How can I check the iframe on my website is secure or not? My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?

There is no way to dictate how a client chooses to execute the HTML/JavaScript you provide.  This should never be a security concern.  If you are loading this iframe src based on a GET variable,  then this is XSS: http://site?iframe_src=javascript:alert(document.cookie).  In this condition an attacker can introduce JavaScript into another user's session, and this is a serious security concern.

If a site can be placed within an iframe,  then it is vulnerable to ClickJacking.  This does not expose the parent site that hosts the iframe,  but rather any site is subject to this type of manipulation.  There are ways of mitigating ClickJacking for sites that must be frame-able.


Virus scanning uploaded images to database I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, should I rescan images which have already been uploaded (or maybe only those that haven't been viewed by every member of the conversation yet), or just leave it be and only scan images that will be uploaded in the future with the updated antivirus?
Rescanning everything would be costly, and if the chances of an exploit in an image emerging and being used before the antivirus is updated are low, then does rescanning make sense? And if it does, which images do you advise me to rescan?

Just to pull some of the comments into an answer:
Firstly, this shouldn't be your responsibility, so if you decide to implement controls, choose something manageable.

A basic scan on upload may be straightforward, as long as you aren't getting overloaded with images. SO perhaps look at scanning unless your scan load or number of images uploaded per minutes goes over a threshold
A scan on access, as @schroeder commented, gives you the most up to date scan and you aren't wasting resources scanning images that may never be accessed.
A basic sanity check on uploaded files - are they valid image files


Decrypt Passwords based on using a user's password I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy).  Once the results of a test come back, we have people that use the information generated on sites such as 23andMe to find relatives and send out invitations for relatives to connect with our clients.  This is done with the client's permission. The accounts belong to the clients, they just give us permission to use them. This is why we do not use our own user names and passwords (the client needs to be able to log in to the websites too).

I have the database entry program mostly done, but one thing I need to be able to do is pull up their username and passwords (in plain text) so we can log onto the 3 different websites we use.

What I want to do is create an overall password that when applied to what is entered into the password field in the data entry program (to save the password) or pulled from the DB (retrieve password), it is convertible to plain text (be able to go back and forth from plain to encrypted using 1 key).

Then each of our employees with permission to view the plain text password has their own unique password that when entered make the key mentioned above.

The database I am working with is MySQL and the program our workers are using to manipulate the MySQL DB is being written in Java.  Any Java based examples or links to examples would be great.

I'm not sure this really offers much security, but the best way I see to do it is:

Have a master key.
Encrypt each customer password with the master key.
Encrypt the master key with a password derived (PBKDF2 or similar) from each employee's password.

Then, when an employee logs in:

Generate the employee's key from their password.
Decrypt the master key.
Use the master key to decrypt customer passwords.


What is a man in the middle attack? My university provided me with the following slide which is confusing me:

From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then authenticates Trudy as Alice. Other than that however I'm really able to explain what else is going on here.

Also, can this happen in symmetric key cryptography? The way I understand it, this can happen because as Alice and Bob exchange keys, Trudy could take it if the security was not good enough and then use it to pretend to send messages in place of Alice.

A man-in-the-middle attack is a simultaneous double impersonation: Charlie poses as Alice when he talks to Bob, as Bob when he talks to Alice. Since both conversations are simultaneous, Charlie can elect to pass chunks of data from Alice directly to Bob and vice-versa, adding his own parts selectively.

If Alice and Bob have a shared secret K, which Charlie does not know, then they can use encryption and MAC to prevent Charlie from doing a successful MitM (Charlie can still cut the wire and disrupt communications, though -- but he can no longer alter data without being detected, or read confidential data). The trick is to reach the point there such a secret K is shared; all the business with certificates and handshake in SSL is about doing just that.


Compromised Wordpress Admin account risk I am wondering what are the risks of a compromised Wordpress Admin account.

Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access to OS or database? If on the same platform, other applications are being run, can the compromised admin cause any issue to other applications?

(I can imagine the hacker would have full control over the website content and look, users account, and can install new plugins that leave a backdoor to come back. But any other risk beyond the wordpress site itself?)

The short answer is that such a compromise would give an attacker the capability to do anything that an admin could do. That would likely include:

Altering theme files
Installing plugins
Accessing the (Wordpress) database

Etc.

Of course, the admin would have the ability to install malicious plugins/files (like a webshell) as well.

  But any other risk beyond the wordpress site itself?

It's safe to assume "yes" - that there would be additional risk.

Without going into a huge amount of detail, the damage that could be done would be a product of:

Your webserver configuration (did you chroot your web files)?
The permissions with which the php executable runs
How prudent you've been setting file permissions throughout your server. Have you made any important files world-writeable?

Regarding that last point: of course, even if your "important" files aren't world writable, they may very well be world readable.

I'm not trying to self-promote here, but you might want to take a look at this webshell platform I made:

https://github.com/chrisallenlane/wash

I demo compromising a Wordpress application on YouTube. This gives you a pretty reasonable overview of the kind of trouble an attacker could cause:

https://www.youtube.com/watch?v=UPaUync0TVA

Please forgive the low-quality, monotonous video :)

TL;DR: if I had an admin account compromised, I personally would consider the entire system compromised and rebuild it from scratch, were that an option.


How do you tell a website they have expired security certificates? I often go to more obscure pages on NASA websites, and I have gotten used to running into an expired security certificate now and then. Over the last week, it started coming up a lot more, to the point I decided maybe I should tell them (rather than simply feel annoyed). But after a little looking around, I realized I had no idea how to direct that message within that giant organization to someone who could actually do something about it.

Is there a way for someone to get that message through to the right people?

Three recent examples:

https://sservi.nasa.gov/
https://trajbrowser.arc.nasa.gov/
https://settlement.arc.nasa.gov/75SummerStudy/Table_of_Contents1.html

(Someone else who checked the 2nd and 3rd address said they no longer get the warning, however I still do. The SSERVI site still shows that way for everyone.)

Update: The comment to contact the general address makes a good point in that if you do nothing else, you should do that. However, a lot of time could be saved by directing a message to the right people, and it seemed there could be a way to do that, if one knew a little more. That's why I posted at all, I thought someone might search later, find this, and get these notifications to the right place faster.

In this case, the answer is (sort of) in the certs (which is not that uncommon):

openssl s_client -connect sservi.nasa.gov:443 | openssl x509 -text

<...snip...>
        Authority Information Access:
            CA Issuers - URI:http://pki.treas.gov/noca_ee_aia.p7c
            CA Issuers - URI:ldap://lc.nasa.gov/ou=NASA%20Operational%20CA,ou=Certification%20Authorities,ou=NASA,o=U.S.%20Government,c=US?cACertificate;binary
            OCSP - URI:http://ocsp.treas.gov

The first link (minus the P7C file) provides a landing page, with a 'contact us': http://pki.treas.gov/contact_us.htm

Another tool (sometimes) worth checking into is whois - but the x509 authority information seems the more appropriate place to check.


Obsolete cryptography (SHA1) warning although certificate uses SHA256 I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message:

Your connection is encrypted with obsolete cryptography.
The connection is encrypted using AES_256_CBC, with SHA1 for message
authentication and DHE_RSA as the key exchange mechanism.

It complains about SHA1 although the only certificate that uses SHA1 is the root certificate, which shouldn't be the problem. Why does Chrome show the warning like this?
Here is the result from the SSL Labs test (certificate information and cipher suites on the server):
Path #1

[my domain]
RSA 2048 bits (e 65537) / SHA256withRSA
COMODO RSA Domain Validation Secure Server CA
RSA 2048 bits (e 65537) / SHA384withRSA
COMODO RSA Certification Authority
RSA 4096 bits (e 65537) / SHA384withRSA

Path #2

[my domain]
RSA 2048 bits (e 65537) / SHA256withRSA
COMODO RSA Domain Validation Secure Server CA
RSA 2048 bits (e 65537) / SHA384withRSA
COMODO RSA Certification Authority
RSA 4096 bits (e 65537) / SHA384withRSA
AddTrust External CA Root
RSA 2048 bits (e 65537) / SHA1withRSA

Cipher Suites

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA

Note: I know that AES_256_CBC isn't considered modern cryptography, so the warning about obsolete cryptography would still appear. I was just wondering about the SHA1 part.

The error message is just misleading

You said yourself:

  I know that AES_256_CBC isn't considered modern cryptography, so the warning about obsolete cryptography would still appear.

And that is why you get that message.

Now unfortunately the message itself is not very clearly phrased.

SHA-1 is used in several circumstances. And here the "SHA-1" refers to HMAC message authentication and not to its use inside certificates.

From the Chromium TLS page (Archived here.):

  Message Authentication

  You may see:

  “The connection is using [cipher] with SHA1 for message authentication.”

  This actually means that the connection is using HMAC-SHA1 for data integrity, rather than as a certificate signing algorithm (e.g. sha1WithRSAEncryption). The HMAC construction is strong enough that it is not broken when used with SHA1 (or even MD5) as the hash function, so this is not currently deprecated.

What to do
Enable and have the server prefer a cipher suite that Chrome likes better. Namely: Something with forward secrecy and either AES-GCM or CHACHA20_POLY1305. (The TLS page recommends TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.)

Since that is already in your list, all you have to do is change the server's preference for it.


What kind of access on the guest is required to break out of a virtual machine? Is it enough to exploit the vulnerability in a program? Is root or kernel access required? Are there maybe even possibilities to directly exploit the host without any vulnerabilities in the guest? To what extent does it depend on the hypervisor?

Hypervisors are designed to protect against malicious guests, but bugs exist.

A hypervisor works by emulating certain hardware components so hardware drivers in the guest can communicate with them correctly. It also sets up hardware accelerated virtualization of the CPU and memory. I explain a bit about x86 virtualization and how it works in another answer. In general, exploiting a hypervisor will require either exploiting a bug in the emulation code of the hypervisor (code which either emulates trapped instructions or hardware devices), or the underlying hardware virtualization technology provided by the CPU itself. Different hypervisors merely provide different ways to interact with the hardware-provided virtualization. Xen, KVM, VirtualBox, HyperV, etc. are all high-level interfaces to the same primitive VT-x (for Intel hardware), which provides a set of CPU instructions for managing virtualization context (entering and leaving VMs, for example).

  Is it enough to exploit the vulnerability in a program?

You need to be able to execute arbitrary code in the guest. One way to do that would be exploit a vulnerability in a program, for example exploiting a web server that is running on the guest.

  Is root or kernel access required?

Sometimes, but not always. Root itself is just a regular user running in usermode. The only thing that makes it powerful is the fact that the kernel trusts it, allowing a root user to compromise the kernel. Once the kernel is compromised, malicious code can run at the highest privilege level. Many hypervisor exploits require messing with the virtual hardware in a way that can only be done in kernelmode, but not all vulnerabilities are like that. Some can be exploited by unprivileged code running entirely in usermode. In general, kernelmode allows for more in-depth interaction with the underlying hypervisor, greatly expanding on attack surface area.

  Are there maybe even possibilities to directly exploit the host without any vulnerabilities in the guest?

Assuming the attacker has local unprivileged access to the guest, they may be able to attack the host over the network, if the host is listening on the network. This really depends on your setup.

  To what extent does it depend on the hypervisor?

Heavily. The vast majority of VM escapes rely on vulnerabilities in the hypervisor. An exploit against Xen won't work on KVM. An exploit against KVM won't work on HyperV. Etc. While there are certain vulnerabilities that apply to all hypervisors by exploiting the underlying hardware accelerated virtualization technology (e.g. VT-x), these are far less common and tend to be much more conditional. An example is an IOMMU bypass on Intel VT-d1 where Interrupt Remapping and x2apic are not supported. This vulnerability allows disabling IOMMU restrictions, regardless of hypervisor.


How can I use Message-ID in header to screen (filter) Emails? Recently started receiving torrent of spam emails immediately after ISP (Charter-Spectrum) switched to an upgraded Email system. Five of my ISP email addresses getting the same spam every day.  Some kind of UTF-8 coding is used to hide detection of text in the From and Subject lines but all have different (spoofed & hidden) From addresses.  The only thing consistent in all these 100+ emails is that they all have @response.foxnews.com in the Message-ID header line.

Is there any way I can filter-out these emails by screening-out all emails with @response.foxnews.com in the Message-ID header line using Outlook or using some interfacing email-spam-cleaner software?  Is there any email-spam-cleaner software that allows filtering based on any header line entry?  Is there some interfacing third-party email-spam-cleaner software that can do this? One that will interface with Outlook Express or with my ISP?

In this age of global spam epidemics why are the filtering and junk-mail screening option so limited that they are largely useless?

I use Outlook Express, which does not have as many options as the full Outlook product. Also, when I talk about email "headers", I am referring to FULL header lines. Most Email programs allow filtering of To, From, Subject header lines, but with the highly complex spam nowadays one needs to be able to filter ANY line in a full header, especially the "Message-ID" header line.

Yes, most email clients support this capability. I use Thunderbird but Outlook can do it as well. I haven't touched Outlook in awhile, but it's something like this:

"File" tab in the main menu
    "Manage Rules and Alerts"
       "New Rule"
           "Select a template" from the Rules Wizard dialog window.

Once you get into it, it should be pretty clear.

Yes you can filter on any header. I used to set a filter at work on a header of "PHISH" to flag corporate phishing test emails.


Over which data is the verify data in the DTLS finished handshake message calculated? I'm currently trying to implement DTLS 1.0 and I'm stuck at the finished message of the handshake. It seems that my calculation of the verify_data is wrong.

RFC 4347 says in 4.2.6.

Finished messages have the same format as in TLS.  However, in order
to remove sensitivity to fragmentation, the Finished MAC MUST be
computed as if each handshake message had been sent as a single
fragment.

Does that mean that the reassembled handshake messages are hashed as if they where TLS handshake messages? I.e. with header but without the message_seq, fragment_offset and fragment_length fields? Or are they hashed without the handshake header at all? Or is each handshake message containing a fragment concatenated?

PS: I can't tag it DTLS because I don't have enough reputation :/

I read as if ... a single fragment to mean you format each message as one fragment that contains the whole message, that is, fragoff=0 fraglen=totlen. The BouncyCastle Java implementation (as of 1.55) agrees with this, and I think someone would have noticed if it didn't interoperate:

package org.bouncycastle.crypto.tls;
...
class DTLSReliableHandshake {
...
private Message updateHandshakeMessagesDigest(Message message)
    throws IOException
{
    if (message.getType() != HandshakeType.hello_request)
    {
        byte[] body = message.getBody();
        byte[] buf = new byte[12];
        TlsUtils.writeUint8(message.getType(), buf, 0);
        TlsUtils.writeUint24(body.length, buf, 1);
        TlsUtils.writeUint16(message.getSeq(), buf, 4);
        TlsUtils.writeUint24(0, buf, 6);
        TlsUtils.writeUint24(body.length, buf, 9);
        handshakeHash.update(buf, 0, buf.length);
        handshakeHash.update(body, 0, body.length);
    }
    return message;
}


GnuPG sub-keys revocation My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored inside an smart card.

My question is, what to do if my smart card gets compromised?

If I understand correctly, I must revoke all sub-keys using revkey command on the prompt of gpg --edit-key $KEYID. After that, I must create new sub-keys and export and share again my public key.

Is this new public key my current public key? My new public key is twice bigger.
How can I propagate sub-keys revocation to the OpenPGP network?
What happens with people having my previous public key?
What if I delkey sub-keys after revkey? My new public key changes but keeps a similar size.
If I do the previous step, will sub-keys revocation propagate to the OpenPGP network?

After generating the revocations and new keys upload it to the sks network
gpg --keyserver pool.sks-keyservers.net --send-key 0xDEADBEEF.  Once that is done you can delete the old subkeys from your copies of your key if you want.

Nothing happens automatically but they will then be able to download an updated copy of your key from with revoked subkeys and new subkeys from the keyservers.  You might want to set an expiry date on your key to force people to update your key on a regular basis.  You can update the expiry date and reupload the key before it expires.

You can also e-mail people you know have a copy of your key suggesting they update it from the keyservers.

As long as you upload the revoked keys before deleting them they should propogate through the keyserver network


Is it possible to detect when a device has been MAC filtered on a Wi-Fi network? Is it possible to detect when a device has been MAC filtered on a Wi-Fi network?

I don't know if it's in the 802.11 standard, or if it's just implemented by ignoring the client network packets.

MAC filtering is implemented by, indeed, ignoring packets whose source MAC address is deemed "inappropriate" by the access point. You won't get a response packet informing you that the access point does not wish to talk to you.

You can test for a blacklist filter by temporarily changing the MAC address of your device: if the device can connect with another MAC address, then its "natural" MAC address is blacklisted. However, most MAC filters work more with whitelists, i.e. a finite short list of allowed MAC addresses, all others being filtered out. This can be tested by configuring your device to mimic the MAC address of another device which is allowed to connect. (For tests only ! Stealing MAC addresses is rude, and usually illegal if you do it in order to work around a security system. Also, having two devices with the same MAC address, up simultaneously, tends to break connectivity for both.)


Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest? Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that:

"during the pentest there exist the possibility to delete or modify sensitive data in the production environment unintentionally due to the execution of some tools, exploits, techniques, etc."

The client says that he is not going to accept that clause and that he believes that no company would accept that clause. He thinks that during a pentest information could be accessed but never deleted or modified.

We know that the execution of some tools like web crawlers or spiders can delete data if the web application is very badly programmed, so the possibility always exists if those types of tools are going to be used.

I know that these are the conditions of the client, and should be accepted, but:

Can a skilled and professional pentester always assure that no data will be deleted or modified in production during a pentest?

Can a pentest really be done if the pentest team has the limitation that data cannot be created nor modified?

Should the pentesting company always include the disclaimer clause just in case?

There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character).  as you say a web crawler can delete data from a system if it's been set-up badly.

I'd say that what should be said is something like "every care will be taken to ensure that the testing does not negatively affect the systems under review and no deliberate attempts will be made to modify or delete production data or to negatively affect the availability of in-scope systems. However with all security testing there is a risk that systems will be affected and the customer should ensure that backups of all data and systems are in place prior to the commencement of the review"


Running an app in docker on Windows If I run an app in a docker container using Kitematic, does that help protect my system from that app?

I mean: does it prevent any problems if the app tries to damage the Operating System?

Whilst no single layer of security can provide complete protection from attack, adding a layer of containerization/virtualization to a solution adds a barrier which an attacker would have to overcome to attack the host system.

In the case of Docker on Windows (so running linux programs on a windows host), it makes use of Hyper-V virtualization so an attacker, to successfully compromise the application, would have to break out of both the container and the Hyper-V VM to compromise the underlying host.


How is "hacking" even possible if I "defend" properly? On a Linux-based server, I follow basic practices as below:

Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time).
Monitor all incoming network traffic to the administrative files.
To extend the layer of protection from #2 above, monitor local file changes (especially ones that have commands that require sudo privileges).
Validate all user input, so that all of the user input is guaranteed to be safe.

As a novice developer, I don't understand how a hacking is even feasible if the server admin practices the above.

Not making sure all security updates are applied? Remember, as the defender, you must win 100% of the time. A hacker only needs to win once.

The steps you listed are also a lot easier said than done (except the password thing... and yet people still choose horrible passwords!).

2) Also, what's a "credible source" for a public facing web server? The entire Internet? The entire Internet, sans China/Russia (/some/other/countries)? Automated systems can detect many types of attacks, but just like antivirus they can only go so far.

3) Monitoring local files is good, but, again, it's not a panacea. What if the attacker manages to inject code into the web server, and then uses a kernel bug to get code into the kernel... without ever writing a file to the disk? At that point, they could write files to the disk, and use a root kit to prevent most (theoretically all) online scans from noticing any changes to the system.

And even if they only manage to exploit the web server, they can do everything the web server can do (which might be all the attacker was interested in anyways).

4) You should always validate user input. Most developers know this (and many try to do it). Sadly, it's much easier said than done, which is why we continue to see issue after issue where user input isn't appropriately validated. You'll never be able to guarantee any real piece of software is correctly validating all user input. Read some PHP+MySQL questions on StackOverflow to see how many people think mysqli_real_escape_string() prevents all SQL injection attacks ("where ID = " . $val is vulnerable, even when $val is the output of mysqli_real_escape_string!).

Even if you could (you can't) ensure every known attack vector was guarded against, you can't do anything more than wildly swinging in the dark against and unknown-unknown (well, continually educating yourself helps).

As an example where your defenses wouldn't have done anything, I was taking part in a security course where we're doing "war games". I was able to root an opposing team's server by being able to get one of their user passwords off another machine (one of them screwed up and typed it into bash as a command by mistake, and they never thought to delete it from .bash_history).

From there, I spoofed the IP of the machine they usually logged in from, and SSHed in, inputting their username + password. I had limited access to the system. I then ran sudo vim, entered the same password again, and had vim spawn a bash shell. Tada! Root access, from a credible source, without modifying any local files in an unusual way, without exploiting a weak password (it was bad, but even the best password in the world wouldn't have helped), nor relying on unvalidated user input.

At that point, being mischievous me, I manually modified all the log files related to my legitimate login, and obliterated their IDS (I'm betting they won't be observant enough to notice I replaced all of its binaries with copies of /bin/true!). A 'real' hacker would likely be far better equipped to ensure their activity wasn't detected by more vigilant admins, but I'd already accomplished my goal, and a small part of me wanted them to find out that someone got it.


Protect against malicious client with key derivation function (PBKDF2)? Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and submit it back to the server, communication uses relatively simple SOAP requests that contain the form in the SOAP body element.

I'm tasked with implementing the server side in this scenario. My problem is with malicious clients that might tamper with the embedded form ID (change it to some arbitrary value) and submit such a form back to the server. On the server side, a form with the modified form ID might already exist and would be overwritten by the submit, thus resulting in data loss.

My proposed solution would be to embed a PBKDF2 hash of the form ID alongside the plain text form ID. If the client tampers with either the plain or hashed ID the server would reject the submission. Is this a reasonably safe way to ensure form integrity? Is it a problem to disclose the hash to the client in this scenario (we are talking data integrity here, not confidentiality)? Are there any potential problems with my solution (e.g. use a better key derivation method)?

Any help is appreciated!

If the salt used for PBKDF2 is of non-trivial length, say 128 bits, and the salt is stored with the form ID on the server (only), then this will allow you to check whether the form ID has been tampered with.  There must be a secret component to the hash because of Kerckhoffs' principle, AKA Shannon's maxim.  In this case, the salt, stored only on the server, is the secret.


What is HPKP and how does it work in case of websites I was looking at HTTP Strict Transport Security (HSTS) implementation in firefox. Firefox stores this data for sites in a file called SiteSecurityServiceState.txt

I see entries in it like -

  support.mozilla.org:HPKP   3   17242   1483383397412,1,0,r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=
  web.facebook.com:HSTS   18  17227   1504027319798,1,0

HSTS is what I was looking for. It is configured in your webserver to send corresponding header in response header. Browser stores it and makes sure all subsequent requests always go to https and certificate in correct - does not allow to add exception (atleast in firefox).

So whats this HPKP and how does it work? Is it some other security configuration?

HSTS and HPKP are different concepts.

An HTTP Strict Transport Security (HSTS) header instructs clients to use HTTPS for all future connections to a website, thereby preventing downgrade attacks. In contrast to HPKP, it doesn't influence how certificates are validated.

An HTTP Public Key Pinning (HPKP) header instructs clients to pin a specific public key to a domain. So, if a HPKP-supporting browser encounters a HPKP header, it will remember the specified public key hashes and associate them with that domain. In the future  (until the specified max-age timeout expires), the browser will only accept a certificate for that domain if any key in the certificate's trust chain matches one of the associated hashes.

HPKP mitigates the risk of an attacker issuing rogue certificates after having compromised a certificate authority (occasionally happens). Your browser would normally be unable to detect a fraudulent certificate if it has been correctly signed by a trusted CA. (Although there are mechanisms to detect certificate revocations, e.g. OCSP/CRLs.) But if you have pinned a particular certificate to a website beforehand, the attacker won't be able to replace it without triggering a browser waning.

Note that since HPKP is trust-on-first-use, it will (similar to HSTS) only be effective after your first visit to a website. An exception to that are preload lists maintained by browser vendors for high-profile websites (Google, Facebook, Twitter, etc.). This means that even if DigiCert (Facebook's CA) would be compromised today, an attacker would be unable to intercept your connection to Facebook because the original certificates' public keys are preloaded in your browser.


In DNSSec, are Delegation Signer Records always SHA-1? I'm creating a RSA/SHA-512 Zone Signing Key and Key Signing Key at Dynect Managed DNS (corporate offering)

The Delegation Signer Record that was created is SHA1.  Should I be concerned about this?

To answer the question, no, the DS records have many different possible algorithms. This list can be viewed here.

I'd recommend moving from SHA1 hashes to at least SHA256. Personally, I use ECDSAP384SHA384 (Algorithm number 14).


How to handle personally identifiable information (PII) as a startup? My startup is finally faced with the potential responsibility of handling PII, and we're concerned with doing it properly from a risk perspective but also so that we're doing this correctly.

What would be the best approach if we wanted to do it ourselves?

We don't currently have a security engineer, but we're operating relatively safely and in Google's Cloud Platform. We've made good design decisions in how our app security works, but we may have to start handling PII so we want to make sure that if it ever is at-rest we are covered.

I know Google offers certifications and white papers on their security, but I'm guessing we'd also need to get our own, from a third party auditor.

Any description of how to go about this would be immensely useful, from best practices and considerations to mandatory implementations.

This is a very broad question, so I'm suggesting a broad answer.  Check out the NIST Cybersecurity Framework, which is a comprehensive plan you can follow to help ensure you're covering all the bases.


EXECUTE AS impersonation I wrote a web application that is using AD authentication (Windows) and has it's own authorization module (RBAC like). Backend is SQL Server.
A DBA on my team is not happy with us using a service account to talk to the database, he would rather have the actual user impersonated using EXECUTE AS at the database level. He would then use actual SQL roles mapped to lock down the access per user. To me it sounds it would be a bad idea as now I have to manage 100s of users at the SQL Server level and it just makes the attack surface bigger.
What other arguments for or against this setup exist?

Here are a few reasons why using EXECUTE as might be a worse idea:

If the web application has SQL injection flaws the attacker could alter their privileges.
If the web application has a vulnerability that leads to attacker controlled code on the server (file upload, command injection, etc) then the attacker can execute queries with the privileges of the connection user.

Recommending security solutions without understanding who or what you are protecting against tends to result in ineffective security controls.


how to close all ports A few days back when I scanned my PC there were no open ports and now I have 5 ports:

PORT     STATE SERVICE
80/tcp   open  http
111/tcp  open  rpcbind
631/tcp  open  ipp
902/tcp  open  iss-realsecure
3306/tcp open  mysql

Is my security at risk? Can anyone tell me how to close all the ports to be safe? I think there is no need for those open ports

Ok.  So the reason that ports are visible on the network is fundamentally that a program you have running on your computer has asked to make that port available on the network.

In the case of the services you've listed the following are the common services that will listen

80/TCP - A web server (something like Apache or Nginx)
111/TCP - usually relating to RPC services (like NFS)
631/TCP - IPPP or CUPS, a printing service
902/TCP - likely something relating to VMWare
3306/TCP - Commonly MySQL .

In and of themselves having a service exposed to the network won't necessarily damage your security, but each one provides a point of attack on your host.  So for example if you have a weak password on your MySQL service an attacker might be able to guess that.

In order to stop them listening, you have a couple of options.

If you don't need that service to be running on your PC, then you can stop the associated process.  runnning the command sudo netstat -plnt should show the listening port and the process/program name associated with it.  Ones that show the local address as 0.0.0.0 or [YOUR_NETWORK_IP] are listening on the network and could be contacted remotely.  So once you have a list of the services just shut them down.
If you do need the services but don't want them to be available on the network you can generally make them only listen on the "localhost" address.  How you do that will vary from service to service, but if you search for "binding to localhost" and the service name you should be able to find something
Perhaps the easiest way to address the problem is to run a firewall on the host to block inbound connections as @smokedispenser mentioned in his comment. Assuming you're using ubuntu something like ufw could be worth looking into.

what's probably happened to cause these services to start listening is that you've installed some new software which provides network services.  At a guess have you perhaps been practising web development?


Identifying bridged ad-hoc connection from router assuming I can access router only. There is a machine#1 connected directly to the router through LAN and it hosts separate ad-hoc wifi. Now machine#2 using bridged connection connects to router through machine#1 using mentioned ad-hoc. With access only to router can I detect machine#2 or not? According to my knowledge router only displays MAC of machine#1 but I might be wrong.

Thanks for answering.

Assuming the use of TCP/IP networking, yes you can. It will list the IP address (and MAC) in the ARP table.

Depending on the configuration of your network, that IP address may be from a different range than the ones your routers DHCP server gives out.


Best strategy to recover running Macbook "modern" Pro ram (Take a Macbook Pro 2017 Sierra 10.12.5 for example.)

What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, created a folder Memory_Captures and:

sudo chown -R root:wheel osxpmem.app/

..and:

sudo osxpmem.app/osxpmem -o Memory_Captures/mem.aff4

I wonder if this is a good strategy in the future. Perhaps an alternative is to powerbutton-off the laptop and then bootup a USB Linux which does not "touch" the RAM, but does the very act of power disconnection affect the RAM contents?

What's a better strategy to recover RAM data of a running Macbook Pro?

The best strategy depends on what your constraints and goals are. A quick answer...

Perhaps an alternative is to powerbutton-off the laptop and then bootup a USB Linux which does not "touch" the RAM

All bootable systems will touch memory. Lighter systems touch less, but still some. However, the memory will be scrambled with a (weak) LFSR algorithm, so the memory you read will need to be broken using cryptanalysis. It is possible, but it's not as simple as running strings on the dump.

does the very act of power disconnection affect the RAM contents?

The act of resetting the system will typically cause the LFSR scrambling seed to change. The BIOS may also wipe some (or all) memory. In that way, the act of turning on power changes memory contents, even if the act of cutting power does not. Additionally, every instant that power source is disconnected from the memory modules, more data is lost. The time without power must be minimal.
Software
This is a common technique where a privileged program is made to read all memory on the system. It is typically fast and does not risk hardware damage or loss of all data, but it can "taint" the memory with its own presence. Additionally, as it is capturing memory from a running system, there can be a bit of memory smear. This is an issue with two distant physical addresses that correspond to a contiguous region of memory. When accessing the memory is not atomic, you can have a snapshot of data from different points in time. The earlier addresses will be from an earlier point in time than the later addresses. There is an excellent paper  explaining this issue and the various workarounds for different types of memory acquisition.
The Volatility framework has many plugins for live analysis of memory on a system. It can, for example, dump arbitrary process memory for subsequent analysis. Unlike most other "raw" memory acquisition techniques, Volatility works with the system to maximize the relevance of memory dumps. However it is also quite invasive and uses a lot of memory. This is only an issue if the memory you want to retrieve is present in unallocated memory.
Direct Memory Access
When a PCI/PCIe device has been configured by a driver to become bus master, it will be able to initiate DMA reads and writes to arbitrary locations in memory. The speed of data acquisition then depends entirely on the transfer rate of the device. Common devices used are Firewire, Thunderbolt, and CardBus, which all have DMA capabilities. Custom PCIe devices can be hotplugged which also read memory contents. PCIe natively supports hotplugging, whereas legacy PCI may be damaged by live hotplugging. This technique has the benefit of not tainting memory with any software, but it has the same downside as the above method where atomicity is not guaranteed.
While not technically considered DMA, another way to gather memory from a running system is the IEEE 1149.1 debugging protocol, called JTAG. This involves a hardware probe being attached to a specific header on the motherboard. A signal is sent to the CPU that puts it into probe mode, turning it into a puppet. The CPU can be halted and memory read, making this technique capable of obtaining an atomic snapshot of memory. The downsides are that not all motherboards support JTAG, probe hardware can be quite expensive on older systems, and reading memory over a debugging interface is very slow.
Cold boot attack (reboot into a live system)
For this kind of cold boot attack, the system is rebooted into a system with a small memory footprint that reads the memory. This works because a reboot does not actually power down memory, leaving the previous contents intact. The downside is that the software you boot into will still need to eat up a small amount of memory. The laziest technique with the biggest footprint would be a live Linux OS. A slightly more complex technique that has a smaller footprint would be a custom bootloader. Finally, you can even write a custom BIOS that reads the contents of memory and exports it to another system, e.g. over a serial bus.
Unlike the above two options, this provides atomicity. As soon as power to the DRAM is cut (whether due to the actual memory modules being removed, or the system being rebooted), the entire contents of memory are frozen in time, providing a perfect snapshot. This can provide legally effective evidence, as you do not have to prove that your acquisition technique did not modify memory. There is a downside to this technique though. As it involves hardware, there is a greater chance of the contents of memory being destroyed. If you make a mistake, you can't go back and try again. Another issue is with the behavior of the BIOS. During the POST test, memory may be wiped for automated pre-boot testing. ECC memory is actually required to be wiped by the BIOS and put in a consistent state. Some of this behavior is described here, specifically in the context of the behavior being abused to mitigate cold boot attacks.
Cold boot attack (memory transfer)
A cold boot attack of this type exploits the memory remanence property of modern DRAM. To store a single bit of data, DRAM charges a capacitor. Every 64ms, the memory controller will check the contents of the capacitor and refresh it if necessary. To read a bit, the voltage of the capacitor is read. While, for reliability, they need to be refreshed every 64ms due to heavy leakage (they are very small capacitors), they can still often be read even seconds from the last refresh. This allows a system to be turned off and still retain memory for a split second. Exploiting this requires physically removing memory from the system (ideally after blasting it with ice-cold coolant to slow the memory decay) and transferring it to a system you control. This has no memory footprint as no programs must be stored on the modules, but it does carry with it a greater risk of memory loss. Every instant the memory is powered off, the chances that the capacitors fully leak their charge increases.
Applicable to both cold boot attack techniques, modern memory (DDR3 and DDR4) uses a technique called memory scrambling to reduce electrical interference caused by successive bursts of 1s or 0s which could overload the controller. Memory scrambling utilizes an encryption algorithm called LFSR. However, this algorithm is highly vulnerable to a number of cryptoanalytic techniques. You must keep in mind that a cold boot attack will likely require that you break the LFSR.
I wrote more about cold boot attack techniques in a question from a previous account.


Securing non-consumer machine-to-machine APIs with Encryption over SSL I'm working on an API that is intended to be consumed by another system. The data is not owned by the requesting machine and the user(s) that the data pertains to are not driving the transaction. You could think of it as the same use-case as a hospital web service that transfers sensitive data and the people that own the data are not involved in the transaction. Or a banking web service that is used to perform analytical queries against lots of user data but the users in the data are not driving the transaction.

Problem

I'm researching authentication & Authorization options for this use case but nearly every document I come across for securing APIs jumps to OAuth 2 and sometimes OpenID Connect. I don't think either are applicable, if I read the RFCs correctly. They seem to center around delegating authentication to a 3rd party with the assumption that a user will then authenticate.

Solution I'm Considering

I've been considering an HMAC token in the Authorization header of the request in which the request details are encoded and signed with a key the client app was given once. Same flow as AWS's authentication scheme for their apis. The only thing I can think of more secure than this is exchanging public encryption keys and having the client encrypt the request with my public key and having me encrypt the response with theirs (PGP/RSA Encryption). Either option would be over TLS with certificate verification. Am I re-inventing the wheel here? Is there a comparable standard of rules to follow for this use case?

Side-note about Encryption over SSL

I've heard it remarked once that encryption over SSL was redundant. I just watched Moxie Marlinspike tear apart SSL at Defcon through a man in the middle and certificate chain spoofing. There is definitely a big difference between the certificate exchange process included in SSL that happens on every session and the one that only takes place once for what I outlined above.

You need to separate authentication from authorization. OAuth 2.0 and OpenID Connect is a system for managing primarily Authorization, not Authentication.

HMAC is a method for symmetric signing. It gives you integrity and partial authentication, but not non-repudiation.

Pubic key encryption is asymmetric encryption. It gives you confidentiality . Note however that encryption by itself doesn't guarantee integrity or authentication. To add these aspects to a PKI encryption system, digital signature and certificates are used. Digital signature also provides limited non-repudiation.

There's really no difference between users to machines, user to user, or machines to machines auth. A machine to machine communication is less likely to complain about the inconvenience of some schemes, but the tactics used to mitigate specific threats models are exactly the same.

Most user-to-machine authentication uses password. In machine-to-machine, this is called pre-shared key (PSK) authentication. TLS can be configured to use TLS-PSK, though this is a relatively rare configuration.

A PSK can also be used to create a message authentication code (MAC). An MAC asserts that the data hasn't been altered in transit. TLS signs the data with MAC for integrity, or you can add HMAC to any messages in any protocol, but it's not a replacement for non-repudiable signature.

In some higher security settings, the system might need a scheme that prevents requests/document from being tampered and prevents the user/machine from later denying the request/document. This non repudiation is provided by digital signature. You can use GPG or S/MIME signature for this. Note that there's limitation on non repudiation from digital signature, in that the signer can just claim that their private key is compromised. In many situations, claiming key compromise often have less severe consequences than admitting to have signed the request/document.

An asymmetric encryption can be used whenever you need asymmetric capability. For example, if you want to allow a machine to be able to write to a data storage, but prevent said machine from reading stored data in the future (or prevent compromise of said machine to allow attacker to decrypt the stored data), then you can use asymmetric encryption.

In many distributed system scenario, you'd also want to be able to prove sequencing or timing of events. Many systems used blockchain to prove sequencing of messages. Alternatively, some may use a timestamping authority. A widely distributed blockchain, like bitcoin's block chain, can also be used as a decentralized timestamping authority.


How to educate users about the dangers of social engineering? What would be the best way to teach and test employees on the topic of social engineering?

What topics would you include?

I work as a technical/customer support representative and have to be aware of Social Engineers on a daily basis. The thing is it's hard to explain why it's effective to a group of people that have not done Customer Support. So, here's what I'd have you do:

Have everyone that has worked a customer support job recall that experience (raise their hands and tell stories about pleasing the customer and how that eventually becomes the goal of the position; try to get them to express the mindset of not wanting to let a customer down and specifically if they've ever broken policy for a customer)
Then, transition to how people take advantage of that desire to help the customer (which is typically by pretending to be a person they're not)

That's brief, but basically prepare customers by telling them that
malicious people will pretend to be someone (or something, such as an authority or business partner) to gain information. And that they'll often use information that's freely available to make their story more convincing.

One good activity might be to have people play a game like "two lies, one truth." Ultimately, from my experience, it comes down to having a sound business policy that limits the damages of Social Engineering and prevents it.


How perform Ping Flood, Ping Of Death, and Teardrop on local network? Is it possible nowadays to perform a Ping Flood, Ping Of Death, and Teardrop on local network?

According to this article, these three attack are useless and out of date. I'd like to test this on my local network.

I'm planning to create a VM with the latest Ubuntu release and low RAM resource (512 MB) to be running on my laptop.

So this will be a one-to-one attack; my host laptop will attack the victim VM (in the same laptop, but with low resources). I could even try multiple laptops attacking my victim VM.

How can I test these attacks?

These are all very old attacks. With the exception of a simple ping flood, you cannot even try to perform them using the latest version of Ubuntu, since it is not affected. You would need to download an old, unpatched copy of a vulnerable operating system such as Windows 95.

The Ping-of-Death involves sending a malformed ICMP request to a computer which crashes as a result. It is an actual DoS vulnerability leading to a crash, not a traditional bandwidth-based attack. It only affects very old systems that are vulnerable to it. In fact, the original was from 1997 and affected Windows 95 and several other contemporary systems. Any vulnerability in a system's networking stack that allows an ICMP request to crash the system could be categorized here.

A teardrop attack involves abusing IP fragmentation with oversized and overlapping payloads. When IP data is fragmented (usually in order to support routers that cannot handle large IP payloads), it contains information telling the destination system how to reassemble it. If this information is corrupt so that it specifies impossible overlap, it can cause old systems not designed to handle that to crash. Old operating systems such as, again, Windows 95 and very old Linux systems were vulnerable to this. Since then, such fragmentation-based attacks have stopped being relevant. Modern systems will gracefully handle improperly-delivered or corrupt IP fragments.

The only attack here which you can actually pull off is the ping flood (ICMP flood). This is a very simple attack involving nothing more than sending a flood of ICMP requests to the target. It only works if the attacking system has significantly more bandwidth than the victim, in which case it does nothing more than saturate the network and degrade service. This attack can be simulated using tools such as hping3. If you are performing this attack over a local network in a VM, you may need to artificially throttle the maximum network speed, since VM networking is so fast that you are unlikely to be able to generate ICMP requests at a high enough rate to cause denial of service.


Any one know about UDP traffic on source port 26221? On my captured network traffic i observe a flow having a source udp port of 26221 and have different destination udp ports. Some of these destination ports were standards IANA ports. The average packet size of these flows were 145 bytes and there were 364 packets within a minute of captured traffic.The destination addresses contains 2 unused ip addresses in IANA table, after 7 minutes the PC resume sending on the same port but the packets size was different.

Any body know if it is a normal traffic or not? any further check I may use to determine if this is benign or not? I goggled for port 26221 but i didn't find something about it.

The source port is almost always randomized so this information does not help classify the type of traffic.   The packet's contents may contain identifying information or the destination port may help, for example destination port 53 is probably DNS.

WireShark is pretty good about identifying traffic, and I am pretty sure it doesn't look at the source or destination port numbers.


Domain socket authentication as in MySQL and PostgreSQL secure? Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure?

The background for my question is: I want to get rid of having to manage all the database user passwords used by various web applications when accessing MySQL and PostgreSQL databases. In all cases when the DB and the App(s) are on the same host, domain socket authentication seems to be the best way to connect them, assuming that each app runs as a separate user.

This mechanism however seems to be very rarely used. Most web apps provide installation instructions proposing password authentication, most linux distributions use passwords by default (infamous MySQL root password) even if DBs are preconfigured for local access only.

I wonder whether there is a good reason to stick to passwords which seems to have only disadvantages (if you impersonate as the user you get their password from the config files and can then access the database without having to re-gain access to the user account).

The MySQL SO_PEERCRED authentication is fairly recent, it was added in version 5.5.10, March 2011. The similar Postgres authentication is a lot older. (Note that Postgres also supports ident, RFC 1413, authentication; MySQL does not, that would be another plugin, perhaps someone will write it.) The relative newness of the feature in MySQL would be one reason you don't see a lot of web apps using it.

The other reason is that, once the app gets enough use, the first thing you'll do for performance or reliability is to move the database to a different host, whereupon you'll have to set up a password (or some other method of authentication) anyway.

As far as security, however, I would say this method is very secure. It depends on the kernel for the security guarantee, that's all.


IoT secure identification scheme We're contemplating to use the following design to securely identify IoT devices from the cloud, and we would like to know if anybody would see major flaws in it.

The design is based on the use of a 4096 bits RSA key.
The public key would be included in the IoT device firmware.
At startup, the device will generate a random 256 bits ID (using a specific chip with true random capabilities or entropy from the user pushing buttons on the device). This ID will not change until the device is reset, and will be kept in RAM.
At first connection, the device will register in a cloud infrastructure sending an encrypted message containing the ID.
Then the device will send encrypted messages containing the ID and the payload. Cloud infrastructure will decrypt the message and will be ensured that it comes from the same device that had registered with the given ID in the first time.
JTAG capabilities are supposed to be disabled on the device. Potting can be considered.
Firmware is supposed to be genuine (user has the ability to flash his device before using it).

In those conditions, do you think there is a way for an attacker with access to the device to steal the ID?

Also another question is which pseudorandom generator could we use (library?) for the RSA encryption?

Thank you very much!

I would recommend the following:

Its best if you deployed a well-tested TLS 1.2 protocol on this device for the purposes of secure authenticated communication rather than invent your own protocol.
Deploy a client certificate on each device and store it as well as the root CA certificates on the device.
Some micro-controllers have an on-chip secure SRAM/EEPROM storage area that can be used ot store keys - e.g. Maxim's MAXQ1010 has a 128 bit storage. Hash the device's certificate and CA root certificates and store this hash value in on-chip secure storage. At startup, the device should generate a hash of the certificate and root CA contents and check whether this is the same as the stored value, if not give an error and refuse to start. Alternatively, store the certificate and root CA within programmable memory for micro-controllers that are one-time programmable.

In summary, by using the current generation of TLS you can rest assured that you've implemented a robust and well-researched protocol. You can then focus your time and effort on developing other functionality of your solution.


Mitigation against MITM at Starbucks Free public WiFi, for example Starbucks, is convenient.  I wonder if there is a way to verify that a laptop has connected to the Starbucks wireless router and not to a man in the middle that tricked my laptop using ARP spoofing.

I might use Starbucks WiFi to connect to a corporate VPN.  Would it make sense to do a quick banner grab and common port scan of my default gateway to see if anything looks odd before I try to connect to the corporate VPN? Does Starbucks use a consistent RFC 1918 private network IP address for the router?

For this question assume the bad guy did his homework.

-My laptop receives an ARP spoof before I am able to connect to my VPN.

-The man in the middle has a certificate from a trusted CA.
https://raymii.org/s/blog/How_I_got_a_valid_SSL_certificate_for_my_ISPs_main_website.html

Not really, no.

First, some terms. You mention ARP spoofing; this is not something you can detect at the IP level. ARP is what tells you which MAC address to address your frames to in order to send them to a given IP; ARP spoofing means you think you're sending them to the right IP, but your device addresses them to the attacker at the MAC layer. This can, however, be detected by software that monitors ARP traffic (by paying attention to ARP updates, and noticing when someone sends one that seems to conflict with a previous update).

The defense to a MitM attack on a TLS-based VPN is certificates (others use shared secrets). Someone with a forged certificate has gone well beyond the "done their homework" stage, into the "this is a serious attacker with serious capabilities" stage. Relying on things that aren't designed to stop a MitM in any way and are easily replicable (like an RFC 1918 address, or the list of open ports) is not likely to work. If the bad guy has the capabilities your question implies, they can just forward all packets on to the router unchanged except for those they want to mess with. You can't detect this, except by checking the public key of the VPN certificate against a known-good value, or by detecting the ARP spoofing in the first place.

There are other things an attacker could do; for instance, they could set up a rogue AP connected to the real one. This doesn't involve ARP spoofing, and can't be detected at the IP layer. It's not all that difficult.

Basically: There are ways to do an MitM attack. To prevent that, certificates were invented; the point of a certificate on a VPN is to prevent MitM attacks. You're asking how to avoid an MitM while assuming the thing designed for that exact purpose has been compromised.


What are the risks of publicly hosting OWASP Juice shop For those who don't know it: The Juice shop is an intentionally vulnerable webshop which 'supports' SQL injection, XSS, DoS and all this kind of nasty stuff. It's nice to run on localhost and play a little around.

So given the facts that it's

Well tested
Made by security professionals
Highly vulnerable

What will be the risks when I publish it to, let's say, Azure?

Something I can imagine is for example nasty JS scripts injected by others, but I know as well that for the DoS case, they make sure the app only freezes for some seconds, instead of until restart, so there are (at least some) safeguards.

If you're running nothing else on the same Azure instance, and nothing on that instance's filesystem contains anything sensitive, then there's not much of a risk factor.

I reviewed a writeup of all the challenges on the Juice Shop, and several of them involve SQL injections that could allow you to modify content on the site. I think your biggest problem is going to be that an attacker could inject a bunch of malicious content and turn your site into a phishing domain or something. Since it's a forum-style product you may also find that spammers fill up your instance with junk. If you're only running this short term and intend to kill the instance after a day or two then I wouldn't worry about it at all.

One countermeasure you could take is to implement HTTP Basic Auth on the webroot of the instance, so that all requests require authentication. That way you can run a public instance but only give access to those who need it.


How to defend against homograph attacks? Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so similar, how can they be differentiated?

Browser vendors already try to protect you from homograph attacks by enforcing  policies how IDNs (Internationalized Domain Names) should be displayed in the URL bar.

Their measures include blacklisting potentially confusable symbols (e.g. ֊, the "Armenian hyphen" U+058A) and displaying URLs with characters from non-latin alphabets as Punycode under certain conditions. So, if you visit

https://wikipediа.org

the URL will be displayed in your URL bar as

https://xn--wikipedi-86g.org/

following the Punycode conversion rules, which you can easily distinguish from wikipedia.org.

If you're interested in the specific algorithm your browser uses to display IDNs, see:

Mozilla's IDN Display Algorithm
Google Chrome's IDN policy

However, converting bad IDNs while maintaining usability (e.g. you'd still want to display a literal ä to someone in Germany) has turned out to be somewhat elusive which is why even in 2018 new attacks have come up.

If you don't trust your browser's built-in protection, there is also a browser extension available which warns you about IDN domains (as @defalt points out). Or you can choose a manual way of detection, as @wchargin describes in his answer.


What's the modp length of diffie-hellman-group-exchange-sha256? OpenSSH 6.2 offers the following key exchange algorithms by default

ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

The group size of the first three is obvious. The same holds for the last two.
But it's unclear which group the two algorithms

diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1

operate on. It's hard to accept that such an important point of security is undocumented. The RFC 4419 says nothing about it and so does the manpage of openSSH.
Can someone put some light on this please?

A DH group is defined by a prime modulus and a generator. The prime modulus is a bit expensive to generate, so OpenSSH will not do that on a general basis. Instead, sshd will, upon receiving a connection, use one of the groups in the /etc/ssh/moduli files. That file contains pre-generated moduli of various sizes. You can use the one provided with OpenSSH, or generate your own with ssh-keygen; see the man page (there is no security issue in using the same group as other people, but nevertheless, for some psychological reason, some sysadmins experience a feeling of higher security when they generate their own moduli).

The actual selection process is, in OpenSSH source code, in the choose_dh() function in the dh.c file. Roughly speaking, if the client wants at least min bits, at most max bits, and preferably n bits, then the server will choose among the moduli in the min..max range; it will try to get the smallest modulus which exceeds n, and, if there is none, the biggest modulus it has (still in the min..max range, of course). If the server finds several modulus of the same "optimal" length, then it selects one randomly. If the server knows of no modulus in the min..max range, then connection fails.

The default /etc/ssh/moduli, at least on my server, appears to have moduli of size 1023 to 8191 bits.


Why is compression done between hash function and encryption in pgp? What are services of pgp? How is compression performed between hash function and encryption? How it can be applied in reality?

Compression must occur before encryption, because compression is inefficient on encrypted data: compression algorithms work on detecting redundancies and structure in the data, and encryption is designed to hide redundancies and structure. Basically, compression does not work at all on properly encrypted data. Conversely, if compression works on encrypted data, then the encryption layer should be viewed with deep suspicion...

When hashing occurs in PGP, it is as part of a signature algorithm, or as an integrity check which is generally known as a MAC. There are several ways to do a MAC; the theoretical "good" way is to apply the MAC on the encrypted data. However, PGP dates from an older time where theory was not yet fully worked out, and uses a hash value (i.e. a function which as no key) and then includes the hash in the encrypted data (see section 5.13); the hash value is turned into a MAC by virtue of reusing the encryption key. In the case of such a MAC, the MAC (i.e. the underlying hash) occurs on whatever is encrypted, so that's the compressed data (if compression was used at all). Since you talk about compression "between" the hash and the encryption, then I suppose that you are not talking about that hash at all.

When the hash is part of the signature, it is customary to compute the signature on the cleartext data, because that's what is "morally" signed, and a signature is supposed to be a proof convincing for third parties. An encrypted message is not convincing for anyone except those who can decrypt it. So the idea is that a signed-and-encrypted message is first signed (and hashing occurs as the first step of the signature), and then the whole thing is encrypted; compression, if any, then occurs just before the encryption. The recipient will then decrypt what was received, and uncompress if compression was applied, and thus obtain a cleartext message with signature that he could show to other people. This sequence of operations thus "makes sense".


How do you analyze an unknown network protocol? Of course Wireshark can be used to sniff traffic - you can inspect each packet or chain of packets.

But how would you do it smarter? Which tools do you use to identify behaviors or to automate the process?

My goal is to identify the different functions, opcodes and everything I can learn about the protocol and software (I have both the client and the server).

There's no way to easily automate this in any useful way, because protocols are designed by humans. As such, they don't really follow any set pattern or rules. You're going to have to put the brain-work in yourself to dissect them.

However, there are some tricks:

Use Wireshark to separate out individual conversations and identify the high-level communication patterns.
Use a "smart" hex editor to dissect the packets. Hex Workshop is a good choice (though it's not free) since it allows you to define C-style structs on data.
Use a diff tool to identify changes between packets.
Use IDA (or another static analysis tool) to identify where network APIs (e.g. Winsock) are used to send / receive data, and work out what they're doing.
Use ImmunityDebugger, OllyDbg, WinDbg or another debugger to trace execution in a live environment. This is especially useful when sending test packets to a client or server app, because you can see where validation tests pass / fail and why. Using distinctive values in these packets allows you to see what types of data flow to different parts of the code, allowing you to identify their function.

In the end, you still have to be a decent reverse engineer to work with this. If you've never attempted to do something like this, I suggest you try it with a simple openly documented protocol and work backwards - try to figure out how it works, then compare your observations with the documentation.


Wiping a computer of personal information while keeping the operating system intact I have a unique situation but will try form this as a generally applicable Q&A:

I must leave my Operating System intact, but completely wipe my information from the computer. How can I do this?

The 64bit CPU laptop is running Windows 10, after upgrading to it for free from Windows 8.1.

This issue stems from a separate problem with the laptop in question, calling for it to be sent in for repairs. The operating system needs to remain intact for service reasons. The operating system cannot be reset because the recovery partition is missing files for whatever reason and needs to be reloaded by the manufacturer I'm sending it to for service anyway. No recovery media is available. Before sending the laptop anywhere, I'd like to wipe all my information from it. (I have backed up all data including one backup with the system image, though I probably won't reload at. There is a limited amount of sensitive information and I might be able to handle it 'manually' using a tool like CCleaner, but this question still remains and I'd like to figure this out.)

I'm under the impression reformatting would be a good way to do this, since my goal is to have a 'clean slate' before sending this laptop anywhere. As I said however, there is no recovery media available and I need to leave the OS in-tact. I could reformat using a free OS (e.g. Ubuntu) but ideally could leave the OS as is so the system files can be examined as they are.

It's possible I'm wrong the OS can remain 'as it is' while I wipe the laptop of my personal files, and maybe I should reformat (the service center claims they'll reload the original OS and recovery partition anyway).

I'm also aware that casually deleting sensitive files may not cut it. In this particular situation, I don't expect having more to worry about than casual information theft, but I'd prefer to 'over-engineer' this security solution prior to leaving the laptop out of my control. CCleaner is a tool I understand does 'permanently delete' data beyond reasonable recovery in most cases, so that could work for me (I'm not trying to secure this against a major organization, just casual or determined criminals). I'm open to suggestions or hearing I'm wrong about CCleaner.

I have tried to look for answers to this question, and there are plenty of Q&As on SE about deleting personal info, but I haven't found any Q&As about, basically, how to get a clean slate while keeping an OS in-tact, without any recovery media.

So, to restate my question: How can I completely wipe my information from a computer while keeping the current operating system intact, with no access to OS recovery media?

Windows 8 and 10 have options to reset your operating system to factory defaults, with or without keeping your personal files.

Click here to see how to do that

Additionally, you can use a utility called eraser to securely erase free space left on the drive.

Click here to check out eraser

This combination would be the simplest method to accomplish what you want accomplished, to the level of security that would most likely suit your needs.

Edit: Microsoft designed their reset tool to be able to securely erase your data, suitable for situations in which the ownership of the computer itself is transferred. This means that eraser may actually be unnecessary. However I will keep it included with this answer for completeness purposes.


Proof of Work as password hash a good idea? Our users log in with username/password, and have a cookie that allows them to remain logged in. Our users are expected to run updated versions of JS.

Assuming someone snags our database at some point,

Is it a good idea to reduce the entropy of our stored passwords by having the users perform a reasonable proof of work task on login and submit that as the password, and increase the difficulty over the years?

What this does:

protect the users from having their weak passwords cracked and associated with their online identities

What this does not:

provide a session key
provide DDoS protection
provide any other server security

clientside registration/login:

h = password
d = "0000f"
do:
  h = hash (h + username + salt)
while (h > d)

send("login", username, h)

serverside login:

d = "0000f"
listen("login", username, h)
if h > d:
  user = database.get(username)
  if user.pass == h:
    send("accepted", true)
    session.user = user

clientside login part 2:

listen("accepted", accepted)
if accepted:
  set cookie("user", user)
  set cookie("h", h)

The advantage of this is that the user does not have to resubmit their password to update the difficulty.

I have implemented this protocol, but I haven't seen this anywhere else. And the first law of cryptodynamics is "Thou shalt never roll your own".

If this works, I would love to see this incorporated into a certificate to show the user that the server stores the user's secrets responsibly.

I'm not an expert here, just throwing around my thoughts since your idea is neat and I'd like to explore it.
As pointed out by @PwdRsch, the password14 talk [video], [slides and sample code] from 2014 (while not the strongest talk I've ever seen) is on exactly this topic.

I have a few issues with your scheme the way it is. First, to prevent replay attacks you should really have the server generate a nonce for each login and send this to the client (since the nonces don't need to be key-strength, and you don't want to present an easy DoS, get them from /dev/urandom rather than the usual /dev/random)
Second, both the attacker and the honest user need to do O(hash_prefix='0000') work, which will be a far bigger penalty to the honest user on their smart phone than it will be to the attacker on their 12 GPU hashing rig. Giving the advantage to the attacker is bad.
Let's fix these by doing something like this:
Client-side:
h = "0"
d = "0000f"
hashed_pw = pbkdf2( password )
do:
  h = hash (h + username + hashed_pw + nonce)
while (h > d)

send("login", username, h)

Server-side:
listen("login", username, h)
user = database.get(username)
if "0000f" > hash (h + username + user.hashed_pw + nonce)
  send("accepted", true)
  session.user = user

Here the server has to do O(1) work (a single hash iteration), the honest client needs to do O(hash_prefix='0000') work, and the attacker need to do exponential work in the length of the password: O(2password_length-1) * O(hash_prefix='0000').

Having hardened your algorithm a bit (but me spending an hour staring at it by no means implies that it's prod-ready), let's look at what it's accomplishing. I assume your threat model is to protect against online brute-force attacks to keep your users' accounts from getting compromised.
Drive-by / low-hanging fruit
In this attack scenario the attacker is looking to find the users dumb enough to be using a password on the most common passwords lists. Here the exponential speedup from forcing the attacker to guess over the password disappears because they are not guessing an exponential number of passwords. So for any user with a weak password, this scheme isn't really doing anything because a few extra milliseconds of hashing is insignificant to the attacker.
Targeted attacks
Here the attacker is trying to break into a specific account. If they really are guessing passwords at random, then this will slow them down, but given that network lag and fail2ban already make a social engineering / phishing attack better value than an online brute-force, I'm not sure you're adding value here either. Enable 2FA with the Google Authenticator if you're worried about this.

Bottom line: The idea is neat and I've enjoyed thinking about this, but

I'm not sure it's adding much value.
"Don't roll your own". I found a few holes in the scheme, so you'd need to spend a lot of time and effort hardening it before I'd be confident to use it in production.


HSTS Strict Transport Security: Include base domain I configured my apache webserver to use HSTS Strict Transport Security.

If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security is only required for www.example.com and its subdomains. It is unfortunately not required for example.com itself and subdomains different from www.

Is there a way to configure that Strict Transport Security is also required for the (higher level) base domain example.com, if a user visits the subdomain www.example.com?

The only (ugly) workaround I found so far is to load some content (e.g., a picture) from example.com by embedding an absolute link https://example.com/content into the website.

Its not an ugly way. But a better way will be to use the preload system : https://hstspreload.appspot.com/


Soundness of GRC.com Haystack padding concept I was wondering how sound is the concept presented by the Gibson Research Corporation (see below if you do not want to follow the link) about simple passwords (= very easy to remember) with the addition of padding.

I understand what Gibson is getting at with increased search space, etc., but I was wondering if this applies to a real world scenarios, i.e., everyday use for your accounts and peace of mind that the passwords are 'secure' even if their entropy is super low.

FOR THOSE THAT DO NOT WANT TO GO TO THE WEBSITE:

Gibson has a search space calculator which indicates what is the search space for a given password. The search space depends on length of passwords and characters that form the password itself (letters - uppercase and lowercase - and/or numbers and/or symbols)

He then goes on about the importance of the length of a password and the mixture of letters, numbers and symbols.

Everything does perfectly sense, but then, he argues that "entropy" is not important, in his own words:

  ENTROPY: If you are mathematically inclined, or if you have some security knowledge and training, you may be familiar with the idea of the “entropy” or the randomness and unpredictability of data. If so, you'll have noticed that the first, stronger password has much less entropy than the second (weaker) password. Virtually everyone has always believed or been told that passwords derived their strength from having “high entropy”. But as we see now, when the only available attack is guessing, that long-standing common wisdom  . . . is  . . . not  . . . correct!

He refers to 2 passwords:

  1) D0g.....................

  2) PrXyc.N(n4k77#L!eVdAfp9

And argues that although the first one is infinetely more memorable than the second one (and even contains a dictionary word) the time to 'crack' it is orders of magnitude greater than the required time for the other, hence, it is more secure.

Is this concept sound? In lay terms... Shall I change all my passwords to something like the first one (super easy and super long) or this is just asking for troubles in todays hyper-connected world? :)

Is entropy completely useless in the "online account passwords" world?

Maybe this question should be asked on StackOverflow since concerns more with practical use of low-entropy passwords in computer systems authorization mechanisms woth regards to password cracking. Don't know...

Is this ok now or shall I be even more concrete? Is this off-topic altogheter?

Dave

Of course entropy theoretically makes a password stronger but from the perspective of a password cracker the first password likely would take much longer to crack. This is because of the length of the password--this argument would probably not be valid with a short password. It is something I have written about before myself

Consider how password cracking software attacks a password:

Try all words from a massive dictionary of words including common passwords.
Try common permutations (password1, password123, p@assw0rd, drowssap, etc) of each dictionary word.
Brute force every password trying every possible letter combination.

As long as a password doesn't fall under the first two categories and the software must perform a full brute force, the first password is strongest because it is one character longer and yet utilizes the same keyspace (upper, lower, numbers, and symbols) as the second password. The first password is 24 characters long and therefore potentially has 95^24 (291,989,024,338,773,000,000,000,000,000,000,000,000,000,000,000) possible permutations. The second password has 95^23 (3,073,568,677,250,240,000,000,000,000,000,000,000,000,000,000) permutations. As you see, that 24th character makes a huge difference.

In practice, if the password was ....g..................... it would likely take much, much longer to crack than the other two because even though it just uses two a lower case letter and a symbol, the password cracking software would still attempt using uppercase letters and numbers and it is two characters longer. Keep in mind, however, that if a bunch of people started following the concept of padding then it wouldn't be difficult to build password cracking rules to try padding all passwords. You are better off mixing the padding throughout the password, alternating multiple characters, or simply adding a couple more semi-words to your password.

When it comes to passwords, lack of entropy and lack of character sets can always be made up for by increasing the length of a password.

Nevertheless, having said all this, you still need to be smart and not reuse the same password or even the same pattern on multiple systems and you really should only rely on stuff like this in cases where you have to memorize a password. Using a password manager with a random password generator is still the best practice to follow.


Securing Android Application API access While creating an Android App that uses an API, the most difficult problem to solve is API security.
Creating a token and securing it in KeyStores is one thing. But what about a guest user?
A guest user requires a Token, and acquiring that Token from the API is not secure, as this API should not require any signing credentials. And creating a temporary Token for the guest user in the Application side is not secure as anything on the Application or Device is accessible one way or another.
I have searched about the thing, and these are the solutions I've found.

Creating a 2-part key : This is not secure, as there is still something on the Application side.
Google's Application authorization : I've found that there is a way to use Google's services to determine whether this client (Application or whoever sent the request) is a valid (legitimate) user, i.e, the request was sent from the Application for which the API was designed for. However, I've seen that this method requires waiting, as the validation is not immediate.
SSL Pinning : I'm not very familiar with the concept, but from what I understand, it's basically creating a Certificate that only your app and the server trust. But that seems to also put code (or in this case, a .crt file) in the app package, which can be compromised and used.

I understand that there are tactics such as ProGuard and DexGuard, but these only make it harder for someone to break into your app, and in DexGuard's case, it's paid.
I thought about using the API to identify that only the client is the app using the package name, but that's not possible since the HTTP/S Client requesting the API is not the app, it's the system's, or in some cases the library's, own HTTP/S Client implementation, which does not contain any information about the app, only the system/client.
From my understanding of application security, these are the main security flaws to be noticed :

Anything inside the application code, files, or resources can be accessed using the APK or the application's own folders on the system.
Even HTTPS SSL certified requests can be sniffed and the attacker can obtain all information about the API (URL, Parameters, etc).
Even if something was protected by the system (such as files), rooted/hacked devices can get access to these resources (there are also legitimate reasons to root your Android device, which means you cannot just block rooted devices).

Searching around in Information Security questions most focus about the Android system's security, not the security between an App and it's API. And the few that do, discuss the security from the server's side, or simply give an example about using a certain technology (Certificate Pinning or Certificate Transparency) in plain code, which is still not secure.
Question :
What are the tactics used to protect an Application from an attacker?
What methods should I be researching to make 95-99% sure my application won't be attacked (there is no 100%, I know, but that 1-5% are dedicated attackers, which wouldn't waste time on such applications from a less known provider)
Possible Attack :
The App has a guest user, meaning they need a temporary Token to use the app. This token cannot be generated from the API, as it does not require any authorization. And cannot be generated from the App since breaking the application code is simple and the attacker can discover the method of generating a temporary Token.
This leads the the API and Application being exposed to the attacker, giving them access to the API's data.

I wanted to comment on your question, but I don't have enough reputation for that.
You're discussing various things surrounding API and application security.
Maybe this article: https://dev.to/bearer/api-security-best-practices-3gjl could gives you some insights. If you apply these practices you should be pretty good.
Like you said, you can't be 100% safe and you have to weigh the risks. Most companies accept certain risks.


RFID-Safe Wallet destroys mag stripe? I'm getting a hang of paying with credit cards, and contactless payment especially, lately (which was quite uncommon where I live until like a few months ago). I'm now looking to buy one of these small credit card wallets because of the comfort and small profile, but also in order to get something with RFID safety.

I'm not really informed on how they actually work. However while searching for a good looking wallet online, I now read on multiple articles that people are complaining about the RFID system destroying their credit cards (the magnetic stripe).

I'm now concerned about whether really getting such a RFID safe wallet. Is it possible for systems like that to destroy your credit cards in such a way?

Short answer: No.
Long answer: Nooooooo.

Longer answer: RFIDs typical work via magnetic coupling to both power and to transmit data. By modulating the load on the secondary coil of the magnetic couple (aka transformer), the RFID card is able to effect a back EMF on the primary coil.

RFID-proof wallets disrupt this by creating a Faraday cage (i.e. opaque box to RF) which prevents the magnetic coupling from occurring.

In order words, it is literally a tinfoil hat.

Seriously. You can build your own RFID-proof wallet by putting tinfoil in it.


Will editing a Word file from a mounted Truecrypt volume leave any trace behind on the host computer? I've heard that even if you have a Word document encrpyted (just using the built in Word encryption tools) and are editing it, it can still leave behind remnants of a file on the local computer in either hidden files or a cache somewhere. I'm not sure if that's even true or not, just something i thought I heard somewhere.

So my question is, when editing documents, such as a Word file, from a mounted Truecrypt volume, does it leave any cache or 'residue' behind on that computer giving any info about the document?

As you can see here the proper answer is "sometimes" but given you count on your document being private you shouldn't assume the behavior of Word is safe.

If you really want to protect your encrypted documents you must use the full disk encryption because there are too many case where your OS/apps will cache data on disk (swap, temp files, filename in the registry as recent documents, hibernation...).


Enabling HTTP Security headers in S/4 Hana web applications We have 3-4 S/4 HANA applications in our environment and want to enable HTTP Security Headers, but couldn't figure out how to go about it. We then approached SAP directly and even their solutions are not working, and their support team has a pretty vague and dissatisfactory answer,they said that the application doesn't require such headers security mechanisms are already in place to mitigate a variety of attacks.
Now me and my team are helpless. Has someone achieved it? The application in question are SRM, Fiori, GRC & ROS.

Before adding any headers I'd carefully investigate whether they could break any normal functionality of the application. ERP systems like S/4 HANA are quite complex, and playing with external security features may cause something unexpected. Furthermore, it may make diagnosing any problems harder, because the support doesn't expect such headers in place, as they believe and announce this kind of problems are mitigated by other means.
Once you have acknowledged this, you do have some possibilities for adding the headers:
SAP Web Dispatcher
From SAP Web Dispatcher Modification of HTTP Requests:

If an SAP Web Dispatcher is configured, HTTP requests first go the Web
Dispatcher, which then filters the requests and distributes them to
the application servers connected in the SAP system. If no SAP Web
Dispatcher is configured, HTTP requests go directly to the Internet
Communication Manager (ICM) on an application server.
It is more practical to modify an HTTP request before it is forwarded
to the application server. The rewrite handler, which is implemented
as part of the HTTP plug-in in Web Dispatcher and in Internet
Communication Manager, provides the functions to perform modification
actions. You can perform different request modifications in the HTTP
server (SAP Web Dispatcher or Internet Communication Manager):

Delete, add, and enhance HTTP header fields:
You can delete or add HTTP header fields, or enhance them with
additional values.

With the syntax <headerop> <name> <pattern> <value> your configuration could contain e.g.
SetResponseHeader Content-Security-Policy script-src 'self'
SetResponseHeader X-Frame-Options SAMEORIGIN
SetResponseHeader X-Content-Type-Options nosniff

Reverse proxy
More generally, if a web application doesn't have a functionality to control headers, you can always place a reverse proxy in front of it. A lightweight solution is NGINX Reverse Proxy. E.g.
server {
    server_name sap.example.com;
    location / {
        proxy_pass  https://backend-sap.example.com;
        add_header  Content-Security-Policy  "script-src 'self'";
        add_header  X-Frame-Options          "SAMEORIGIN";
        add_header  X-Content-Type-Options   "nosniff";
    }
}


Protection against clickjacking in Firefox without installing addons? On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. However, it seems that NoScript also protects against clickjacking and to my knowledge Javascript is NOT required for this attack to be successful.

What can I do to be protected against clickjacking in Firefox, without installing any addons?

EDIT:

I'm looking for a solution that DO NOT require installing addons, but can be configured in about:config

Firefox doesn't have an option to turn of iframes in about:config, see this bug report. It's also not that likely that it will get that option anytime soon, seeing that this issue was first reported 15 years ago.

You could disable iframes without plugins by using custom CSS (iframe { display: none !important; }). This would be done via an CSS file in /~/.mozilla/firefox/<random-id>.default/chrome/userContent.css. This setting should not be overwritable via a websites CSS (but future Firefox versions might of course allow a website to overwrite custom CSS, which would allow an attacker to bypass this).

ClickJacking should not be possible without iframes (although there might possibly be a way via the embed tag, but it didn't work for me).

Personally, I would probably trust NoScript more than this approach, but if you definitely do not want to install plugins, this might be the best way to do it.


NFC and ISO 14443 : security? I'm trying to understand if the ISO 14443 guarantees any degree of security for an NFC transaction. I can't access the documentation because it is not free, but I see devices (like MIFARE DESFire or what) claiming they respect the standard.

When I see summaries of the content of the standard, I don't see any information in terms of security, authentication, or what.

Does somebody know if there is something to know about?
Is the security of these devices only ensured by the constructors?

ISO14443 is just a link protocol like Ethernet, as far as I know it does not provide any security by itself, it's up to the different vendors to implement their own on top of that.


Company Laptop and iTunes/iPhone With their permission, I am selling a company laptop that I used, but I had been using iTunes and syncing my iPhone on that PC. Is it possible for a forensic tech to retrieve any of the browsing history of safari through the stored back ups of my iPhone? And retrieving any emails or messages I have sent out? I had the computer reformatted, but I want to take extra precautions.

I am somewhat wary of leaking any kind of corporate secrets or personal information. Too much money at stake here that can cost me my career. Thanks.

Reformatting is not sufficient, you need to securely wipe the disk.  Reformatting is like ripping the cover off a book; it's not pretty but all the info is still there.

DBAN is a popular free tool for wiping hard drives.  If the drive is SSD, you need other tools.

Companies that care will usually not release systems with disks; they'll destroy the disk and whoever buys the laptop/desktop will have to buy a new disk to put in it.  When you look at the overall cost of a system, disk is pretty cheap.


Amazon cert SHA-1 signed? I just checked Amazon's certificate and it shows it is SHA-1 signed. But Chrome does not show any warnings, like it does (the red cross) for other websites with SHA-1 signed certificates.

Am I looking at this wrong?

Chrome is flagging SHA-1 signed certs based on their expiration date.

For the full details on the different dates and indicators, please review:

http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html

The cert Amazon has deployed expires Oct 2nd, 2015.


Substitute Key on 128 Bit Encryption I'm trying to obtain a copy of program that uses 128 bit encryption,  I've been denied since it could decrypt ANYTHING that anyone else has saved in it.

I suggested giving me the program, but on mine just change the key so it only works on my copy and no others.

I know little of encryption, but it sounds like a logical solution to me.  I get the program, and they get to keep their key secret.

My program with a different key would not read their files.

Is this correct?

There are a great number of assumptions to be made because you do not give a lot of details. But, yes, if you change the keys it uses, then it encrypts/decrypts it's own unique set.