Am I encrypting and storing an array of user-details correctly? I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have been doing.

Username, password and personal details are entered.
A random 128-bit symmetric key is generated.
Two random initialization-vectors are generated.
The array in which the personal details (name, email etc) are stored is AES-128 encrypted using the freshly generated key and the first initialization vector.
The symmetric key itself is then encrypted with AES-128 – using the user's password plain-text password as the key and the second initialization-vector.
The newly encrypted key, initialization vector 1 & 2 and the encrypted array of personal details are stored in an object which is then serialized into a file under an ID – a hash of the user's username.
When program retrieves the details – it hashes the current user's username, looks up that hash in the "users" file (the ID), retrieves the object associated with it, decrypts the key and the uses the decrypted key to decrypt the user-data.

Is it grotesquely insecure? Am I missing something obvious?

Few comments to the provided flow:

Be sure that when you say "Two random initialization-vectors are generated.", they really are cryptographically-secure random.
Symmetric Encryption must be Authenticated Encryption.

Therefore, I suggest you add som MAC (i.e using HMAC). E.g:

1. AES-encrypt: plaintext + secret key + fresh-generated random IV = ciphertext C1.
2. C2 = IV + C1.
3. MAC = HMAC(K , C2) where K is a different secret key independent the first used.
4. C3 = C2 + MAC.


Is there something similar to pseudorandom generators but in the opposite direction? Pseudorandom generators (PRG) are functions that takes a random small input (called the Seed) and maps it into much larger output .

However, the mapping process must be unpredictable in order for the PRG to be used securely in cryptography.

My question is: Are there any tool  the does the opposite? i.e. takes a long random string and maps it to a smaller random unpredictable output?

And if not, can we use s-box for this purpose?

It seems to me a cryptographic hash, such as the SHA family, would do what you are describing. If not perhaps you could clarify your question.


What are my options for a career switch into IT Security? I am currently working as a Software/Web Developer with around eight years experience, however I have always had an interest in IT Security and am now hoping to move my career in this direction.

I was wondering what areas of IT Security might make for a natural progression from software/web development and what certifications might apply? Or if a 'natural progression' even matters if I find another area to be of greater interest. E.g. I find penetration testing really interesting but I'm not sure if my existing skills would be any use here.

Also, I'm wondering if its too late in the game to make a switch like this and maybe I should have done it earlier? (I'm in my early 30s) If I decide it is too late, it is still my intention to up-skill in this area because it will most likely help my software/web development anyway (its also interesting and something I want to do anyway!).

I'm quite excited about the idea of taking my knowledge of security to a greater level, learning new skills and gaining some certifications etc, but I want to try and set a clear direction for myself first so I don't just wander aimlessly.

Thanks in advance!

Well.. if there is an area of IT security in which your skills would have any use that is pentesting. As software/web developer you know how a program/web works, so you should know which parameter, form, etc may be exploited. Also with programming experience you can go further and analyze the code from its source, not just trying the common attacks in websites.

All said was regarding to web pentesting. After learn about this (I recommend you The Web Application Hacker's Handbook -Finding and Exploiting Security Flaws and wargames), you should move into services vulnerabilities (here is where port scanners and frameworks like Metasploit get into the game).

Also with programming experience you could get into forensics.

Lately people trend to relate IT security with hacking and cyber war, and that's not true. I'm telling you this because I've read lately people who want to move into security because due to recent news they think this is like a "Hollywood Movie". If you are in this group of people, just keep programming, you won't success in security and you won't feel comfortable with your job.

About certifications, I think everyone should have the Security+ because it covers the basics about security. After... well when you have a Security+ you'll know how to approach your career.


Using nmap to bypass a firewall and perform OS fingerprinting How can I use nmap to perform operating system detection on a system which has all of its ports filtered by a firewall?

Is there a way to bypass it?

I have tried: syn scan, xmas scan, fragment scan, service version detection (-sV), and nmap nse script scan.  When I performed the scans, the reply that I got was the same in all the cases.  I cannot provide the exact response but it was something like this: " ****host is up" "all the 1000 ports are filtered****".

The answer depends on what you are targeting to some extent. If there is an Internet-facing port on the host your scan may be blocked by the firewall responding with resets (RST) which makes your initial scan results look closed or filtered even though that may not be entirely true. Firewalls are designed to make this harder and can block some scans but if at least one port is available for testing you have a very good chance of figuring it out.

That said you will have to focus on information like the type and versions of applications running on the system. Use nmap to focus on the ports that are open and increase verbosity and look at the service versions.

nmap -Pn -vvv -sV -p 80 #(webserver) or
nmap -Pn -vvv -sV -p 22 #(ssh, hopefully on another port)

and you
    will see outputs that include lines like

22/tcp open  ssh     syn-ack OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

This can help you identify the host even if general port scanning will not.

Note: you can also take this a step further by analyzing the protocol traffic itself or content available via the applications exposed.

Additionally an nmap FTP bounce scan can also scan other servers behind a firewall:

https://nmap.org/nsedoc/scripts/ftp-bounce.html

nmap -vvv -b -PN :@


Wordpress server compromised I am running a wordpress website and suddenly cpu usage spiked to 100%.
When I tried to dig in, I found a binary in php/tmp folder which was running with configuration file-

{
    "algo": "cryptonight",
    "av": 0,
    "background": true,
    "donate-level": 1,
    "log-file": "/dev/null",
    "threads": "1",
    "pools": [
        {
            "url": "xmr.crypto-pool.fr:80/xmr",
            "user": "xyz",
        },
    ],
}

It seems to me that the server is involved in mining monero coin. As the location of folder is in tmp directory, I guess that the files were shipped there exploiting some insecure file upload kind of vulnerability, but I can't understand how the attacker made the system to execute the binary. As I can see the process in htop, I don't think attacker gained root access to system at any point of time, or he could have installed some root kit to hide the process at all.  The process is being run under daemon user and and PPid 1 and restarts itself after sometime if I try to kill it. I can't see any init file related to this binary. I want to figure out exactly how the attacker managed to start it as daemon and how is it being controlled but I am stuck here. Any tips for further analysis will be very helpful.

EDIT:
Php version is - 7.0.6
My wordpress is running using bitnami certified aws image. Php master process is running as root and children are running as daemon. As I checked php.ini  file, there is nothing under disable_function configuration. This I guess is a bad practice as someone can exploit functions like exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source.  I am not sure about editing the configuration as I have never worked with wordpress or php and I am not sure if this will break the wordpress itself.  Even if I migrate my wordpress to a new instance, how can I make sure that it will not happen again ?

This is really just a partial answer, so hopefully someone will come by with more details, but I wanted to give you something to get started.

https://www.wordfence.com/blog/2016/03/attackers-gain-access-wordpress-sites/

Wordpress hacks are a pain.  We typically avoided wordpress altogether, but if we had a client that really wanted to run a wordpress site, we would put them on their own server for just this reason.  How did they get in?  That can be very hard to determine.  Log files and lots of digging will be your friend.  The core wordpress software itself is usually fairly secure these days, so long as your wordpress installation is up-to-date.  However, you should audit your third-party modules with an extremely fine-toothed comb.  When some of our wordpress-hosted sites were compromised in the past, it was almost always because of security weaknesses in third party modules that someone installed.  Check for any security warnings related to any third party modules you have installed, especially the more popular ones.

It sounds like you caught it right after it happened.  That is good because it will mean that you have far less logs to look through.  Dig through them in detail until you find anything suspicious.  It's hard to be much more specific then that.  Once you figure out how they got in, Nuke it from orbit!, restore from a known-good configuration, and patch the issue that let them in in the first place.


Encrypting a blob with a password Is there anything to say against to have an amount of public keys, which encrypt a common password for a blob encrypted?

So Users 1,2,3 have all certificates for themselves and can use them to get the master password. With this master password they are able to decrypt the key to the blob and in case they need the contents of it they decrypt the blob too.

The biggest attack vector for common strong encryption algorithms, is afaik most of the time the implementation. If I rely on Framework components for Encryption/Decryption and load the certificate on the fly, assuming the way the certificate (and with it the key) is transmitted, can be considered moderately safe, would you say this is a way to go?

The scheme you are describing is called "Hybrid Encryption for Multiple Recipients" and is already well-implemented in GnuPG.

The user David Segonds described it well in this answer on StackOverflow:

  GnuPG does multi-key encryption in standard.

  The following command will encrypt doc.txt using the public key for Alice and the public key for Bob. Alice can decrypt using her private key. Bob can also decrypt using his private key.

gpg --encrypt --recipient alice@example.com \
    --recipient bob@example.com doc.txt

  This feature is detailed in the user guide section entitled "Encrypting and decrypting documents"

The scheme works just as you described it. First, a random Data Encryption Key (DEK) to be used with a symmetric cipher is chosen. Then this key is encrypted, one copy for every recipient, with their respective public key.

Finally, the actual data is encrypted with the DEK. Then the encrypted keys and the encrypted data are stored as a file to be sent to the recipients. For example, the file could look like this:

                  +--- Encrypted DEK
                  |    with the public  +--- This file has been encrypted
                  |    key of Bob       |    by the Data Encryption Key (DEK)
                  v                     v
+---------------+---------------+-----+----------------+----------------------+
| Encrypted DEK | Encrypted DEK | ... | Encrypted File | Signature of Creator |
+---------------+---------------+-----+----------------+----------------------+
  ^                               ^                           ^
  |                               |                           |   (Optional) Signature
  |    Encrypted DEK with the     |    More encrypted DEKs    +--- of the creator
  +--- public key of Alice        +--- of further recipients

Of course, this graphic is purely demonstrative and not actually how the file is structured.

In order for Bob to decrypt the data, he would first validate the signature of the file, if it was signed. Then, he would check all the encrypted DEKs, until he finds the one he can decrypt with his private key.

Once Bob is in possession of the DEK, he can use whatever symmetric cipher was chosen to decrypt the file and receive the plaintext.


Enforcing DMARC policy (reject) on an Office 365 tenant The domain & tenant has SPF and DKIM properly configured and DMARC policy set to p=reject. Still, emails spoofed with the domain in the From header aren't rejected, but appear in the Junk Email folder on Office 365. People do check their Junk Email for false positives, and are still reading all the CEO frauds, sextortion letters etc.

This seems a feature instead of a bug, as described in Microsoft's documentation:

  How Office 365 handles inbound email that fails DMARC

  If the DMARC policy of the sending server is p=reject, EOP marks the
  message as spam instead of rejecting it. In other words, for inbound
  email, Office 365 treats p=reject and p=quarantine the same way.

  Office 365 is configured like this because some legitimate email may
  fail DMARC. For example, a message might fail DMARC if it is sent to a
  mailing list that then relays the message to all list participants. If
  Office 365 rejected these messages, people could lose legitimate email
  and have no way to retrieve it. Instead, these messages will still
  fail DMARC but they will be marked as spam and not rejected.

However, this reasoning has some flaws:

DKIM protects legitimate mail; DKIM signed messages do pass with the DMARC policy even if it fails to align with the SPF when forwarded on a mailing list. (Mailing lists should change the envelope sender to pass SPF checks, anyway, so the SPF checks are probably passed, but not aligned.)
By implementing p=reject instead of p=quarantine the owner of the domain has stated that the emails should be rejected. Therefore, Microsoft's implementation is against RFC 7489, 6.3:

p: Requested Mail Receiver policy ...

   reject:  The Domain Owner wishes for Mail Receivers to reject
      email that fails the DMARC mechanism check.  Rejection SHOULD
      occur during the SMTP transaction.

Is there any setting on Office 365 to alter this behaviour and reject these messages?

This can be achieved on an Office 365 tenant by adding a transport rule. An email not passing DMARC tests of a domain having p=reject will have dmarc=fail action=oreject and compauth=fail reason=000 in the Authentication-Results header.

You could catch the dmarc=fail action=oreject:

  action  Indicates the action taken by the spam filter based on the
  results of the DMARC check.

  oreject or o.reject: Stands for override reject. In this case
  Office 365 uses this action when it receives a message that fails the
  DMARC check from a domain whose DMARC TXT record has a policy of
  p=reject. Instead of deleting or rejecting the message, Office 365
  marks the message as spam.

Unfortunately, the composite authentication compauth=fail reason=000 is the same for both p=reject and p=quarantine. Using it alone would also affect mails with the less strict policy to only quarantine it. Following the RFC 7489, 6.3 you wouldn't want that.

  compauth=fail Message failed explicit authentication (sending domain
  published records explicitly in DNS) or implicit authentication
  (sending domain did not publish records in DNS, so Office 365
  interpolated the result as if it had published records).

  reason=0xx Message failed composite authentication.

  000 means the message failed DMARC with an action of reject or quarantine.

To avoid false positives, requiring both would be the best. However, Office 365 transport rules doesn't have an option for "and" conditions: the only suitable option "a message header includes..." can only be used once, and it only has "or"-lists i.e. "includes any of these words". For these reasons I've picked the dmarc=fail action=oreject and use it in the following instructions.

Steps for adding the transport rule:

Go to the Exchange admin center https://outlook.office365.com/ecp/
On mail flow > rules, press the + to add a rule and name it e.g. DMARC reject.
To get the required settings to show, press the "More options..." link below the selection.
On "Apply this rule if..." select "A message header..." and "includes any of there words".
Add the details: 'Authentication-Results' header includes 'dmarc=fail action=oreject'.

Select the desired action with the setting "Do the following..." and "Block the message..."

The RFC 7489, 1.3 Rejecting Messages suggests two possibilities:

   o  A "silent discard", wherein the SMTP server returns a 2xy reply
      code implying to the client that delivery (or, at least, relay)
      was successfully completed, but then simply discarding the message
      with no further action.

The equivalent for this would be "Delete the message without notifying anyone."

   o  Full rejection, wherein the SMTP server issues a 5xy reply code as
      an indication to the SMTP client that the transaction failed; the
      SMTP client is then responsible for generating notification that
      delivery failed (see Section 4.2.5 of SMTP RFC 5321).

i.e. "Reject the message with the explanation... rejected by DMARC policy"

However, Microsoft Office 365 doesn't support connection-stage rejection, so the latter doesn't exactly respond with an SMTP 5xy reply code, but sends a non-delivery report (NDR) to the envelope sender, with the defined custom message:

The technical error on the NDR is 550 5.7.1 TRANSPORT.RULES.RejectMessage; the message was rejected by organization policy and it has the original message headers attached.


ATM skimming with magnetic stripe I have a question about ATM skimming. If ATMs in the UK still accept magnetic stripe can't a thief still use a cloned card at the ATM to withdraw money?

Short answer
Yes, they can.
Long answer
If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it.
Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can guess where you used credit card and punch that zipcode.
Also if you read suggested thread below, you will see how they steal PIN.
I don't live in UK, but this applies to any card reader that uses magnetic strip.
That's why card issuers are strongly recommending use of IC instead of magnetic strip.
Read this thread to avoid being a victim.


Pseudo-Unique PICC Identifier in Passports/ID Cards I'm currently researching fingerprint abilities of german ID cards. These cards are compliant to ISO 14443 (the same standard as for passports). I found a part that caught my attention and I have a question concerning this, as I have no chance to really test it on passports/ID cards at the moment.

ISO/IEC 14443-3, Chapter 7.9.2 says:

  A Pseudo-Unique PICC Identifier (PUPI) is used to differentiate PICCs during anticollision. This 4-Byte number may be either a number dynamically generated by the PICC or a diversified fixed number.

Proposition: There is a small chance of bad implementations here. If there are >2 passports/ID cards around, each one might use the same PUPI all the time.

I haven't found a source to support my proposition so far, so I'm crowdsourcing it and would be happy to hear your thoughts.

Yes, it's possible to have a PUPI collisions. (It's called pseudo-unique, after all, not unique.) This can happen with probability 2-32 if the PUPI is chosen randomly, or more if it isn't. The question is, so what? How is a PUPI collision harmful?

The primary intent of the PUPI is to be unique at a particular point in space-time: an RFID reader emits a “hello y'all” signal (REQA or REQB), and all the cards that receive this signal respond with a message (ATQA or ATQB) containing some type identification information (e.g. “I'm a German ID card”) and a PUPI. The reader may then decide to start a conversation with one of the cards that are in range, and it uses the PUPI to identify which of the cards it will talk to. It's irrelevant whether the reader has talked to different card with the same PUPI in the past, or whether there's another card reporting the same PUPI to a different reader.

If there are two cards in range with the same PUPI, it's likely that the reader won't be able to communicate with either (both would reply if prompted). Having multiple cards in range is supported in principle, but isn't guaranteed to work anyway: it requires the analog signal to be of good enough quality, and depends on how much interference there is (due to opaque or reflecting objects in the vicinity, among others). While a card attempting to trigger PUPI collisions is a DoS, there are worse ways to cause a DoS (it's radio, so it can be jammed).

Another element to the PUPI is privacy: if a card always reports the same PUPI, it's easier to track it. But you can already track a card by type: the PUPI only matters if there are several cards of the same type in the same general location. Ideally, the PUPI should be randomized at each powerup (I don't know if German ID cards to that), or should be identical on all cards (which would also ensure privacy but could cause collisions if there are several ID cards in close proximity — not a very common occurrence in day-to-day situations).


Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.

We collect certain kinds of requests through a web form, and write them to a database. Every 10 minutes, cron runs a php script that

queries a view in the database (no user-supplied or program-supplied parameters),
emails new requests to us, and
writes the keys for new requests to another table, effectively removing those rows from the view.

That's the only process running under cron, and cron runs just that one script.

All php database access is through PDO. Inserts use PDO's bindParam.

A single php file contains the connection information for the MySQL server. It's stored outside the web root, I'm the owner, and its permissions are read/write for me alone with no other permissions at all.

Yesterday, I got this error message emailed from cron.

  SQLSTATE[HY000] [1130] Host 'somedomain.org' is not allowed to
  connect to this MySQL server

So far, this is a one-time error. The rest of the time, the php script works as designed.

Neither that domain nor its IP address appear in the web server's log files or in a database dump.

Am I correct in interpreting this as an attempt to crack our server?

Is this configuration good enough to keep our data safe unless my own credentials are compromised?

Later...

The web site for 'somedomain.org' is hosted on the same server our web site's on. If they'd simply made a typo in connecting to their own database, any error message I might see shouldn't have come from cron. This error, coming from cron, seems to be telling me that somehow they're trying to use their credentials, but running my script. Is that right?

Still later...

One of my Google alerts tells me that a content aggregator, 'yetanotherdomain.com' has started scraping data from our web pages. This domain, 'yetanotherdomain.com' is not hosted on the same server our web site's on. But administrative and technical contacts for both 'somedomain.org' and 'yetanotherdomain.com' are registered to the same phone number in the USA.

I looked up the IP address of 'yetanotherdomain.com' using host. Following up with whois <ip address> gives me this output (snipped).

network:Street-Address:N/A
network:City:Kiev
network:State:OT
network:Postal-Code:04209
network:Country-Code:UKR

My first guess would not be a hacking attempt, but rather a transient glitch in your shared hosting's DNS or something similar.  On shared hosting, something like this could easily happen for a brief period.

Update (8/7): If you are concerned that you might be under a hacking attack, my suggestion would be: rather than expending a lot of energy trying to confirm whether you are in fact under attack or not; rather than expending a lot of energy trying to identify the perpetrator; instead, I suggest that you focus on making sure your system is secure against attack and can resist attacks.

Take this as a good opportunity to review your security practices and the configuration of your systems to ensure that you are in good shape.  If you are under attack, this will help protect yourself -- and even if you are not under attack, you get good protection against other kinds of attacks.  In either case, you will have the peace of mind of knowing you've done all you can to lock down your systems.


How can I send a file with DLL to Cuckoo Sandbox? I want to submit an executable for analysis in Cuckoo Sandbox.

The file must be in the same folder with a DLL I have. How can I request Cuckoo to test my exe and make it run properly? (i.e exe and dll in the same directory).

Note - I don't have any problem to put the dll at the guest machine, take a snapshot and then submit the file. I just don't know where to put my dll in the guest machine (Where Cuckoo put the exe on guest?)

Thanks in advance.

Cuckoo creates a folder with a randomly generated name (So it changes every time you run a new analysis) in the root of C:\ which it uses to store the submitted file, among other things.

What you could probably do is create a zip file containing both your executable and your DLL file, then submit that zip to Cuckoo. When the analysis is run Cuckoo's zip package will unzip the archive containing both files into the same directory, then run the first executable it finds from that zip.

I think that should do the trick.


What are the security best practices for clients authenticating users with password against LDAP? To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication).

From what I understand, there are two approaches for user authentication:

Comparing password with userPassword attribute.

The client binds to the LDAP server using a specified bind user
The client sends an LDAP query to retrieve the user entry
The client extracts the userPassword hashing scheme
The client hashes the password provided by the user with the extracted hashing scheme and compares it with the hased password in the userPassword attribute
If both hashes match, the user is authenticated successful, otherwise authentication failed

LDAP Bind with user and password

The client binds to the LDAP server using the user who wants to log in and the password he provided
If the LDAP Bind was succesfull, the authentication is succesfull, otherwise authentication failed

It seems many implementation are still using the first approach, whereas the second approach seems to be more secure and also allows Pass Through authentication.

If users need to be authenticated with a password, what are the security best practices for authenticating against LDAP and are they documented somewhere?
Are there any other approaches than the one described above?

For most deployments checking the password via LDAP simple bind is the best solution. Especially because most LDAP server implementations apply password policy restrictions (pw expiry etc.) only when processing bind requests.

However there is an interesting use-case for using compare requests:

In a really paranoid LDAP setup the application would bind with a service account and would then be explicitly authorized via fine-grained ACLs to check the password on behalf of the user. Such an additional security boundary is nearly not possible with bind requests because those are always anonymous (besides looking at peer's IP address or similar).

P.S.: There are several flavors of pass-through authentication. If you have a LDAP application-level proxy you can of course forward compare requests to other LDAP servers.


Best practice to guard against an app copying private ssh keys stored under ~/.ssh? Given that any application running as the logged in user will have read access to that user's ~/.ssh folder, it seems trivial for the application to copy that user's private key and send it over the network.

Is maintaining SSH keys under ~/.ssh considered unsafe for this reason? If so, what is the recommended way to manage SSH keys?

As Naftuli Tzvi Kay stated a well worn solution is using a hardware device to manage your keys.
Some alternatives for a software solution include:

Making your private keys only readable by root / sudo
Encrypting your private key with a password, so at least it will be non trivial for the attacker to crack it if they do steal
Storing them in an encrypted directory somewhere on your local machine


What is the best practice for resetting multi-factor when a user requests to recover their password? I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and development time restraints, the MFA chosen is a simple TOTP solution, but in the future I may include other providers such as Authy.

In the process of developing the Password Recovery flow, I thought that if someone forgot their password, they most likely forgot/lost their MFA as well. In your experiences, is this assumption correct? What is the "best practice" here? Do I reset the MFA along with the password on password recovery, or do I force the user to authenticate through another method in order to have their MFA reset?

I would not make that assumption as it would undermine the security of having a second factor to a certain degree. A malicious factor who manages to reset a user's password (such as by exploiting a vulnerability in the password recovery flow) will then be able to take over the account by resetting MFA as well.

The password recovery flow should be separate to the MFA recovery flow by using some form of out-of-band verification such as sending a password reset link within a "forgotten password email" containing a randomly generated and unique token that allows the user to reset the password only.

The MFA recovery flow should work in a different manner. If you are offering TOTP only, I suggest offering a fallback method in place such as a list of "backup codes" of valid OTPs that the user needs to keep safe, or otherwise an OTP sent via SMS/phone call with a short expiration time. Otherwise, you will need to offer some other form of out-of-band service for allowing users to verify their personal details so that service provider can proceed with disabling MFA on his/her account.


Provide json post data in form based authentification ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu).

When the data is something like "user=toto&psswd=t@T°", it will translate it into

"user={%username%}&psswd={%password%}"

after you told it about the keywords user and psswd.

But when your data is a json object such as {"user":"toto","psswd":"t@T°"},
and even though the content-type of the original request specifies it, ZAP will be unable to detect what keyword can be used, and will propose {"user":"toto","psswd":"t@T°"} as both username and password keyword... thus preventing you from defining a correct login pattern.

Do you know of a tip to process through form-based authentication with ZAP?

Unfortunately at this time there is an outstanding feature request for handling authentication via a JSON Object: https://github.com/zaproxy/zaproxy/issues/2439

One alternative is to record a scripted authentication.

Update:

The previously discussed functionality is now available: https://github.com/zaproxy/zaproxy/pull/4624

If you want to use it, you'll either have to use a weekly: https://github.com/zaproxy/zaproxy/wiki/Downloads#zap-weekly

Or, wait for the next full release (likely 2.8.0).

The corresponding PR to update the help content for the new JSON Authentication functionality is here: https://github.com/zaproxy/zap-core-help/pull/188/files if you want to check it out.

You set it up the same way you would for form based authentication. Make sure you define a Logged-in or Logged-out Identifier (or both). Here's some screenshots to help you along:

Manually configure the Authentication for your Context:

Use the Site Tree Context menu(s) to set it up:

Here's an additional help link that might assist you in getting authentication setup: https://github.com/zaproxy/zaproxy/wiki/FAQformauth


Does PCI PIN Security allows keeping the PIN in-memory for a short period of time? I've been asked to implement a page where a user can unblock her account by credit card number and PIN validation + some other method (e.g. SMS OTP) in a two-step process.

The flow suggests validating the CC number and PIN first and then do the SMS OTP validation.

In order to prevent abuse of back-end resources and possible PIN blocking at scale, one idea is:

Have the first page capture the CC number and PIN
Use only the CC number to find the user
Send an SMS OTP to her mobile
If SMS OTP checks, then validate CC number and PIN

So, CC number and PIN will be held in memory (HTTP session) from the time the user entered them on the first page until she receives and submits the OTP on the second page (a few minutes, I guess).

Does that violate any PCI rules? Especially the "keep the PIN in memory" part?

PIN Security Requirements, Version 2.0, reads:

  Requirement 4: PINs must not be stored except as part of a store-and-forward transaction, and only for the minimum time necessary. If a
  transaction is logged, the encrypted PIN block must be masked or deleted from the record before it is logged.

and right below:

  Transactions may be stored and forwarded under certain conditions - ISO 9564

I checked an older version of ISO 9564-1 but I did not find anything with regards to store and forward. Does anybody have some insight on the conditions under which store and forward is allowed?

Moreover, does keeping the PIN in memory for a short period of time even qualify as "store"?

Storage in PCI terms refers to data being written to disk and generally not to data which is stored in Volatile RAM. The reference to storage for store and forward is to disk and is to allow devices store cardholder validation information pending a device being able to connect or reconnect to a Payment Service Provider or acquirer for the purposes of authenticating the cardholder to allow authorisation of the transaction. In PCI, this data cannot be stored subsequent to the transaction i.e. once its purpose is fulfilled, it must be deleted.

The process you're referring to must include PIN storage in the back end which is permissible for issuers only and that data must be securely stored. You're also describing storing the data in Volatile RAM which is permissible.


Preventing interaction among web application on a shared hosting account I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too.

So, My question is what are the potential ways in which an attacker can exploit a application on a shared account using a different application. Also, How can I prevent such attacks?

Methods of Shared Web Application Server Compromise

Pretty much endless. Have a look at the Open Web Application Security Project's 2013 Top 10, (www.owasp.org) just for starters. If you're anything like me, you're already trembling.

Threat and Risk Assessment: Scope

A full threat and risk assessment would also take into account compromise of user authentication data, e.g. cross-site request forgery, because one compromised session could permit unrestricted access to the server if the account is not isolated properly. For example, consider a hacker exploiting a known vulnerability in a web application after having successfully hijacked a valid user's session.

Injury Assessment

What you're asking about is something that is more often considered in the highest-security scenarios: banking, finance, government, military... And in all of those cases servers with high-value assets are almost categorically isolated and not shared. The evaluation of what is high value is often made on the basis of three principles: confidentiality, availability and integrity.

Example of classic industry high-security scenarios

For example, for a bank, all the financial transaction data is highly confidential, very restricted in availability and its integrity is paramount. That's why most banks will isolate their server clusters by application and by relative interactivity. Then they will also make routine redundant backups of the information into geographically disparate locations, on equally secure clusters.

Threat Mitigation

The best methods to prevent server compromise are routine hardening:

the strongest passwords combined with multifactor authentication,
secure-signed kernels and software only, e.g. SELinux
strict controls using a software firewall like iptables defining which applications are allowed to use which ports in what direction and by what users, but also hardware-based firewalls,
active monitoring of the network traffic using a software like Wireshark6,
you can also use [intrusion detection and prevention systems, possibly even two or three such systems at the same time,
if you are safeguarding high-value information that is exposed to high risk (according to your threat and risk assessment), then physical security should also be considered as a fundamental factor (i.e. who has access to the datacentre, how are they cleared for access, how are keys managed),
you can find more information from NIST Special Publication 800-53 -- Anecdotally, I remember hearing a statistic that NASA had only implemented about 65% of these suggested controls by 2014, by virtue of how exhaustive they are.


Why does whatsapp use phone number instead of username for identification? This feature of whatsapp looks like a bad practice refering to the privacy of their users, I guess it has received critics about that and even though it's nowadays an old application it continues the same.

I think that something like relating an username to a certain phone number has to be easy, even trivial, sort of how a DNS works but whatsapp still stays the same, so my guess might be wrong.

Is there any reason that it is done this way?

It's easy to use.

Everybody has a phone number, and you normally have the phone numbers of most people you want to chat with.

Therefore, you only need to allow WhatsApp access to your contacts and can chat right away.

This has of course some privacy implications, but the easiness seemed to be more inportant to the developers of WhatsApp than better privacy.

(And even the "private" messenger Signal asks for access to the contact list and compares it to the list of registered users... see https://whispersystems.org/blog/contact-discovery/ )


Algorithm to generate NTLMv2 Hash in PHP I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client  challenge, domain, account and password. The resulting hash appears to be not correct. Can someone guide me about the correct way:

Here is the algorithm in PHP language:

function GenerateNTMLv2($password, $account, $domain, $client_challenge, $server_challenge) {

    $hash = mhash(MHASH_MD4, $password);
    $hash = mhash(MHASH_MD5, strtoupper($account) . $domain, $hash);
    $hash = mhash(MHASH_MD5, $client_challenge . $server_challenge, $hash);

    return strtoupper(bin2hex($hash));
}

I have provided the following parameters:

$password='asim3347';
$client_challenge =  '0101000000000000DF5ED1178FBACE012FDEE788AA2574CE0000000002001200430041004E00440059004C0041004E00440001001200430041004E00440059004C0041004E00440004001200630061006E00640079006C0061006E00640003001200630061006E00640079006C0061006E006400060004000300000007000800DF5ED1178FBACE0108003000300000000000000001000000002000004C60DD0226C932C69BAF540769C9E4DA53ABF77A8D56DBA0F9AA214EEEBB30AE0A001000000000000000000000000000000000000900240063006900660073002F003100390032002E003100360038002E0030002E003200320038000000000000000000';
$server_challenge = 'FFC7C728CAAC8BE8';
$domain = 'SOFTECH';
$account = 'asim';

The function returns the following NTLMv2 hash: 48335EFCA9A07EA12B9EBBC2AEE30C8E

Where as the HASH must be: 3780B32F46FA60CE1431264A525B0D60

Can anyone suggest the correct algorithm?

I sorted out the correct algorithm for PHP. Thanks for the contribution. Following is the code:

function GenerateNTMLv2($password, $account, $domain, $client_challenge, $server_challenge) {

    $unicode_password= iconv ( 'UTF-8', 'UTF-16LE', $password );

    $NTLM_Key = mhash ( MHASH_MD4, $unicode_password);
    $NTLM_Hash = mhash ( MHASH_MD5, iconv ( 'UTF-8', 'UTF-16LE', strtoupper ( $account ) . $domain ), $NTLM_Key );
    $NTLM_Chal_Hash = mhash ( MHASH_MD5, pack ( "H*", $server_challenge . $client_challenge ), $NTLM_Hash );

    return strtoupper ( bin2hex ( $NTLM_Chal_Hash ) );
}


How is using acces() opening a security hole? The man page for access(2) tells :

  Warning: Using access() to check if a user is authorized to, for example, open a file before actually doing so using open(2) creates a security hole, because the user might exploit the short time interval between checking and opening the file to manipulate it. For this reason, the use of this system call should be avoided.

So, what kind of security hole it creates?

If somebody doesn't like linux.die.net, here is from freebsd.org and manpagez with similar text to avoid use of access().

It is a race condition. You do the access(), then you do the open(). In the small time between the two calls, the file may have changed. Typically, the file is, say, /tmp/foo. Initially, the file is owned by some user (who is the bad guy of the story), and the target is some root-powered application. The application does the access(), sees that the file really belongs to the user, and thus thinks: "that's fine, it's his file, I can process it on his behalf". Then the bad guy quickly replaces the file with a symbolic link to /etc/shadow. The application has already taken the decision to open /tmp/foo, but when it does, it really opens and processes /etc/shadow.


Email Security Gateway vs Firewall An email security gateway is an edge device such a router that serves for relaying the external network with the private network. It helps with detecting and blocking spams and phishing emails. That being said, I would like to know :

1) What is the difference between an email security gateway and firewall ? Could an email security gateway be considered as an smtp proxy ?

2) Does an email security gateway run an MTA or a UA?

3) How does it detect spams and phishing emails?

The term firewall describes a broad category of products for a variety of use cases. There are simple packet filter firewalls using iptables or similar but also so called Next Generation Firewalls which do application level analysis. And there are Intrusion Prevention Systems, Unified Threat Management products, Industry Firewalls ... and also Secure Gateways. Sometimes these names refer to their task, sometimes to a technology and sometimes they are just marketing lingo. But all of these various kinds of network firewalls have in common that they are used for separating networks at various kind of layers: from packet to application layer.

  1) What is the difference between an email security gateway and firewall ? Could an email security gateway be considered as an smtp proxy ?

Mail Gateways or Secure Mail Gateways provide a separation at the Application Layer by analyzing the context of mail delivery and the content of mails transferred through a network boundary. This way they help to protect the inner network against malware, phishing, spam etc but can also help to detect data leakage from inside to outside using emails. While there are standalone Secure Mail Gateways or cloud based solutions the necessary functionality is often included in modern enterprise firewalls too. But, like with firewalls in general the quality of the solutions can vary a lot even between products which claim to have the same general features.

  2) Does an email security gateway run an MTA or a UA?

Secure Mail Gateways are commonly implemented as MTA, i.e. explicitly configured as MX for incoming mail and as the outgoing mail server in the mail clients. But, there are also products which can be used in a transparent way, i.e. which are setup in front of an existing MTA with no additional configuration in DNS or at the clients.

  3) How does it detect spams and phishing emails?

This by itself is a broad question. But, to mention some techniques: there is blacklisting of IP addresses which are known to deliver unwanted or harmful mails (DNS-BL - DNS based blacklists). There is Greylisting to temporarily deny receiving some mail in the hope that spammers will just give up. There is the use of SPF, DKIM and DMARC to detect sender spoofing. There are various content based filters which for example compare received mails with known bad mails received in honeypots or check if they contain links to known spam or phishing sites. And while these are probably the most used and well known techniques this is by far not an exhaustive list of techniques used.


Sign a document as created with an authorized software build I'm creating some software that essentially enforces a specific process for creating specific documents, which protects them from being challenged later.
Afterwards, the file is signed with the user's key (USB token not related to the software). Recently there came a stakeholder suggestion to also sign it with the software's key to prove the process was followed.

But anyone could pull the key from the software and sign anything with it. So how could I include something in the file that confirms (or allows to disprove that) it was created with an authorized build of the software? Doesn't matter if the copy was obtained legitimately, just that it's not been modified.

To avoid the gory details, imagine the software calculates Pi, and we want to sign that Pi as calculated by a proper algorithm and not randomly generated past 3.1419.

I've narrowed down the threat model to two cases:

A. Someone (average solo developer) alters the software, or creates a replacement, then blames the software when things go wrong. I need a way to show "It wasn't our build".
B. Some lawyer claims the document is meaningless because anyone could have done A. The good guys need to show there were some protections against that.

The software needs to work offline, so online authentication on every signature is not acceptable. Online setup is acceptable if it can be done easily. The project's far too small for anything as monstrous as Denuvo, and security through obscurity is not normally accepted. But I still feel there's got to be a simple solution that I'm too blind to see.

I have considered using the user's token to encrypt/decrypt the signing certificate, but we need a way to ensure it's supplied to a proper build. Thought a bit about what code signing could do, but it doesn't seem to do anything for this case. What am I missing?

You're correct in saying that embedding a key in the software is no good, because an attacker could read out the same key.

One thing that stands out as a worthwhile place to look is the (new-ish) hardware modules called Trusted Platform Modules, or TPMs. There are published schemes that use TPMs to, for example, detect cheating in online games by ensuring the game binary and memory state has not been externally modified. Without inspecting them in detail it's hard to be sure, but that sounds like something you could use.

The fundamental idea here is that you're asking for confirmation not from your software, but from the computer's hardware. The hardware can, say, hash your binary and sign it with a private key stored only in that hardware: it doesn't even go to the CPU. That does imply that Intel or whoever makes the chips could, were they so inclined, mask the existence of a fake version. They might have back doors, up to and including copies of the private keys embedded in the chip. Nevertheless, protecting yourself from everyone short of those with the leverage to bully or bribe security hardware manufacturers probably covers your use case.


Can an empty uploaded file cause any security issues? The php.net page on the move_uploaded_file() function contains a User Contributed Note which says,

Security tips you must know before use this function :
First : make sure that the file is not empty.

I really cannot see how an empty file could be any more of a problem than a file that has either benign or malicious contents. Nor have I ever seen this advice before. However, since the note is highly upvoted, perhaps I may be missing something. So, can allowing empty files to be uploaded create any security vulnerabilities/issues or is this part of the advice pointless?

I would say it's just security in depth. There are probably no reasons to accept an empty files and this could potentially lead to unexpected behaviors and security  issues.


CSRF testing of an api endpoint using GET requests I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate.

I'm trying to write a piece of code that automatically loads on different domain that'll sends a GET request to that endpoint, using that persons cookies to see if I can maliciously fetch their new api token. I'm just checking to see if my endpoint is safe or if this is possible. I only want logged-in requests from the same domain being able to hit that endpoint. Not sure if this is actually considered CSRF since there no state changing. There is a CORS policy so not sure if that is preventing me from doing this. And varnish is the front end with X-XSS-Protection:1 enabled.

Things I've tried, simply having a different domain page load the endpoint. With a user logged in another tab. This returns a 200, with expected cookies of the logged in user, but no the JSON response.

The below returns a 200 with correct cookies of logged in user, but no json response. I believe this is not returning data due to same origin policy in the browser. Correct me if I'm wrong.

document.write('')

Both XMLHttpRequest and JQuery to perform a GET request to the target endpoint, again from a different domain and user logged into on a different tab. Returns a 401 not authorized and no cookies. Maybe there's some additional jquery I need to capture and send cookies with the request.

$.get('https://mydomain/endpoint', function(responseText) {
alert(responseText);});

As well as copying the curl request from Chrome developer console of a successful web request to the api endpoint. Surprisingly curl doesn't return the new token even with the expected parameters & cookies. Maybe also because of same origin policies.

Other ideas, is this even possible with what I've described?

As you started to mention, CSRF is only really useful for actions that change state, so this is not truly an example of CSRF.

From OWASP:

  Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.

Further, the reason you are not able to see the response is likely due to Cross-Origin Resource Sharing (CORS).

MDN web docs states:

  For security reasons, browsers restrict cross-origin HTTP requests
  initiated from within scripts. For example, XMLHttpRequest and the
  Fetch API follow the same-origin policy. This means that a web
  application using those APIs can only request HTTP resources from the
  same domain the application was loaded from unless CORS headers are
  used.

So while the remote resources are indeed fetchable, the browser is disallowing the JavaScript on your test pages from viewing the responses. Note that is the default behavior unless you have gone out of your way to set the correct headers on the server.


Asymmetric vs symmetric encryption benchmarks I have found these benchmarks in Crypto++'s site.
http://www.cryptopp.com/benchmarks.html

But I am, quite honestly, not entirely sure how to interpret them.

I am really looking for a  set of benchmarks, or a study, that shows how asymmetric encryption is slower (and more computationally expensive) than symmetric encryption.

Basically, something that directly pits them against each other and shows the slower performance of asymmetric ciphers.

Could anyone link me to something like that? My Google searches have proved futile.

In fact, the assertion that asymmetric cryptography is slower than symmetric cryptography does not make a lot of sense. They do not do the same thing. What asymmetric cryptography does, symmetric cryptography cannot do; less intuitively, this also works the other way round: what symmetric cryptography does, asymmetric cryptography cannot do.

Asymmetric encryption allows making the encryption key public, without revealing the decryption key; this is the obvious advantage of asymmetric encryption over symmetric encryption, and the reason why it was invented in the first place.

In the other direction: asymmetric encryption processes only messages of a limited size, and inherently incurs a non-fixed size overhead. For instance, with a 2048-bit RSA key and following the PKCS#1 standard (RSAES-PKCS1-v1_5), input messages cannot exceed 245 bytes in length, and yet yield a 256-byte output. It is unclear how a longer message should be split into sub-messages to be processed individually with RSA; this superficially looks like the "chaining" problem with block ciphers, for which modes of operation have been defined, allowing bulk processing of input data. However, block ciphers are easy: they work over nice sequences of bits, and encrypted blocks are indistinguishable from uniform randomness. The same would not hold for, say, RSA, where encrypted messages are integers modulo a big integer which is not a power of 2, which induces biases. This problem of chaining RSA encryptions is not well-studied, and does not seem to have obviously secure solutions.

The size overhead for asymmetric encryption is consubstantial to its asymmetry: since the encryption key is public, everybody can try to encrypt data with the encryption key. If the encryption is deterministic, then this allows an immediate brute force attack on the plaintext (the attacker tries potential plaintext values until a match is found). To prevent that, the encryption MUST be non-deterministic, which in turn implies a size increase (because of pigeonholes).

The raw consequence is that asymmetric encryption is not good at bulk encryption. When the data to encrypt is larger than the elementary size of the algorithm, then we do not really know how to do it securely, but we have rather fundamental reasons to believe that it would be expensive in terms of network bandwidth.

None of the above is about computational cost. To make a meaningful comparison that takes computational cost into account, one must be in a context where there is, indeed, a choice between symmetric and asymmetric encryption to be made. Basically, this would be a situation where:

You want asymmetric encryption for a message m.
You may want to use so-called "hybrid encryption": asymmetric encryption to encrypt a random key K, that you then use to process the data with a symmetric encryption algorithm.
The message m could be processed directly with the asymmetric encryption algorithm.

The third condition means that m is small enough to be the input of a single invocation of the asymmetric encryption algorithm, since otherwise you would not know how to process it. In that case, raw asymmetric encryption necessarily wins, since the choice is between "one asymmetric encryption" and "one asymmetric encryption plus some symmetric encryption stuff". On the other hand, if the size of m may exceed that which can be processed with a single call to the encryption algorithm, then you are back to the chaining problem, and any talk about performance is at best premature: first define what you want to do, see whether it is secure, and then (only then) can we talk about speed.

To make an analogy: you could ask which vehicle is faster, between this one:

and that one:

If you think that the answer is obvious, go drive your Ferrari into a lake...


How does Eve monitor and obtain ciphertexts? Throughout my readings on cryptography, Eve is always assumed to have the capability to be a passive listener and obtain every message exchanged between two communicators. How can one demonstrate this? I have a presentation and would like to know if there is a software I can demonstrate to the audience and show them that every message sent through is obtained by me, but are useless because they are encrypted.

I'd recommend grabbing Wireshark and listening on a Wifi network. If your network card can be put into promiscuous mode, and it probably can, then Wireshark will show all packets on the network that it picks up... e.g., everything on the network, essentially.

You could demonstrate the difference between HTTPS (say, have someone browse their Gmail account) and HTTP (say, browse reddit).

The reasons why I suggest using a Wifi network are twofold: first, Wifi networks model a very real-world scenario (say, public wifi at Starbucks), and second, Wifi networks have a "broadcast everything" model that makes picking up traffic really easy.

For more complex network topologies, e.g. a good ethernet with switches and whatnot, there are other techniques that can be used to sniff/MITM hard-to-reach packets, like ARP spoofing. But these are probably outside of the scope of what you want to demonstrate — you may decide to mention them in passing, though.


Proper Linux user authentication through PAM aware applications Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. (Amongst other options but those I do not have trouble with) It will be used as a centralised management and configuration system.

However because it is slightly insane from a security point of view to run the daemon as root I have been looking at alternatives.

The options I came across were:

Creating a group with read access to the /etc/shadow file and adding the daemon user to the group. (Additional downside, will need write access too if it needs to update user credentials. Which may come back to the initial root issue.)
Invoking a shell from the daemon and use su to temporarily switch to root/given user before authenticating. (One example included doing su [username] which would mean you are authenticated if the call succeeds.)
Creating a separate process that does only authentication under root and is communicated with through UNIX domain sockets. (This currently has my preference as the other two feel more like hacky workarounds.)

I have the nagging feeling I am missing an obvious solution but I have no idea what that would be. If this is not the case which one would be preferable from a security standpoint. What I found had was split between the various options without much insight into the trade-offs or how it compares to the other options. Because of the nature of the applications it will manage security is the highest priority in regards to any solutions.

As you ouline, due to the limitaiton of /etc/shadow access, at some level, your application will either have to access that file or access some other module/service which has access to that file. There is no avoiding it if you want a solution which uses locally managed user credentials (unless you totally roll your own, which I strongly recommend avoiding).

I think your best approach is to separate the authentication component. Apart from having the benefit of limiting your exposure surface, it has another great advantage not yet mentioned. From your post, it seems this software will run at client sites, some of which may have LDAP, some of which will not. If your authentication component is modularised/separate from the core of your application, you have the possibility of getting the best of both worlds. Basically, your client site can use the method which fits best with their architecture.

Keeping the environment as straight-forward and consistent as possible is almost as important as using the right technology. Many security problems arise because the environment or architecture is too complicated. Changes get made by someone who doesn't fully understand the full implications and the next thing you know, you have a major security hole.

If you write your application in such a way that it can pass off authentication to an external module, you can allow sites to select what fits best for them. They avoid having to manage yet another identity source, can ensure consistency across their envrionment and possibly get additional benefits, such as single sign-on or same sign-on etc. You could provide a 'default' auth module which uses PAM for those sites that don't have LDAP or similar.

The challenge with this approach is in selection or definition of the interface. How should the communication occur? I would keep it simple. Possibly domain sockets, but perhaps other standards, such as SAML 2.0 may be worth checking out.

You may also be intersted in this article, which talks about using PAM to control service access

https://www.linux.com/news/featured-blogs/203-konstantin-ryabitsev/699697-how-the-linux-foundation-and-fedora-are-addressing-workstation-security

Also, depending on the deployment platform - redhat or debian based, you should check out SELinux and AppArmor for ways to limit potential problems, such as restricting what resoruces an executable is allowed to access etc.


Do we require to eliminate share drive access to PCI users? Do we really require to eliminate the share drive access to the PCI users.
We have a file server outside PCI VLAN. But PCI users have access to it.

We dont have any DLP solutions. Does the PCI standard requires to eliminate file servers?

It doesn't require you to eliminate them, but if PCI-scoped user systems with PAN data on them can freely save files to them, then the file servers are in PCI scope and have to be subjected to full DSS compliance.

...and if your newly PCI-scoped file servers are also accessible to non-PCI-scoped user systems, then those non-PCI-scoped user systems are in PCI scope and have to be subjected to full DSS compliance.

...and so on, and so forth.


Key(session token) authentication vs default login/pass authentication I am building web application and have an idea to build custom authentication system, which would be quick and secure.

I do not want to use almost "default" login (email) / password combination.
I want to generate for all the users random unique cryptographically secure string key (say 70 random characters) when they sign up.

There would be only one input field to sign in, where user will have to input this key to restore his session again.

The only thing I am concerned about is its security.
What are the problems I have to cope with, using this method of authentication?

The only problem, I suspect for now is brute force.
But as far as I understand, if I take any library for generating, say email recovery password tokens, the possibility of brute force will be small. Moreover from math (correct me please if I'm wrong) the chance to brute two fields of 20 characters length (like login and password) is same as one field 40 char length (my key) if they have same set of characters.

EDIT 1: I added that fact, that key should be not only random, but unique also, to make it possible to use as an ID. however I am wondering if hash, using, in ex. Bcrypt would be also unique. Is it possible to achieve that? Will the hash be unique if the key is unique? Is the risk of collision high?

Maybe I'm missing something, but this still feels like reinventing the wheel. As you keep adding provisions for potential issues, I feel you'll converge close to something we do use currently.

I think of authentication as this:

At signup, I declare that I'm X (my UserID / email); and I provide some secret (the password Y) that only you (the site) and I know.
When I return to  login next time, I tell you that I'm X; and to prove it, I tell you the shared secret Y that we agreed upon when I signed up. Thus you accept that I'm the same X.

In security parlance we treat this as just one of the 3 common factors. You could add more factors, but I'm unable to see how we could reduce the first factor from the pair of data items (X,Y) to just one data item.

In general though, it is absolutely essential to provide completely smooth UX to users - and any attempt in that direction is laudable. For example, the way we do it in our website security app ActiFend is by

Not asking for registration at all (first time sign-in = registration)
Accepting federated authentication: Use their Google/FB/LinkedIn account and obtain the email address (only that) from there. If Google says "hey I checked this user and am accepting this user as X", that's good enough for us for this purpose.
For those who want another option, we send an email-based OTP, so that no need to store / save any password; complex or otherwise.

We're not the only one who's trying new ideas for this... e.g., Slack uses "magic links" (a user friendly term to depict alternate-channel authentication); Twitter and Google accept similar alt-channel auth (authenticate from another device where you're already logged in).

There are many ideas - but none of them have managed to pare down the data items to one. You might hide one of the items from the user (e.g., you could take the device ID as X; or their IP address as X.. each with their own issues), but can't avoid it altogether, I think.

I'm unable to articulate this any better... I hope this still helps.


Will checking the CSRF token on the header and the form's hidden be enough? From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy.

Is comparing the CSRF token on the cookie header with the  form's hidden element be enough?

With this method, the CSRF token implementation eliminates the need of saving the CSRF token on the server; is this a right approach?

CSRF token need to be check on server side.

That said, the token is often stored in a cookie so your approach is ok.

CSRF work like that :

For request :

Create token and store in on server or in cookie
Add the token to the form
When you receive a post, verify that the token in the form is the same one as the token saved on server side (or cookie)


Padlocks suitable as teaching aids for public key cryptography - do they exist? When explaining public key encryption, people commonly use the imagery of keys and padlocks. However, most padlocks have only one key (i.e. only one bitting), and work like this:

The padlock can be locked without any keys; and
The padlock can be unlocked only using the key.

Is there a class of padlocks that, instead, functions roughly like public key encryption does? That is, such that for each padlock, there are two keys, and:

The padlock can only be locked by using key 1; and
The padlock can only be unlocked by using key 2.

I don't require specific make or model recommendations. Nor do the padlocks need to be secure, as I would be using them as teaching aids: they could even be made of plastic, as long as they function as above.

My question: do such padlocks exist, and, if so, what is this class of padlocks called, so that I can look them up and evaluate the options available?

(The next best option I can think of would be to make a box with two doors, each with its own, differently-keyed lock: one "public" and one "private". However, this would weaken the analogy somewhat. Hence the question above.)

I don't believe they do and I'm not sure how that would work. There really isn't a call for a padlock you have to lock with a key, it is more complex than it needs to be.

For other locks, I think the nearest you would get to are those that have a master key which is quite common. But even there, any of the keys will lock any of the locks. The master key can open multiple locks of course.


Can a file have the same MD5SUM but different SHA-1 results from different tools? I have one file. SHA-1 and MD5 have been generated long time back. I do not know which tool has been earlier.

Recently I generated SHA-1 & MD5 for the same JAR. Surprisingly I found that MD5 is same both the times but SHA-1 is different.

How is it possible?

Thanks in advance.

Can a file has same MD5SUM and different SHA-1 from different tools?

If the file has not in fact been changed in the meantime?

No. Not if both old and new hashsumming tools are correctly implemented. (I.E. if they are implemented according to the MD5 and SHA1 standards.)

I suspect (in fact I'm short of betting) that the earlier checksum was just misdocumented.


Is a firewall needed on a small office that simply needs internet access? I'm planning on porting all of my office's software needs to cloud services that I can access via internet. It's a simple LAN that has a NAT gateway pointing to the open internet.

Would a firewall give me any benefits in this use case? What am I defending against?

If you don't care what your internal users connect to on the Internet then a simple NAT device would be an effective firewall.

If you want to open up internal services to the Internet, you would then need a more advanced system.

If you want to monitor your internal network for potential malware you would need additional systems like a firewall or an IDS/IPS or some desktop level software like AV or Tanium.


PCI compliance requirements when acting as a pass-through for credit card details I'm working for a startup and we generate prepaid Mastercards from a card issuer. In our database we save a card reference id, not the 16 digit PAN or CVC. Later we do an API to the card issuer to get the PAN and CVC and POST these to a retailer online store (the retailer is using Salesforce Commerce Cloud). On the retailer site, the PAN and CVC are processed by the payment processor.

All communication (from our servers to the card issuer and from our servers to the retailer store) is done over SSL. I think because we do not store the PAN or CVC, and instead act as a pass-through, we do not need to be PCI compliant. Is this correct?

From: https://www.pcicomplianceguide.org/faq/#2

  The PCI DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data

As you have stated in the above, you both accept and transmit cardholder data from yourselves to the retailer, so yes, you need to be PCI compliant.


SSH: Best practice for PublicKey Authentication from multiple Devices I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I copy the privatekey to my phone, laptop, etc? The main Problem that annoys me is all the different Passphrases that I would then write into a Password manager anyways...

You should have a different private key for each device. Here's the reason that i can think of :

This keys are for authentication so if you share them, you won't be able to discrimate the different users/devices connecting to your server. Should a problem happens you'll probably want to know the device involved.
The security of Public key authentication is based on the secret of private keys. The more a secret is duplicated the more difficult it is to keep it secret.
If you have a security breach on one device (or the device is stolen), it won't compromise the security of the other devices and you'll have the opportunity to ban this specific device.

Security often comes with a cost. Money, time, skills, comfort of use.
If the cost of having multiple passphrases is to high, you could use a password manager to store and remind them.


Javascript client side image decryption, does this add any safety or is it flawed I want to store passport copies safely in a database, the database itself is a normal MySQL database and on a somewhat trusted web server. The user who owns the passport copy should only be able to upload his or her passport not view it. The approach I want to take consists of the following steps.

Configuration:

System administrator opens page via https
Administrator submits a generated public key to the server and stores private key locally (on smart card or something not permanently attached to computer preferred)

Passport storage:

User opens page via https
User selects passport copy (image) in browser and submits it to the server
The server encrypts the image with the public RSA key and stores it in the database column
Server overwrites any unencrypted copy in memory

Passport retrieval:

Admin opens page via https
Server loads encrypted column and sends the encrypted image via AJAX to the admin browser
The admin's browser loads the private key from a file or smarcard and decrypts the image using https://www.pidder.de/pidcrypt library
The unencrypted image data is injected into the src attribute of a image tag.

(I have not yet found a good way to load the private key in the browser)

Questions:

If the server is hacked and the database downloaded by the attacker, are the passport copies then safe?
Is there a better way to ensure the copies are safe?

it DOES potentially add security in that the private key is not on the web facing server. Since that server is Internet-facing 24x7 it has a VERY large attack potential.

It does assume however that the administrator PC is well secured & this may not be the reality. The use of a removable secure store such as a smart card is potentially better as indicated by you - assuming the store is kept secure ;)

The copy on the web server will be as secure as the method used to encrypt the data. Assuming best practice, that should be pretty good though if an attacker got the whole database and if that contained many thousands of entries all encrypted with the same key, the security would be weakened. Salting and multi-pass encryption would probably help with that.

However, there is an even stronger and potentially simpler way of security the data. It depends on how you are using the image though. You could simply not store the image on the web server! In a typical enterprise setup, you would keep a secure data server inside your network (whereas the web server would be in the DMZ). The secure data server would periodically take the data from the web server and delete the image on the web server. Combined with a sensible encryption process similar to the one outlined but where the private key was kept on the internal network, possibly in a security accelerator card for ultimate security, this would get rid of the need for administrator intervention and would keep the sensitive data out of view.


Does Antivirus upload malware samples from infected computers? According to Kaspersky, its antivirus software "automatically uploaded [malware samples] to Kaspersky’s specialists for further analysis."  Is this common practice for antivirus software? How do they make sure they're not uploading personal files infected with malware?

I understand that antivirus software initially checks some hash of samples found on an infected computer and checks a database for a match first.  I'm asking about the case where they don't find a match and have a potentially "new" malware.

Kaspersky does not upload personal files by default
Kaspersky will upload possible viruses for analysis only if YOU specify that

Since it is unclear what version you refer to, I'll give you a general example:

Options for this are very well controllable. Even on older versions (like KAV 2013), if you open the application settings window, in the left part of the window, you can select the Advanced Settings section. In the Operating mode section, you can click the Settings button and the Operating mode window opens. There, you can select the Enable dump writing check box to enable the application to write application dump files. You can then select the Send dump and trace files to Kaspersky Lab check box or choose to clear the Send dump and trace files to Kaspersky Lab check box.

If the file is not actually found to be infected but you still consider it suspect, you can upload it manually for analysis using VirusDesk ( https://virusdesk.kaspersky.com ).

In the current versions of Kaspersky Security Center, you also have the clear option (Under Advanced --> Application management): I agree (or not) to participate in Kaspersky Security Network.

As for propaganda like "Russian hackers exploited vulnerabilities in the antivirus program to breach an NSA contractor’s computer in 2015 and steal classified files" it's totally irrelevant. Some big corporations wanted some revenge because Kaspersky was the only anti-virus that disclosed what some big manufacturers were doing to potentially or directly (i.e. seagate) spy anyone using their components. That's why all the fuss in the US against Kaspersky.

I've been using various anti-virus solutions since the MS-DOS era and I can say hands down that currently Kaspersky is one of the best AV solutions up there, even no.1 at this moment.

Note that What I considered the best AV varied a lot every few years, because some AV companies improved a lot while others made bad choices. My view on this was always impartial.


Is it okay to store this health data in a public cloud? Is it okay to store relative health data in the public cloud, accessible by all users of my mobile app? Put another way, is this not considered PHI?

For example:

Bob has a resting heart rate of 40 BPM. When he did a plank for 3 minutes, his heart rate rose to 80 BPM. The percentage of which his heart rate increased (100%) is stored in the public cloud, while his actual heart rates are stored in an HIPAA-compliant private cloud.
Joe has a resting heart rate of 70 BPM. When he did a plank for 3 minutes, his heart rate rose to 100 BPM. The percentage of which his heart rate increased (~42%) is stored in the public cloud, while his actual heart rates are stored in an HIPAA-compliant private cloud.

Another example:

Bob has asthma. Bob's best peak flow is 700 L/min. This morning, Bob took his peak flow, and he got 660 L/min. The percentage of how close he got to his best peak flow (~94%) and his location1 are stored in the public cloud, while his actual peak flows are stored in an HIPAA-compliant private cloud.

All data in the public cloud will be stored anonymously. Bob's name and its association with his heart rate rising by 100% and location are not stored.

Is this kind of data allowed to be stored and shared with other users? The idea is to see if those in your general location are experiencing the same percentage increase/decrease.

1First 3 digits of the zip code if population is greater than 20,000?

Might be OK.  Some due diligence is required, and you might have to hire a statistician, and will need signoff from your legal dept.  Here's the rule:

De-Identified Information
De-identified data (e.g., aggregate statistical data or data stripped of individual identifiers) require no individual privacy protections and are not covered by the Privacy Rule. De-identifying can be conducted through
statistical de-identification --- a properly qualified statistician using accepted analytic techniques concludes the risk is substantially limited that the information might be used, alone or in combination with other reasonably available information, to identify the subject of the information [45 CFR § 164.514(b)]; or the
Safe-harbor method --- a covered entity or its business associate de-identifies information by removing 18 identifiers (Box 2) and the covered entity does not have actual knowledge that the remaining information can be used alone or in combination with other data to identify the subject [45 CFR § 164.514(b)].


Microsoft IIS Express Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)?

Is there a waiver process?

Respectfully disagree that policy discussions are offtopic for Information Security. Good information security starts with good information security policies.

IIS is a prohibited install on workstations under USGCB. This would suggest that any waiver must be based on a business case and approved by your agency's Designated Approval Authority as part of the Authority to Operate for your Major Application or General Support System.

Refer to your agency's security policy documentation and the NIST website.


Hosted Email Hacked, SQL injection maybe? I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.

Basically, someone is using my email account to mass send spam. I've changed all the passwords and everything but when my Gmail pulls the emails from the host it's still downloading loads of spam messages that show like this:

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  example@example
    SMTP error from remote mail server after end of data:
    host 198.91.80.251 [198.91.80.251]: 554 5.6.0 id=23634-03 - Rejected by MTA on relaying, from MTA([127.0.0.1]:10030):
    554 Error: This email address has lost rights to send email from the system

------ This is a copy of the message, including all the headers. ------

Return-path: <admin@example>
Received: from keenesystems.com ([66.135.33.211]:2370 helo=server211)
        by absolut.x10hosting.com with esmtpsa (TLSv1:RC4-MD5:128)
        (Exim 4.77)
        (envelope-from <admin@example>)
        id 1TGwSW-002hHe-Lc
        for example@example; Wed, 26 Sep 2012 13:35:44 -0500
MIME-Version: 1.0
Date: Wed, 26 Sep 2012 13:35:43 -0500
X-Priority: 3 (Normal)
X-Mailer: Ximian Evolution 3.9.9 (8.5.3-6)
Subject: New staff members wanted at Auction It Online
From: admin@example
Reply-To: example@example
To: <example@example>
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Message-ID: <OUTLOOK-IDM-9aed7054-6a3e-e1a4-1d5c-3e73377652a6@server211>

I'm not aware of how this has happened. I'm not sure how anyone could have got hold of my password.

It's a simple wordpress install, at some point recently my host went down and there was a fresh install of wordpress with default admin accounts, I have a feeling it could be something to do with this.

My question is, even though I've changed all my passwords it's all still happening, is there annywhere in paticular this script would be stored on my host. I really can't deal with having my hosting account suspended and my email account sending all this spam.

The attacker may or may not have your email password; this message doesn't indicate one way or the other. This is a failure notice from some email sent (possibly by your website) earlier in the day. You should expect to continue to get these notices for a while even after the outbound email stops, though the rate should slow significantly over time. If it doesn't, then the outbound messages are still going out and you need to re-evaluate your current security.

As for how the attacker got in, if you're running an old Wordpress install, there has been a vulnerability or two in the not-too-distant past that could account for this. If you're running an updated install, then check your plugins and themes. The vast majority of the time, it's a plugin or theme that is to blame.

People tend to only install software (like Wordpress) that has a decent reputation, but they completely let their guard down when installing third-party components. It's very possible that the person who wrote your theme or component has no idea how to write software; this could even be his very first attempt. And yet a vulnerability in a theme or a module is just as bad and just as exploitable as one in the core system.

You have to be extremely cautious, particularly with PHP software (which has much lower barriers to entry for inexperienced developers), and only install code that you know you can trust.

Also, you have to stay on top of the updates. The window between when an update for a package is officially released till when the issues it fixes get widely exploited by even inexperienced hackers is only a matter of days.


What is the purpose of the authorization code in OAuth 2? Why do we need to ask the authorization server for theAuthorization code and then exchange the Authorization code for anAccess token on the same server? Why not to return anAccess token directly, without issuing anAuthorization code?
I do understand that it is specified by the standard but there should be some logic behind this.

The way the “authorization code grant type” is meant to be implemented is in a web app that has public and confidential clients. The authorization code is authorized by the resource owner and the browser (public client) redirects the application to the callback URL, passing the authorization code in the URL parameters. Because the browser is a public client we should not expose the token here. Instead, the (confidential) backend of our webapp, passes that authorization code as well as client_secret to the authorization server and exchanges it for the token.

Do you see how we protect the token and api client_secret by keeping that workflow in the backend?


How Secure is my Heroku Source Code? I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances.

First off, I am aware that I am handing my data over to an external company, and that it's game over if bad actors manage to infiltrate Heroku or to hack my individual user account.

With that out of the way, I have a few questions:

How secure is the source code of the microservices that I'm pushing to a Heroku dyno? If someone else knows the URL of my app, e.g. https://newbs-dyno.herokuapp.com, what can they do? Can unauthorized users clone the underlying git repo? Can they view the contents (files and folders) that I've put on the dyno?
How securely stored are the configuration variables? I want to use config vars to store some credentials, as described in the documentation. Is this good practice?

What defines how visible or invisible my dyno's contents, configuration variables included, are? Is it correct to think of my dyno as a server-side application that exposes a few well-defined endpoints?

Heroku is a platform as a service offering, your code will live in virtual containers, this means that it is better isolated from other containers running in the same server (speaking strictly about direct file access).

The way to store secrets, as you pointed out, is to use config vars. The heroku documentation specifies this as the secure way:

  A better solution is to use environment variables, and keep the keys
  out of the code. On a traditional host or working locally you can set
  environment vars in your bashrc file. On Heroku, you use config vars.

You can in fact keep files outside of the public folder by specifying the Document Root of your application. This will set the folder where the web server will look for your php files. The web server will reject direct internet access to files outside of the Document Root, your code may still introduce vulnerabilities that allow this but from a configuration point of view this is the way to go.


How to test my website for the rails YAML vulnerability I am quite puzzled by how to test my rails app for the YAML vulnerability

first, I upgraded to the latest rails 3.2.11, and I tried this

It gave me not likely to be vulnerable or URIPATH must be set
which should be reasonable since I upgraded to the latest rails.

But I checked another rails app which I abandoned long time ago, which I know isn't patched.
I got the same result. Note that both of my apps run on heroku.

What is the difference between RHOSTS and VHOST and URI?
Should RPORT be the http port or should it be the port that the webserver is running?

Sorry for a short response, but I'm sure others will fill in eventually.

RPORT most likely means the port that the webserver is running on.

I've not used metasploit for this yet, unless Tinfoil Security uses the same concept, see:
https://www.tinfoilsecurity.com/railscheck

-k0nsl


Why does gpg --list-keys modify my keyring? I am concerned that listing the keys in my GPG keyring changes my pubring.gpg and trustdb.gpg files. I expected listing keys to be a read-only operation.

Would you know what the reason is? If there is no good reason, is there a way to prevent it? Taking the hashes of these files to verify their authenticity would make my job easier.

Script to reproduce

rm keys -rf
mkdir keys

gpg --homedir keys --gen-key --batch <<EOF
Key-Type: RSA
Key-Length: 2048
SubKey-Type: RSA
SubKey-Length: 2048
Name-Real: Test
Expire-Date: 0
EOF

find keys -type f -exec sha256sum {} \;

gpg --homedir keys --list-keys

find keys -type f -exec sha256sum {} \;

Sample output

gpg: WARNING: unsafe permissions on homedir `keys'
gpg: keyring `keys/secring.gpg' created
gpg: keyring `keys/pubring.gpg' created
.....+++++
..+++++
...+++++
..+++++
gpg: keys/trustdb.gpg: trustdb created
gpg: key A492C6DF marked as ultimately trusted
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  keys/pubring.gpg~
a5791aee44c5496e11105a9ecd6d1dc41b64c19f3ad236a21ad854fe636dda3a  keys/random_seed
357de0c1a72450c653f6a1bd472bc50db975e4016644967cd49c3edcd416bdac  keys/pubring.gpg
f408c36e2f20bcd79da92ddbbb9866fa47bd5c1cfa1457b09a8a7560ac52f94f  keys/secring.gpg
854fa0608f4a3d8ff264c4720c4c6e3a72db9a37a6e28244705f6dd3cd954ebf  keys/trustdb.gpg
gpg: WARNING: unsafe permissions on homedir `keys'
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
keys/pubring.gpg
----------------
pub   2048R/A492C6DF 2017-03-02
uid                  Test
sub   2048R/CBA76512 2017-03-02

357de0c1a72450c653f6a1bd472bc50db975e4016644967cd49c3edcd416bdac  keys/pubring.gpg~
a5791aee44c5496e11105a9ecd6d1dc41b64c19f3ad236a21ad854fe636dda3a  keys/random_seed
d8d723c224be6e54099305f18d6064758b05033698d64c7d6c591e518b6116ad  keys/pubring.gpg
f408c36e2f20bcd79da92ddbbb9866fa47bd5c1cfa1457b09a8a7560ac52f94f  keys/secring.gpg
7bb05436e0077fbe90f3407ebd90d62a6d2983c878de9bfc6bf44d6ae724cf04  keys/trustdb.gpg

When you use --list-keys for the first time, GPG implicitly performs a trust database check (because you haven't done one before). This also shows up in your log:

gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model

Checking the trust DB is not a read-only process. It will at least change a timestamp in the trustdb.gpg file. Here is what the check is for:

--check-trustdb
       Do  trust  database  maintenance  without user interaction. From
       time to time the trust database must be updated so that  expired
       keys or signatures and the resulting changes in the Web of Trust
       can be tracked. Normally, GnuPG  will  calculate  when  this  is
       required  and do it automatically unless --no-auto-check-trustdb
       is set. [...]

  Taking the hashes of these files to verify their authenticity would make my job easier.

Key files contain more than just the key parameters, they have metadata attached. It's not guaranteed that two files containing the same keys always produce the same file hash. Hence, instead of hashing the files you should --fingerprint the specific keys if you want to compare them.

Also, if you don't want to preserve your ownertrust settings (or don't have any), then there'd be no need to backup the trust DB at all and you could just delete the trustdb.gpg file (although it would reappear with the next check).

(I couldn't reproduce any changes for pubring.gpg when using your script.)


Is it secure to use email to add content to a website? I have a website running a social network Buddypress.

Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without logging in Buddypress.

My idea was this one: each comment generates an email notification, and the notification has a Reply-To field filled with a long unique identifier (UUID). I would keep in a table the tuples (UUID, messageId, notifiedUser)

On the server side, when I receive an email in, say, Postfix, I would parse the recipient to see if there is a previously generated UUID, and check if the emitter is the person which the notification was sent to. If I find a match, I parse the email body in search of the reply, then I call some buddyPress PHP code to insert the text inside the database.

My question is: is it secure, and what attacks is this vulnerable to ?

Clearly, somebody sniffing (UUID, recipient) could immediately send garbage by impersonating the original recipient  (i.e sending an email with a forged From: field, equal to the To: field of the email he just sniffed). But is it a real concern ? Which paths used by emails are encrypted ?

This is no more or less secure than sending a link in the e-mail that allows responding without having to login.  It is not particularly secure, but it is a supported feature.  There is already a post by E-mail feature provided in WordPress that you may want to look in to.  I'm not 100% sure that it will work for posting comments, but if you do have to write your own stuff, you could base it off the existing mail to post functionality.

Just be aware that e-mail can easily be spoofed and is sent completely unencrypted, so anything you e-mail may be intercepted and anyone could send an e-mail appearing to be from any address unless you use some kind of e-mail signing and verification.


Can you recover the password from ZipCrypto encrypted ZIP file? I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily.

Now the question is, can you also get at the password (assume this is a very long, very high entropy password)?

A colleague has actually managed to use one of our "high security pass phrases" for encrypting a ZIP file and sending it out to a third-party e-mail system. Are other containers, using the same passphrase, secure, or could someone, who fetched that ZIP file, "extract" the passphrase from it and then move on to decrypt other, higher-security containers with it as well?

Maybe.

The legacy algorithm uses iterated CRC32 to derive its initial state from the password.  As the original paper describing the attack (archive.org link) notes, the invertibility of the CRC32 hash function means that the password can be recovered with complexity 2((n-6)*8), so passwords of up to 16-18 characters should be reasonably recoverable.

However, because the cipher only maintains 12 bytes of internal state, if the actual password is longer than this, an attacker may instead find a 12- or 13-byte "equivalent password" that can decrypt other legacy-zip files, but is useless for decrypting files encrypted with other algorithms.


Can my school monitor what I'm looking at at home? Sophos is installed yesterday I accidentally searched up a website and misspelled a character and it took me to an obscene website that I was horrified by on my school laptop. I was also on my school account. Can my school see what I looked up?

It is technically possible, even with Sophos installed. But unlikely if you were at home and are not having a VPN connection established to your school. But nobody will be able to answer it with a yes or no without doing an analysis of your computer.