Facebook security algorithm: Locked out of my own account after resetting password I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude.

I logged out from all devices, and changed the password, so far so good.

But now I cannot login anymore from any device now because I'm asked to either:

Login from a list of RUSSIAN devices I never used
Ask my fake RUSSIAN friends for help (I never added any friend)
Identify photos of fake RUSSIAN friends I never added.

This occurs even after resetting the password via Email (I do have access to the Email account), but Facebook prioritizes the fact that someone has been using the account from Russia over the ownership of the Email account itself. Yes this is actually happening, it's not a joke.

Could Mark Z. be more idiotic than this? They managed to use my compromised password to login from Russia and start adding friends, they happily deleted my verification phone number, and now I cannot even login or delete the account after resetting my password successfully?

Note the Russian hacker never changed the password nor the email. It just deleted my phone number and it has been using the account almost everyday, logging in from supposedly "Samsung" and "Windows PC" devices from a supposed city identified as Perm, Russia. Is there some way to make Facebook aware about this idiocy? I know the account is probably lost forever now, but at least I'd like to delete it permanently.

The answer to the question, is there some way to report the issue, is yes! You can report the incident here:

https://www.facebook.com/hacked


CSRF protection and Single Page Apps I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.

Should I send a CSRF token when the app is first loaded then re use that token on every request? Should I have a mechanism to refresh the token? Are there other protections rather than a CSRF token that would make more sense for a single page app?

Well here is how I ended up implementing CSRF:

On the first request, sets a CSRF token as a cookie. Every subsequent AJAX requests include the CSRF token as a X-CSRF-Token HTTP header.

Django has some nice documentation on how to do this cleanly with jQuery: https://docs.djangoproject.com/en/dev/ref/contrib/csrf/

Edit: An alternative approach whitelists requests that contain the X-Requested-With header. It seems that's what Rails does. But as @damio pointed out below, the X-Requested-With is a security hazard, Django and Rails reverted back to not using it and forcing a token.


True or False: HSTS is absolutely useless against MITM attacks I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents.

Statement 1: If clients IO traffic goes through MITM from the start, can the attacker can just strip Strict-Transport-Security header, even from initial HTTPS connection?

I'm aware of the pre-defined HSTS lists that browsers are implementing. This measure does not cover all sites/browsers.

Statement 2: Attacker can pass Strict-Transport-Security: max-age=0 header at any time, and disable HSTS.

If both of these are true, or even number 2 alone, HSTS seems pretty useless. It can't be that easy, where am I wrong?

Statement 1: There should be no header for an attacker to strip since sending it over HTTP is useless. No idea why someone would send it over HTTP. And if the attacker has certificates that the client trust so a HTTPS connection will be established, then HTTPS won't bother the attacker.
A connection over HTTP is still vulnerable, HSTS won't change this. It will transparently switch from HTTP to HTTPS if a valid HSTS entry exists.

Statement 2: Again, a browsers should only act on HSTS headers sent over a HTTPS connection. If the attacker can send that header (s)he won't be bothered by HTTPS.

Anyway, Defense in Depth! Which is why I do not think that HSTS is useless. If you immediately upgrade every HTTP connection to an HTTPS connection using redirects your users can be vulnerable a lot over the course of a year!
Compare that to the initial connection when using HSTS and a browser that supports it!


What's the difference between "access aggregation" and "authorization creep"? I'm studying for the CISSP and am getting hung up on some terminology.  Specifically, I'm confused on the difference between access aggregation and authorization creep.

In both cases, it seems to me that an individual users are gaining more access to more systems. Is access aggregation considered acceptable but authorization creep isn't?

Not sure if this is correct specifically for CISSP, but where I work the terms mean the following:

Access Aggregation
Users gaining more access across more systems, this might be intentional as a result of something like the implementation of single sign on capabilities or unintentional where they are granted new access rights without considering the rights they already have.

Authorisation Creep
This is where theres a bit of overlap with access aggregation, its when users are given new, or more expansive, rights without having their old rights revoked.


Preventing a web-page from getting hit from another server A DDoS attack may result from a website attempting to access the resource of another website. For instance, example.com (attacker) is trying to access resources on example.net (victim).

The information which I have gathered till now is:

If example.com tries to access the resources on example.net by embedding the site in an <iframe>, example.net can mitigate it using the X-Frame-Options header.
If example.com tries to access the resources on example.net using XHR, example.net can mitigate it using the Access-Control-Allow-Origin header.

In the above cases, example.net is still being hit by example.com even though the content is not being served. Are there any W3 standards or mechanisms which can be used to prevent example.net from getting hit in first place?

Not sure what you're trying to ask, but I'll try to answer to the question I think that you might be asking.

As long as web technologies allow fetching resources from other domains this kind of DDoS attack is possible. Even if the remote server doesn't serve anything back, it must process the requests (eg. uses server resources). This kind of attack would require that malicious site has enough visitors to overwhelm the target server with traffic. This is basically like the slashdot effect, but happens w/o the user knowing that the browser is fetching stuff from the target site.


How bad would a partial hash leak be, realistically? Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(password + salt) method, with MD5, SHA-1 and SHA-256 being the most commonly used hash functions.

The SHA-1 hash of mySuperSecretPassword123 with the salt !8(L-_20hs is E5D0BEE0300BF17508CABA842084753685781907.

Assume an attacker would steal the salt and the first half of the hash, so E5D0BEE0300BF17508CA. We also assume that the attacker is aware that SHA-1 is being used and how the salt and the password are concatenated.

How difficult would it be for an attacker to recover the original password?

  1 bcrypt technically isn't a key derivation function, but for the purposes of this question it functions identically.

Actually, it's as bad as a full hash leak.

Hash-cracking is done by:

Generating password candidates
Hashing them
Comparing the resulting hashes to the hash you want to crack

None of those steps will be slower in case of a partial hash leak, so this is very similar to a full hash leak speed-wise.

Please note that if the partial hash output is not long enough, a lot of password candidates will match. In that scenario, you can't know which candidate was the real password.


Is it safe to enable SSLv2 ClientHello support? In the wake of the POODLE attack, many web sites have dropped support for SSLv3.  But some clients still in relatively common use as of May 2015 still initiate the handshake with an SSLv2 ClientHello message.  For example, openssl 0.9.8 which ships with Mac OS X 10.10, and Java 6 which is also still in common use at least on Mac OS X.

Oracle recommends that servers using the JSSE to terminate SSL keep the SSLv2Hello pseudo-protocol enabled, which in turn allows an SSLv2 ClientHello handshake, for backward compatibility with such clients.  (See table rows "Developers using JSSE APIs - Server").

Although clients using SSLv2 ClientHello are vulnerable to protocol downgrade attacks, this is also true of clients using later handshake versions as well, unless both the client and the server support TLS_FALLBACK_SCSV.  And as long as the server has disabled SSLv2 and SSLv3, the handshake cannot complete with a protocol lower than TLSv1.  And I suspect clients which support TLSv1.1 or later probably do not use SSLv2 ClientHello anyway, so this seems to me to be a reasonable configuration.

Are there any known attack vectors I have missed which would make it inadvisable to keep SSLv2 ClientHello support enabled?

In light of the recent DROWN vulnerability, it's now critical you disable SSLv2 protocols on any server that might give the attacker the possibility to do handshakes. It's now considered not only insecure, but highly critical since it can compromise other servers using the same certificate. More information here and here.

SSLv2Hello is secure against it, and can be used since it does not actually make complete handshake but rather negotiate the protocol on which to be made the handshake.


Risk when having public IP I need to access CCTV system in the office environment. So I ask network people to do necessary steps. They told me that they need my public IP.   I need to know if giving my public IP is a security risk or not. If there is a risk, how to avoid the risk?

If you're going to access to your CCTV system from your office, you have to configure it with a public IP address (available from any part of the world), and about security risks, it depends, if your camera is password protected the risk is lower, otherwise anyone with the public IP address can see the same images that you see, and your CCTV is could to end up like the ones in this Google dork: intitle:"Live View / – AXIS". If you expose some resource on the Internet, there will always be a risk.


Can you trust your computer devices to be safe to use if they have been in the hands of potential hackers? Suppose you lose the bag containing your laptop along with its accessories or while travelling the police confiscate all your computer devices, can you safely use all the devices again if you format all your devices and wipe all the data?

How far should you go at the software level? Would formatting the hard drive be enough or should you rewrite the BIOS also if it's editable for your laptop? And for other devices such as usb drives, external hdds, routers, and mouse? Can you use them again safely? Could they change the usb firmware for example?

And what about the hardware? Should you be worried about that? I have read laptops are hard to modify but I think you can still modify them. Modifications such as installing a keylogger.

So the question is, can these devices software and/or hardware be modified? If yes, then can you reverse the changes and how far should you go to be sure that the device is completely safe?

1) Laptop

2) External HDDs or SSDs

3) USB drive

4) Router

5) Mouse

Most people don't have the skills required or time to do more than format their HDDs. Is the answer that you can't be sure that your device is clean after an incident like this? I am sure many countries border police have got the resources to do whatever can be done with electronics.

What you are describing is called an Evil Maid attack.

The short answer is NO: you cannot trust them.

The long answer is MAYBE: depending on the hardware manufacturers of your devices you can verify the integrity of the data and the firmware of their components. However, I still not know any easy solution for all of them as a whole.

For the BIOS and internal HDDs/SSDs you can use a TPM with Anti Evil Maid, which lets you store a secret inside the TPM and only releases it if the BIOS and storage haven't been tampered with.

For the external storage you can always store checksums on other devices (or even on paper) and verify them later without mounting the drives.

When it comes to the firmware of USB devices, storage devices (internal or external) and mouse, there may be some vendors that allow downloading their firmware or dumping it easily from the device itself. However, in most cases it would have to be extracted from the memory chips and compare it to the previous one to verify its integrity. PS/2 mouses and keyboards present an interesting alternative from this point of view, but they are becoming rare history museum items nowadays.

Many home routers (and all of them should) allow downloading firmware binaries from their manufacturers' websites and flashing them again in recovery mode.

However, as most of the manufacturer's firmware is proprietary, one should ask the following question: can devices be trusted with their original firmware itself?


OpenSSL DH modp size If OpenSSL is configured to use a DH for key exchange, e.g. TLS_DHE_RSA_WITH_AES_128_CBC_SHA, where does it take the size for modp (or even modp itself) from?

The following is a screenshot from wireshark. The server selected TLS_DHE_RSA_WITH_AES_128_CBC_SHA from the client's proposals and sends its DH parameters.

Any ideas, why OpenSSL decides to use the (too) small 96 * 8 = 768 Bit group?

In SSL/TLS, the group (modulus and generator) used for DHE cipher suites is entirely up to the server. OpenSSL (the library) can be configured to use a specific group; with the command-line tool (openssl s_server), this is a matter of using the -dhparam option; otherwise, the DH parameters can be included in the file containing the certificate itself.

This page contains some information, including this:

  To use perfect forward secrecy cipher suites, you must set up Diffie-Hellman parameters (on the server side), or the PFS cipher suites will be silently ignored.

So the library does not use "default DH parameters"; it is up to whatever software uses the library. In the case of the command-line tool, it seems to use a 512-bit modulus, which is, to say the least, a bit short... but OK for test. In your case, one must assume that whatever is your server application which uses OpenSSL, it has configured the library with a 768-bit modulus. It is possible (but it depends on that application) that stuffing explicit DH parameters in the same file as the one containing the server's certificate suffices to force OpenSSL to uses these parameters.

Notes:

If OpenSSL, as a server, selects an "export" cipher suite then it will force use of a 512-bit modulus for DH, but this is an edge case.
You are not completely free to use any size you want because of interoperability issues. It seems that some SSL clients out there will not like a DH modulus longer than 1024 bits. I also surmise that a DH modulus size which is not a multiple of 32 or 64 may induce extra problems.
With Elliptic Curve DH (the recent ECDHE cipher suite) the problem is different, because most implementations support only a handful of specific curves, not "any curve of a given size". There is an extension which allows the client to tell which curves it supports; otherwise, the server will choose depending on its configuration (in any case, anything else than P-256 will imply interoperability issues).


Is PCI necessary as a SaaS provider when payments handled on third party site? We've been asked by one of our clients to complete a SAQ-D.  Even though PCI is not a law, we don't want to attest to something that shouldn't apply to us in the first place.

We're not sure compliance is necessary because all credit card transactions are handled on a third party website.  The information we have about the customer is nothing more than name, address and a little contact info (phone, email).

The customer logs in, puts products in their cart and clicks to checkout which sends them to a third party site where they put in their credit card information.  The only information that comes back to our servers is a transaction code used by our client to reference the payment in their off-site merchant area.

Do we have to do the SAQ-D or should we push back?

It sounds like you might qualify for the SAQ A. I would suggest going through the SAQ Instructions and letting it guide you on which SAQ to use. If your business takes credit cards payments, it is required to be PCI compliant. Just because you outsource the payments to another site does not mean you skip the SAQ entirely, but you might qualify for one that requires less demonstration (like SAQ A vs SAQ D).


What format is an decrypted RSA private key in, specifically in OS X Keychain? I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, after extracting through the tool.

The problem is, I can't figure out what format the key is in, to convert it to PEM/DER or any standard format.
After extraction, it looks like this:

[+] Private Key Record
 [-] PrintName: <name>
 [-] Label
<hexdump>
 [-] Key Class : CSSM_KEYCLASS_PRIVATE_KEY
 [-] Private : 0
 [-] Key Type : CSSM_ALGID_RSA
 [-] Key Size : 2048 bits
 [-] Effective Key Size : 2048 bits
 [-] Extracted : 0
 [-] CSSM Type : Core CSP (local space)
 [-] Key Name
<hexdump>
 [-] Decrypted Private Key
<hexdump>

Does anyone know what format this decrypted private key is in? And/or how to convert it to an OpenSSL-supported format?

I'm reading between the lines of the chainbreaker docs and your OP (having not tried the tool yet myself), and it seems like the private key should be fully present under "Decrypted Private Key" in raw hexadecimal format. The rest seems to just be a novel display format for the metadata.

Put simply, I believe you need to convert the raw hex key into base64 which is how we are used to seeing RSA keys in plaintext. This answer explains it fairly well:  https://www.reddit.com/r/crypto/comments/2hcd4z/converting_a_hexadecimal_private_key_into_a_pem/ckrgs8k/


How to Trust a Self-Signed Certificate According to Why are self signed certificates not trusted and is there a way to make them trusted?, to trust a self-signed certificate we need to import the root certificate into the trust store of the browser. Does that mean I must distribute to my clients a file, and is that the *.crt file, the *.csr, or the *.key file? What instructions should they follow to import that certificate correctly?

Does that mean I must distribute to my clients a file, and is that the *.crt file, the *.csr, or the *.key file?

You need to distribute the certificate, i.e. the *.crt file. The *.key file must be kept secret since this can be used to impersonate the certificate. It is only actually needed on the server.

  What instructions should they follow to import that certificate correctly?

There is no generic way to install a certificate. Details depend on OS and client (i.e. different browsers, apps ...).


Monero miner in ~/.info directory - a worm signature? On one of development machines, we've noticed high CPU usage caused by md process. A short inspection has lead to ~/.info/md process which turned out to be monero miner, started by crontab.

Unfortunately we've deleted it too eagerly, without inspecting, how it could get there.

It could be installed 'for fun' or as a part of some performance benchmark, or anything, but if it was a worm or virus, than we have a bigger problem for inspect.

Does the installation directory and the name of the process matches any known worm or virus? It looks like an attempt to hide the activity behind under the legitimate processs name (though on *nix all 2-character names are probably reserved for something legitimate).

The machine is running Ubuntu.

I've tried googling for 'monero worm .info md' but without any reasonable results, probably the whole phrase is not good searchable.

As others have stated, the miner is just the payload. If this is a web server you may want to look at the Apache or the web server access logs around the same time stamp as the creation date of the md file. It's possible they exploited a vulnerability or logged into an administrative page with a default password.  You could also check if syslog got SSH logins and see if any came in around same time or from unusual source IP as again maybe you have a default or weak password set.

If all you did was delete the miner you likely have other issues and the miner or other malware may come back since the attacker probably still has an entry point or has placed multiple backdoors on the system.

You could also run netstat -anop and look for odd network connections outbound as the attacker may have a reverse shell or another miner on the system.

You could also if it's a web server review all files in all web folders on the system looking webshells (odd webpages that attacker dropped in order to remotely execute commands).

Attackers don't just go away if you delete the payload so be in the look out for them to return or they may already be there.


Yahoo Security Breach Affecting 500,000,000+ Accounts: Why would they believe it was "state-sponsored"? It was recently disclosed that private information pertaining to over 500 million Yahoo accounts was stolen.

Yahoo's Chief Information Security Officer, Bob Lord, states that the information was stolen from Yahoo's computers by what Yahoo "believes is a state-sponsored actor".

First of all, what "state"?

Second of all, how would they know?

Bonus: Why does he use the word "actor"?

That Yahoo claims that the attack was state sponsored does not mean that it was state sponsored, or even that them themself believe it was. The reason for why they would claim this lies somewhere on a continium between two extremes:

Yahoo were completely incompetent and vulnerable. There is no way they are going to admit to the world that the thief was a 15 year old working from his mothers basement, so to make it look like it's not their fault they are portraying the attacker as extremely dangerous and competent, which is exactly what "state sponsored" implies.
Yahoo were in fact very competent, but the attackers used very advanced methods (0-days, computaionally expensive crypto cracking, etc) so it is in fact reasonable to believe that the attackers would need to be sponsored by someone with a lot of resources - i.e. a state - to be able to pull it off.

As Micheal mentions in his answer, Stuxnet was an example of #2. That time Comodo claimed they had been hacked by a foreign state but it was in fact a 21 year old Iranian student is an example of #1.

Where on this scale Yahoo falls is anybodys guess.

As to what state: In case of #1 no state at all. In case of #2, they would not have to know what state it was just to suspect that a state was involved. The key point here is that "state sponsored" is just code for "someone with loads of resources".


Setting up Windows laptops to require a smartcard for unlocking I am looking for details on how to secure a windows laptop using smart cards.

The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the internet.  Scheduling and payment applications run on the laptop.  The operator is often away from the vehicle when performing work at a customer's location.

To use the system, the operator should insert their smart card into the reader on the laptop.  This should unlock the laptop.
I want the application server to have client-side certificates which somehow are stored (or activated) using the smart card.
Thus if the vehicle/laptop get stolen or compromised the thief cannot access the server without the smart card.

Certainly we can deactivate the user account/revoke certificate after we discover the laptop has been stolen, but its the time in between where unauthorized access may be possible.

In an ideal world, I would love wireless (bluetooth?) smart cards, so the operator does not actually have to insert any card, just be close. (like this: Blackberry + RIM Bluetooth-based Smart Card Reader)

Assuming the laptops to run under Windows, you would need the following:

a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate;
to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of a PIN code);
to set a local policy which locks the laptop when the card is removed (that one is easy);
to activate certificate-based client authentication on the HTTPS server (see this if the server is IIS).

I have done all of this with that kind of cards; they come in several form factors, including as "USB keys" (actually USB-based smart card readers with an embedded smart card), which are convenient since all laptops have USB ports. The biggest cost is the PKI; not really the software, especially since there are free PKI (and you will want to have a look at this, by the way). 95% of PKI is procedures, i.e. people who spend some time doing things and checking that they did it right and auditing that other people did things right.


Ping Input box on web server vulnerable to piped commands? Scenario is this.

I have logged into a web server as admin through the Login page in browser. it has displayed me with a home page of sorts that has an input box with a button next to it saying "ping"

it essentially will ping any ip address that you input. (tested with local and external URL's)

I know for a fact the service running on the web server is running as root.

my question is this. can i put in an IP address and then pipe a command after it to elevate my privileges?

For Example... (excluding the actual ping command in actuality)

ping 192.168.0.1 | usermod -a -G <groupname> username

ping 192.168.0.1 | whoami

the command shell running the ping is running under root (99% sure of this) so in theory it should allow me to elevate a users privileges on the system? please correct me if i'm wrong.

thanks in advance

If the command shell is running as root and User supplied input is not properly validated then it will execute whatever command you will pass  to the shell. I think there will be proper validation of the inputs passed by the users. Like when a user will enter the IPv4 address then it will be combination of integers and dots and for IPv6 it will be integer and : . So when the user will pass the value then definitely it will be validated before passing it to shell using variable.


Why block IPs from which SSH login failed too often? I have an internet-facing Raspberry Pi on a private internet connection and the last time I set it up, I didn't bother installing a way of blocking IP addresses from which too many SSH login attempts failed from attempting SSH logins in the near future because I simply don't see the point of it.

All this resulted in is log entries looking like this:

2016-10-01 14:28:25 root        failed   119.249.54.88:56388
2016-10-01 14:28:26 root        failed   121.18.238.104:43921
2016-10-01 14:28:27 root        failed   119.249.54.88:56388
2016-10-01 14:28:28 root        failed   121.18.238.104:43921
2016-10-01 14:28:30 root        failed   119.249.54.88:56388
2016-10-01 14:28:30 root        failed   121.18.238.104:43921
2016-10-01 14:28:34 root        failed   121.18.238.104:41379
2016-10-01 14:28:35 root        failed   121.18.238.104:41379
2016-10-01 14:28:35 root        failed   119.249.54.88:60430
2016-10-01 14:28:37 root        failed   121.18.238.104:41379
2016-10-01 14:28:37 root        failed   119.249.54.88:60430
2016-10-01 14:28:41 root        failed   121.18.238.104:42230
2016-10-01 14:28:41 root        failed   119.249.54.88:60430

The log only shows login attempts via password since attempting to log in via public key authentication would be even more ridiculous. The vast majority of login attempts tries to log in as root which in the case of my raspi of course can't even log in at all. So far, no login attempts even guessed a valid user name (pi has been guessed quite often but it doesn't exist on my raspi), let alone one which even can log in via username and password.

Is there any security benefit of blocking such IP addresses for a few minutes? The chance of a system with only complex passwords (for the users which can log in via username and password) seems to be basically 0. Even with only an 8 character printable ASCII password (which would be pathetic, of course), the username guaranteed to be correct (since one should never assume a username to be a secret), and 100 login attempts per second (which my slow internet connection probably can't even handle), that's literally ~1 million years until expected success.

If I block these login attempts, all I'm realistically going to do is to tell the attackers to go attack someone else and maybe lock myself out for a few minutes if I get a password wrong too often (happened only once thus far and I set the time to block to something like 2 minutes so I only had to wait for a short period of time). I don't see why this would be advised. It just seems so unnecessary. Am I missing something?

This is a simple brute force attack, they pick a login and go trying every possible password, starting from the most common ones and such.

In your case they've been trying a user name that doesn't even exist, which leads you to question if there's even a point in blocking them, but consider the scenario where they do try a valid login.

Not blocking their IP would give them the opportunity to try out several millions, maybe billions of passwords per day, until they find the right one.

If you block their IP for several minutes every time they fail a number of attempts, however, will render their hopes of finding that password within a practical time completely futile. That server won't be hacked that way within a life time.

This also means they will most likely give up and stop flooding your server with silly login attempts.


Is there any research on which SSL certificate authority has the best browser compatibility We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of the security implications)

We obviously need SSL for this because it'll be embedded on SSL enabled websites so I'm looking for the SSL certificate authority with the best possible browser compatibility. I'm wondering if any research has been conducted on this subject that has real data to backup the claims. I hear a lot of people saying its very similar between the big players but I've never seen the data to back it up especially in our case where 0.01% comparability difference is a big deal.

Verisign was in the certificate business from literally the very beginning, and for that reason alone is your top contender for most widely accepted across all devices, versions, technologies, and usage cases. They currently control somewhere around 40% of the SSL certificate market (when you include their other assets like Thawte, according to wikipedia), so a device that does not trust Verisign certificates would be considered "broken" by consumer standards.


Is FAR (False Accept Rate) a property of algorithm or a property of the system? As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance

  False match rate (FMR, also called FAR = False Accept Rate): the
  probability that the system incorrectly matches the input pattern to a
  non-matching template in the database. It measures the percent of
  invalid inputs that are incorrectly accepted. In case of similarity
  scale, if the person is an imposter in reality, but the matching score
  is higher than the threshold, then he is treated as genuine. This
  increases the FMR, which thus also depends upon the threshold value

For example we have case:

1000 users templates of faces in database
100 users-impostors which aren't in database trying to log the system, once every
FAR = 0.001 (0.1%)

Then how many false matches will there be?

1000 * 100 * 0.001 = 100 (some of users-impostors will be accepted with many templates in database, some no once)
100 * 0.001 = 0.1 (imposters will not be allowed into the system, only 10% that one impostor may still be accepted to the system)

Or the same question in other words, what specifically is FAR (False Accept Rate):

Is FAR a false match of one attempt to compare with only one template in database? And it does not depend on the size of the database.
Or is FAR - if there is at least one match with any of the templates in database? And it depends on the size of the database.

First you should define whether your system uses identification or authentication. Identification finds a biometric scan in a database (e.g. to find a criminal in a crowd), while authentication compares a biometric scan with a single database entry (e.g. to grant access after a user scanned his RFID card).

According to my CISSP guide, FAR is a property of the system and it is calculated on a single comparison.

Assuming that each impostor is only allowed one scan, if your biometric system is used for authorization then the average probability that one impostor enters is

100 impostors x 0.001% FAR x 1 database entry = 0.1% = 1 impostor every 1000 days

If your biometric system is used for identification as the sole access control system, then the average probability that an impostor enters is

100 impostors x 0.001% FAR x 1000 database entries = 100% = 1 impostor every day

Unless there are specific business needs, biometrics is better suited for authentication.


Protecting third-party credentials in a web database in light of weak passwords I need to store third party credentials in a database for a web application. The third party supports OAUTH and I plan on getting a long-lived token to allow my app to access the third party, but I would like to protect the OAUTH token stored in my database by encrypting it with the user's login password (using PBKDF2 or bcrypt).

Since users routinely pick very bad passwords, I am requiring two-factor authentication to my application using TOTP (RFC 6238).

Is there any way to incorporate the TOTP token into a scheme to encrypt the third-party OAUTH token?

This makes no sense.
There is an interesting basic difference between passwords and TOTP/HOTP.
TOTP is a symmetric algorithm. The server and the client share the same information. They share the OTP secret key, the synchronized time and the last timecounter to avoid replay.

In contrast the password authentication mechanism does not share information. The user knows the password, but the server does not know the password. It only knows the salted and maybe peppered hash of the password. I.e. the server does not have all necessary components to get to know, what the user knows - i.e. the password!

Again, in the case of TOTP the server has all information. The user does not have any additional information. This means if you want to use TOTP to encrypt something on the server, the server will also have all information to encrypt/decrypt this. And this means that the encrypted data and the encryption key (or the information you use to create the encryption key) are located on the server.

The question is, which threats you want to mitigate.

Mitigating the threat of sql injections and stealing the database can be faced by using an application level encryption key, that is not stored in the database. In this case this is even better than creating an encryption key from any TOTP material, which is probably also stored in the database, since the attacker would get the encrypted data and the information to create the encrpytion key when he stole the database.


Do the skills of a software developer transfer well into working in computer security or white hat hacking? I am conflicted. I want to become a software developer but I am also interested in the networking side of things… Is software development and network security 2 whole different beasts? If they are, could learning both become a whole “jack of all trades master of none” situation?

Should I specialize or could I be a software Dev with a "hacking" hobby.

As a developer of 15 years who has moved into a pen-test role,  I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure security background.

Firstly and foremostly you understand the developer mindset, this means that you probably understand why a developer chose a particular solution, and understand some of their thought processes.  As a developer you have a knowledge of their 'language' how they think and talk, and as such you should be able to communicate any security findings and recommendations in a manner that a developer can understand.

Secondly you probably have a much better programming base than many pen-testers, this will come in very useful for developing tools and apps to help out (really I've seen some of the hacked together tools, it's a wonder that they work at all ;)

Code Review... This is an obvious big winner, you just need to start looking for insecure patterns and insecure language idioms.

Your understanding of software development practices (agile, waterfall etc), can be quickly augmented with learning about BSIMM, SAMM, and SDL

Depending on your developer background you may have a good understanding of OS/networking innards.  I spent some time in the networking/OS world, which I found useful to inform other developers what the computer was really doing with their code.  Likewise if you have spent your time in the Web world, that's where your focus will likely be.

It's worth noting that you may feel that there are vast areas of knowledge that you are lacking, but there are no pen-testers who know it all.  You will bring your own knowledge and skills, and as long as you are prepared to learn and teach, it will be a very rewarding career move.  It also has the advantage of making your really hire-able in two fields.


How is it possible that hardware-encrypted flash devices are safe? I start with the fact that I understand how flash devices (pendrives) can be encrypted with software, for example Bitlocker. Simply, the encryption key is the password given during encryption and decryption by user, where the said software is something like proxy between man and the hardware.

How is this in the case of hardware-encrypted pendrives? E.g. this one.
Does one always require installation of drivers / software for such a device?
How can it be safe? Where is the encryption key stored? After all, it must be physically inside the device - in addition, unencrypted. So how can it be safe?

Can someone explain it?

How is this in the case of hardware-encrypted pendrives? E.g. this one. Does one always require installation of drivers / software for such a device?

Yep, generally devices like that require special drivers. The drivers will be included in the device, on a read-only but unencrypted partition. You'll note that the device you linked only works with pretty specific Windows and MacOS versions, all fairly new, even though a normal flashdrive will happily work on anything back to Windows 98 or so without installing any drivers at all.

In fact, all transparent (that is, you interact with the data using a normal file browser, and it's mounted in the normal file system) encryption requires a driver. BitLocker has a driver that is present in all supported versions of Windows, and if you encrypt a flashdrive with BitLocker, it reserves a tiny bit of unencrypted space to store the necessary driver for read-only access to the flashdrive on versions and editions of Windows that don't have BitLocker already. The driver doesn't necessarily need to be kernel-mode - on OSes with support for FUSE drivers, you can use those - but then, FUSE has its own kernel-mode driver already.

  How can it be safe? Where is the encryption key stored? After all, it must be physically inside the device - in addition, unencrypted. So how can it be safe?

Why in the world would the encryption key be stored in plain text anywhere?!? The actual data encryption key - the "master" key - is never stored in plain text anywhere except in the driver's ephemeral memory, and ideally for as short a time as possible there. The only way the master key is persistently stored is encrypted, and the key used to encrypt the master key is derived from the password (using a strong, slow password-hashing function). The password itself is of course also never stored anywhere, just like your password for a web site is never stored anywhere. The reason you encrypt ("wrap") the master key with the password-derived key, rather than simply deriving the master key from the password directly, is that it lets you change the password without needing to decrypt and re-encrypt all the data (you only need to re-encrypt the master key).

Here's a typical idea of what the process of unlocking an encrypted volume might look like:

You enter your password into the software.
The software runs your password through a strong hashing function to produce a password verifier value.
The software checks that the password verifier matches the one it has stored; if not, you entered the wrong password. The verifier is stored in plain text, but its only purpose is to check whether the user entered the right password; changing the verifier doesn't let you decrypt the data (in fact, it makes it harder).
The software notes that your password is correct (the verifier matches), so it runs the password through another password hashing algorithm (might be the same algorithm with a different salt, or another algorithm entirely).
The output of this second password hashing algorithm is treated as a symmetric key, and used to decrypt the master key. The decrypted master key is stored only in the software (typically a driver)'s RAM.
The software lets you access the data on the drive, transparently using the master key to encrypt and decrypt as you write and read.
You lock and/or eject the drive, and the software deletes the master key (and your password) from its memory.

The only things that are stored persistently are the the encrypted data, the encrypted master key, and the password verifier. The password verifier cannot be used to get the original password or to decrypt the master key. The master key cannot be used to decrypt the data while it is itself encrypted. The data is safe unless the attacker can get the password.

Note, of course, that things like keyloggers and such could still capture the password as you enter it. Also, the master key does need to be stored in the software's memory, so an attacker that is able to read the software's memory (either using their own highly-privileged software, or by physically reading the RAM chips) will also be able to decrypt the drive.


Is a web app vulnerable if it only uses session token in cookie to authenticate a user I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability.

The website i was testing was only using session tokens to authenticate a user, so my first question is, is it vulnerablity for a website to only check session tokens. I logged in on 2 accounts in 2 different browsers, attacker in firefox, victim in chrome, now from chrome i copied user's session token and in firfox i refreshed the url intercepted the request and replaced the session token of the attacker with victim, it logged me in victim's account could make changes in victim's account, now let me make this clear when i logout the session token expires so it was only working on active sessions, so is it a vulnerability to be able to login to someome's current active session with just a token, there were other tokens in the cookie but they were not doing anything, removing them made no difference. Now ignoring my rest of the points would you consider it a vulnerability on its own?
there was also no rate limit on how many times i could check session tokens, i checked 1000 wrong tokens and entered a right token at this the end and the response length changed so should i consider it a vulnerability that i could brute force live active sessions on a website
the length of the token was same, i tried it with different sessions, length was always same
Is it normal for a user to manipulate session token in requests  is it a vulnerability? I mean is related to idor vulnerability in anyway?

There were also xss vulnerabilities that could allow me to get session token of the victim but i wanna ignore that part for now i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

Also if it is a vulnerability what would you call it?

I would also appreciate if you recommend a source to understand it better

A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.

Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but you can also just steal their password or login from their PC. The session cookie doens't add any vulnerability.

  There were also xss vulnerabilities that could allow me to get session
  token of the victim

Now, that is a vunerabilty.

  i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

That's also not a bug or vunerability, but a feature. What if a user updates their browser during a session? Their user-agent would change, but you wouldn't want them to have to login again. You also should't bind sessions to IP-addresses as users can change IP at random, especially when not at home.


What is the difference between a HIDS/HIPS and an anti virus? I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS.

But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?

First, you talk about HIDS and HIPS.

The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything.
The 'P' stands for "Prevention". This means that when the protection system detects a possible security event, it will automatically try to block it.

Since an anti-virus main use is to actively block the access to files detected as malicious, then it would be nearer to an HIPS than and HIDS.

Are they the same thing? This is a good question, especially since Wikipedia states that "The lines become very blurred here, as many of the tools overlap in functionality."

Historically speaking: no. An anti-virus primary goal is to detect and block access to malicious files, while and HIPS solution has a broader goal: it may track changes on the file system (to detect changes not necessarily implying any malicious code, like an unexpected settings change for instance), analyze log filess (system and application logs), check the system components to detect any irregularities, and indeed also try to detect potential malware.

An HIPS solution may be either composed of several different software and the anti-virus be only of them, or one may go toward all-in-one solutions where a single tool will bundle all these functions.

The fact is that nowadays end-user's anti-virus are a bit more than simple anti-virus, over time they have accumulated a very large panel of features turning them more into security suites which can be indeed perceived as end-user's HIPS solutions.

So, my answer here is two folds:

A basic anti-virus, whose only goal is to detect and block access to malicious files, is only a part of an HIPS solution,
Current end-user's anti-virus go well over this, they are often renamed as security suites and are becoming end-user's HIPS solutions.


How can I send emails anonymously? How can I send email anonymously? We used to track email's IP and its location based upon the email headers, and there are many possible ways to track the email's id's which were sent by the anonymous service too. My query is it possible to send anonymous emails?

I wish to send the email which cant be tracked by others - using virtual machines may be one idea, but there were matter of high risks which can be tracked easily.

How can we send anonymous email?

Update: This answer is currently outdated. After having its servers raided by the FBI, TorMail no longer exists. I currently use CounterMail.

TorMail is the best* mailing service for anonymity. Why?

Absolutely no signup confirmation required (unlike GMail for example).
Accessed via the Tor network (Even the mail server doesn't know your IP).
Unlike other mailing services (Hotmail, GMail, Guerilla Mail, even Hushmail), TorMail doesn't have any info about you** to give to authorities even if forced by a court order.

*Some time ago I was very interested in this subject, I've looked into it a lot, and when I say "best" I mean among the ones I've looked into.

**They might have some information about you, like the signature provided by your browser, but not your IP. But they claim they don't keep any logs, and personally I trust them to some extent.


Best practice, who should be responisble for HTTPS configuration? I work for a consultancy that develops internal and intranet web applications. We do not own or manage any infrastructure but do install and support the applications. We've had a request asking us to take over configuration and management of HTTPS/SSL on a web server. Is there any reason why this would sit with the application developer as opposed to the IT Infrastructure team who would manage and administer the server?

As I understand it, the certificate would belong to the server and should ideally by managed by those who own the server, I'm not aware of any reason that the application would need to be aware of the certificate that would require the developers to own the configuration of the web server.

What is best practice for this? especially when developers are a 3rd party working on behalf of a client.

Edit: in this instance we are dealing with straightforward LOB CRUD applications, so I can't think of any special cases that would require the app itself to do anything unusual. Not that I want to discourage answers that may apply to others who may be in that situation!

One edge case where it might make sense to put responsibility for ssl certificates on the app/app developers:

If your app was reachable through multiple domain names, and these domain names were controlled by the app itself, then it would make sense for the app / app developers to set up a system to automatically extend the certificate to the new list of domains whenever a domain was added.

This might also be relevant for applications which allow users to create their own subdomains, (e.g. john.example.com and jane.example.com), but I think that in that case, what you'd usually do is get a wildcard certificate which would cover *.example.com, and in that case there'd be no need for the app / app developpers to take care of the certificate).

Other than that, I don't see a reason why a third-party consultant should take care of a client's ssl certificates. In fact, I'd see it as a disadvantage, since from a security viewpoint you'd add an additional point of failure - after all, if the consultant took care of getting a certificate for the client's server, he'd also have access to the private key, and this could be a liability for both the client and the consultant:

The client could never be sure of who had access to his encrypted communications with his clients, since he couldn't know whether the consultant who got the ssl certificate for him took all the necessary care to keep the private key secure, and in case there was a breach of privacy with financial (or public) consequences, the consultant might suddenly have to show that it wasn't his fault in order not to be held accountable.

So if I were you, I'd counsel the client against outsourcing certificate acquisition and deployment if at all possible (of course, if they don't have their own tech guys, then there's no way around it).


What is the "segment size" when using Cipher FeedBack (CFB) chaining mode? When using CFB chaining mode with AES, I see instructions that the "plaintext length (in bytes) must be a multiple of segment_size/8" (also mentioned here). What does that mean?

The segment size refers to how much plaintext is encrypted by the output of the AES encryption operation.

AES has input and output in 128-bit blocks, and CFB mode converts the block cipher into a stream cipher using an IV, outputting 128-bits of stream at a time.

In segmented modes, only a portion of that stream is used. For an 8-bit segment size, only the first 8-bits of stream are used to encrypt 8-bits of plaintext. The remaining 120-bits are not used. Those 8 ciphertext bits then become the last bits of the input block.

How the remaining 120-bits of input block are generated depends on the implementation. They may even be unchanged from the original IV. The common alternative is to left-shift the previous input block by the segment size, this is the method described in Wikipedia for CFB segmented encryption.

Segmented encryption is obviously not as efficient as using the entire output block. Doing this allows synchronization to occur when data of a certain size is lost.

The following diagram is extraced from NIST Special Publication 800-38a that describes the segmented encryption operation:


Can flash drive content leak to intenret? Per order from our Department of Computer Security:

  Staff should follow the Data Protection Law by not connecting a flash
  drive with personal data of clients to a computer with Windows OS that
  has access to internet, wired or Wi-Fi. That does not apply to
  computers with Linux or Mac OS.

Is this correct that this difference exists and data from hard drives or flash drives can leak to internet on Windows OS if such a computer has hidden malware software running on it? There is no such risk for UNIX systems due to different architecture?

That order is only partially effective:

Generally, attached storage - be it hard drives or thumb drives - can be exfiltrated.

Yet, this reads like „unplug the network, use flash drive, plug network back in“. And that won’t help generally; malware could just buffer the contents until there is internet available for exfiltration (and the Vault 7 papers show us that that is in fact happening).

Also, such malware can easily exist for Mac OS or Linux as well.

While this order and practice can reduce the risk, it does not mitigate it completely.


Python notebooks and sharing I'm a beginner when it comes to programming or servers. I installed Python (programming language) as well as Jupyter notebook as part of an online course project. After installation, I was simply following instructions and typed "jupyter notebook" in the command prompt.

The following text appeared in the command prompt:

> Writing notebook server cookie secret to (folder name)
> Serving notebooks from local directory: (folder name)
> ...

After this, my local folder contents appeared in a browser window. This seemed quite scary, as if everyone using the same application now had access to my hard drive.

Does anyone know if this is part of what the Jupyter notebook is supposed to do? And if it is not, why do they make it seem extremely suspicious? I mean come on, the application said "Serving notebooks from local directory" - even though I realize that a notebook is a Jupyter project type, it is still the most confusing output line I've ever read when running a computer program.

If you start the juypter notebook server it will generate an authorization token and a URL which uses this token. If you look further at the output you will see something like this:

[I 06:02:28.891 NotebookApp] The Jupyter Notebook is running at: http://localhost:8888/?token=e2b7d4eb14d22f46a7950ccb01aecaf303951cb6fbe87fa9

Everybody which knows this URL can connect to the notebook and is considered authorized. Thus, the URL or this token should be treated like a password.

  ...as if everyone using the same application now had access to my hard drive.

Everybody using the same application and the same authorization token has access to the local folder (not the whole hard drive). This is similar to for example sharing a folder within Windows and giving others the path and the password to it.

  ...  even though I realize that a notebook is a Jupyter project type

From within the Juypter notebook you have access to files inside the local directory too. This is for example needed to include local data into computations done inside your notebook.


How to set up a Virtual Machine for a Honeypot? On this thread, it's stated that it's probably a good idea to use a VM for your honeypot. I believe this is because;

Comparative data is easier when comparing 2 exact images.
Host/Network Security is probably easier
Quicker to clean up/set up additional pots.

Looking for a step by step process so any NEW researchers can get it the OS up and running by your answer. This will also be Part 1 of "How to setup a honeypot" series of questions.
How would you set up a VM for a honey pot?

When considering advice, such as it is better to use a VM to host a honeypot, I think it important to also consider what conditions may have changed since that advice became 'popular'. In this case for example, it would be important to be familiar with new threats, such as 'Crisis' see http://arstechnica.com/security/2012/08/crisis-espionage-malware-targets-virtual-machines/ , as this malware has the potential to undermine your analysis because it can even infect a non-running VM image, thereby compromising your 'known' good/clean base.

Tim


Elgamal algorithm PHP code I was wondering if there is a PHP implementation for Elgamal algorithm for website data security ?

I found that for EC, Diffie-Hellman but could not find any about elgamal.

Thanks in advance.

There are GnuPG bindings for PHP, and GnuPG implements the OpenPGP format, which is about the only standard format covering ElGamal encryption. In any case, you are warmly encouraged not to design your own crypto protocol, and instead rely on existing standards like OpenPGP (these things are harder to make correctly than what it seems at first glance).


Is there a way to forward ports through VPN? My ISP seems to have filtered all ports. I have found a few decent free VPN services with open ports. Is there a way to forward those open ports to my network address? Or is there any other free VPN services which do this out of the box?

Edit:
I'm trying to establish a meterpreter session with reverse tcp. I have forwarded the required ports on the router and have also added inbound firewall rules. Everything works perfectly fine on LAN. I wanted to see how it works on the WAN but my ISP doesn't seem to have any ports open at all. I want see if port forwarding is possible through free VPN services before changing my ISP.

There's definitively a way to forward ports with VPN, just not with any VPN service.

You have to rent a server, a cheap VPS box will do, and then set up a VPN between you and it with something like OpenVPN, set up to tunnel your traffic through the server.

Once that is done you can use iptables in the VPS to forward all the ports you want just like you would on a LAN.


Is there such thing as an OS "internal firewall" I was wondering if there is such thing as an OS "internal firewall". If it exists, it must be under a different name.

I am looking for a way to control which applications can talk to which other applications inside of a single computer.

I am not only asking about TCP/IP sockets, but also UNIX-domain sockets, pipes, and all other IPC mechanisms...

I have found this
http://www.tresys.com/innovation/papers/Securing-IPC-in-SELinux.pdf
But it is only about making channels unidirectional. It suggests that security for bidirectional channels has already been solved, but I cannot find more information.

Note that covert channels are another issue and not the subject of this question.

But it is only about making channels unidirectional. It suggests that security for bidirectional channels has already been solved, but I cannot find more information.

It suggests that a bi-directional channel is simply a pair of uni-directional channels.

By the way, they hardly "solve" the problem of uni-directional channels, due to the "back channels" described. Sure, the bandwidth of a back channel is low. But how much bandwidth do you need to steal critical data like an encryption key, passphrase or a private key? Answer: 128 bits for either of the first two, 2888 bits for an SSH-format ECDSA private key. Even if you can only transfer one bit per second (a very pessimal estimate), 2888 bits is less than an hour.


Generate X509 ERR_CERT_COMMON_NAME_INVALID I am trying to set up https server on python3, but I could not generate a certificate and a key properly.

That is the server code:

import http.server, ssl
server_address = ('localhost', 4443)
httpd = http.server.HTTPServer(server_address, http.server.SimpleHTTPRequestHandler)
httpd.socket = ssl.wrap_socket(httpd.socket,
                               server_side=True,
                               certfile='cert.pem',
                               keyfile='key.pem',
                               ssl_version=ssl.PROTOCOL_SSLv23)
httpd.serve_forever()

This is how I generate the certificate:

$ openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout key.pem

I set Common Name to mysite.com

Then I made a record in hosts file, so that I could resolve my host by name:

127.0.0.1 www.mysite.com
127.0.0.1 mysite.com

And import the certificate to the trusted root CA section in *.pem and *.crt formats

But chrome browser keeps showing an error

  "ERR_CERT_COMMON_NAME_INVALID", "Subject Alternative Name missing"

Is there something I missed or misunderstood?

Use SAN or a different browser.

The SubjectAlternativeName extension identified in the error dialog, abbreviated SAN and also called UCC = Unified Communication Certificate by Microsoft and some CAs, has been the officially preferred place to identify your server for about a decade, superseding the use of CommonName (CN) as done last century. A few months ago, Chrome (at version 58) began requiring SAN and rejecting CN-only; other browsers don't for now, but may well follow suit in the future.

Especially if you want to use one cert for both mysite.com and www.mysite.com definitely use SAN. SAN allows you to have one cert for both of these; CN does not. Even if you use a wildcard *.mysite.com in CN it matches www.mysite.com and multipedal.site.com but NOT site.com; there are numerous Qs on this issue (search for them).

See https://serverfault.com/questions/845766/generating-a-self-signed-cert-with-openssl-that-works-in-chrome-58
or https://serverfault.com/questions/880804/can-not-get-rid-of-neterr-cert-common-name-invalid-error-in-chrome-with-self

For more on the 'trick' of creating cert with SAN in OpenSSL without putting it in your config, see
Provide subjectAltName to openssl directly on command line
Followup to one-liner to create cert request with SAN


Hashing vs "One-way Encryption" When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of security.stackexchange.com exploration), I determined that having a user database with the salt in the DB is secure, as long as it's a per-user salt and a slow hashing algorithm.

The security expert said that if the DB was compromised, everything was compromised, which is true. He suggested "one way encryption", which...I don't really get. Isn't hashing, by definition, one way, whilst encryption, by definition, isn't?

If anyone could clear this up, that'd be great.

You are correct.  Hashing is not invertible and encryption is.  The security expert is talking through his hat.

The "pepper" that cpast is talking about is the key of a keyed hash.  In that case, there are three components in the input to the hash algorithm: the password, the salt, and the key.  If the database is compromised, the salt is compromised, but the key is not.  If the key is of non-trivial length, like 128 bits, recovering the password from hash and salt alone is probably not possible.  (Strictly speaking, it is an "intractable" problem.  One knows how to to it -- try all possible key values -- one just cannot do it in reasonable time.)


What steps can I take to identify what type of compromise of my computer has occured I got involved in a strange scenario today :-) . Some 'UDPAgent.exe' file/worm/virus was trying to access my collegue's system and the antivirum program was showing that this particular thing is coming from my ip though I had no idea aboutt he particular trojan/worm/virus.

Any ideas/guesses/helps in identifying the issue would be highly appreciated?

After Rory's reply, my questions would be:
1 - Anyone in the forum had seen such programs/scripts before?
2 - what investigation can I carry out on my computer when I suspect it is compromised?

Thanks Rory!

Alright, so I'm not going to outline an entire incident response procedure, but I will give you a place to start.

Download and run this tool.  It is basically an in-depth snapshot of running processes on your machine.  If you do have something running on your machine, 9.5 chances out of 10 it will come up in the hijackthis report.  Now I will also say that if you're new to this type of thing, the resulting report i fairly hard to process, but if you're on other forums talking about this, than they're going to want to see that report.

Also, i recommend that you take a look at the proposed answers to this question which outline some general steps that one can take to mitigate threats.  Like the responses there say, the only foolproof way to make sure you're not infected is to start from scratch;  Wipe the disk and start over.

One last comment, if you do happen to find out that you have x or y rootkit/malware you can then research for the tool that removes it best.  I know there have been a bunch of times where kaspersky rootkit removal tools have saved my rear-end.  But I must again caution that if you remove one entity it does not mean that you've solved your problem.  When you are able to remove malware you have no way to know if that's the initial attack, the result of a bigger issue, or the only case of malware on the machine.


is SSRF attack or vulnerability? I'm reading now about SSRF attacks, and many articles "SSRF is an attack" and others said "it's a vulnerability." Which is correct?

Let's begin by expanding the acronym: Server Side Request Forgery (SSFR).

It is nicely explained on this Acunetix page with detail (including vulnerable code and examples). They consider it an attack. OWASP also classifies it as an attack.

Now, the source of the confusion on whether something should be termed an attack or a vulnerability is that generally those go in pairs, and we talk about them very loosely. So we could both say:

Mallory performed a ssrf and dumped the password hashes.
There is a ssrf on this application that we need to fix

The first refers to a ssrf attack while the second to a ssrf vulnerability. This is common, you can swap SSRF with SQLi above and have the same result.¹ Actually, for every foo attack, you could refer to a corresponding foo vulnerability that would be defined as foo attack would work. The context disambiguates them on every case, so we go on doing that, even if it's not the most purist way to phrase it.

But simplifications aside, I would consider SSRF to be an attack. This is a Forgery, so it is actually an attack.

As described by OWASP:

  Attacks are the techniques that attackers use to exploit the vulnerabilities in applications. Attacks are often confused with vulnerabilities, so please try to be sure that the attack you are describing is something that an attacker would do, rather than a weakness in an application.

Even though we would talk about a SSRF vulnerability, strictly it is being vulnerable to a SSRF attack. The vulnerability itself would be a lack of validation. Of course, how exactly we categorize it will depend on the exact definitions we use for both attack and vulnerability.

According to CISSP a vulnerability is

  The absence or weakness of a safeguard in an asset that makes a threat potentially more likely to occur, or likely to occur more frequently.

ISO/IEC TS 17961 C Secure Coding Rules defines it a

  set of conditions that allows an attacker to violate an explicit or implicit security policy

MITRE says

  A "vulnerability" is a weakness in the computational logic (e.g., code) found in software and some hardware components (e.g., firmware) that, when exploited, results in a negative impact to confidentiality, integrity, OR availability.

We need some stretching to fit the “SSRF vulnerability” into these definitions, as it is not a weakness, but the consequence of the weakness: a SSRF attack would work.

Thus, SSRF is the name of an attack, not a vulnerability, and sensu stricto we should talk about being vulnerable to a SSRF attack, not having a SSRF vulnerability.

¹ In fact, we have an exact duplicate of this question but referring to XSS instead of SSRF: Is XSS a vulnerability or an attack?


Encrypt data, still able to do text search If I use rot13 crypto I still can do text search.
For example:

Query:           John
Encrypted Query: WBUA

Database Entries: John Smith => WBUA FZVGU
                  Jon Babe   => WBA ONOR

Result: WBUA matches WBUA FZVGU

Are there more secure crypto methods (for example with a secure key), with that I also can do textsearch?

Thanks

No, this is not possible with secure encryption. The reason is really simple.

What you do requires that you are able to create the cypher text ξ(λ) of a small piece of plain text λ and then can find that cypher text everywhere where λ occurs in a bigger piece of plain text Λ.

When people do crypto, they attempt to reach so-called protection goals. One of them usually is or from the ones in place it follows that an outside observer cannot figure out whether the same piece of text occurs twice in the same message or even whether 2 messages stem from the same plain text. Therefore, ξ(Λ) is not guaranteed to contain ξ(λ) and finding ξ(λ) in ξ(Λ) doesn't tell you anything because it can show up anywhere.


Use the server's key to digitally sign the HTML content it delivered? Is there any way to prove that a HTML page was delivered to my browser, and not modified in any way, after it was delivered over TLS?

I need to prove integrity, and authenticity of the sender, ideally by the server's public key.

Is there a tool for it?

I can only find information about the handshake methods, but not for the content delivering.

I want to end with a signed HTML page that can be verified with the server's public key

From what I'm understand, what you're trying to do is to verify, after you are sure that the page arrived from the network untouched (since it's TLS), that it has not be modified by any client-side malware.

Since it's a client-side malware, it's safe to presume it can change anything he wants on the client side, after the session is decrypted from the TLS layer. Then, there is no way for you to be sure the data is intact : even if you add a cryptographic signature, the malware could just change your server's public key in memory and resign the HTML, or simply bypass the signature check.


Which security features should a switch offer that firewall cannot? Are there any kind of security functions that typically must be provided by a switch, because these security features cannot be run on a firewall (which typically works on layer 3 = IP layer and above)?

I was thinking about some kind of ARP protection that it operates at layer 2, but I actually don't know whether any switch offers this kind of protection. What are some other security functionality in this category?

There are a number of security features that can only be implemented on layer two.

802.1X is used to authentificate hosts and to prevent unauthenticated hosts from becoming a part of your network. // As mentioned above you can also whitelist/blacklist devices based on their MAC but this is not as reliable as 802.1X because the MAC address of a device can be faked relatively easy.

VLANs can be used to switch different networks on a switch. This can be used to segment a network wich can increase the security when done correctly. VLANs can also be used in combination with 802.1X to isolate hosts when they violate a policy you want to enforce.

Port Security can be used to limit the devices that can be attached to a single port. This prevents the flooding of the CAM table of switches. This would otherwise cause the switch to downgrade to a HUB or a DoS.
Also Port Security can be used to prevent other attacks that operate on a higher layer but can only be prevented when you are able to include a lower layer. For example limiting DHCP to a specific physical port.

Spanning Tree is used to prevent networking loops. Loops are mostly created by accident but can also be used by intentionally to cause a DoS.

Storm Control is related to spanning tree and helps to supress traffic generated by a packet storm or even to shut down the ports that are affected.


What can be the risks of opening mdb files in windows using microsoft access? I have download file.mdb from internet. When I click to open it, firefox tells me that mdb is an executable file and can harm my computer! How can this file harm my computer and is it just for mdb files or excel and words

I do not think Firefox is telling you that ".mdb" files can harm your computer, but rather Microsoft Access is telling you this warning message.  A ".mdb" file is a MS Access 2007 and earlier type of Access database file.  Every file that is downloaded from the internet and opened by any MS Office application will give a warning when opening the file.

The reason being that, in many MS Office applications you can insert something called "macros" in an MS Office file.  Macros are short programs that are written usually in VB Script (Visual Basic), and their intended purpose is to do minute tasks.  Since malicious software can also be created from VB, it is possible for a macro in an MS Office file to be malicious code.

For a user that will be using the macros for themselves later, it would not be concern as they themselves were the original creators of the macros.  However, trouble comes when opening files from the internet, as the file may contain malicious macros that may infect the computer.  Thus, the reason why such warning messages come when opening MS Office files from the internet, with a MS Office application.


Bypass directory traversal filter in PHP? I have a legacy PHP app, which has code similar to this:

<?php

$doc = $_GET['doc'];

if (preg_match('#\.\./#', $doc)) {
  header("HTTP/1.1 403 Forbidden");
  die();
}

$content = file_get_contents("/home/example/src/docs/" . $doc);

echo $content;

The filter looks a little bit too simplistic to me. I have tried throwing all sorts of attacks at it and it seems to stop them. Can anyone think of a way to bypass this filter?

It is indeed way too simplistic. You can bypass it using a backslash character.
Example of a way to bypass it on my IIS server:
http://example.com/index.php?doc=..\/index.php

It checks for "../" while, in order to make it "safer", it should check for ".." or don't allow any dots at all and make sure it's only included in the extension of the file requested.


C++ standard library use in malware I was recently analyzing the sources of ZeuS, ZeroAccess, Carberp and other professional malware and there was one thing which I found weird:

The authors did not use the standard library std::-functions very frequently when they could have. I mean stuff like std::fstream / std::string / std::cout (for debugging).

My question is why? A lot of tasks could be accomplished easier if they would use these functions. I don't think efficiency was their concern since the speed boost wouldn't be worth the time spend.

Source example here

When writing a malware, you should make as few assumptions as possible on the libraries existing on the target (victim) machine. As the sources you show in comment are for Windows, all you can safely assume is that the functions for WINAPI calls will be available, because any additional dependency on redistributable bits for any C or C++ system may be present or not: many Window machines have no installed development tools, and they only have the libraries (DLL) that were required by other software.

That means that to be able to use functions from the C++ (or even C) library, the developper should statically link the used standard library resulting in a heavy application, when a malware should be tiny in order not to sched light on it because of its size.

That's a possible reason why the developpers of Zeus make an intensive usage of WINAPI calls and avoid calls to the C standard library, not speaking of the C++ one which would add a new layer and some overhead in size.


Can you trust driver download websites? I am looking for a driver and typed the hardware ID into google. I found information as well as sites that offer the driver.

I am hesitant to accept the offer since they are not the original source and I do not know their business model.

Is it secure to download drivers from such sites? Are there known secure and insecure sources?

While I don't know of any known good or known bad driver download sites such classification might change rapidly when known good sites get hacked or change their business model maybe after getting sold. This happened in other cases too, for example with trusted browser extensions.

Thus the safest choice is to get the drivers from the original source, i.e. the vendor. While there were hacks of vendor sites in the past it is still the safest choice because the vendor definitely has an interest in providing the user with the correct software while the business model of these 3rd party driver download sites is unclear. And of course use signed drivers only.


What are main differences between Source Code Analysis vs Static Application Security Testing(SAST)? Do these 2 terminologies refer to the same thing?
https://www.owasp.org/index.php/Source_Code_Analysis_Tools

http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis#.NET

Some of the tools overlap. Makes you wonder. If they are different can someone explain to me the differences.

Often, people use these interchangeably within the security industry.

The lists you are pointing to are referring to the same types of tools/assessment, with the addition that the second list is broader, including static analysis tools that are not targeted at security, such as those used to check for code quality issues.

Some types of SAST technically do not review source, but binaries, so it can be a little bit of a misnomer to call it SCA, in that situation.

I personally like the DAST, SAST, MAST nomenclature, because it delineates between the broad types of assessing applications for security issues: by running tests against a running application (dynamic analysis), by examining the code components or a model of them (static analysis), or by tool-assisted expert inspection and testing (manual analysis).


How can I make sure if my computer is infected and know if I have to nuke it from orbit? I am aware of this question: Help! My home PC has been infected by a virus! What do I do now? and would adhere to its answer if I had, as this question states, "determined beyond doubt that my home PC is infected by a virus".

However, I haven't determined this. Since I believe this can easily be a generic question, let me say what happened:

I followed an outlink from Wikipedia to a legitimate looking site
The legitimate site loaded however, after a few seconds, it changed to a clearly fake warning that my Firefox was out of date, prompting me to download & install a new version (which, in reality, was a suspicious file from Dropbox);
I left the site without installing the likely malware.

However, now, there are basically two possibilities; either the website got hacked or I have a browser redirect malware installed on my computer. I would assume the former, since I've already have seen legitmimate websites showing a piece of scareware, and this even once happened when I had followed a Wikipedia outlink, BUT... After seeing this fake Firefox download today I tried browsing that suspicious page, reasoning that nothing worse that has already happened may further happen... AND I never saw this scam again. This perplexes me, since all other legitimate-looking websites hacked to show scams were showing them consistently. On each visit. So either this particular website I visited today dealt with the problem minutes after I left it, or the scam is designed to never show itself to one person more than once, or... I have a browser redirect malware installed.

Maybe I shouldn't, but... Since I was unable to find this scam on this website again, I was browsing and working normally for a few hours hoping to spot any irregularities. I didn't spot any.

Since I believe it would be an exaggeration to nuke an entire system from orbit just because a website shows me a scam, how should I make sure that such extreme measures are or are not necessary? I've run a full scan with Windows Defender and no threats were found.

There is no reason to nuke it from orbit just because it showed you a scam once. If malware is capable of installing itself automatically (a drive-by infection), it would not be trying to trick you into downloading an executable. In general, if malware is to install through a browser vulnerability on its own, it will do so without making itself known. All you saw was malware so limited that it requires the user to execute it manually to do anything harmful.

So, why did you only see it once? There are several possibilities:

The malware came from an embedded advertisement, and the ads are on rotation.
The malicious download is only presented every n website visits to avoid suspicion.
The site was hacked, but no longer is. Compromise can be very brief.
As you say, it could simply be that it does not show the same person the scam twice.

The first two possibilities are the ones that I would suspect. Advertisements are almost always outsourced to ad companies, and some of these companies are less reputable (or less secure) than others. It is not uncommon to accidentally approve a malicious ad on a legitimate website. Scams or malicious code is also often served on a random basis. I know of one shock website which creates popups and does other benign (but highly annoying or offensive) activities, but every once in a while will serve actual malware. A site that is not consistent with its malice will last.

If it is browser redirect malware, you still don't need to nuke it from orbit. Browser malware is common and tends to be limited to controlling the browser. This malware, being unable to perform arbitrary actions on your computer, must resort to trying to trick the user into downloading real malware from their browser, because they trust their browser. If you do have redirect malware, reinstalling your browser to remove all settings and plugins is usually sufficient to remove it.


Include input data in key stretching? Follow-up to this question: Strong PHP hashing without salt.

Without entering into the details, using bcrypt without salt/pepper is a bit complex for my case, so I'm staying on a "plain loop" implementation.

In the "version 1" below, I'm simply hashing the sha512 repeatedly, whereas in "version 2" I include the input data in each iteration:

$data = $websiteDomain . $myChildSchool . $myPetName . $etc;

// version 1
$result = $data;
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $result, true);
}

// version 2
$result = '';
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $data . $result, true);
}

$result = str_replace(['/', '+', '='], '', base64_encode($result));
$result = substr($result, 0, $passwordLength);

Is "version 2" more secure?

I'm thinking about stuff like parallelization for "version 1", where the first hash would be normally computed, then the 999,999 remaining hashes of each candidate would be computed using some parallelized processing.

using bcrypt without salt/pepper is a bit complex for my case

Use bcrypt with the cost parameter specified for key stretching, examples in the official doc: http://php.net/manual/en/function.password-hash.php

password_hash("unsalted password", PASSWORD_BCRYPT, ["cost" => $cost]);

Is it more complex? I don't think so.

Side note: all PHP versions where password_hash is supported, have automatic salt generation enabled by default. If not using PHP7, you can specify your own (salt parameter in the array) but I don't see the point of doing so.


Password sent via email upon registration I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does).

They use pretty good passwords (12 characters long with uppercase and lowercase letters, numbers and symbols). Now, assuming that the passwords are secure enough, why would someone decide to use this approach versus the traditional one (letting the users decide their own passwords)?

The first thing that comes to my mind is that, by doing this, you avoid the use of weak passwords upon registration, thus increasing security, but then allowing the user to change the password would make all this useless.

The second thing I can think of is that you could avoid the risk of credentials sent in the clear during the registration process, if the website doesn't support HTTPS. But then again, if a website cares so much about the user's security, I assume that it probably has HTTPS support too.

Is there something I am forgetting?

And to make the question more suited to this website: do you think that creating strong random password and then emailing them to the users is a good idea?

First, its generally a bad idea to send permanent passwords for secure things via email, especially user generated passwords (which the user may share on other resources).  Your email is often automatically saved to disk if you use an email client, which is easily read by anyone with physical access to your computer if you don't encrypt your hard disk or ever leave the encrypted hard disk unlocked.  Also there are generally no guarantees in email that an eavesdropper isn't reading your email messages, e.g., if you check your mail via POP/IMAP without SSL or someone is scanning your email server-side, or while the email is routed between mail servers.  Granted a computer-generated password is being stored with your email may not be that much of a compromise, especially if the system allows someone with access to your email could reset the password.  (And if the site uses cookies to store login information you could read cookies off the hard disk just as easily as reading email off the hard disk).

Its nice that the process described above verifies that the email address is (initially) readable by the registering user.  This can also be done by requiring a registering user to click a link with a random token.  Granted temporary email services like 10minutemail.com can get around this, a user may be less likely to lie as they'll want to have the password in their records.

Another nice thing is that it sets a strong password by default.  Many people will not change defaults or if they do change the password, will use a similarly strong password.  Consider organ donation with countries opt-in/opt-out countries.  99% of Austrians are organ donors as the default is to be a donor (opt-out), and 12% of Germans are organ donors as the default is to not be a donor (opt-in).   This aspect of psychology is probably more of a factor in choosing the default for other security features like "this is a public computer (do not remember my login)", but for users who already save passwords in their browser this isn't particularly different.

The password change functionality ideally can attempt to check that the new password is sufficiently strong.  E.g., is not similar to passwords in a common password list, is not dictionary word, or a dictionary word followed by a 1 or 2 digit number or punctuation mark.  This could be a very annoying and more CPU intensive to make every registering user generate a strong password, but possibly less intensive if the check is only done on password change page (assuming some frustrated users give up).  Also, its better to have them frustrated at changing the password once they already have a working account versus before they have one.


Why can't we use POST method for all requests? It is known that sensitive information should not be transmitted in GET requests as GET requests will be cached and POST should be used.

Why can't we use POST method for all request and ignoring GET request?
What all difficulties/ barriers will be faced if we ignore GET method and start using POST exclusively?

HTTP has different verbs, which have different semantics:

GET : does not change anything server side, multiple GET with same parameters should get same response - typically get an account value
POST : can make changes server side, multiple POST with same parameters can lead to different results and responses - typically add an amount to an account
PUT : can make changes server side, multiple PUT with same parameters should lead to same result and response - typically set an account value

DELETE and HEAD also exists but I do not think that you want use them here.

As POST is not idempotent, major browser will warn you if you send twice the same POST request which is not desirable in GET use cases.

Anyway, headers in the HTTP request control where the response should be cached or not, so it is possible to ask caches to not keep responses to GET requests.

Finally, caching (in the sense of caching proxies) is not security related. If you do not want someone to eavesdrop your requests and reponses, you should not worry about caching but use HTTPS which ensures that everything is correctly encrypted.

Browser caching is a different question, because then can store the last URLs in their history cache. So sensitive information should not be send in the URL, unless you consistently clean the history when you close you browser, and close your browser when you have finished browsing a site. But sent in URL and sent in a GET request are different questions. HTTP basic authentication allow to pass the credentials in the HTTP headers of a GET request, which is safe. And login form authentication is an non idempotent request (the state after and before authentication is not the same) so it shall be a POST request per HTTP semantics.

TL/DR: The problem is not in GET vs POST request. The rules for confidentiality are:

always use HTTPS
never pass sensitive data in URL.


Brute Forcing LUKS Full Disk Encryption - Time? let's say we have encrypted our drive with AES 256 XTS and the following Hash:

SHA1 with ~500k Iterations and a 20+ password

SHA512 with ~250k Iterations and the same 20+ password.

Let's think of the best hardware and the fastest hardware out there. How long would it take to Brute Force the Hash or the password in both cases?

If that 20 character password is completely random and uses any of the 95 ASCII characters. Then you'd have 9520 (3.58×1039) possible passwords.
How many SHA1/SHA512 hashes can we do per second? Let's assume we have the following computer:
PC4: Ubuntu 14.04, 64 bit
Catalyst 14.9
8x AMD R9 290X
stock core clock
oclHashcat v1.31

SHA1    29976 Mh/s
SHA512  4576 Mh/s

Source: http://hashcat.net/oclhashcat/
So if you're using SHA1 with 500k iterations, you could try 59952 passwords per second.
With SHA512 and 250k iterations, you could try 18304 passwords per second.
SHA1: 9520 / 59952 = 9.98×1034 seconds = 1.89×1027 years.
SHA512: 9520 / 18304 = 19.59×1035 seconds = 6.21×1027 years.
Even if you had a billion of these machines with 8 video cards in them each, you wouldn't even come close.
If you use only 1 iteration and a 10 character random password:
SHA1: 9510 / 29976000000 = 2 billion seconds = 63.34 years
SHA512: 9510 / 4576000000 = 1.31×1010 = 414.9 years
So if you'd then attack that with a thousand of those machines (8000 video cards), you'd get it down to a manageable 23 days / 151 days.
A 20 character random password is about as difficult to bruteforce as a 128 bit AES key.
2128 roughly equals 9520. So impossible.
This is trying to bruteforce the key by going through the entire key space. You could also attack the hash function and try to calculate the preimage. This is however not applicable for disk encryption because the hash is not stored, it is generated on the fly and the output is used as the encryption key.


What are the tradeoffs in allowing logouts of other logged-in sessions? For instance, Gmail has allowed remote logout since 2008.  I think I have seen other sites that allow you to log out all other logged-in sessions.

What are the tradeoffs to consider in this session management strategy?

The feature is really useful from a security perspective as it allows users to easily notice if someone else is accessing the account. This is a really useful feature in the sort of attacks where the attacker would want to silently observe the account to obtain information without actually doing anything active which would draw attention to himself.

The biggest downside I can think of would be an attacker being able to perform a denial-of-service attack against currently logged in accounts. Of course this isn't much of a downside as the attacker could do far worst if he is able to access your account.


Advantage Mutual authentication over PSK I have a client - server setup with TLS communication.
I want to be sure of mutual authentication.

The safety that certificates can offer assumes that the private key that links to the certificate remains private. But isn't this the same as assuming a pre-shared key remains private? Because both the client and the server are programmed at my computer, can't the exchange of the key be done just as safe in advance?

So is using a certificate at both ends any safer then a Pre-shared key in this scenario?
And is there any other advantage that certificates can provide?

"Pre-shared key" is indeed a valid model, and simple, if you can pull it off. Asymmetric cryptography, with public and private keys, and certificates, was invented to solve the secret key distribution problem: in general, it is hard to ensure that all pairs of systems/people who must securely talk to each other actually share a secret value. In a client-server setup, where client and server are distinct machines, then a shared secret must necessarily have travelled from one machine to the other. Travelling secrets are "less secret". With asymmetric cryptography, only public values actually go over the wires; private keys can remain local through their complete life cycle, and that's usually a good idea.

Similarly, if client and server share the same secret value, then an attacker hijacking either machine learns the secret and can impersonate both. With asymmetric cryptography, an attacker who plunders the RAM or disk of the client can later on connect to the server and authenticate as a client, but cannot run a fake server which would fool the client.

These are reasons why a pre-shared key mechanism, though tempting (it is lighter on CPU, and involves none of the dreaded X.509/CA business), make in practice imply some weaknesses, depending on how the system is installed and maintained.

(Of course, in all of the above I suppose that you do not do anything stupid, such as having a shared "secret" between the server and 10000 clients; if 10000 clients know a "secret" then it no longer is a secret. Appropriate pre-shared key systems use a different key for each client-server pair. When the pre-shared key is a human-remembered secret, i.e. a password, then extra care must be employed, because passwords are weak; this can be managed with SRP.)