Ransomware note found - cannot find encrypted files I have a note on my machine which indicates that my machine has ransomware on it.  I've done a system restore of my machine back several weeks, and each time the files keep coming back.  My files are NOT encrypted, but I am still getting the note.

Any suggestions on how I could find what is causing this note?

Before restoring the system, make sure you delete those notes, then you can enable Auditing to track file changes on the folder(s) where you see those files recreated (open folder Properties->Security->Advanced->Auditing). All changes will be reported in the Security log. They will provide you with more information about the process which creates those files.

There are chances you might find the malicious process right in the log information. There is also the possibility to find an intermediary process instead (e.g. a cmd.exe which executes a script that copies files). In this case it would be best also to enable Process Tracking Auditing (this is done from Local/Group Security Policy) before those files are recreated (e.g. after system restore, boot into safe mode and enable the auditing), however this is not guaranteed to work in all cases, as it depends on how the malware gets executed when the system starts.

Last, but not least, you might need to consider the scenario in which the system snapshot you try to restore might be already infected.


Should the thumbprint be SHA2 in addition to the Signature Hash Algorithm? I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256).

Is this an acceptable configuration?

Should I recommend that the client update to SHA2 for a Thumbprint?

Would this cause some backward compatibility issues?

Computed field
I think that's a calculated value by the Windows GUI. And not actually inside the cert. Have a look at the cert itself using OpenSSL. (openssl x509 -in MYFILENAME.CER -noout -text)
Here's a blog that talks about this:

http://morgansimonsen.wordpress.com/2013/04/16/understanding-x-509-digital-certificate-thumbprints/

the thumbprint is a computed field, i.e. not a part of the certificate data itself.


Stop Rubber Ducky HID attack I have managed to stop most of the attack vectors using a varity of different group policies. The only one that I'm having issues with is when it uses the HID attack method.

Has anybody come up with a solution of how to stop it imitating a keyboard and getting let into the system?

Physical access to a USB port means you're pretty much screwed.

HID (ie, keyboard) emulation is only one thing that a USB device can do. It can also pretend to be an ethernet interface, or a modem, and offer "network access" to the PC. If the OS helpfully autoconfigures it, and decides to use it, then the device will be able to sniff the network traffic, spoof DNS queries, etc.

More details here.

Now, if you're only interested in stopping this and not the other attacks, you can stop it with software that will detect an excessive typing speed. That won't stop a slow rubber ducky of course. You could check the USB VID/PID of the keyboard, but a USB device can easily spoof these.

Really, USB is physical access, it's insecure.


The most secure external hard drives on the market Wondering what the most secure hard drives are on the market, as stuff like this points out that sometime the "encryption software" that comes bundled with external hard drives is probably insecure and it would be better to use something open source where you can check the code. Also I have just read here and there that this and that has this or that security flaw at the hardware level. Wondering if this is the case everywhere (obviously there are probably going to be unknowns at the hardware level), that all the external drives have one flaw or another, or if there are some drives out there with a good reputation for security. Trying to get a sense if it is worthwhile considering what drive you get or if it is pretty much pointless as all of them are insecure in one way or another. If it's purely opinion based well then I will assume that they are all insecure in one way or another lol, but hopefully there's one or two that are better than the rest.

Hardware encryption meeting the standards for FIPS 140-2 certification is validated by the National Institute of Standards and Technology (US Dept of Commerce).

These devices conform to some of the highest standards for physical and Cryptographic security. Reliance on purely a vendors trust is not needed if you verify the product is listed with NIST as validated.

One of the most common FIPS 140-2 devices used in industry is the Ironkey and has been arround for many years.


Why do people tell me not to use VLANs for security? I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and that host ports don't accept tagged frames (They are not "VLAN Aware"). I've also made sure that the trunk ports don't have a native VLAN. I've also enabled "Ingress Filtering". Furthermore, I've made sure that host ports are only members of a single VLAN, which is the same as the PVID of the respective port. The only ports which are members of multiple VLANs are the trunk ports.

Can someone please explain to me why the above isn't secure? I believe I've addressed the double tagging issue..

Update: Both switches are Hp Procurve 1800-24G

  This question was IT Security Question of the Week.
  Read the Apr 20, 2012 blog entry for more details or submit your own Question of the Week.

VLAN:s are not inherently insecure. I'm writing this from a service provider perspective, where VLANs are the technology used in 99% (statistics made up on the spot) of cases to segment different customers from each other. Residential customers from each other, residential customers from enterprise leased lines, enterprise VPNs from each other, you name it.

The VLAN hopping attacks that exist all depend on a few factors;

The switch speaks some kind of trunk protocol to you, allowing you to "register" for a different VLAN. This should never, ever occur on a customer port, or someone should get fired.
The port is a tagged port, and the switch isn't protected against double tagged packets. This is only an issue if you have customers on VLAN-tagged ports, which you shouldn't. Even then, it's only an issue if you allow untagged packets on trunk ports between switches which, again, you shouldn't.

The "packets travel on the same wire" reasoning is valid, if the attacker has access to the physical wire in question. If that's the case, you have a lot bigger problems than what VLANs can solve.

So, by all means use VLANs as a security measure, but make sure that you never, ever speak VLAN tags with the entities you want segmented from each other, and do keep track of which switch features are enabled on ports facing such entities.


What risk does commoditized dedicated SHA256 processors pose to IT Operations? With the advent of GPU-based computing, and now commoditized/dedicated SHA256 processors, what risk does this hardware pose to cryptography?

What security algorithms should be closely watched or upgraded?

Such hardware may make life more difficult for people who rely on PBKDF2 for password hashing. Password hashing functions are intentionally slow -- slow for the honest server and for the attacker alike. We want it to be as slow as is tolerable for the server which uses it, so that it becomes (hopefully) intolerably slow for the attacker.

The defendant's advantage in the password hashing game is the password complexity. The defendant wants a function which can be used to verify one password at a time, whereas the attacker must try millions or billions of them.

The attacker's advantages are:

Patience: the attacker can afford to spend two weeks cracking the password, while the defendant must verify a user's password within one second (users have no patience).
Money: the attacker's budget for hardware can exceed that of the defendant.
Parallelization: the attacker has many passwords to try and thus can fully benefit from hardware which can do parallel computations (e.g. clusters, GPU, or simply a bunch of PC momentarily "borrowed" from a University, in case the attacker is a bored student).
Specialization: the attacker can invest in specialized hardware (such as the ones you refer to) and thus get more hashing done per dollar invested than the defendant (because the defendant uses a server which must also do something useful besides verifying the passwords).

Specialized hardware which is good at SHA-256 is thus an advantage for the attacker, if the password hashing function uses SHA-256, of course. Some other password hashing functions (e.g. bcrypt and, even more so, scrypt) are more GPU-resilient and will offer a somewhat better protection, as long as nobody begins to mass-produce specialized bcrypt-cracking hardware, of course (e.g. the Virtex family of FPGA from Xilinx, which have embedded RAM blocks and can thus compute bcrypt quite efficiently). See this answer for a more detailed discussion.

Note that while SHA-256 specialized hardware makes it theoretically easier to attack SHA-256 upfront (building collisions, computing preimages...), the work factor for these attacks is still far away in the unfeasible zone. See this answer for some analysis.


Detecting Router (NAT) via port scan I am developing a simple port scanner using Python, Scapy, nmap module. I want to detect if the host which I apply the port scan is a router or not. How can I identify or guess if the host is a router?

You cannot detect a router using a port scan since not all routers expose ports. Routers are used for routing IP packets at Layer 3 of the OSI model and are used to bridge two different computer networks.

You can detect a router by doing what the traceroute command does.

Assuming you know what the IP address of the target router is then you would Send a ICMP Echo message with a TTL value of one to a destination IP that you suspect is on the other side of the network as the target router. If you get a ICMP Time Exceeded reply back from the IP of the target router, then you know it is a router. You might need to do this with some trial and error as you might not know the IP addresses on the other side of the router.

You can easily test this using the traceroute command against a target router then mimic the same behavior using the Scapy API to send ICMP Echo messages with TTL of one and test it out.


Do android apps have signatures like Window executables? Windows has a pretty good signature system. I was wondering if Android has a signature system for APKs.

If this would be the case, are they self signed? Are the play store apps signed by Google in any way?

Is it possible using this signature detection to detect if an app is from the Play Store?

All android apps must be signed by developers using self-signed certificates or by third-parties, such as an OEM, mobile operator, or alternate market. When apps are updated, the updated versions must be signed by the same developer. Additionally, applications can share permissions if they are signed by the same developer.

Apps on Google Play are also signed by Google Play. By default, Android blocks the installation of apps that are not signed by Google Play, unless the user has specifically enabled the "Unknown Sources" option under Security Settings.

References:

https://source.android.com/security/overview/app-security.html#application-signing
https://developer.android.com/distribute/tools/open-distribution.html
https://developer.android.com/studio/publish/app-signing.html


Is there an attack that can modify ciphertext while still allowing it to be decrypted? Is there any way an encrypted file using AES-256 could be modified without alerting the file owner, ie., so it can still be decrypted with the same key?

I know that without an initialization vector blocks in a cipher-text can be deleted, moved, duplicated etc. (am I right?) without detection. Using an initialization vector should preclude that attack, but are there any others?

Does the cipher-text need to be signed in order to ensure that it is unchanged?

Yes.

This is an issue with any crypto system that does not protect integrity, such as with a signature or hmac.  You see, encryption and decryption are just mathematical operations.  You can always perform a mathematical operation on a blob of binary data, and will always get a result. Encrypting an decrypting operations do not error out because the data is modified.

The specific impact of modifying the ciphertext depends upon the mode of operation and the data modified.  There is a famous attack where twiddling a bit in the old ATM (automated teller machines) protocol protected by DES would change the value of a transaction - deposit an unknown number of dollars instead of the amount you typed.  The attacker wouldn't know what the result would be, but the attacker would deposit a small amount of money and the system would have a large max value, so odds were that a 'random' change to the amount would result in a larger deposit.

Swapping blocks and the other attacks you reference are intended for known meaningful changes. The root cause is still the same - lack of protecting the integrity of the message.

Now, there are a few exceptions to this, in the form of GCM, XST and a couple other newer encryption modes.  These modes include the integrity check as part of the algorithm, instead of requiring you to implement an integrity check, yourself.

The initialization vector makes two values encrypted with the same key encrypt to different values.  Without the IV, when you reuse keys and resent the 'same' message you would get the same ciphertext.


How does password-append OTP validation work? Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way hashed?

The password is not hashed in the application but in the server. The server gets the password+OTP token in clear (protected with HTTPS between client and server) and can extract both password and OTP token from this, then proceed with normal password verification.


Suggestion on asymmetric (hybrid encryption) encryption for big file We will be using following commands to encrypt to firmware file at server and that will be decrypted on the embedded board using decryption command mentioned below,

Following command will be used to generate symmetric key of 128 bit length

openssl rand 16 > ./symmetric.key

we will use following commands to create private and public keys in PKCS#8 format

openssl genrsa 4096 | openssl pkcs8 -inform PEM -topk8 -v2 aes-128-cbc -nocrypt -out keyfile.pem
openssl pkey -inform PEM -in keyfile.pem -pubout -out keyfile_pkcs.pub

For encrypting firmware we will use following command

openssl enc  -in firmware.tar -aes-128-cbc -salt -out firmware.enc -pass file:./symmetric.key

We have two choices to encrypt/decrypt symmetric key at board side,

Option 1. Encrypt symmetric key using public key at server and decrypt it using private key at board.

We thought of using following command sets,

openssl pkeyutl -encrypt -pubin -inkey keyfile_pkcs.pub -in symmetric.key -out symmetric.key.enc
openssl pkeyutl -decrypt -inkey keyfile.pem -in symmetric.key.enc -out decrypted_symmetric.key

Option 2. Encrypt(sign) it using private key at server and decrypt(verifyrecover) it using public key at board.
We thought of using following command sets,

openssl pkeyutl -sign -inkey keyfile.pem -in symmetric.key -out symmetric.key.enc
openssl pkeyutl -verifyrecover -pubin -inkey keyfile_pkcs.pub -in symmetric.key.enc -out decrypted_symmetric.key

EDIT Just for completeness putting command to decrypt firmware file using symmetric key.

openssl enc -d -aes-128-cbc -in firmware.enc -pass file:./decrypted_symmetric.key -out firmware.tar

Now being new to this cryptography and OpenSSL we have following doubts,

  Doubt 1: Which option to choose for encrypting symmetric key? (option
  1 or option 2)

  Doubt 2: Do you suggest any improvements in above commands? Do you see
  any problem in this method ?

Any other suggestion/correction/pointers ?

Not an answer but you asked for suggestions and this would be a lot for (SX) comments.

(0) openssl pkcs8 -topk8 ... -v2 aes-128-cbc -nocrypt is misleading at best if not wrong. If the output file is not encrypted, it doesn't matter what algorithm is not used to encrypt it.

(1) openssl enc -pass file: (or -kfile) reads the first line of the file as a string, and uses it as password (not key) with a weak PBKDF. You have random bytes for 'password' so the weak PBKDF is only silly not broken, but there's a 12% chance one of the random bytes will be NL or null and cause the key to have reduced entropy and about a 6% chance it will have low enough entropy to be broken. Either use rand -hex value as key with -K uppercase; or use rand -hex or convert to base64 (either of which gives all-alphanumeric) and let the PBKDF (trivially) distill it.

(2) CBC is unauthenticated and somewhat malleable (though not as bad as the stream modes) and you don't add authenticatation. If an attacker wants your device to accept an altered file, they probably can after a fair amount of work, although the details depend on your file(s) and your device(s).

(3) CBC requires padding and openssl enc uses PKCS#5, and you don't authenticate; if your device is observable, this probably gives a padding oracle. If an attacker can provide crafted files and detect whether your device successfully decrypts or not, they can quickly break your encryption.

(4) But why are you encrypting anyway? Is this firmware secret? Most firmware isn't, and in most applications where firmware is downloaded the important thing is integrity and authenticity, that is, loading only authorized firmware while rejecting tampered or forged firmware. Encryption in general is not designed to do that, and this encryption in particular does not do that. If what you want is integrity and authenticity, use signature not encryption, as @P4cK3tHuNt3R pointed to.

EDIT: specifically for authentication you can use digital signature

openssl dgst -$hash -sign privatekeyfile >sigfile
# combine the pieces for transmission then separate and
openssl dgst -$hash -verify publickeyfile -signature sigfile

or use CMS format which combines and separates the data for you

openssl cms -sign -signer certfile [-inkey keyfile_if_not_in_certfile] -outform der
openssl cms -verify -inform der [-CAfile/CApath unless your root or selfsigned is in default truststore]
# assumes the transfer process handles binary, as most do nowadays;
# if not use -outform and -inform PEM, or default SMIME with -text
# to add/strip dummy headers presuming your data isn't proper MIME

or several possible MACs, but from commandline HMAC is easiest

openssl dgst -$hash -hmac keystring
# at each and and compare
# note you can't easily use an arbitrary (binary) key here
# but HMAC construction inherently distills up to one hash input block
# worth of key so just use about 128 bits of entropy in hex or base64

openssl supports a variety of hashes, but unless you need to consider other factors I would use sha256 or sha512, the latter especially on 64bit machines. Hashes now officially broken or endangered for general signature (MD5, SHA1) would actually be safe in your application, but that can be complicated and timeconsuming to justify to people, so just avoid the problem.

If you really want encryption and authentication, although as above I don't think you need it, authenticed encryption modes GCM and CCM (which do both at once) are available in openssl library but not (currently?) in commandline, so easiest is to just encrypt and then authenticate with either/any of the above. The key (as it were) is encrypt then authenticate, and conversely verify then decrypt; this blocks the malleability and oracle that apply to unprotected CBC (and most other) encryption.


Which hashing algorithm is ideal for use on the web? I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why.

It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are the best because they do not have the collisions that MD5 and older hash techniques have. I'm wondering if SHA-2 family techniques are less supported on the web because of other reasons besides security, such as ease of implementation or speed of execution.

On a website that is already protected by the encryption of an SSL certificate via TLS/HTTPS the data (i.e. a password) is already being encrypted anyway (putting aside the recent issues with Heartbleed). So perhaps more priority has been given to algorithms that are easier to implement rather than more secure? It still seems sketchy to use MD5 on the web, i.e. for password hashing.

Which hashing algorithm is best for the web and why?

Which algorithm is best depends on what you're using it for.  If you're trying to spot random data corruption, for example, a blindingly-fast algorithm like CRC-32 is ideal.  On the other hand, if you're trying to secure password hashes, you want an inherently slow algorithm like bcrypt.  For protecting data transfers against malicious tampering, you want a fast, cryptographically-secure algorithm such as SHA-256.  And finally, if you need to interoperate with someone else's software, you use whatever hash function they're expecting.


Does removing user interaction create a secure sandbox that nullifies XSS? Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot.

Would it be possible for the online service to completely protect the integrity of the host machine itself against XSS attacks?

My understanding is that XSS attacks rely on user interaction to be effective. If there is no user interacting with the browser, and only screenshots are taken, sure any sort of crazy content could be loaded into the browser, but could the security of the host itself be compromised?

While there's a input that anyone can modify, not sanitized and returned to the user we will have a XSS vector.

The "classic" example is the select that receives the option through the URL:

...
Select your language:
<select><script>
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");
document.write("<OPTION value=2>English</OPTION>");
</script></select>
...

So if a malicious user instead of send a standard answer like:

http://www.some.site/page.html?default=French

Send a request like this:

http://www.some.site/page.html?default=<script>alert(document.cookie)</script>

The user cookies will be shown on the alert.

Some links for reference on DOM Based XSS and how to prevent it.

https://www.owasp.org/index.php/DOM_Based_XSS
https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet


What is "anonymous identity" in enterprise WPA? When connecting to an enterprise WPA protected network, I have the option the add an "anonymous identity" (see related screenshot). I don't understand what's the point though.

Who get to see this identity ? What is obfuscated by this anonymous identity ?

The anonymous identity is used in EAP so that the authenticator can choose the correct authentication server to process the credentials. For example sending anonymous identities of foo@example to Example's RADIUS server.

See here for more information.

The anonymous identity is sent in the clear. Some client systems have a privacy option for the anonymous identity. In this case rather than foo@example being sent in the client response, only @example is sent, protecting the actual identity of the user. All an eavesdropper can see is that they want to authenticate with Example.


Why would password managers provide support for OTP codes? Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table?
We, as security professionals, have been fighting for the adoption of 2FA for a long time, and now that we are reaching a wider coverage, password managers are increasingly providing support for both passwords and OTP, hence, defeating the purpose of multiple factors of authentication.
Some will say, the benefit of 2FA from the point of view of the target service is still there, but come on, if the average Joe had 15 online identities, now it's only necessary to attack one of them (the password manager) and if the user used the service to store the OTP codes as well... GG WP.

Password managers want to also manage OTP because they're in the business of making authentication easier.
But there's a trade-off.
Managing OTP (or any other truly additional factors) in the same place as your passwords shifts the risk model. It pools multiple independent factors into a single attack surface. This turns the system(s) running the password manager into a higher-value target.
The increased risk may be acceptable for general users, but it is riskier for targeted / high-risk users. (The rest of my answer takes the high-risk users as the more interesting case.)
If OTP codes are stored on an independent device, by contrast, then compromise of the system(s) hosting the password manager (while still obviously bad) does not provide instant unfettered access to all accounts stored in the password manager.
Of course, a user can always check the "don't require OTP on this system" checkbox. High-risk users can skip that option, and require the OTP at every login. If they do so, then if they surf the web from their laptop but use a phone-based OTP app, an attacker must compromise both endpoints - the surfing system, and the phone - to authenticate as the target user on OTP-enabled websites. (Which is the fundamental value proposition of MFA.)
And it's important to remember that storing OTP in your password manager is not an "either/or" situation. Some users might choose to store low-value OTP codes in the password manager, and high-value OTP codes somewhere else. (Corollary: it would be great if the password managers could advise users about the trade-offs, so they can make informed risk decisions!)
Not storing OTP separately decreases the cost of (targeted) attack. But as always, whether or not that matters depends on your threat model.


Can my VPN provider see the name of my WiFi? Can my VPN provider track the wireless network name, besides the IP?
If I'm connecting from home to the VPN via my WiFi called "Whatever" - do they see that my WiFi is called that?

Yes but this is not an issue with the VPN protocol per se its more an issue with data leakage of traffic exiting through that connection.

Specifically there are many ways in which geolocation can be done against the client via a number of protocols. In your case the most relevant one would be using client-side javascript to capture the wireless SSID and comparing it to a geolocation database of wireless SSID's. If ANY web server requests this data while you are using a VPN provider that information will also be sent via this connection. A more malicious VPN provider could also MITM a cleartext http session and easily add a request like that in (note: I'm not saying VPN providers do this and most likely they don't because they don't really need too in order to determine your location as most clients will leak that information via normal usage).

Note: This also means some web servers will know your SSID too.

See the Wi-Fi based positioning section and javascript geolocation demo on the following web page:

https://mobiforge.com/design-development/html5-mobile-web-a-guide-geolocation-api


Is AES 256 secure enough for putting Backups to AWS or Dropbox? How long would it take with current hardware to hack an Disk Image which was encrypted with AES 256?

I ask because i want to backup personal files (contracts, tax-things, code, keys, private documents) and leave them outside of my home (e.g. at the office, at dropbox or AWS).

Is it a good/safe idea or not? Since i am not the president of the united states, i think others are not that interested in my files as i was the president ;)
But i want to have still a good sleep while the files are stored as the destinations mentioned above.

AES-256 is definitely secure for file storage. The only weakness is the key that you choose. As long as you choose a strong key for it, AES-256 will keep your files safe. According to this Wikipedia page, the best attack on AES was published in 2011 and to break AES-256, it still required 2^254.4 operations. The page further states that:

  This is a very small gain, as a 126-bit key (instead of 128-bits) would still take billions of years.

The page then mentions that breaking a 128-bit key would require the storage of 2^81 bits of data (about 38 trillion terabytes).

So, all-in-all, as long as you have a strong, non-brute-forceable key, you should be completely fine to store files online using AES-256 protection. (In fact, you could probably even use AES-128 without worrying, but I don't see any sense in using less protection when you can use more.)


Why would a bat file that just starts a program be considered a virus? My friend's computer was having a lot of viruses so he wanted me to download an operating system for him. So he gave me a flash memory. When I opened the flash my antivirus (Kaspersky Total Security) kept removing it saying it was Trojan.bat.runner.bv. I have restored it a lot of times but it kept deleting it. So I renamed it from 1.bat to 1.txt and all I found was this:

cd .Trashes
start wscript "459\vrdve.js"
exit

My question is how is that a virus? It won't harm my computer in any way it just starts a program.

It would be detected as a virus because it is an executable (.bat) calling a Javascript file. A recipe for a bad infection.


Why does it take longer for my computer to recognize a wrong password than a correct one when logging in? When I enter the right password to log in to my computer*, I am in instantly. However, if I mistype it, there is around a 2 second pause. Are there significantly more computations taking place to check if a password is incorrect than incorrect?
* (MacBook Air 2015 if it matters)

This is not really much of a computer science question, more a user interface design and/or infosec question.

Are there significantly more computations taking place to check if a password is incorrect than incorrect?

Since there is no third possibility, checking if a password is incorrect and checking if a password is correct, are the same thing. If it is not correct, then it is incorrect, if it is not incorrect, then it is correct.

However, if I mistype it, there is around a 2 second pause.

The user interface design reason for this is to give you time to think about your password. Also, it accounts for the "cat walking across keyboard" case.
The infosec reason is to slow down brute force attacks. A legitimate user who accidentally mistypes their password will only lose 2 seconds re-typing it again. An attacker running a brute force attack who needs to try out trillions of passwords automatically, will be severely slowed down.
The legitimate user will be slowed down from being able to type their passwords about once per second to about once every 3 seconds. The attacker will be slowed down from being able to try thousands of passwords per second to once every 2 seconds.
Typically, the wait time is even made to increase with every wrong try, up to a maximum. Sometimes, there is also a maximum number of wrong tries after which additional measures need to be taken to gain back access to the account, although such a measure is slightly dangerous, since it can easily be abused for a denial of service attack if not designed carefully.


Why don't browsers restrict cookies per-tab to combat CSRF attacks? Why are the cookies shared between browser tabs? does avoiding this prevent CSRF on cookie based authentication web sites? Is sharing the cookie between tabs favored for easily accessing the website from multiple tabs without authentication?

Yeah, the cookie is a "browser thing"... not a "tab thing". Is to favor multiple login on the same site on different tabs what in the most of the cases is an advantage.

Yeah, you are right, in the hypothetical case of to have "tab cookies" the CSRF attacks make no sense because as I guess you know very well, the Cross Site Request Forgery attacks are based on:

A user have an already existing session on website A.
Then, clicking on an evil link maybe on website B or in an email or however, another request is done (this is usually done in other tab) launching a forged request trying to do something on website A "abusing" of the already set existing session or cookie on the victim's browser to perform any "evil action".

If you want a separate session on a browser there are ways to achieve that like using private browsing. That separates the session/cookies from the other sessions. That's because is like "other instance of browser", but between tabs of private browsing you'll share session/cookies in the same way.

Hope it helps.


Passwordless authentication - how and when to invalidate a login code Our system uses passwordless login to send user a login code+link by e-mail by which they can login.

We found one of our customers has a mail scanner that actually follows those links. We invalidate the login codes on use to the reduce the attack surface for an attacker. But now such emails no longer have a valid login link.

There seem to be two solutions to this:

Do not provide a login link but only a code in the message.
Let the login code be valid after first time use for X period (say it invalidates after 15 minutes)

Option 1 seems to be unacceptable by our UX team.

Option two seems to be much less secure:

Provides a bigger attack surface because more codes will be active in our database
Social engineering will be easier: a user could take a picture of someones mail and type of the code within the valid period (even though user already used the code) and login with this code.

Would there be any other or better solution that would be both UX friendly and (atleast as) secure?

Instead of invalidating the login code when the link is clicked, have a script on the page that runs and makes a request to your server to invalidate the code.  This will only be effective if the "mail scanner" just visits the page and doesn't run any scripts on it.

You should also invalidate the code after a period of time (your second option), because if the user is running a browser with scripts disabled the code will not be invalidated by this method.  The timeout serves as a backup if this is the case.

If you find that whatever "mail scanner" your users have is running scripts on the page, this won't work.  Instead, you could require a user action on the linked page to complete the login process.  Your users would click the link in the e-mail and be taken to a simple page with a login button, and perhaps some text like Log in as <username>?.  Only log them in (and invalidate the login code) when they click the button.  This would require two clicks from your users instead of one, but I don't think that's too inconvenient.

Since the "mail scanner" will only visit the page and not click the button, it won't use up the code.

The more I think about it, the more I like requiring a click.  It doesn't rely on the mail scanner not running scripts so it should be more robust.  You could even combine it with Steffen Ullrich's cookie idea.  If the user clicks the login link in the e-mail and has the cookie, you know they're not the mail scanner so you can log them in right away.  One click and they're logged in.  If the cookie is NOT present, the click might actually be coming from the mail scanner, so you show a page with a login button.  If it's actually just the user on a different browser (or the same browser with cookies disabled), they'll click the button and log in.  In this case it took them two clicks, but that's only a slight inconvenience and it's only necessary if the cookie isn't there.

See this similar question.


Validating Credentials - Logic in Application vs Database I am studying

Web Application Security, A Beginner's Guide Paperback – November 3, 2011
by Bryan Sullivan  (Author), Vincent Liu  (Author)

On pp 69, "Validating Credentials", they say you can validate credentials based on

Comparison logic in application with plaintext passwords
Comparison logic in database with plaintext passwords
....

I cannot understand the difference between logic in application vs database.

The text for "Comparison logic in application..." says:

  The application sends a request (for example, SQL query or LDAP query)
  to the back-end database to retrieve the record associated with the
  username...

The text for "Comparison logic in database..." says:

  This technique involves crafting a SQL query or LDAP request to the
  back-end system with a conditional statement that asks the back end to
  return any records with matching fields that correspond to the
  supplied username and the supplied password

I cannot grasp the difference between the two. I would think that the application also crafts an SQL query or LDAP request to the back-end system with a conditional statement.

How do I visualize this? Thanks!

Think about it this way:

Most system have multiple components. In a traditional set up this is usually a client that is distributed to the users, a server, and a database.

The database is usually a commonly used, highly optimized piece of software written by somebody else, whereas servers are very often custom software that is written by you  specifically for the clients' needs

In this example, the server talks to the clients. If the database would talk directly to the clients it generally makes your system extremely insecure because the client (and therefore your users) has access to all your data.

The client sends a request to the server asking to verify the details that were entered with the database. Once the client is verified the server decides which information the client can see, for how long the client can request that data without having to be re-verified, the amount of data that is transmitted, etc.

Take for example google. When you google your search query, you open up a Web page (the client). The client talks to the server as you are interacting with google, the server sends you back suggestions and eventually gives you the answer to your question, but you as a client don't need access to all information in google, only google's servers should have access to all this information, and should only show you what you need to know.

Another analogy, when you're in a  restaurant, you are the client, your waiter is the server, it understands what you need, and tells the kitchen (the database) what to cook you, and once it's ready it'll bring you the result. That's about exactly what a server does.

Feel free to ask further questions :-)


Hardening Services, Ports on OSX People boast about OSX Security, yet I find it very hard to find a comprehensive manual in regards to any equivalent Services and the ports they use. I am aware of lanchd and launchctl and Lingon is quite a handy utility, however the information is quite overwhelming, as there are so many different agents and daemons running.

Basically my question is, which one of those daemons and agents are safe to disable in order to eliminate OSX attack vectors based on exploits found on those agents? Are Daemons and Agents the equivalent of what we call Services on Linux systems? And finally, why is OSX perceived to be safer than other Operating Systems?

Actually, daemons on OS X are equivalent to what is called daemons on Linux too. Both systems share a Unix ancestry. OS X is derived from FreeBSD. If you want to understand how security works on OS X, some Unix experience is advised. Sections 4 and 14 of the FreeBSD handbook would be relevant.

On a general basis, you should mind services (or daemons or whatever way you wish to name them) which offer an external entry point. The netstat -an command will show you what ports currently correspond to some server code, but those which are bound to 127.0.0.1 (aka "localhost") are not actually reachable from the outside -- so they are "safe".

OS X has the reputation of being "safer than other OS" because Apple invested a lot in a communications campaign which repeated that idea ad nauseam, until it stuck. One must admit that when it comes to Public Relations, the people at Apple are really skilled.


How to guarantee only my client application can request a nonce? I have a web site and a service in a server.
I'm developing the "Register User" and "Login" components.
I've searched on the internet and I've found two protocols to login user using 'nonce' and 'salt', here and here.
I've also found two explanations in order to use SSL/TLS, here and here, and bcrypt.
I believe these tips will help me a lot, however I have some questions:
How could I guarantee that only my client application will request a 'nonce' to my server? In other words, I would not like that others could request a 'nonce'.

A nonce is used in the process of authenticating the client. If you want to make sure that only your client application requests the nonce you need to have to add some authentication first - before accessing a nonce, i.e. authentication of the client application before doing authentication of the user. This might sound kind of silly - and it is not actually not needed.
There is  no real need that only specific client applications can get a nonce. Properly implemented a nonce is cheap to issue and there is no need to restrict who can get one.


Client identity other than URL/DNS name in certificate I am currently working on a project where nearly whole communication is done using HTTPS and ActiveMQ. Servers and clients are physically in different places, different organizations and in different domains. System components will communicate using 2-way SSL (or rather TLS w/ Mutual Authentitcation? I'm not very good at naming things yet), which gives us authentication, but we'd like to use some value from certificate to perform authorization (particularly access to queues on message broker). Because of these and other requirements, we'd like to give unique URI-like identifier to each component of the system. We have decided that it will look similarly to this: "<ORGANIZATION>.backend.processor" or "<ORGANIZATION>.device.<UUID>"..

Now, my question is: should I put this identifier into DN/CN field and put DNS names (so physical addresses) into SAN (or subjAltName) of the certificate, or rather should I put it into SAN and DNS into both SAN and DN/CN field?

According to this answer, putting aforementioned identifier into DN/CN field is secure, since our infrastructure will be homogeneous and connections from external sources will be done only by browsers, which we can easily put requirements on, this should work flawlessly. But maybe we should generate two certificates for each component and use one for presenting to connecting clients (so DNSname in both SAN and DN/CN) and the other one to authorize ourselves to components that we connect to?

we'd like to use some value from certificate to perform authorization

You use the certificate for authentication and once you authenticated a user you can do authorization.

Sounds like hair splitting but it helps improve design.

Additionally, according to rfc3820 you can use the extKeyUsage to store some basic authorization data on the certificate itself.

For identification purposes, use of CN/SAN is fine, but you might want to use subdomains of a domain you own for them.

  But maybe we should generate two certificates for each component and
  use one for presenting to connecting clients (so DNSname in both SAN
  and DN/CN) and the other one to authorize ourselves to components that
  we connect to?

You can use the same certificate for both purposes. If the server is compromised you'd need to revoke both keys anyway.


How content-type:image can lead to infected JAR file? Symantec published a news about a malvertising campaign targeting IE users with Java exploits (already known vulnerabilities). At some point they explain that the users are redirected on malicious domains using the following GET :

As we can see, user is looking for Ilns0.gif , and it accepts GZIP encoding.

Server replies with Content-Type: image/gif and delivers an infected .jar file.

How is it possible to use an incorrect type and still get the file loaded by the user ?
Why browsers don't alert you when a server delivers an unexpected content ?

There's a longstanding issue (feature?) with IE doing Content Sniffing instead of just respecting Content-Type; this still exists largely for historical reasons. You do have the ability to disable it - MIME Type Detection references the Feature Controls - if you want to make your machine(s) more secure. It is still marginally useful since a common 'fix' server-side for unknown binary file types is to server as application/octet-stream, which may cause things to not work as expected (videos may download instead of play, for example).

It's likely that this particular exploit just happens to use a gif because it'll get past email scanners, etc. more easily embedded in an  tag in an email.


Why does the EFFs unique-prefix-wordlist have so long words A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words.

One variant is the “short word list (with words that have unique three-character prefixes)”. They write about this list

  Finally, we're publishing one more short list [.txt] which with a few  additional features making the words easy to type:

  Each word has a unique three-character prefix. This means that future software could auto-complete words in the passphrase after the user has typed the first three characters
  All words are at least an edit distance of 3 apart. This means that future software could correct any single typo in the user's passphrase (and in many cases more than one typo).

  We've added these features in the hope that they might be used by software in the future that was specially designed to take advantage of them, but will not offer a significant benefit today so this list is mostly a proof-of-concept for individual users. Software developers might be able to find interesting uses for this list.

But why would they hope for software developers to implement auto-complete? Couldn’t they just tell the users “remember the whole world, but just type the first three characters” to get the same effect – no loss of security, but shorter passphrases?

Also, I noticed that the list contains words like viperfish that seem awfully redundant – wouldn’t the shorter word viper work just as well in its place? Similarly, mapmaker could just be map, capsule could be cap, older could be old. Is there a reason why they have not just chosen the simplest, shortest english word for a given three-letter prefix?

Using cap, old and (presumably) viper would ruin the edit distance guarantee.

I imagine that users don't want to just type the first three letters - it can be less mental effort to type words. There's another common scheme where you take a longer sequence of words and include only the first letter from each word: Which approach you prefer is largely a matter of taste.


What implications does the KeRanger infection have for Mac OSX security? Recently some hackers replaced installers for a popular torrent client with an infected version. According to paloaltonetworks, they have no idea how the hackers managed to do this (let's just assume the server was compromised) and that the infected app managed to make it past Apple's Gatekeeper protection because it was signed with a valid development certificate. Although the certificates were revoked and the ransomware was removed, the article did not address a primary concern:

Does this show a huge security flaw, in that a compromised server can easily distribute malicious binaries? How could Apple have prevented this from happening?

Does this show a huge security flaw, in that a compromised server can easily distribute malicious binaries? How could Apple have prevented this from happening?

Welcome to the internet where not everybody is friendly, same as in the world outside the internet.

Apple could not have prevented the compromise of the server because the server is not in control by apple. And as long as apple trusts developers to sign their own software it is not possible to prevent the execution by harmful but signed software. Apple limits at least the impact by revoking the certificate as soon as the problem is known. Apple might try to restrict software distribution to their own apple store only and heavily inspect each of the offered software. But this has associated costs which not everybody likes to pay and apart from that history shows that it is still possible to trick apple into distributing software which later turns out to be malicious.

Just compare this too real life where you trust some Mr.Mallory because your good friend Mr.Pear told you that this person is trustworthy. You would probably not call it "a huge security flaw" if it turns out that Mr.Mallory is a crook which tricked both you and Mr.Pear. Instead you would accept it as something which just happens from time to time because there is no such thing as full security.


Limit attempt of user login against PBKDF2 I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years .

I argued against it and thought we should allow users to attempt to login a maximum of 200 times a day , anything more would result in a locking of the user account . My rationale was that PBKDF2 would soon be broken in a few years time and we would have to change our encryption system again hence why not just limit the number of times a user can attempt to login. My boss however insists on me implementing PBKDF2

These are my following questions :

1) Is my rationale for wanting to limit the number of tries a user can login reasonable ??

2) Are there any flaws in my argument

3) Is my boss correct ???

1) Is my rationale for wanting to limit the number of tries a user can login reasonable ??

No, absolutely not the way you describe it. It's fine to limit the number of failed attempts in a short period of time and scale it up from there but you should never set a hard limit for a long period like an entire day. Who are you to tell me I cannot login to my account for the 201st time today?

  2) Are there any flaws in my argument

Yes. MD5/SHA1/SHA256/SHA512 etc is stupidly flawed for password hashing. Also, PBKDF2 has been widely used for quite a number of years. There are no signs that it will be broken "in a few years". See this answer for more details.

  3) Is my boss correct ???

Absolutely, yes.


Getting credentials using proxy server Is it possible to get the username and password we enter into sites like facebook using proxy server?

The scenario is like this :
1.My laptop is connected to a network.
2.It is configured to use a proxy server to connect to Internet.
3.I enter my credentials into secure sites.

Is it possible for others to get credentials in the above scenario ?

If the URL uses SSL (i.e. is https://) and use the proxy only for transport, then no, the proxy sees only encrypted data and cannot peek at it. (Unless the proxy tries to feed you with a forged certificate, which requires some prior installation of a collaborating CA in your machine; this may happen in work environments, when your enemy is the local sysadmin.)

If the connection, as it exits your machine, is unprotected, then yes, by definition the proxy sees every byte which comes and goes. This is true for all proxy technologies.

The situation can be made more complex if the proxy itself asks for some authentication, and/or if the proxy negotiates some SSL between itself and the target server. For the technologically unwary, it can become a bit hard to know where the password you type actually goes. If:

your browser and local machine are clean (it has not been touched by a potentially hostile sysadmin or malware);
your browser says "that's SSL" with the (in)famous padlock icon;
the server name in the URL bar is indeed what you expect (it is exactly www.facebook.com, and not something like www.facebook.com.sdjygsdb.com);
your browser sees nothing wrong with the server's certificate (no scary warning, URL bar turned red or something like that);

Then:

what you send to the server is safe from prying eyes of external entities, including proxies.

Otherwise:

anything goes. Your data is at least potentially insecurely transfered, and proxies are in ideal conditions to meddle with it.


How do I pick a VPN provider? There's a lot of VPN providers out there. Some are free, some are for a fee, some report logs to the government, some inject ads into your HTTP, some are in other countries, you might not have any real promise of security when using these services.

How do you go about shopping for a VPN provider that won't just sell or give away your data? What criteria should I use? Is setting up my own VPN through a web host somewhere a more secure option?

First you should ask your self: What advantage does a VPN provider have over providing your own with something like OpenVPN? If you are paranoid you could get a Virtual private Server(VPS) host.  Other than that I would make sure that the service was fast, cheap and wasn't in the news for a security breach.


Are SEH exploits valid against Linux? I was trying to write an exploit for Crossfire (a game on Linux which has BOF vulnerability) to practice for a CTF.

While fuzzing the game, I found out that if you increase the buffer size you send over constant value, the game in the debugger will behave in a way similar to Windows' applications behavior when the buffer writes over SEH. (EIP not being overwritten, register values are corrupted and execution stops)

The solution to this, according to the CTF, is to use a small buffer pointed to by ESP to jump to the rest of the shellcode which resides at the beginning of the buffer.

However, this led me to a question: Does Linux have a similar way to handle exceptions which is exploitable?

P.S. When I tried to google "SEH with Linux",  the pages I got where mentioning Linux as the attacking machine, not the victim.

No. Structured Exception Handlers (SEH) are a Windows-only thing, so Linux cannot be exploited in the same way.


DMARC rua indicates mail send from competitorDomain.com for ourDomain.com, is this (potentially) mallicous? We've received several rua reports indicating that one of our direct competitors is sending emails with our domain in the mail from headers.
I do not have access to the actual emails sources, and I have no idea what would cause this. The one cause I can think of is that somebody at the competitors company is sending out emails on our behalf (a conclusion I hope we can discredit).
Relevant rua report section:
<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  (...)
  <record>
    <row>
      <source_ip>209.85.220.69</source_ip><!-- mail-sor-f69.google.com -->
      <count>2</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>local_policy</type>
          <comment>arc=pass</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>[our domain].com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>[competitor domain]-com.20150923.gappssmtp.com</domain>
        <result>pass</result>
        <selector>20150923</selector>
      </dkim>
      <spf>
        <domain>[competitor domain].com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

So, my question is:
What can cause this to happen? Is there normal behaviour that could cause these reports? Is this the result of legitimate email traffic? or is this an indication of malicious behaviour somewhere?

Side note
I'm unsure what the section means.
  (...)
  <reason>
    <type>local_policy</type>
    <comment>arc=pass</comment>
  </reason>
(...)

Reading up on DMARC `arc` leads me to suspect it may be caused by email forwarding but `arc` should make sure the DKIM headers would still be available for authentication? In which case the forwarded email should not `fail` the DMARC policy?

If you're sure that all of your legit mail passes DMARC, including the header FROM domain (example.com) and MAIL FROM (Envelope FROM) domain, something like em.example.com are in alignment, that is, both have example.com as the organizational domain, then you could try a more aggressive DMARC policy to p=quarantine (asks mailbox providers to route non authentic mail to spam) or p=reject (asks mailbox providers to reject any mail that's not authenticated).
Do you know about many emails per week that aren't passing DMARC, say, from this competitor go out? Are any of your email streams, ones that you send failing DMARC? Are any of your own mail streams that are failing DMARC OR SPF?
It's important to be very careful when moving to a more aggressive DMARC policy but if someone seems to be spoofing your domain, then you might consider cutting that off.
Do you feel comfortable calling this competitor or otherwise asking them if there's some misconfiguration on their side whereby they are mistakingly using your domain?


Dealing with a fraudulent email that went to vendors Recently a business I'm working with had an email that was sent to some vendors of theirs using emails that were remarkably similar to their own emails. The attackers used letter substitution to mimic the business's domain (e.g. exarnple@dornain.com — notice the use of "r" and "n" to imitate an "m").

Luckily, the vendors contacted by these people were diligent enough to catch the mismatched email addresses. However, I'm concerned that similar attacks will hit other vendors of theirs that might not have the same protocols in place.

Aside from contacting every one of vendors, is there anything the business can do on their end to mitigate these attacks? Or are they reliant on vendors being diligent with double-checking their contacts?

The experience your organization has had is similar to what many organizations that deal with sensitive information deal with on a regular basis (ie banks, credit bureau's, revenue agencies, etc). Whale Phishing in particular is a nasty attack that takes advantage of these technical weaknesses.

This issue is one that mostly needs to be solved with procedures, as opposed to technical controls. Below are some examples, but these are obviously not completely fool proof nor do they apply to every situation.

First and foremost establish internal policies and procedures when dealing with any movement of money or sensitive information (Wire Transfers can only be initiated by in-person meetings, orders must be processed after sign off from two people that are in the office, etc) and ensure these are adhered to. This means ensuring that everyone affected internally is aware of these policies and adheres to them.
Issue communications to relevant stakeholders letting them know that specific communications (such as account breach in the case of banks) will never come from e-mail, or your organization will never request you provide information from links contained within emails.
You may choose to register domains that may slightly vary on what your domain is to prevent cyber squatting (ex d0main.com / doma1n.com).
Establish an email address or phone line that people can call to inquire about the authenticity of an email transmission (ie abuse@domain.com)
Put a statement on your website to let relevant parties know of your policies.

It's not exciting but the best way to mitigate these attacks is to establish a firm set of policies and communicating those policies to whoever would need to know them. Let your vendors know that that you'll only place orders through their secure portal (for example).


How To Track A Phone With No SIM Someone stole my phone at school, and either removed or deactivated the SIM card so the location is not able to be found on my Android Device Manager. Can I track it without the SIM card myself?

It depends on the phone platform, whether you have tracking set up in advance and whether someone is foolish enough to break into your account while on Wi-Fi or leave the phone on while in reach of a Wi-Fi you've previously connected to.

So the realistic answer is probably not though the sooner you try, the better.

Anyone with any brains would have factory reset the phone immediately after removing the SIM.


IP Address leak on LAN scan I am using VPN and encrypting my web traffic through them. However, When I do Lan Scan I can see my real ip address. All other websites, IPleak.net, WebRTC leaks, DNS leak, Email Leak and IPv6 leak do not reveal my real IP address, which is safe. However, if anyone use packet sniffing or do a Lan Scan shall see real Ip address. What can I do to hide that or that is not possible ? I am using OS X (Mac). Apple Firewall is turned on.

Any ideas or suggestions what to do ?

As the IP address being visible on the LAN is how your VPN packets get back to you hiding it from other people on the same LAN is a tad hard.  Also normally the point of a VPN for privacy isn't to conceal your IP address from everyone but to make sure that the people who can see your IP address can't see what data you are sending and receiving and people who can see the data can't see your IP address.

Whatever you do the people who administer the LAN will probably be able to tell you are the person using a VPN if they can be bothered to look.  Most techniques that would hide your IP address on the LAN will make you even
more obvious in some other way.

If you want to hide the fact that you are using a VPN from the LAN admins your best bet is to try and make sure that your VPN looks like normal (eg https or ssh) traffic.  While this isn't too hard to do at a superficial level traffic analysis would probably reveal you.


Password-free logins using your email address only? The state of logins is horrendous.  With each site having it's own rules for passwords, it can be very hard to remember what variation you used on any given site.  Logins are pure pain.  One thing I love about Craigslist is that it did away with logins altogether.  I know this design may not suit every site, but there's something to their design that beckons to be repeated.

OpenID is great on sites that have adopted it, but it's still not standard.

Would it be feasible/wise to use an email address as a login and provide no password?  The site would send a short-term key directly to your email address.  You click on the link and you're in.  When you're done, you "logout" and your key is terminated.

I've toyed with this idea before.  What concerns (i.e. spammers, bots, etc.) would make this impractical or unsafe and could they be overcome?

This idea has been covered on the following questions:

If I include a Forgot Password service, then what's the point of using a password? discusses sending a link by email, as the way to authenticate you.  It discusses some improvements, such as how to avoid requiring the user to wait for email to arrive and click a link every time they want to log in.  It also discusses some challenges, such as the reliance upon the user's email provider and the user's email password.
How to implement non-password authentication in a web site discusses, more generally, ways to authenticate the user without using a password. It discusses the use of persistent cookies to remember the user, so they only have to log in once on any particular computer, and then there is no need to enter a password again on subsequent visits.  This is a great way to authenticate users and reduce the need to type in passwords.  It can also be combined nicely with email-based authentication, as is discussed in the answers there.

So, read the answers on those questions.  I think you'll find that they already cover the sort of ground you were thinking of.  Enjoy!


Prepare for effects of Data Loss Prevention My company are preparing to install DLP (Data Loss Prevention) on our machines. I don't know what that means, how it works, what it can block for us, or how they can control our PCs and our connections.

I hear that this tools can block everything like USB Ports, or transfer of information to another machine. Is that true? What if I use a Linux boot, can I access my information when this tools is installed or is that not possible?

Can you please give me an idea, how I should prepare my self to this tools?

If you know what vendor and/or solution was chosen, I would check their docs.

One key thing is whether this is a network based DLP solution (in which case, you could check the docs for BroIDS to see how they conceive of DLP), or a local agent based one (i.e. some extension to an antivirus solution).

On a very basic level, a DLP solution will look for either keywords, or content hashes (e.g. sha256 digests) to identify 'sensitive' data that should not be allowed to leave your control/area of visibility.
As usual, it is more complicated than that, but that's the very, very basic functionality you should expect.

In theory at least, DLP shouldn't prevent you from accessing something (that's a job for ACLs and other access control mechanism), it is more meant to prevent you from storing the data in bad or unauthorised places (e.g. sending yourself or others passwords, credit card data, proprietary code/information, etc).

There are generally ways around DLP if you really, really, want to find them, but if your DLP solution isn't allowing you to do your job, fix the solution, don't work around the limitation.


Find out who has hacked your gmail account I received a message from google saying they had prevented a hacking attempt.  However I then received messages from friends saying that they had received spam from my gmail account.   If you go to the security tab of gmail it lists

"Application/device sign-in attempt (prevented) London (UK)"

The email from Google also lists an IP address which I am not sure I can post here.  Is there some way to get information on whose IP address it could be? For example, if it is an office or a mobile or a home IP address?

You could do a whois lookup. On linux or OSX it's a command line tool. You can also find websites that provide that functionality.

However, most certainly the attacker just used this IP as a proxy or vpn endpoint to disguise his real ip. I would say it's almost certain that this is rather another victim's IP than the one of the attacker unless he's a complete noob.

So i would advise you to be careful with that IP. You might contact the abuse email address that is usually provided within the whois lookup and advise them that you are being attacked by this IP. They may inform the owner of that IP or the may just not respond at all, as this is often the case in my experience.

hth


How to request CVE if CNA didn't provide an answer A couple of weeks ago I have found a vulnerability in a product. I have contacted them reporting it a week ago and also to get the CVE.

I didn't receive any answer from the mailing list and I would like what can I do in such a situation. In Mitre's CVE documentation they said only CNA's can request the CVE.

Thank you in advance.

CNAs can take more than a week to respond. Some are staffed by a small team - sometimes just one person - and if people are on holiday or off sick then there may be delays. If two weeks goes by  and you've got nothing back, that's more of a cause for concern.

If you feel like an excessive amount of time has passed you can opt to ask MITRE for a CVE directly and note in your application that the CNA did not respond. You should supply a timeline of communications to support this.


Is it possible to recover data from a Western Digital TRIM supporting disks (not SSD) after quick format? I have a western digital blue disk, which is one of the SMR variations. I've heard that they support TRIM command. The disk is accidentally quick formatted on Windows 10, and now seems to be all zero. But, I'm wondering, for a disk it would take illogical amount of effort to actually set all sectors (1TB) to zero. I don't really understood how TRIM applies to such disks, and suppose to see something like a list of safely deletable sectors or something like that in the disk's firmware.

So the question is: Is there any way to recover the data from my disk? Including firmware tweaks or hardware tweaks?

Yes, I can assure you with 100% confidence there is definitely ways to retrieve the information. If you rewrite over the sectors of data too many times or just pass over them to wipe the drive, then it would no longer be possible. There's just one downfall to the information I'm providing - the way I've retrieved deleted data (from formatted disks, emptied recycle bins, corrupted and/or failed disk drives) involves recovery software that typically has a price attached to it.

However, you may be able to retrieve the full extent of your files and data just with the trial versions. Stellar-Phoenix is the main software I use, though not for any particular reason. Other programs I've used include DMDE (Disk Editor & Data Recovery), EaseUS Data Recovery, and ... now that I'm looking, I think this one IS free:

TestDisk  -  TestDisk & PhotoRec

Be aware, though, having used testdisk 3-4 different times myself, it creates quite a large number of directories and - for whatever reason - accumulates far more GB of space during its recovery process than any of the other software I used. BUT ... it definitely works. I just hope you have a specific file type or perhaps have knowledge of a programming language that can help you sift through the mountain of directories it creates.

At any rate, I hope this helps! I skimmed the testdisk website and confirmed it is, indeed, free, open source, and works.

Unfortunately, I'm doubtful any of the software I mentioned above can recover firmware "tweaks", although would it not be possible to perform the same tweaks again? On the other hand, I am unaware as to the extent of said "tweaks". At any rate, good luck! Hopefully you can get back to the same, familiar system it once was.


Whats the difference between certificate pinning and a truststore in Android/iOS? I‘m facing the implementation of certificate pinning and often get asked why if there are trust stores within Android, iOS does not have such a concept. So I’m required to build the standard HPKP and Pin two public keys.

I have read the post What is certificate pinning? and asked myself what is the main difference between certificate pinning and a TrustStore concept?  Do they do the same except they validate the full certificate instead of the sha256 of the public key?

Certificate pinning and a TrustStore are not the same concept. The difference is not necessarily in trusting the certificate vs trusting the public key used in it. You can pin certificates too.
Android's Trust store essentially contains of a bunch of certificate authority that are trusted by the Android developers or users(they can manually add root certificates). When you validate a certificate using a Trust Store, you know that the certificate was created by the trusted root and the certificate was meant for a particular host. This approach leaves you vulnerable to situations like the root CA losing its private key.
As mentioned on OWASP, certificate pinning is a good way to stay away from problems like these. I am going to borrow a paragraph from that article which might help you understand the difference:

When Do You Pin?
You should pin anytime you want to be relatively certain of the remote host's identity or when operating in a hostile environment. Since one or both are almost always true, you should probably pin all the time.
A perfect case in point: during the two weeks or so of preparation for the presentation and cheat sheet, we've observed three relevant and related failures. First was Nokia/Opera willfully breaking the secure channel; second was DigiCert issuing a code signing certificate for malware; and third was Bit9's loss of its root signing key. The environment is not only hostile, it's toxic.


Is there a name for this (unconventional?) use of RSA for authentication? I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a private key, in this case the entire message is encrypted, using:

Modulus:          n = 0x35... # length 51 bytes / 406 bits
Public exponent:  e = 3       # to maximize performance
Private exponent: d = ...     # such that d⋅e ≡ 1 (mod φ(n))

The message (typically 250 bytes in length) is split into multiple blocks of 50 bytes each. Each block is then encrypted independently by first adding a prefix (where : represents concatenation):

plaintext = 0x15 : block
ciphertext = (plaintext ^ d) mod n

When the ciphertext is read, each block is recovered by decrypting:

plaintext = (ciphertext ^ 3) mod n
assert plaintext[0] == 0x15
block = plaintext[1..]

In terms of authentication, verifying that the first byte of the plaintext is 0x15 is not particularly useful - decrypting random ciphertext would pass that check approximately 2% of the time.

Instead, this system relies on the fact that, if the message was not encrypted using the correct private key, after decryption the message itself would be invalid.

Is there a name for this (unconventional?) use of public-key cryptography for authentication? Could it be considered a form of digital signature?

When describing this system, is it correct to refer to the use of the private exponent as "encrypting" and the public exponent as "decrypting", as above? Could the ciphertext be described as "encrypted", "signed" or neither of these?

The use of the private key cannot reasonably be called “encrypting” since the security objective is to ensure authentication, not confidentiality. There can't be any encryption going on since all the information to reverse it is public. What you describe is a signature scheme, specifically a signature scheme with recovery since the same encoded message contains both the information needed to verify the authenticity and the information needed to reconstruct the message. The main difference with modern signature schemes (PKCS#1 v1.5, PSS) is that this scheme is broken in several ways.

Modern RSA signature schemes prevent the formation of forged signatures by including a fixed “padding string” at some part of the decoding. Both PKCS#1 methods mandate at least 8 bytes of padding. The scheme you describe doesn't have anything like this (except the leading byte, but as you note it has negligible impact) and so has to rely on plaintext validity.

The leading 0x15 at least prevents the ability to forge valid messages with lots of leading null bytes. The public exponentiation operation is easily reversible if it doesn't wrap around: if M is less than the eth root of n then taking the eth root of M (as an integer) would result in a valid signature. Mandating a high bit set causes all such M to be invalid. The leading 0x15 also makes it difficult to generate valid signatures by multiplying valid signed messages together (but only if you don't hit that ~2% chance of randomly getting the leading 0x15 in the result).

Splitting the message enables the trivial attack of reordering the blocks of a signed message. Modern signature schemes use a hash to condense the message to a length that the asymmetric operation supports, ensuring that a given signature is only valid for the one message that has the signed hash.


Testing Digital Signature Verification I'm testing a system which involves updating a database using files sent from external parties. These files sent from external parties are basically just large flat files to update a database. The requirement is that these files must be signed used a File Signing Key in accordance with the FIPS 186-4 Digital Signature Standard using SHA-256 hashing algorithm and encrypting the derived hash using an RSA Digital Signing Algorithm of 2048-bit modulus in accordance with PKCS #1. The SHA-256 hashing algorithm will be applied to the entire data file. This will result in a digital signature of 2048 bits in Octet form, which will be appended within the file.

To test that the system verifies the signature correctly, I need to firstly sign the file. Information Security is not really my forte and I would appreciate guidance in the right direction. Is there a tool that I can use to perform this? Apart from the certificates, what would the pre-requisites be?

Many thanks.

The text you quote basically means: the file is signed with RSA, and the signature is appended "as is" to the file. There is nothing about certificates here; signatures use keys. Certificates are ways to bind public keys to identities. The passage you quote, though atrocious in many ways, is still relatively clear about the certificates: there are none here.

Signatures make sense only relatively to verification:

The signature is produced with, as inputs, the data to sign (the entire file) and the private key.
The verification takes as input the signed data (the entire file, again), the signature, and the public key, and tells you whether the signature is good or not.

As you describe the problem, the database expects input files to be signed with a specific private key, corresponding to the public key that the database will use for the verification. If you do not have that private key at hand, then you will not be able to generate signatures. You need that key if you want to sign a file of your own. Otherwise, that's an absolute no-way.

If you have the private key in some format or another, you will still need to write a little piece of code to compute the signature and append it to the file (this simple "appending" process is not a standard signature format, so you won't get a standalone off-the-shelf tool to do it). This can be done in many programming frameworks, e.g. with Java (using java.security.Signature) or C (with some library like OpenSSL).

Anyway, in cryptography, you can do no decent testing "from the outside". The best you can do is to take an existing signed update file, that the database accepts; then modify the signature (change the value of one of the bytes of the signature, which should be the last 256 bytes of the signed file, from your description), and see that the file with the modified signature is no longer accepted by the database. This would demonstrate that the database "verifies something", not that it does it correctly. Knowing whether a cryptographic system does its job adequately is not done by testing but by auditing the code.


Why is it a problem to store strong passwords as unsalted hashes? My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side).  In that context, could you explain why it would be a problem to store them as plain unsalted hashes (either MD5, SHA1, or SHA256).

Such strong passwords can be safely stored unsalted with a fast algorithm like SHA256, there is no problem in that.

The problems are different, you have to trust the client, the secure transportation to the server, and you have to make sure that the generated passwords are indeed unpredictable.


Symbolic links, PATH and privilege escalation vulnerability I am a bit inexperienced to this...

I am using this VM https://www.vulnhub.com/entry/the-wall-1,130/ for practicing and there is a step I don't understand. Here: https://research.g0blin.co.uk/thewall-vulnhub-writeup/

  After calling strings on the binary, I can see one path that is not
  correctly limited to a static path - mail. A rather crude way of
  finding the vulnerability, but effective.

So basically to get DavidGilmour's shell I need to create a symbolic link to /bin/sh in /tmp/mail and change the PATH variable. But I don't understand why that is done nor how it works. Can anyone explain me?

I know the PATH variable is where the executables are, kind of like in Windows, so when I write, for example, 'cat' or some other command in the command prompt it works and I don't have to write the whole path to cat (at least that's what I believe it does).

And why is the symbolic link saved to /tmp/mail? And why is a symbolic link even used?

The attacker is attempting to get a shell running as the DavidGilmour user. Based on their explorations, the decision is to try to exploit a vulnerability in the shineon binary because that binary is setuid to DavidGilmour:

$ ls -lah /usr/local/bin/shineon
-rwsr-s---  1 DavidGilmour  RichardWright   7.3K Oct 25 07:58 /usr/local/bin/shineon

Notice the s in the permissions. That indicates that when shineon is run, it will run as DavidGilmour. But as shineon is a program of limited functionality, it doesn't have a start shell command. Instead, the attacker looks at the functionality the shell provides:

1. Calendar
2. Who
3. Check Internet
4. Check Mail
5. Exit

and then looks at the strings inside the binary. The relevant strings are:

/usr/bin/cal
/usr/bin/who
/sbin/ping -c 3 www.google.com
mail

The attacker guesses that those are the command strings used to execute the functionality of the application: Calendar corresponds to /usr/bin/cal, etc... The attacker cleverly notices that mail doesn't have a full path. This means that the script will run the first mail command it finds in the PATH. So the attacker creates a command named mail in some random directory. They chose /tmp, but that choice is unimportant. The command is a symbolic link to /bin/sh. A symbolic link creates an alias between two files. In this case, when the operating system executes /tmp/mail, it will actually execute /bin/sh. They could have copied /bin/sh to /tmp/mail as well, but why bother. Copying takes time and uses disk space. Symbolic linking is equally effective and faster.

The final step is to set the PATH environment variable to begin with /tmp so that when the OS goes to execute the mail command, it will find /tmp/mail. And, being that this is just a symbolic link to /bin/sh, it will execute /bin/sh as DavidGilmour (remember that the program is setuid so it always runs as DavidGilmour).

Goal achieved!


Is HTTPS sufficient to protect app/server communication? Scenario:

Adam has designed an iPad app that will be publicly distributed.  The app will communicate with Adam's server via https.  While the fact that this app communicates with this server isn't sensitive, the particulars of the communication between the app and the server are -- things that are trade secrets might be inferred by seeing that specific data that the app is requesting of and getting from the server.  Adam is worried that Eve may be able to see the plain-text communication between the app and the server when Adam's app is running on Eve's iPad, connected to Eve's wifi network.

If Eve is a highly competent individual or small company (but not necessarily the NSA/CIA/KGB/etc), can Eve accomplish the goal of seeing the communication between the app and the server under these circumstances if the only encryption is via https?  This assumes that Eve can fully manipulate her own wifi network and accept whatever fake certificates and ignore whatever warnings the iPad may offer.  (This is NOT about Eve seeing communication between Adam's server and the app on Brad's iPad when he's using Starbucks wifi -- we assume that Eve controls the device and the network here.)

If Eve is able to see such communication, would Adam be well advised to encrypt everything sent between the app and the server, or is this adding cost to his project for slight or no gains?

You should assume that any data sent to a device is fully visible to the owner of the device.

Trying to transfer content to a device without actually making it accessible to the device's owner is effectively what DRM attempts to accomplish, with only limited success.  After all, can you think of any video games that haven't been pirated?  DRM can make it more difficult for a device owner to access the content, but there is no way to make it impossible.

HTTPS in particular mainly protects against snooping from people in between the device and you server.  There are a variety of techniques and tools that can allow even someone with little computer skills to intercept HTTPS traffic on their own devices.

The next step of protection is to add public key pinning to your app.  This prevents a user from using an HTTPs proxy, which is the most common (and usually simplest) way of intercepting network traffic.  By using public key pinning you make it so that the device owner has to root their device and/or reverse engineer your app to remove the public key pinning requirement.

After that it gets much harder, and with less benefit.


Prevention from cross site scripting in different scenerio? I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my application so in case we encode characters, html tags not rendered on browser.

So i have made a filter which blocked  and  tags only. Is there any other approach or any other characters or strings which i need to blocked??

It sounds like the approach you're taking to preventing Cross-Site Scripting is black-listing specific tags.

This approach is very difficult to maintain and would not be a recommended one as there are always new tags and parameters which could allow for Cross-Site scripting coming along, so it requires constant maintenance.  A good example of the variety of vectors that can be used for XSS is here.

If you need your users to be able to use rich content on the site (perhaps for formatting text), then perhaps another option would be to look at languages like markdown which could allow users to enter richer text, without the dangers of pure HTML.


Why is php not used for banking sites or for a banking transaction? Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site.

Why is this? What about PHP is holding it back from this, or what about these other languages make them popular for secure transaction?

For banking sites or major transactional sites the risk management costs mean it is much easier and cheaper for a large corporate to feel confident with an application developed in .NET and uses the security framework provided with .NET than to use PHP.

At the end of the day organisations will use the cheapest environment they feel can provide the security they want based on their risk appetite, their threat profile and the size and type of development teams.

Developing a secure PHP application is likely to cost much more than a .NET application at enterprise level.


Docker secret security I was trying to understand Docker secret functionality and had one query. Suppose our container is running a vulnerable microservice like PHP server which is susceptible to RCE. Can somebody attack my container through the IP address and gain a shell to my container? If yes can the attacker cat the contents of the secret file which is mounted?

Short answer: yes.
The Docker documentation says:

  Secrets are encrypted during transit and at rest... Here

, which is exactly what it is supposed to be. And rest in this case means: While it is not used by the docker container.

But if your running software needs to read the secrets (such as an SSH key) it has to be decrypted. This means that in every case the secret gets mounted to a docker container it will be decrypted.
And given this scenario every attacker who has shell access will be able to read this as well. This is not what docker tries to protect you from. See also: Docker Secrets


Is it considered worth it to replace OpenSSH's moduli file? Consequences of tampered /etc/ssh/moduli describes a possible risk if the moduli file for an OpenSSH server has been tampered with.

Taking the logic a step further, is there any concern with the default file shipped with OpenSSH? I ask because the Secure Secure Shell article mentions this:

  If you chose to enable 5 [diffie-hellman-group-exchange-sha256], open /etc/ssh/moduli if exists, and delete lines where the 5th column is less than 2000. If it does not exist, create it:

ssh-keygen -G "${HOME}/moduli" -b 4096
ssh-keygen -T /etc/ssh/moduli -f "${HOME}/moduli"
rm "${HOME}/moduli"

This reads to me as though DH primes less than 2048 are considered insecure, and should be replaced with larger primes. However, the OpenSSH developers, smart people, haven't replaced the file that ships by default with one that does include larger primes. Am I missing something?

Exchange/Selection process
Why remove primes shorter than 2000 bits? According to RFC4419, the key exchange starts with the client sending its preferences to the server in the form of 3 numbers:

the minimum acceptable modulus length,
the maximum acceptable length
and the preferred length.

Then the server chooses a random prime that best satisfies this requirement.
In practice (at least with OpenSSH 6.7), the client's minimum and maximum is always 1024 and 8192. The preferred length is 8 times the security level of the symmetric cipher. The server then chooses like this:

it discards the primes outside the min-max range,
then it picks the shortest available length that's not less than the preferred length
finally, it chooses one randomly out of those.

With AES-128, we end up with an 1024 bit modulus which is more like 2^80 effort to break. (It's not linear, you can't just multiply by 8.)
Why regenerate?
Why regenerate the file from scratch? To quote RFC4419:
The use of multiple moduli inhibits a determined attacker from
precalculating moduli exchange values, and discourages dedication of
resources for analysis of any particular modulus.

This has been demonstrated in the Logjam attack.
It is not as effective if everyone uses the same moduli file distributed with the SSH package. For this reason, I generated different moduli files on every host.
Note: modern SSH uses elliptic-curve Diffie-Hellman, which is more secure in theory.
If you want to generate new non elliptic-curve primes do this:
ssh-keygen -G moduli-2048.candidates -b 2048
ssh-keygen -T moduli-2048 -f moduli-2048.candidates

Then replace the contents of your moduli (usually /etc/ssh/moduli) file with the contents of moduli-2048


Is it possible to see who is connected to the guest network on a TP-Link WR840N? I have a TP-Link WR840N v2 router with a guest network enabled. I'd like to view the clients connected to it, but can't figure out how to do so. I'd also like to apply MAC filtering rules for that guest network if that's possible.

For clients, go to DHCP and DHCP Client List.

And for MAC filtering, you have "how to" from tp-link - official website:

How to configure Wireless MAC address filter on wireless router?


What is the correct way to make a password salt? I've made the below function to make a completely random 64 character long hash

   function password_salt($password){
    $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . "ewuwmeqwjkeq 7689" . hash("sha256", strtotime("now - 10 days") . $password));
    $salt = $salt . $password;
    for ($i=0;$i<10000;$i++){
        $salt = hash("sha512",$salt);
    }
    $hash = $salt . $password;
    for ($i=0;$i<10000;$i++){
        $hash = hash("sha512",$hash);
    }
    $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . $hash . "ewuwmeqwjkeq 7689" . hash("sha256", strtotime("now - 10 days") . $hash . $salt) . $salt);

    //salt is almost ready for production
    // go salt part 2
    $salt2 = hash("sha512", $salt . $salt . $salt . $password . mt_rand(1,100000) . "dsjdj3y87Yhuu(&^TYUGh" . hash("sha512", $salt . $salt . $password . $salt));

    //hash salt . salt2 . salt . salt2 . salt2 . hash salt2 timestamp
    $salt = hash("sha512", $salt . $salt2 . uniqid(rand(), true) . $salt . $salt2 . $salt2 . hash("sha512", $salt2 . strtotime("now")));

    // go salt 3
    $salt3 = hash("sha512", $salt2 . $salt . $salt2 . $password . mt_rand(1,100000) . "DMDJ3908_))O l;[h" . hash("sha512", $salt . $salt2 . $password . $salt2));

    //final salt
    $salt = hash("sha512", $salt3 . $salt2 . $salt . $salt2 . $salt3 . hash("sha512", $salt3 . strtotime("now - 1 day") . uniqid(rand(), true)) . uniqid(rand(), true));

    echo "Salt: ". $salt . "

";
}

Is this function good enough to make a secure salt?

With a language-independent approach, it's highly recommended to use well-vetted and time-tested techniques to securely hash your passwords (or any crypto-related issues, for that matters) instead of coming up with your own.

Why? Because you, by definition, is one brain. Most of the time, one brain doesn't catch its own mistakes until it's too late. Three brains is better, and four even better. Such libraries can have anywhere between tens to thousands of people working on them and/or trying to break them.

Since you're using PHP, I'd recommend using libraries that have little learning curve and they do everything for you (generating the salt, hashing, and verification) like PHPass. If you have the luxury of coding only for PHP 5.5, then you can use PHP's own API for that (check password_hash).

Finally, to answer your question directly, if you just want generate a 64 character long hex string (a gigantic 256-bit), I recommend using something like this:

$salt = bin2hex(openssl_random_pseudo_bytes(32));

Note: While 256-bit is fantastic, I think it's a bit too much for a salt. I recommend going with 128-bit (16 bytes), which will produce a 32 character long hex string.


Storing encrypted data readable only by user but created by server Context

I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in reports.

The problem is that I really want to secure the datas stored, meaning that I want my datas to be read-able only by the user and the server (Because it's exposed using a RESTful API, to server an angularjs application).

Data is stored in a graphdb called neo4j

Already thought

Storing an encryption key in each user node

Problem is that if someone steals my database, they just have to find the algorithm used to encrypt and they can get every flaw of every website.

Encrypt data sent by user with it's password (clear) on client side, so the server doesn't know the key since he is only storing the hashed password.

Problem is that the server will not be able to store encrypted data if he doesn't know the encryption key.

How can I achieve that? I really need to secure my data at this point, meaning that even if you steal the database, it's impossible to get data out of it, unless you are... me or the developper who created the encryption system.

One of the main cryptography principle is  Kerckhoffs's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge".

So the option with special key for every user sounds reasonable. Selected algorithm and key length should be strong enough to protect data in case when database is stolen. Recommendations for selecting algorithm and key length can be found in OWASP guide https://www.owasp.org/index.php/Guide_to_Cryptography

The main issue in that case would be how to protect user keys from stealing and implement appropriate key management.
The following items should be taken into account during implementation process:

Key storage: file or HSM (like SafeNet)
Frequency of key rotation (e.g. change keys once a year)
Master key (a key from storage with other keys) protection


Making passwd/shadow files more secure The passwd/shadow files in a unix-like OS contain sensitive info such as a user's password. In addition those files aren't necessarily secured: with a live CD we can access those files on the hard drive and potentially gain access to the sensitive information.

My question is: is there anyway to make those two files more secure -- perhaps "lock" them or even change their location on the filesystem?

If someone has physical access to the machine they can modify these files to create a new root account or crack existing password hashes which is useful due to the prevalence of password reuse.   Renaming or changing the location would be "(in)security though obscurity" and will provide no appreciable protection against this attack pattern.

Steps to protect your self:

1) Set a bios password,  and force your hard-drive to be the boot drive.  This however does not prevent someone from removing the drive from the machine.

2) Consider full disk encryption.  Even if you just encrypt /etc/ someone could replace /usr/bin or /bin with malicious binaries that could be run as root.   Even your /home/user/.bashrc file can be used to hijack your PATH and obtain root if you are a suoder.

But this isn't a prefect solution. You should think of security in layers and try and prevent physical access to the machine.  (@dr jimbob  has a good point.)