1073741824
$ # again header size matches exactly with offset given
$ # problem is the header file is too unreasonably bulky !

$ # Let's try something different
$ cryptsetup --header-backup-file header_1GiB_backup luksHeaderBackup header_1GiB
$ stat -c '%s' header_1GiB_backup
134250496
$ # header_1GiB_backup is slightly more than 128 MiB, precisely "$((2**15*4097))"

$ # Let's see what's the difference between header_1GiB and header_1GiB_backup
$ cmp header_1GiB header_1GiB_backup
cmp: EOF on header_1GiB_backup after byte 134250496, in line 523167
$ xxd -s $((134250496-16)) header_1GiB | head -n2
08007ff0: 9d3a e917 4327 f9e5 6dfb bdcb 3890 6168  .:..C'..m...8.ah
08008000: 0000 0000 0000 0000 0000 0000 0000 0000  ................
$ xxd -p -s 134250496 header_1GiB | { grep '[^0]' || echo 'only null bytes found'; }
only null bytes found
$ # As I suspected:  header_1GiB  =  header_1GiB_backup padded with zeros
$ # I've tried to 'luksHeaderBackup' other large headers, the resulting size is always the same: 134250496 bytes

$ # Are other headers padded with zeros? Let's have a look
$ tail -c 32 header_* | cat --show-nonprinting
==> header_0 <==
M-NM-^WM-PM-0M-LM-`M-^^BM-;M-,JM-+M-dM-:g1UM-/`M-"^Con<jD^F[^SJM-#*
==> header_1GiB <==
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
==> header_1GiB_backup <==
QM-^HM-^CM-^XM-i^_M-*GM-x~KM-i'M-^NM-^G]M-^]:M-i^WC'M-yM-emM-{M-=M-K8M-^Pah
==> header_1MiB <==
sM-KM-&=`~^FM-^PM-'M-G(AM-jM-_M-&l~>WM-^ZM-a^_M-^^M-qhs^R)M-2M-TM-eS
==> header_4MiB <==
~^@KM--F^U^[M-dM-_M-<M-;^FM-/M-^MM-'M-^\M-m?M-\dM-"M-^DM-sM-fEM-C^WeM-GTM-\M-^[
==> header_default <==
UM-_V
M-^^+M-z3M-^M-\M-*pM-jM-\M-^@"M-}|^OM-0M-6M-FM-DM-NM-b^ZM-!M-IM-^KM-^MR[
$ # Only 'header_1GiB' is padded with zeros, all others I believe are padded with random bytes

Default header size is 16 MiB and it seems to be more than enough for the purpose
System setups with large offsets should be facilitated with default size detached header
A default sized detached header should be also given for any offset smaller than 16 MiB, as it is the case for zero offset

# losetup --offset 1GiB /dev/loop0 /dev/sdc
# cryptsetup --header header_1GiB --offset $((2**21)) luksFormat /dev/loop0

Header size would be 16777216 bytes.
https://gitlab.com/cryptsetup/cryptsetup/-/issues/452


Storing password along with encrypted file I was making a small application to encrypt files and ran into the problem of verifying that the provided key is the correct one when decrypting. My idea was to store the (padded, encrypted) key along with the encrypted file so when you want to decrypt, the program first checks if the first couple of bytes (un-padded) equals the provided key. I'm no security expert and I can't see a problem with the approach but i still have a feeling that this would be a bad practice some how.

Is this approach OK from a security perspective? Is there perhaps already another solution to the initial problem?

While there's no obvious vulnerability here, a better option is simply to store a static string, rather than the key itself. If an attacker finds a side-channel attack which allows them to discover one block of plaintext, your approach would leak the passphrase and thus break the whole system, whereas the fixed text option would not.


Any way to prove that two devices are in the same physical space, for authentication? I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs.

This could be:

A digital ID and the authenticator
A consumer and a merchant
A digital key for a door, and a lock

Is there any way to prove that the devices are in the same location?

One way I was thinking of making this work, is to read environmental data (RF noise, bluetooth signal distance) and include this data in the verification channel.  Since the devices are somewhat near each other, this environmental data should be almost the same.

Question

If it makes sense to include environmental data to prove two devices are in the same location, what data should be used?
Since the environmental data will likely never be numerically identical, but very similar, how can this be included in an authentication protocol?  (this is the crypto aspect of the question)

There are schemes (1 and 2) that use environmental sensors like accelerators to generate a shared secret.

Two devices are shaken while held together. The specific time, pattern and magnitude of shaking should be unique to these two devices.

This data can be used to calculate a secret value only these two devices should know.


DRM - Make sure that a SDK is used by the client legally We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement.
Especially, the client could call SDK's public services and methods from its own source code.

For example, the agreements may require that the client may use the SDK only in ONE environment (in an application for example).

Thereupon, we would like to monitor the SDK to ensure that the client respects this constraint, and if he use the SDK in an environment he didn't buy the SDK for, we want to be able to block the access to the SDK, so he couldn't use it.

I do know that several companies implement such features for the frameworks and SDK they provide, but I couldn't find anything on the web on how to set up such a mechanism ...
We would like to use some standard solution, even it is a paid one, rather than building something from scratch ...

Thanx very much for anyone who could enlightens us !!!

Clarification/Update
Our SDK does not provide web services, it provides only local methods which client may call after installing the SDK.
Actually there is only one http-request-based method in the SDK.
It's the entry point of the SDK, a method which is called setUp() which takes essentially two parameters : client's username and password.
So foremost the client has to call this method, which check out his credentials through http request to our server. If the authentication succeed, then the client may use the SDK local methods, otherwise he cannot.

Edit
I just discovered the concept of API key, at first I thought it would be a potential solution for this problem, but it appears that it doesn't suit the context of the issue I'm trying to solve, thanx to @Matthew.
Now I'm wondering if a license enforcement would be a suitable solution ?? Actually I am thinking about the way Aspose team handles the licenses they give to their clients. Following to this link, they seems to manage DRM rather tightly ...
And one last thing, what is the difference between a license and a product key ? Knowing the advantages and drawbacks of each of these solutions might help me a lot for choosing the right security system for my API.

It's essentially a legal problem - you want to control what is running on a client's device, which means you'll need the co-operation of the client.

For a company providing a web based API (e.g. your SDK does some kind of interfacing with your web based service, possibly by implementing some encryption, or special transport method), this is down to monitoring the service, looking for unusual patterns. You could bill on a per request basis (don't care where the requests come from, but if they suddenly start using more, you get more money). You could look for changes in key elements being sent (if you're suddenly getting data reflecting both Windows and Linux hosts, you can be fairly sure the client is using two copies on different systems, and block one).

In your case, though, based on the question as it stands now, you have no interaction with the individual requests (you interact once, when they initialize the framework, but then allow use through some method). It's like your SDK is an image file which the client has been asked to only use in one place. If the client copies it, you don't know. If they run it on a different machine, you don't know. If they run multiple applications on a single machine all using it, you don't know.

So, what are your options?

Hardware dongle. Done properly, they restrict the use of software to a specific machine. This generally requires moving parts of your software into the dongle, else it becomes trivial to strip out any checking code from your software. This also doesn't prevent multiple applications on the same system from using the software - if it can legitimately be used from one, it's possible to copy the data being sent to the dongle from another.
Change your model to be web/network based. Now you can see what's going on, but you may limit the uses of your software. Depending on what it does, it might not be suited for the latency this would introduce, or there may be limitations on where your client's data can be sent (e.g. EU data to US servers can be problematic, at times).
Change your pricing model. Allow clients to use the software as much as they want, but charge more up-front. Make the software free, and charge on a support basis. Charge less, to encourage people to buy multiple copies if they use it in multiple places. These are all models that various companies use, to varying degrees of success.
Be really selective with clients. If you don't trust your clients to abide by your licensing terms, the only really sure way to prevent abuse is to only let people you do trust have access. Require third party "running software" audits on client networks, looking for abusive use of your code. I've never seen a company succeed on a large scale with this model, but it can apply to some specialist areas, such as sensitive control systems.

Some big companies have used some of these: Microsoft, for example, uses ongoing web based authentication - after an initial check, Windows/Office apps ping home every so often to see whether they have been deauthorised. Red Hat charge for the software (but you can get most of it for free), but they charge more for the support, and they check licensing details with support requests. There are some specialist software packages (especially in academic fields) where you only get access to them after attending training on how to use it, which is essentially a form of being selective with clients - the theory is that it cuts down on "trivial" questions from new users. NXP (a large semi-conductor company) offer dongles for some of their development tools, on the basis that not all users have network connectivity.

Depending on how your initialization code works, it's even possible that a really unscrupulous client could simply look at the return value from your servers, and provide that themselves - this would be the case if the method returned a true/false response when provided with a username/password combination, but also if it returned some fixed or predictable value (hash of the current time, or a pre-determined string).


Why did browser authors not make 127.0.0.1/localhost-hosted webpages skip the referrer? For a long time, I was so convinced that 127.0.0.1/localhost-hosted webpages, that is, with URLs such as:

http://127.0.0.1/MySecretControlPanel/sensitive.php?stuff=goes&here=dude

... did not send the "HTTP referrer" header when you click hyperlinks on them.

But they do! That is, unless you go out of your way and figure this out and proactively add a special header:

<meta name="referrer" content="no-referrer">

This means that, for the longest time, every damn site I visited by following a link in my control panel was seeing my private, sensitive URLs!

I clicked a ton of links. I have shortcuts in many cases which let me easily check things. All of those sites could see my URLs. Even though they were localhost-hosted.

Again, I was so sure that browser authors would have the basic sanity to skip the header for such websites. After all, they explicitly skip 127.0.0.1/localhost for proxies by default, so in my mind, this was a given. But it wasn't a given. It was not done at all.

Now, a bunch of sites in the world could in theory figure out exactly what I have looked at on their site (because the name of my application and thus the URL after the / is very unique), and they also have tons of sensitive "search query" kind of data which I inputted thinking that it would be private and secure, when in reality, the stupid damn browser (Firefox/Pale Moon) was just leaking that data to the world.

I just wonder why they made this decision. The entire concept of "referrers" is evil to begin with, at least if it includes more than the hostname. At least if they only saw "127.0.0.1", that would not be as bad.

And it doesn't help to tell me that I "should have checked". I know that I should've. Just like I will know that I "should've" done this and that thing after it's too late, but the point is that I never thought about testing it because it seemed like something that didn't even need to be tested.

Don't blame the browser authors, as they just follow the HTTP protocol. The specification of the Referer header in RFC 7231, 5.5.2 does acknowledge the privacy concerns, but it only forbids sending the URL of a secure HTTPS page over unsecured HTTP channel:

  The Referer field has the potential to reveal information about the
  request context or browsing history of the user, which is a privacy
  concern if the referring resource's identifier reveals personal
  information (such as an account name) or a resource that is supposed
  to be confidential (such as behind a firewall or internal to a secured
  service). Most general-purpose user agents do not send the Referer
  header field when the referring resource is a local "file" or "data"
  URI. A user agent MUST NOT send a Referer header field in an unsecured
  HTTP request if the referring page was received with a secure
  protocol. See Section 9.4 for additional security considerations.

You should not put sensitive data on the URL due to information exposure through query strings in url. The Referer header is not the only way to leak this information:

  Referer Header
  Web Logs
  Shared Systems
  Browser History
  Browser Cache
  Shoulder Surfing


different portscan tools give different results I have different results as of my open TCP ports. When using nmap -sS 127.0.0.1, I get some 5 usual open ports, but when using osx built-in tool as stroke, I get those 5 ports plus 5 extra ports. How can it come ?

first nmap -sS 127.0.0.1

Starting Nmap 6.25 ( http://nmap.org ) at 2013-07-03 12:00 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00012s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
80/tcp   open  http
88/tcp   open  kerberos-sec
548/tcp  open  afp
631/tcp  open  ipp
8888/tcp open  sun-answerbook

and ./stroke 127.0.0.1 0 6000 gives

Open TCP Port:  80          http
     Open TCP Port:     88          kerberos
     Open TCP Port:     548         afpovertcp
     Open TCP Port:     631         ipp
     Open TCP Port:     4370
     Open TCP Port:     4371
     Open TCP Port:     4380
     Open TCP Port:     4381
     Open TCP Port:     5037

My guess is that you aren't seeing those open ports is because of the default behavior of nmap to only scan the 1.000 most commonly used ports.

If you want to cover all ports you need to explicitly state that you want to scan all ports with the -p parameter. So say I want to scan from port 1 until 5037:

nmap -sS 127.0.0.1 -p1-5037

To view which process is running on what port:

sudo lsof -i -P | grep -i "listen"


How can I make sure that the incoming file is definitely of the expected file type? I have a program to check if incoming files are in an expected filetype, e.g. PDF. The program first takes a look at the magic number, and determines the file type out of that. The problem is that I still can inject malicious script-files (for example batch-files on windows) by simply putting the magic number in the beginning, which is later ignored in the command line when executing the file. Is there another way to make sure that the file is (in this example) a true pdf-file?

Ensuring a file is the right file type is challenging, and sometimes impossible.

When possible, use a strict file parser.

For a PDF file, use a pdf library or pdf parser to parse the file and reject the file if any parsing issues arise.  This can often have real compatibility consequences, since many PDF clients allow malformed PDF documents.

Save the file in a restricted location with restricted permissions

Be sure to save the file in a location that isn't processed by your web server. Ensure the extension is non executable by your webserver. Allow only read access to the file (explicitly deny execute privileges).

Understand what kinds of attacks are made possible by user uploaded files

In the case of a file being uploaded to a server, if non execute precautions are taken, then a malicious file getting past your file parser is mitigated. However, if the file is made available to other users, you may want to use antivirus or scan for known malicious signatures. This blacklist approach is a last resort, but it is a reasonable measure to take.


DNS MITM Remote Attack I guess this is not considered a true MITM attack since the attacker does not have to be between the server and client. My question is how it is possible to poison a DNS cache, and redirect traffic to your computer that is hosting a proxy that then forwards traffic to the actual web server? I wanted to simulate an such an attack by setting up BIND on my network but I'm not sure how to configure a proxy like paros to forward traffic to a specific web server. For example, I will run Apache on 192.168.1.2 which will host www.example.com on my LAN, BIND on 192.168.1.2, and Paros on 192.168.1.3. I will then use Kaminsky's improved birthday attack to poison the cache of the bind server which will redirect all queries of www.example.com (192.168.1.2) to 192.168.1.3 which runs Paros. I can do everything up to this point, but I don't know how to properly configure Paros to then forward traffic to the actual web server @ 192.168.1.2 whenever www.example.com is queried by another host on my network.

This is not exactly what you were asking for, and I'm not sure if it's close enough...
But you can look up DNS Rebinding, which effectively does something very similiar (perhaps a bit in reverse), in a very simple way.

From the linked wikipedia article:

  The attacker registers a domain (such as attacker.com) and delegates it to a DNS server he controls. The server is configured to respond with a very short time to live (TTL) record, preventing the response from being cached. When the victim browses to the malicious domain, the attacker's DNS server first responds with the IP address of a server hosting the malicious client-side code. For instance, he could point the victim's browser to a web site that contains malicious JavaScript or Flash.

  The malicious client-side code makes additional accesses to the original domain name (such as attacker.com). These are permitted by the same-origin policy. However, when the victim's browser runs the script it makes a new DNS request for the domain, and the attacker replies with a new IP address. For instance, he could reply with an internal IP address or the IP address of a target somewhere else on the internet.

Specifically to what you were asking, if a DNS server or client is not configured correctly, they may accept DNS responses, even if they did not originally send that request. In that case, it would be possible to send an arbitrary DNS record, that will be cached and saved by the DNS server.
I do not know how common this is anymore, as I'm pretty sure most common DNS packages prevent this by default.


How do I make safe login-emails? (GET/POST) Vision

I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the email address in the process).

This would be a form of passwordless authentication.

Problem

The problem I see with this approach, is that a link will send a GET request - but this GET request will change the state of the user session (activating it).

GET requests should (according to the HTTP-standard) never have side-effects. This is something browsers assume as well, which means they might prefetch GET requests to optimize performance/user experience.

Let's say you are using Gmail in the browser. Could it then happen that the browser will prefetch the link in the email?

It would be a huge security problem if simply opening the email was enough to be signed in to the site.

What I have considered

Using JavaScript on the landing page to send a POST request

My gut feeling tells me that, even though HTML/CSS/JavaScript from a link could be prefetched, none of this code (especially the JavaScript) will be run before the browser explicitly opens the link.

This should mean that if the user session is somehow activated using JavaScript (by sending a POST request to the backend), it should be safe to use a GET request to get to this page (as a link in the email).

Am I right by assuming this?

Is it bad practice to do it this way?

Using a HTML form in the email body

Another option would be to place a form in the email, which would allow for a POST request from the email directly.

It seems, however - that several email clients will block form submissions from within emails. Email clients that that allow form submissions tend to warn the user that the email is likely malicious. It seems this is not really a good solution.

So, first of all, links from email change state all the time. While non-idempotent GETs are a violation of the de jure standard, the de facto standard is that any browser or email system which doesn't allow users to make GET requests for things like email verification, password reset, and the various other services that use email-based passwordless login (such as Slack) is a browser or mail client that everybody will consider broken. Another common example is the "logout" link (which on many sites is just a GET to https://example.com/logout, without even any CSRF protection); while this is potentially a security risk, in practice it is extremely widely used and difficult to exploit as anything other than a prank.

WITH THAT SAID the standard way to handle this is safely is for the link in the email to contain a (strong random unique) token that takes the user to a landing page, and the landing page says, basically, "hey, you appear to be [username], click HERE to log in" along with a "Not [username]? Click HERE instead" link in smaller text underneath. The emailed link expires after either link on the landing page is clicked, or after a certain period of time has elapsed (usually no more than an hour), whichever comes sooner. Loading the landing page does not immediately expire the link, though, and the "links" on the landing page can safely be buttons on a HTML form that POSTs to your service, or JavaScript triggers. The "links" on the landing page should ideally have CSRF protection.

This has a few advantages:

No problem if the landing page is visited "ahead of time".
No way for an attacker to trick somebody into signing on by accident.
No state-changing GET requests needed (though the JS event could just trigger a navigation to an unpredictable "complete this login" page, if you don't care about that part of the spec).
Allows the user to cancel the login if they clicked the link by accident, or have multiple accounts and used the wrong one by accident.

It also has some disadvantages:

The user has to click an extra time. You can mitigate this by have a timeout that automatically logs the user in after a few seconds, if they don't click anything or close the page.
The token sent in the URL can potentially remain active for a period after being visited. This is a risk because URLs are sometimes logged in places where untrusted users might see, or are otherwise exposable. I don't think there's any mitigation for this (aside from having the lifetime be very short) other than making the link itself single-use, which both breaks "GETs should be idempotent" (not actually a big deal, as explained above) and "pre-fetching this URL should not break stuff" (see above).

Incidentally, webmail services and web-based chat systems and so on pretty much always rewrite links in received messages (try copying the actual link out of a Gmail message, for example; the status bar text is a lie). When you click the link, you get bounced through a redirect page in another tab, rather than it opening the destination in that other tab directly. This prevents things like the linked-to page using the window.opener property to mess with the webmail/chat page.


Ways to protect phone from hacking through a wifi network when travelling I'm planning on traveling to a resort in Mexico. The resort offers wifi, but I know someone who recently traveled to this resort and had their phone hacked via the wifi network. I would be wanting to use the wifi for browsing the web or playing games but am worried that, since I have my phone connected with my email and banking, that I might get hacked by using it. Is there a way to disconnect from these services and remove sensitive data from my phone prior to traveling? Or in general, any way to keep my phone safe while still enjoying wifi?

This problem is solved by using a VPN. Using a VPN, your data is not visible in plain-text to someone who is capturing the network traffic.

Depending on how "techie" you are, you have various options.

If you are not technology savvy, look for a VPN service. There are a lot out there, but product recommendation is out of the scope of stackexchange. Just be aware to not use any free provider.
If you are proficient with computers, you can create your own VPN server using a cloud provider (AWS for instance). A common software used in this case is OpenVPN. A good thing of AWS is that there is available a preconfigured virtual machine (AMI). Here you have a tutorial to set everything up.


Password hashing with salt. Where do you leave the salt? I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that:

The salt should be random.
The salt should not be reused.
Using hashing without salt makes it possible to use rainbow tables and dictionary attacks (using the top 10000 passwords, hashing
them, and finding matches).

I've seen alot of libraries that store the salt alongside the data. In some cases as a prefix for the hash i.e. (salt.Hash).

I'm confused as to where you should leave the salt. Storing the salt with the hash itself seems illogical. What if the attacker reads the salt from the field, hashes his dictionary with the salt and then finds a match. It seems as just one easy extra step.

Storing the salt together with the hash is fine. The salt is essentially public information. Many systems store it in a format like $hashAlgorithm$parameters$salt.hash.

  But isn't this insecure?

No, because the point of a salt is not to be secret. The point for the salt is to be random and unique. It should increase the work factor for the attacker, not prevent an attack completely. Let me demonstrate this:

Scenario 1

Your database contains 1,000,000 users, all just having their hashes stored in plain SHA-1. An attacker compromises it. Their possibilities are now:

Perform a lookup-attack, meaning that the attacker just looks up the hash in a database of pre-computed hashes.
Perform an attack with a rainbow-table, which is a variant of the above-mentioned attack.
Hash a well-known list of passwords themselves (e.g. rockyou.txt), exactly once.
Brute-force weak passwords, or password in a common scheme, like an uppercase character, followed by 8 lowercase characters and one digit.

Scenario 2

Your database contains 1,000,000 users, all just having their hashes stored in Argon2 with a unique, random salt. An attacker compromises it. Their possibilities are now:

Hash a well-known list of passwords themselves (e.g. rockyou.txt), 1,000,000 times.
Brute-force weak passwords, or password in a common scheme, like an uppercase character, followed by 8 lowercase characters and one digit - 1,000,000 times.

It's not possible to do a lookup-attack, because nobody would store the hashes to millions of password, with millions of possible salt combinations. It's also not possible to do a rainbow-table attack, because building the rainbow table for every user with their salt would take longer than to just computer each hash.

Furthermore, just by adding a salt, you changed the amount of work required from "Hash once, check everything" to "Hash every time". In our scenario with 1,000,000 users, you made the task of the attacker 1,000,000 times more difficult.


What is the difference between a penetration test and a vulnerability assessment? What is the difference between a penetration test and a vulnerability assessment?

Why would you choose one over the other?

What deliverables would you expect to receive and how would you rate the quality of them?

I'm sure I posted an answer to this previously, but my google-fu must be weak this morning. From my blog post on Penetration Taxonomy, we have a list of testing types that is gaining acceptance. Also, working with the Penetration Testing Execution Standard we hope to further develop this. This list should help explain how to choose one over another.

Deliverables are almost a separate issue - and should be defined by the need and the audience (eg for a governance body you would not expect the same detail as you would provide to a technical remediation team, but you would want to include business risk information). There is also a Reporting stream within PTES development to try and codify this area:

Discovery

The purpose of this stage is to identify systems within scope and the services in use. It is not intended to discover vulnerabilities, but version detection may highlight deprecated versions of software / firmware and thus indicate potential vulnerabilities.

Vulnerability Scan

Following the discovery stage this looks for known security issues by using automated tools to match conditions with known vulnerabilities. The reported risk level is set automatically by the tool with no manual verification or interpretation by the test vendor. This can be supplemented with credential based scanning that looks to remove some common false positives by using supplied credentials to authenticate with a service (such as local windows accounts).

Vulnerability Assessment

This uses discovery and vulnerability scanning to identify security vulnerabilities and places the findings into the context of the environment under test. An example would be removing common false positives from the report and deciding risk levels that should be applied to each report finding to improve business understanding and context.

Security Assessment

Builds upon Vulnerability Assessment by adding manual verification to confirm exposure, but does not include the exploitation of vulnerabilities to gain further access. Verification could be in the form of authorised access to a system to confirm system settings and involve examining logs, system responses, error messages, codes, etc. A Security Assessment is looking to gain a broad coverage of the systems under test but not the depth of exposure that a specific vulnerability could lead to.

Penetration Test

Penetration testing simulates an attack by a malicious party. Building on the previous stages and involves exploitation of found vulnerabilities to gain further access. Using this approach will result in an understanding of the ability of an attacker to gain access to confidential information, affect data integrity or availability of a service and the respective impact. Each test is approached using a consistent and complete methodology in a way that allows the tester to use their problem solving abilities, the output from a range of tools and their own knowledge of networking and systems to find vulnerabilities that would/ could not be identified by automated tools. This approach looks at the depth of attack as compared to the Security Assessment approach that looks at the broader coverage.

Security Audit

Driven by an Audit / Risk function to look at a specific control or compliance issue. Characterised by a narrow scope, this type of engagement could make use of any of the earlier approaches discussed (vulnerability assessment, security assessment, penetration test).

Security Review

Verification that industry or internal security standards have been applied to system components or product. This is typically completed through gap analysis and utilises build / code reviews or by reviewing design documents and architecture diagrams. This activity does not utilise any of the earlier approaches (Vulnerability Assessment, Security Assessment, Penetration Test, Security Audit)


Kali Linux: Run penetration test and generate report for particular site? I am new in Kali Linux and recently one of my jobs is to use Kali Linux to scan a newly developed site and see if there are any security issue.

And after going through some courses I found that, in Kali Linux there are a lot of tools that you can use to do scanning, but it seems that there is no a single tool, at least for a beginner, to just "Scan a website and generate a report".

Can it be done?

This is too broad question, but I'll mention some tools that I've found useful and easy to begin with:

Netsparker

Good tool that helps with testing SQL Injection and Cross-site Scripting. Check this image for a report example.
Nessus

Amazing tool due to its ease of use, installation and activation might be difficult, but it's a good tool to try. It can help you with scanning html5 and Ajax web applications, along with host scanning. Check this image for a report example.
W3af

Another good tool for testing web applications, it also can helps with HTTP basic and digest authentication testing. Not sure if there's a good report generating.

You can check this article for many other tools.


Subject verification of certificates Suppose H has taken C’s certificate and manually changed the subject information in C’s certificate from C to H. Would this modification be detected by A during the certificate verification process?

The data in the cert is hashed and the hash is sighed with C's private key. C's public key is in the cert. All of this is hashed and signed by a CA's key. Changing the subject changes the hash, the new cert is bad without even verifying the first signature.


How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)? I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable.

Now I want to check my router, but I'm not sure how to test it.
Iif I modify /etc/resolv.conf to nameserver [my router's ip], then just execute client side PoC, it shows:

  CVE-2015-7547-client: getaddrinfo: Name or service not known

Does it mean my router is not vulnerable?

Testing if the router is vulnerably requires the ability to run (and usually also compile) some proof of concept code at the router and watching the output. How this can be done is described in GHOST bug: is there a simple way to test if my system is secure?.

But since there is usually no way to do this at most home routers (at least not for most users) you will probably not be able to test the router yourself. Instead you need to check with the vendor for more information like a statement that the router is not vulnerable or an updated firmware.


How does "Key Transparency" work? A few days ago, Google published Key Transparency to solve the problem of verifying the key fingerprints of e.g. your chat partners.

Unfortunately, I don't really understand how Key Transparency works.
Can someone explain it in simple words or with a nice example?

And will it make manual fingerprint comparison in real life obsolete?

Key Transparency makes it possible for users to know about all the public keys that are in the user's account, preventing the server from adding public keys to a user's account without detection.  Key Transparency does this by using piece of blockchain technology called a Merkle Tree.

When Bob wants to talk to Alice, he first asks the server for

Alice's latest public key
An inclusion proof of Alice's public key in the latest key-value database snapshot (Map Root)
An inclusion proof of the latest snapshot in a log of global state (Signed Log Root).

This proves to Bob that Alice's key has been publicly committed to and that Alice can see it.

When Alice audits her account she walks through the merkle tree to see all the public keys that have ever been in her account.  If there are any public keys that she does not recognize, she can remove them.

Manual fingerprint comparison still has value because it proves to Bob that Alice has indeed inspected her account for public keys she does not recognize. But for all those times that people don't check fingerprints, Key Transparency helps make sure that everything is still OK.


Protocol fuzzing of a java application I need to fuzz a communication between a client-server application written in Java. Already set up a MITM (burp), so I am able to see every request. The request body is a soap-xml document where some keys are exchanged.
I would like to fuzz the request header and the request body also, where the keys are placed. What would be the best choice? Is there any fuzzer which is suited more to request header or to the xml body fuzzing? Is there any preferred libary/fuzzer for fuzzing Java?

I would look at using the Intruder in Burp Suite.

Capture an initial request using the proxy, send it to the intruder then you can mark your fuzzing candidates including headers

Configure your list of payloads that would like to fuzz with and launch the attack

as you can see, we have replaced the headers and can see the responses


When logging out of a website is anything else required then destroying the session? In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.

session_start();
session_destroy();

Is there anything else that needs to be done?

EDIT: I reposted on Stackoverflow here but I'm still not fully understanding.

Basically I'm asking, you tell me, what needs to be done at logout? I know since I create a session using session_start() at login I need to call session_destroy(). Some SO pages say to call session_regenerate_id(true) and session_unset() too and I don't get why.

No, you shouldn't be doing this and not just for minimal performance gains. I realize what made you think it'd be a good practice, but let's analyze these two quotes from the PHP manual a bit more:

  session_start() creates a session or resumes the current one based
  on a session identifier passed via a GET or POST request, or passed
  via a cookie.

  session_destroy() destroys all of the data associated with the
  current session. It does not unset any of the global variables
  associated with the session, or unset the session cookie. To use the
  session variables again, session_start() has to be called.

OK, that's clear. You also mention in your post on SO that there's a chance that the user can directly navigate to this URI where you'll be running this code from. You really shouldn't be doing this and you should at the very least check user log-in data and the referrer string before starting the session and delete the session whenever user state changes. But let's say you didn't change your code and we can navigate to the URI in question. Now imagine this scenario:

I have access to one of your legit user's computers, his/her network, can access your web application through same IP, and can collect his/her client-side session data
I make a POST or GET request with no session data to your URI running this code
I manually add these session fragments (session cookie, user-agent string) that I have access to in my modified browser

Voila!

All of this is really easy to do and plenty of people with direct access to targeted user's computer would have the means and reasons to do such a thing, if they only had the knowledge to. And you're slightly lowering that bar.

Let's see what will happen.

session_start() will be called before the session was invalidated on your web server (which happens on session_destroy()), effectively creating a new user session. I can then replace my new session data with the old (stolen) one, and your web application will have (based on my user-end session data) no reasons to suspect I'm not the user the session was created for in the first place. It will resume as if I was the previous user I stole session data from.

So how does this differ to session hijacking when using session handling routines in their intended order?

In a long discussion with @Xander dissecting PHP session handling routines, we've come to the conclusion that it doesn't change much anything in that sense. However, you also gain nothing by doing it so, and might result in breaking functionality of any third-party user session framework, if your PHP application depends on in. Quoting your related SO question "I'm concerned that if a user directly navigates to this page there may be an error destroying the session" does expose another concern, that you're essentially enabling exploiter a look into your user-end session data structure for free, without any user authentication before creating it. Saying "But I'm deleting it immediately!" doesn't really apply in this sense, as session_destroy() "...does not unset any of the global variables associated with the session, or unset the session cookie." Saying it differently:

You just made session hijacking slightly easier, not the other way around!

TL;DR - So in short, you'll have to do it 'the boring, standard way' as that's in what order these two session changing routines were designed to run.