What are the security implications if systemd is not restarted after it has been updated? My understanding is that systemd is the parent process for all other processes running on Linux.

If systemd has been updated on production devices such as servers and the service is not restarted, what are the security implications?

What are the common attack vectors for systemd to signal it must be restarted?

The article on systemctl daemon-reexec suggests that a package update already performs restart systemd.

This suggests there is no requirement to restart systemd even though the output below displays it has been updated and may be using deleted files.

PID  | PPID | UID  | User    | Command       | Service       | Files
-----+------+------+---------+---------------+---------------+----------------------------
1    | 0    | 0    | root    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
907  | 1    | 0    | root    | systemd-udevd | systemd-udevd | /usr/lib64/libkmod.so.2.3.3
2284 | 1    | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
2285 | 2284 | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3

It's still running the old binary, having all its vulnerabilities. You can restart Systemd without reboot using the Manager Lifecycle Commands: systemctl daemon-reexec should be enough after a package upgrade.

The details depends entirely on the vulnerabilities found in the specific version and is information that will become obsolete too quickly to be meaningful on a Q/A site. You should check

the release notes (for Ubuntu, Debian e.g. stable systemd_232-25+deb9u8) and
Common Vulnerabilities and Exposures (CVE). Last vulnerabilities were memory corruptions (CVE-2018-16864, CVE-2018-16865) and an information leak (CVE-2018-16866). (You could also notice that there's CVE-2018-16888 that hasn't currently been fixed in Debian stable.)

If you aren't able to evaluate whether these vulnerabilities have security implications in your situation, just upgrade your packages regularly and restart the services.


Setting up DNSsec for an exotic TLD I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money.

How can I easily setup DNSSEC for my domain?

.money is one of the new top level domains (TLDs), as such it (by itself) should support DNSSEC.

This turns the DNSSEC support into a question of your registrar. As you noted already, it's not supported by default by your registrar and its DNS services.
This leaves you only the option to run your own DNS server with DNSSEC server and by "own" I mean either really your own BIND server (not recommended) or some DNS provider who automatizes DNSSEC for you.

Running DNS yourself however isn't the full solution to deploy DNSSEC. You also need to a) inform your registrar that you don't want to use his DNS servers anymore, but your own (this should be a standard thing) and b) tell the registrar the so called "DS" record. The registrar than needs to put the DS record into the parent zone (i.e. .money), which should be done by a short support ticket along with the DS record.


Are Amazon AWS instanceIds security sensitive? For troubleshooting, it's useful to include HTTP response headers that indicate proxy and backend EC2 instance ids, such as:

X-Backend: i-8af67c92e0f3d89b6b
X-Via: i-5b8146e7102940c75b-us-east-2b

Is there any security issue with doing this? Is the instanceId considered sensitive in any way?

I personally don't feel that EC2 Instance IDs are a security problem. These IDs are only useful within AWS and this requires authentication and authorization.

However, there is another method. Tag your EC2 instances with unique information. Then provide that unique tag instead of the instance ID.

Tagging Your Amazon EC2 Resources


open stmp port as an attack vector? I'm currently in the process of securing my website and searching for vulnerabilities. It has an open ftp port and an open stmp port (25). I watched a few tutorials online about hacking into stmp ports online, and realized it's incredibly easy to log into my stmp port via telnet. My question is: does this stmp port pose a security threat to my website?

An open port represents a program that is listening to anyone on the internet.  It provides anyone with the opportunity to attempt to exploit the program to gain access to the computer.

Allowing public access like this is always a calculated risk.  There are many ways to minimize the risk, such as using reputable secure software, and always keeping it up to date.  In the case of an SMTP server that you are not running on purpose, both of these precautions are unlikely.

Is there any reason at all to run the service?  Could it be all risk, no reward?


Access control to anonymous users What is the formal name -- and description -- of the problem of giving users access to a resource exactly once each while not requiring them to identify themselves?

In other words, to have a system that is able to give away access tokens to users as long as they have never obtained any before.

Assuming that users are able to perform cryptographic functions, and can be assumed to have personal certificates signed by the system, but which they do not want to reveal to the system in order to gain access.

Is there such a model? Is there such a well-described problem?

There is no such model and no such problem. As long as users are not authenticated you cannot prevent multiple usage of your resources by the same user. Users can delete cookies, can change their IP, can change their browser, etc. If you require users to be authenticated then you can reduce the number of such cases, because some part of users can find it to difficult to create multiple accounts to your system. To assure each user has really a single account, or (more precisely) not too many accounts, you can use registration via mobile phone, or use credit card number in the registration process.


Do TrueCrypt volumes look like random data? Let say I use Eraser (or other tools) to erase my hard drive (using DoD standards which is 7 times or Gutmann which is 35 times),

These eraser tools just write random data on the hard drive many times correct?

Also if encryption looks like random data, how can anyone say its encrypted or not without you confessing?

If I were to erase one of my hard drives now, so I can sell it without anyone snooping on it easily, and the authorities seized my computer and told me to decrypt the hard drive… Well, I can't!

What I'm asking is, do TrueCrypt volumes look like random data?

Yes, TrueCrypt volumes look like random data. This is mentioned in the Plausible deniability section of the TrueCrypt FAQ. The FAQ even mentions that having just erased a disk is an excuse for having a volume full of random data. I hate to call it a plausible excuse because as a rule people don't keep such volumes around.

If your disk is seized and found to contain random data, it'll look like you either have an encrypted partition or you've just erased it. Either case will look suspicious. Far better to fill it with halfway-useful stuff like a spare, bare OS installation.

Note that making multiple passes when erasing data is largely a myth; it's neither required nor necessarily sufficient to erase all traces of prior existing data, nor is overwriting with random data a significant improvement over zeroing. See How can I reliably erase all information on a hard drive?, Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?


Google account verification request Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used).

I double checked it was the real app and logged in again (I went through all the authentication steps, including 2FA through SMS that was automatically picked up by the app).

I then checked all my account activities and security settings, and found there were no signs of access or edits other than my own. Everything looked perfectly fine, including linked devices and apps.

Should I worry, or is this a random check by Google to see if my access from the phone is still valid? (Or maybe Google Play Services just lost an auth token and asked me to log in again?)

Example of sign-in request:

Google says it's not a security problem and that you don't have to worry.
After investigation they issued a statement in the Google product forums:

What happened?
During routine maintenance [from 1pm to midnight PST yesterday], a number of users were signed-out from their Google accounts. This may have resulted in you being signed out of your account or seeing a notification about “A change in your Google account” or “Account Action Required.”
We hear your concerns that this appeared to potentially be phishing or another type of security issue. We can assure you that the security of your account was never in danger as a result of this issue. You can always learn more about the Security tools Google provides at www.google.com/safetycenter/
What should I do now?
First, try signing back in with your usual username and password at accounts.google.com. If you can’t remember your password or can’t sign in for another reason, recover your account here: g.co/recover.

Note that the statement only refers to this particular incident from around February 24th, 2017 which has affected many users and is likely harmless. But more generally, if Google is asking for a security confirmation or warning you about changed account details, you should take that seriously and review your security settings and recent logins - as you should do regularly anyways.


Tripwire - Is it security Theater? Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.

Let's say I have tripwire configured to run nightly and installed it on a fresh non-rootkitted system.
Then at noon today a skilled intruder installs a rootkit to my system.

How do I know their rootkit hasn't replaced my tripwire with a tripwire impersonator; using a different set of public/private keys (and fake authentication binaries) that more or less replays the last files (readable with public key) to assure me that no checksums are changing (essentially just replaying known log files).  I guess I could notice that my private passphrase no longer works to open the private key; but I don't think it would be that difficult to let any password work (or just the first one typed in).  I guess I should be checking the file sizes/shasum/md5sum of tripwire with known values, but on my rootkitted system all those utilities could be compromised.

I'm looking at the documentation from http://sourceforge.net/projects/tripwire/files/tripwire-src/2.3.0-docs-pdf/ and don't see how tripwire provides any extra security -- besides making the rootkit developers have to work a little harder (to mimic one extra utility as configured by the user).

In practice, I doubt I'd ever routinely boot off a live cd to check hashes safely; so I am wondering if it provides any safety or if its just security theater.

I think there's something to be said for setting a bar, regardless of how low it is.  Can Tripwire be bypassed?  Sure.  Will it catch things that you wouldn't otherwise?  Yes it will.

The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it.  If it blows up every time someone changes something in their home dir, you'll ignore it.  If it blows up every time your web people change your site, you'll ignore it.  If it blows up every time someone upgrades a package... you get it.  However, if you've got a good workflow around it where it only complains when something abnormal is happening, you'll pay attention to it, and that certainly has value.


HTTPS Certificate mismatch alert before redirection Let's analyze the following situation:

A server is hosting 10 websites: site1.com - site10.com.
Only one of these websites uses SSL -site1.com.
If you try to access site2 - site10 over https the browser displays a certificate mismatch alert, but if you ignore the error, it redirects to http.

I know why the certificate alert is being displayed, but I do not know how to treat it from a security point of view.

Should the issue causing the browser alert be treated as an improper configuration problem, a security problem or is there no problem at all?

When a security warning is displayed, the user should treat it as a full-scale security emergency and trigger damage containment and recovery procedures. It is well-known that users do not do that; instead, they click OK or Cancel (whichever is nearest to the current mouse pointer position).

In the situation you describe, the user is trying to contact an inexistent site: there is no such thing as an SSL-enabled site2.com. Because of a quirk of HTTPS, the server cannot return the correct answer (namely "connection refused") and instead initiates a SSL connection with the certificate for site1.com (hence the warning). Once the SSL handshake is done, the browser sends the actual URL (which contains site2.com), the server becomes aware of the problem, and courteously offers a redirection to the non-HTTPS site.

If the client browser is recent enough, it may use the Server Name Indication extension, giving an advanced indication of the server name that the browser tries to reach (i.e. site2.com), which would allow the server to abort the SSL layer early on, avoiding the security warning popup on the client (the server would still have to be configured to implement that behaviour, though).


Can anyone provide references for implementing web application self password reset mechanisms properly? We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).

My problem is that I can't find any references to point the developers at around using that technique.  Can anyone point me in the direction of some good references on this technique?

Some suggestions:

Don't reset the user's password until confirmed. Don't immediately reset the user's password.  Only reset it once the user clicks on a confirmation link sent to their pre-registered email address.

Require a CAPTCHA. When a user requests that their password be reset, force them to solve a CAPTCHA before proceeding any further.  This is to prevent automated tools from trying to give many users grief, and force the user to prove they are a human (not a robot).

Randomness. The time-limited password reset URL should include a random, unguessable component.  Make sure you use crypto-quality randomness.  The output from /dev/urandom or System.Security.Cryptography.RNGCryptoServiceProvider would be a good choice.  The output from rand() or random() or System.Random are not random enough and would be a bad choice.  A GUID or timestamp is not random enough and would not be a good choice.

Include a time limit. The reset confirmation link should expire after some reasonable time: say, 24 hours.  The link should be usable only once, and should immediately expire as soon as it is used.

Include explanatory text in the email. You may want to add some explanatory text to the email, to explain why the email was sent, in case someone requests a reset for an account that is not your own.  You could include some text like "Someone has requested that the password be reset for your account username on site.  If you made this request, click here to change your password.  If you did not make this request, click here to cancel the request."

Send email after the password is reset. Once the password is successfully reset, send email to the user to let them know that the password has been changed.  Don't include the new password in that email.

Monitor cancellations. You might consider including some logic to monitor the frequency with which users click the cancellation link indicating that they didn't request a reset.  If this goes above a certain threshold, it might be useful to send an alert to the system operators.  Also, if a cancellation link for some request is visited after the confirmation link is visited, that's a potential indication of an attack against that user -- you may want to take action at that point, e.g., invalidate the user's password and require them to reset their password again.  (This is a defense against the following attack: the attacker gains access to the user's mailbox, then requests that their password on your site be reset, then visits the confirmation link.  If the attacker doesn't delete these emails from the user's inbox, then when the real user reads their email, they may click the cancellation link, giving you an indication of possible trouble.)

Use HTTPS. The link should use https (not http:), to protect against various attacks (e.g., Firesheep attacks on users surfing the web from an Internet cafe).

Log these operations. I suggest logging all such requests.  In addition to logging the user's username, you may want to log the IP address of the client that requested a reset link be emailed to the user, as well as the IP address of the client that visited the reset link.

Additional reading. You may also want to read Troy Hunt's excellent blog post, Everything you ever wanted to know about building a secure password reset feature.  Thanks to @coryT for a link to this resource.

Lastly, consider non-password authentication.  Passwords have many problems as an authentication mechanism, and you might consider other methods of authenticating users, such as storing a secure persistent cookie on their machine with an unguessable secret to authenticate them.  This way, there is no password to forget and no way for the user to be phished, though you do need to provide a way for a user to authorize access from a new machine or a new browser (possibly via email to the user's pre-registered email address).  This survey paper has an excellent survey of many fallback authentication methods and their strengths and weaknesses.


Sending server-generated password by email I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction.

The password is separate to their login credentials, and they can only enter this auth password if they're logged in.

We want the server to generate and send the password to them by email, and we'll store a hash of the password on the server. At the user's request we will be able to refresh this password.

I've looked at other questions, such as Is sending password to user email secure?, and it seems that the issue isn't with sending passwords, but storing plaintext passwords.

Is there anything I should be concerned about with this process?

Yes, several things. While this is unfortunately standard procdure, it's a bad idea:

Those passwords should be invalidated after a short period of time (and especially if the emails are not end-to-end encrypted).

There are good chances, someone else has those passwords, too, because Emails are post cards rather than letters.

If the passwords are invalidated that fast, most users might not be fast enough to enter them themselves.
If your website is not TLS all the way (or something goes south, via XSS or malware), there is also a good chance that an evesdropper can hijack the session and also access the password (if it's sent unenctypted).

This is especially true for free, unencrypted WiFi, as many users check their emails unencryped, exposing the password right away. An automated approach would always be faster than the user.

A better approach would be to use an TOTP with a second factor (such as a smartphone app or a security token. There are apps for that for all major smart phones (Google Authenticator being a big one, but other apps can be used as well) and security tokens are next to nothing in purchase.

If that is not an option, try to fall back on another out-of-band communication channel such as SMS or automated voice calls reading the password out loud and invalidating it 10 seconds later.

Side note:

  and it seems that the issue isn't with sending passwords, but storing plaintext passwords.

That's not correct, there are different issues and risks with both.


Is there a technical security standard for internet facing test environments? We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security vulnerabilities etc, we found that the servers were indexed by Google and other search engines. This led to a situation where customers were clicking on search engine links and attempting to make use of the UAT environment for business. We've put a few controls in place now to ensure this does not happen again but to avoid future errors, I was hoping there is a full standard available to say e.g.

Ensure sites are not searchable by search engines by making use of
Robots.txt or other meta tags
Clearly mark UAT environments as different from Prod environments
Etc...

Is there a standard / checklist available for this specific use case?

There is no such standard. Even robots.txt is only a recommendation the bots might follow or ignore and some might even explicitly check whats behind the things they should not crawl. And test environments might actually be interesting for a potential attacker since they might have weaker security.

If you don't want others to crawl your site you need to explicitly restrict the access instead of hoping that they voluntarily don't access the site. Such explicit restrictions are done for example with authentication using username+password or client certificates or by restricting based on source IP address who can access this site. This is similar to putting a lock on the door where only few users have the key instead of just putting a sign there which kindly asks others to not open the door.


How to prevent contradictions in policies Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies.

What can be a good measure to prevent this?

Example: I say to my employees that no-one has the ability to access room FR1 after 7pm on Wednesday, but in the same policy I also alerted employees that everyone who can confirm a valid authorization are allowed in room FR1 until they leave, no matter what time.

This is just an example, but in reality, it is much broader than that. To be 100% clear, rules that interfere with other rules and that combination will fail because of confusion. I want to prevent these kinds of complications.

Typically, you want to have your policies in a hierarchical format so that child policies support the parent policies. That's one way to ensure that you do not end up with contradictions or logic loops.

Your example is highly detailed and is more of a procedure than a policy (a minor point, but I'm going with "procedure"), but the way to prevent contradictions and logic loops in procedures is to run decision trees to track the state of the elements in the procedures. This sounds more complex than it is, but you just need to list the various elements that can have their own states (allowed, not allowed, locked, unlocked, etc.) and see if there are different conditions that can trigger different states at the same time. You start by asking, "where do I reference room FR1?" and work from there.


Cmd traceroute not being affected by VPN configuration I am using a virtual private server in combination with SOCKS5 proxy, which in essence provides the same functionality as VPN.

When I connect and check my public IP, it shows the location of the server. However, when I do a traceroute to a website in cmd, it only goes through local connections in my country.

Is this ok? Is the traffic not supposed to be all routed through the VPS?

An application must be specifically support the use of a SOCKS proxy. Web browsers usually do, while most other applications usually do not. There are some ways to "socksify" other applications but details depend on the OS and maybe the application too.

Apart from that SOCKS5 supports only tunneling of TCP and UDP. traceroute and tracert often default to use of ICMP which can not be tunneled with SOCKS5.


What are 'screened' DH groups? Currently it's recommended to do something about the contents of /etc/ssh/moduli.
I've seen two ways:

to strip all moduli of less than 2047 bytes size from the file.
to recreate them using ssh-keygen.

The first is a very quick fix, and immediately should improve security. On the other hand, i don't know if there's any extra issue for the remaining ones lurking that we'll find out about in a few months. Thus I at least want to gather the exact way for regenerating /etc/ssh/moduli using ssh-keygen.

The man page says the following:

 By default, each candidate will be subjected to 100 primality tests.
 This may be overridden using the -a option.  The DH generator value will
 be chosen automatically for the prime under consideration.  If a specific
 generator is desired, it may be requested using the -W option.  Valid
 generator values are 2, 3, and 5.

 Screened DH groups may be installed in
 .../etc/ssh/moduli.  It is important that this file con-
 tains moduli of a range of bit lengths and that both ends of a connection
 share common moduli.

I wonder what "screened" means in this context.
Does it mean you ran

  ssh-keygen -T moduli-length-f moduli-length.candidates

against a file created using -G ?
Or does it mean you have someone (who happens to be a group of crypto specialists with supercomputer in reach) look at them with more sophisticated methods?

It's so extremeley vague, I'm unable to tell what they mean.
To make it worse, I haven't found any distro having documented how they make the moduli set for their own SSH package. I guess it takes days if they include 8k ones and so they're just happy to be done with it - but it doesn't instill confidence either. So I'd really love to get a handle on this.

If you wondered: The difference between 2 and 5 might be described here:
What is the difference between Diffie Hellman generator 2 and 5?

But actually, the manpage says 'the DH generator' which could be either 2 or 5. Awesome.

"screened" means "has been verified to be good and strong and not deliberately weakened, by somebody who knows what this means". In practice, this means that the parameters have been generated with a NUMS method.


Can I add hashes and a digital signature to a compressed file, and is it necessary in this situation? I am wanting to create a project for a Linux Desktop environment and was curious about a certain subject. I plan to add all the files of the project and compress it into a .zip file. Is is possible for me to add md5, sha1, and sha256 hashes to the .zip file? If possible how would I go about doing this. I would also like to add a digital signature too. Thanks!

Open a Linux Terminal and cd into the directory with your project.

Type:

echo `md5sum <filename here>` > md5.txt

This will calculate the md5 hash of your file and put it in md5.txt

If you want to do the same with other hash algorithms you can use sha1sum, sha256sum, etc, in this same way. If you want to store a digital signature in a zip file just paste it into a text file.

I don't see why zipping should be a problem, it's just compressing the files, so now you can go ahead and zip up all the files you need, like that md5.txt file you just created.

To zip up files in terminal you can either:

zip archive.zip md5.txt file.php

Which will create a zip archive named archive.zip containing md5.txt and file.php (you can list as many files as you want to zip up).

Or you can run:

zip -r archive.zip folder/

Which will zip up the entire contents of the folder/ folder


What could be done with web shell on unrooted android device? Is it possible to control unrooted android device through a web shell?

I've been trying to execute various php shells but the whole response is error statements like this

php is installed and all other php pages works fine
The tested php shells works fine on another controlled systems

If the web server such as Palapa Web Server is installed on the Android device and the Android device is capable to execute PHP scripts then you can definately get the shell access of the device.

Note: Android supports a beautiful and the robust concept of sandboxing such that each application runs as different user. Once you will get the shell access on the device you will get the privelleges of the application that is executing the webshell.


How to transfer the `id` more securely in Rails project? I checked my rails project with a brakeman, and received warning.

  Potentially dangerous key allowed for mass assignment:
  params.require(:inspector_id)

class ReportsController < ApplicationController
  ...
  def report_params
    params.require(:report).permit(inspector_id, ...)
  end
end

class Report < ApplicationRecord
  belongs_to :inspector
end

class Inspector < ApplicationRecord
  has_many :reports
end

How to transfer the ID more securely?

That would depend on your permissions model. As it stands, a call to update_attributes etc. allows anyone with permissions to update a report to also link that report to any inspector. If this is not a privileged operation in your application, e.g. if all your users have the same rights and are supposed to be able to access all records in your database, that might be fine.

Otherwise you'd need to check whether the current user is allowed to establish a link between the specified report and inspector. How that works is of course highly dependent on your application; if you want a nice way to organise your permissions in a central place, I encourage you to have a look at the cancancan gem:

https://github.com/CanCanCommunity/cancancan

In any case, the problem is not the way the ID is transferred but that you might need to check it before accepting it into your database.


Encryption in case of distributed architecture I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server).

I could understand that in case of HTTPS request, SSL handshake will happen, a tunnel will be created and then all the data for session would be encrypted.

But I couldn't get clear answer for below question:

I am 90% sure that load balancer will not participate (or anything to do with) in SSL handshake because it is just for load balancing, so will forward to Apache based on its balancing algo. Could you please confirm?
All the application resources are in Weblogic (application server), so I makes me feel that finally the encryption and SSL handshake (or tunnel) will happen from Weblogic, and it would be Weblogic which will select one of the cipher suites provides by web browser, for encryption.

Am I correct?
If yes then what would be the role of Apache in SSL handshake? Will Apache simply forward the request to Weblogic and the end-to-end tunnel will be between web browser and Weblogic?

I read that maximum number of connections are controlled by Apache, so it suggests me that there would be a SSL handshake and tunnel between web browser and Apache. And if that happens then wouldn't it be overkill because there would be 2 SSL handshakes and encryption (web browser - Apache and Apache - Weblogic)?
Whether Weblogic or Apache will do the cipher suite selection?

I could identify that for Weblogic cipher suite selection can be controlled using Dweblogic.security.SSL.Ciphersuites=TLS_RSA_WITH_AES_256_CBC_SHA256" but how it can be controlled in Apache?

I think you're looking for SSL Termination, what basically happens is that the load balancer handles all the TLS/SSL process and forwards the requests to the end servers. This approach aims to streamline the implementation and management of SSL connections, imagine a load balancer serving 20 back end servers, it would require 20 machines to be able to handle connections from the same domain, and if you decide to upgrade your certificates thats a lot of work. If you however, implement it at the load balancer, all the back end servers need not to worry about this process.

  Web Client --> HTTPS --> Load Balancer --> HTTP --> Backend Servers

One thing to consider is that you would be trusting that the connection between your load balancer and your back end servers is secure, which for most server schemas isn't really a problem.

Here is an article on how to implement this for NginX


Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie.

The web application is written in .Net so I have added this content to web config:

<httpCookies requireSSL="true" />

After that I checked application in browser with the "Advanced Cookie Manager" add-on in Firefox.

Results of Advanced Cookie Manager: some attributes IsSecure values are true, some are false.

I want to check to see if this is a false positive - how else can I re-check secure attribute.

Cookies can be set multiple times which can result in insecure cookie attributes (Secure and HTTPOnly) and race conditions.  Tools can produce false positives,  what really matters is if the browser is using the flag properly.  To viewing the cookie's security attributes within the browser's developer console (ctrl+shft+j).

If the cookie is being set multiple times, the challenge is finding the misconfigured request handler.  Here is the process for tracking down the culprit:

Open a new private window in firefox or chrome.
Open the developer console (ctrl+shift+j)
Load the page that is responsible for setting the secure cookie.
Look at every HTTP request that contains a set-cookie HTTP header element. find one that doesn't have the Secure flag.


302 redirect and the body on the page (you are redirected to ...) I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this:

You are being redirected.

My questions:

Why there is HTML code, if the browsers will redirect it automatically?
If I inject code in href, can a JavaScript code be executed before the redirection happened or not?

1- why there are html code if the browser will redirect it automatically

It's traditional from the times where 302 was new and not every client understood what it means. It is not really needed today and uselessly wastes bandwidth.

  2- if inject code in href, a javascript code can this executed before the redirection happened ? or not ?

If you have a proper 302 response, that is a Location header is present, the body will be ignored and nothing will be executed.

If no Location header is present (which would be an invalid response) it depends on the browser and context: if the URL with the bad 302 was included with img tag or was linked HTML it will often be rendered including the execution of Javascript inside the HTML. In other cases like downloads (link not leading to HTML) or script context it will instead result in an error.

There are firewalls which can be bypassed this way because they don't expect the browser to execute the body of 302 responses and thus skip inspection even if no Location header in the response indicates the target of the redirection.


Is it OK to reuse the same SALT key across multiple deployments? We are building a base application that needs to encrypt SSN, DOB, etc...

The application is deployed to many customers.

Is it "OK" to use the same SALT key for the AES encryption/decryption ?

It is NOT okay.

Someone can get your salt, build a rainbow table, and easily decrypt all data from all customers. The whole point of a salt is to negate the effects of rainbow tables.

You shouldn't even use the same salt with one customers. Just generate a new salt with every new key. You can store the encrypted text and salt together, there is no need to protect the salt.


Is it probable that a penetration tester can eventually become a good malware analyst? Would it be logical for a pen tester who knows scripting and how viruses/malware are made to apply for a job as a malware analyst? Would this give him/her an edge at all? Or not really.

Yes, I am currently in transition from a primary penetration-testing skillset towards a Data Forensics and Incident Response (DFIR) skillset which includes Malware Analysis.

My background in network engineering has helped me with tools such as Malcom, for analyzing C2, but also with configurations of automated malware analysis solutions, such as Palo Alto Networks WildFire/AutoFocus as well as FireEye and LastLine.

A strong Linux, Windows, and macOS background will also help when extracting the features and behavior of malware with tools such as Cuckoo Sandbox and its cloud implementation, Malwr. (Update 09/26/2017): Here are some interesting links for going back-and forth from a pentester position to a responder position --

http://digitalizedwarfare.com/2016/03/24/sandbox-stories-flight-of-the-great-cuckoo-bird/
https://infosecspeakeasy.org/t/howto-build-a-cuckoo-sandbox/27
https://bdavis-cybersecurity.blogspot.com/2016/12/cuckoo-sandbox-installation-part-4-of-4.html
https://byte-atlas.blogspot.com/2017/02/hardening-vbox-win7x64.html
https://github.com/AlicanAkyol/sems
https://github.com/hfiref0x/VBoxHardenedLoader
https://github.com/LordNoteworthy/al-khaser (N.B., benchmark your defenses with some attacks!!!)
https://github.com/a0rtega/pafish

Most-importantly, learning DFIR has aided at improving my pentesting tradecraft as well. If I know what to detect, then I know how to counter that detection! For example, the course I recently took at the DerbyCon Training: Advanced PowerShell for Blue and Red Teams -- helped quite significantly for hiding shares (but then detecting them with the MountPoints2 registry key) but then using other protocols such as WMI, WinRM, or PS Remoting to hide in plain sight on the network.

Learning some forensics techniques has also helped my pentesting in a variety of ways. For example, the other week I used a network-block device userland server (nbd-server) to access a disk remotely with the nbd driver and nbd-client in order to run a localized cvechecker.

Get the two books: Learning Network Forensics, and also, Windows Malware Analysis Essentials. Practice using the -- https://github.com/jonschipp/ISLET -- training environments, especially with Bro. There are many great resources but these will fast-track you.


Does using Chrome bypass the Apple iOS gotofail bug ? Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?

No, Chrome on iOS is not affected by this bug as it doesn't use Apple's offical SSL/TLS library.

On Mac OS X, Chrome and Mozilla Firefox are not affected either.

Note that other applications than internet browsers are affected by this bug, in fact any application that relies on Apple's SSL/TLS library to encrypt data is affected (e.g. Mail, Calendar, etc.).


Possible to control desktop data activity LED on Windows or Linux for data extraction? I am trying to extract data from an air-gapped computer as a project.
I already have a working prototype using high frequency sound and a key-logger.

I would like to find another way to do it without much effort.
I have already tested trying to control the fan speed on a desktop to achieve a similar result to the high frequency sound but there is too much noise interference for it to be useable.
I am trying now to control the blinking data activity LED on the computer, and capture that information using a camera.

Does anyone know a way to control/overwrite the normal progress LED usage using any programming language either on Windows or Linux?

For Linux at least, there is the LED subsystem that does what you want. From kernel documentation:

  In its simplest form, the LED class just allows control of LEDs from
  userspace. LEDs appear in /sys/class/leds/. The maximum brightness of the
  LED is defined in max_brightness file. The brightness file will set the brightness
  of the LED (taking a value 0-max_brightness). Most LEDs don't have hardware
  brightness support so will just be turned on for non-zero brightness settings.

  The class also introduces the optional concept of an LED trigger. A trigger
  is a kernel based source of led events. Triggers can either be simple or
  complex. A simple trigger isn't configurable and is designed to slot into
  existing subsystems with minimal additional code. Examples are the disk-activity,
  nand-disk and sharpsl-charge triggers. With led triggers disabled, the code
  optimises away.

There is a way to do this without LEDs, by modulating activity on the CPU and turning a computer, even one without a wireless NIC, into a transmitter using a certain frequency. From the abstract of a research paper titled GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies:

  Air-gapped networks are isolated, separated both logically and physically from public networks. Although the feasibility of invading such systems has been demonstrated in recent years, exfiltration of data from air-gapped networks is still a challenging task. In this paper we present GSMem, a malware that can exfiltrate data through an air-gap over cellular frequencies. Rogue software on an infected target computer modulates and transmits electromagnetic signals at cellular frequencies by invoking specific memory-related instructions and utilizing the multichannel memory architecture to amplify the transmission

It is also possible to do by utilizing general-purpose USB devices, such as flash drives. From a similar research paper titled USBee: Air-Gap Covert-Channel via Electromagnetic Emission from USB:

  In this paper we present USBee, a software that can utilize an unmodified USB device connected to a computer as a RF transmitter. We demonstrate how a software can intentionally generate controlled electromagnetic emissions from the data bus of a USB connector. We also show that the emitted RF signals can be controlled and modulated with arbitrary binary data.

Similar techniques can be found by searching for research involving covert data exfiltration on air-gapped computers, particularly when involving electromagnetic emissions.


Firmware protection scheme Edit:
I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) .

I am working on a limited, embedded system that has to be field-upgradable. I want to protect the firmware against copying/reverse-engineering and modification (it will be transferred over plain HTTP).

First parts is easy - I use AES-128-CBC. Keys are burned in the bootloader. Microcontroller memory is locked.

The second part is my problem. My system is too limited to do a "heavyweight" (eg. RSA) signature verification.

I have an idea to distribute the firmware as AES(firmware+hash(firmware)). My device will first decrypt the whole image, calculate hash of the decrypted part and compare it with the original hash appended at the end).

I know that encryption alone is not authentication, but I can't imagine a successful attach against something "inside" AES that will give the right (encrypted) hash at the end.

Questions:

Is my scheme secure?
Can the hash be "weak" and still make the whole scheme secure? (eg. MD5? I know it is "broken", but I think it is still hard to meddle with it inside an encrypted image).

No, it is not secure.

First of all, you're suggesting a MAC-then-encrypt, which is known to be vulnerable to "chosen ciphertext" attacks (i.e. an attacker can take a valid message, modify it, and observe the result to gain information about the plaintext).

Secondly, you're suggesting the use of a hash rather than a MAC or even better a digital signature. A hash is not designed to verify the sender of information, only that the information has not been modified since being sent. A MAC can verify that the message came from the sender. A digital signature can verify that the sender is who it claims to be. You want a digital signature.

Finally, you're relying on symmetric encryption, a.k.a. "shared key" encryption. How is that key determined? You mentioned not wanting to do RSA (an example of asymmetric/public key encryption) which means you probably plan to keep the encryption key on your device, or hand it out to those who purchase/maintain the device. This means that the key is discoverable. Since this is a symmetric key, this furthermore means that once discovered the key can be used to create messages that appear valid using your scheme. There are certainly hardware modules that can help make it MUCH more difficult and expensive to extract the key (maybe even impossible) but the key may still be stolen from YOU, in which case you will need a way to change the key, and update all devices previously using that key, if you want to maintain security in such an event.

Why exactly do you think your device is not capable of using standard technology like public key cryptography? You really should just use proven methods instead of rolling your own.


Is a CA obligated to issue a certificate for a proven legitimate request? As hinted at in Does any technology prevent a CA unilaterally revoking a certificate?, I'm a little uncomfortable with the possibility that CAs effectively licensing a website to operate (given the de facto deprecation of unencrypted HTTP).

Are there any obligations on a CA to issue a certificate if the requesting entity provides the necessary level of identity verification?

Good question.

You are paying the CA for the service of verifying your CSR against public records, and putting their reputation on the line for you. I'm not sure if a CA is contractually obliged to provide you service. Is a lawyer required to represent you in court as soon as you walk into their office?

I would assume that a CA has the authority both to:

Refuse to certify any CSR for any reason they see fit.
Revoke any certificate at any time, for any reason they see fit.

I can see why this would cause some public concern in a post-Snowden world. Let me assure you that (to the best of my knowledge) CAs are private companies acting out of their own economic self-interests with no government affiliations, and that the public SSL roots are routinely audited by many industry and multi-national government panels looking for that kind of fraud. A CA that is caught doing something dirty will go out of business very very quickly.

As @Matthew said in the top answer to the linked question, the whole system works on

  Peer pressure, effectively.

[Disclaimer since I've been accused of bias before; I work for a CA]

Although it's not in your question, I would like to draw a distinction between Domain Validated certs and Extended Validation certs.

A DV cert will cost you 0$ - 5$, and the issuance is completely automated: you just need to prove that you own the DNS registry, and that you can place a file on the server that responds to that IP address. While there is no guarantee that this is free of political influence, it's pretty safe.

EV certs involve humans and paperwork and phone calls and stuff. This is the one where your suspicions might be justified.

Given that DV certs are so easy to get, your fear that a CA (or political consortium of CAs?) can de facto block a website from operating is not really justified - as long as you're ok with the plain-old-padlock, not the super-green-bar.


I want to filter Snort rules by date written I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?

These sources do not necessarily include any sort of "date stamp" in the rules though such information could be included in the msg field of the rule options.  You may notice some URLs in the reference field contain dates but this info is not going to be populated sufficiently to rely upon it.  I don't know of any sites/systems/tools that may help and the only suggestion I have is painful...

Starting with the earliest rules you want to evaluate and working up the latest rules, essentially you want to diff from one version of the file to the next which would yield when rules was added/updated/deleted.


Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8 I'm trying to create a public key pair for ssh-rsa authentication.  If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this:

  "ssh-rsa AAAAB3 ... 6yIK9Nbw== rsa-key-20150709"

This works fine, however I would like to attempt to create such a file using OpenSSL instead. Mostly because I just want to convert/create a private key later in PKCS#8 format using:

  openssl pkcs8 -topk8 -v2 des3

I read this can be done independent of the public key after the fact.  So I used "openssl" and just generated a key, but I couldn't get it into the "ssh-rsa" format .

Does anybody know how to "convert" or output my public key to the seemingly standard "OpenSSH authorized_keys file" without using PuTTY tools?

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.)

Less obviously, OpenSSH uses OpenSSL format(s) for private keys, although they recently (6.5) added a optional format of their own. Thus a private-key file you generated with OpenSSL is an OpenSSH private key, and OpenSSH can convert it to an OpenSSH public key with the -y option of ssh-keygen. See http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-keygen.1?query=ssh-keygen .

(Dupe of https://stackoverflow.com/questions/10271197/openssl-how-to-extract-public-key
and https://serverfault.com/questions/52285/create-a-public-ssh-key-from-the-private-key .)


Is this a good way to manage encryption keys? I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being a noob I did advise my team that we should hire a security expert and/or have a security audit once PoC is complete.
The problem
I want to store encrypted files in a decentralized manner. I'm using IPFS for that.
But since the files are encrypted I need to store encryption keys securely.
Current solution
I've implemented envelope encryption of encryption keys by means of using Hashicorp Vault and it's Transit Engine.
So when a file is uploaded by the user a new encryption key (Data Encryption Key - DEK) is generated, the file is encrypted and encryption key
is then sent over HTTPS to the machine hosting Vault and encrypted (with Key Encryption Key - KEK). DEK wrapped with KEK is then stored in a central database.
I know about existence of HSMs but I don't have access to one at this moment. We do plan to use HSM in the future though
(we plan to implement digital signatures, too). At the very least we'll probably move our key management infrastructure to Google Cloud KMS
and use HSM level keys.
When a user registers in the app a new entity is created in Vault so that I can leverage ACLs to limit access to the KEKs (which are created per user)
only to the specific user.
Questions

First of all, do you think this scheme is secure?
In case this scheme is ok, how much do you think HSM would add to security? (thinking about cost to benefit ratio)
By default Vault's ACLs allow root user to access everything anyway. I would like to limit that so that only user can (after authenticating)
access their KEK. How would you go around trust issues here?
The KEKs are managed by us, but do you think there is a better way of doing that? I was thinking password-based key derivation
but I'm not sure users would be ready for complications (in cases like forgetting their password).

DEK and KEK are used everywhere and especially in cloud encryption so you are on the good way. You can read from : https://cloud.google.com/kms/docs/envelope-encryption?hl=en
HSM is used to secure the Master Key of Hashicorp Vault, so if you do not have it then you have to put physical procedure to store the Shamir based on the Master Key of Vault when you want to unseal/restore it. If you use an HSM then this key will be stored securely and Hashicorp Vault will be able to restore itself as the key is always available to it.
Edit2: You can use softHSM to simulate the behavior. I have setup a HashiCorp Vault + Utimaco hsm using pkcs#11 library and it works very well. Not sure if utimaco simulator is available to everybody.
Also HSM protects against physical attack, even if an physical hacker server where Vault runs then he will not have the keys and won't be able to restore Vault, he will require to have the HSM.
A good reading from vault itself : https://www.vaultproject.io/docs/enterprise/hsm/behavior
Regarding 3. I would recommend to use least privileged and so indeed to restrict root permissions. I haven't used it but HCL like describe here : https://learn.hashicorp.com/tutorials/vault/policies
The quote says simplicity is the ultimate sophistication so keep it simple and then you will see
Edit : last but not least, while using encryption, reminds that if the key is lost then the data also.
Hope it helps


What was behind the surge of Adobe Flash Player vulnerabilities/patches in 2015? It's no secret that 2015 was a rough year, security-wise, for Adobe's Flash Player. Aside from Adobe itself beginning to essentially deprecate Flash development  largely due to Flash Player's longstanding status a primary target for attackers, the vulnerability report and security update stats tell a tale.  The relevant page on Adobe's site lists 22 separate days on which it pushed out patches for Flash Player, including a sizable number of out-of-band releases to fix zero-days.  (Like the Hacking Team zero-days.  And the Pawn Storm zero-day.  And the Christmas zero-day.)  The National Vulnerability Database lists 330 discrete CVE ids that were issued for reported Flash Player vulnerabilities in 2015.  Not fun numbers.

But the baffling thing to me is less that so many vulnerabilities were found in Flash Player in 2015 and more that so many more vulnerabilities were found in it in 2015 than in previous years.  According to the NVD, in 2013 56 CVEs were issued for Flash Player vulnerabilities.  In 2014, the number increased somewhat to 74.  But going from 74 to 330 is an astonishing jump.

So what was behind that dramatic surge last year?  The only hypothetical factors that have occurred to my mind were (a) chance, (b) some major change in the way Adobe defines separate vulnerabilities, and (c) some shift in the focus of security researchers to hunting for Flash Player vulns as targets like Java client and Windows have (arguably) been hardened.  But those are just wild, pseudo-educated guesses that even I don't find terribly compelling. Does anyone have anything more solid about why the number of Flash Player vulnerabilities/zero-days/patches exploded last year?

I think that the answers you get here are mostly speculations. But the question is interesting nevertheless. I see the following main reasons:

Other usual attack vectors like Java or ActiveX were harder to exploit because the relevant functionality was either switched off or layers of interaction were added (i.e. click to play, warnings with unsigned code and similar). Thus other attack vectors need to be found. Since flash is almost everywhere and known to be buggy it makes a good attack vector.
Adobe fixed known exploits faster and browsers like Firefox or Chrome made sure that you don't use a known vulnerable version any longer. Because of the smaller  time frame in which an exploit could be used in public (sometimes a few days only now) more exploits were needed. And it looks like there were always enough new exploits available because lots of money can be made today by developing and selling new exploits.
Creating botnets, sending spam, injecting advertisements is a business where lots of money can be made. On the other side the basic protection from operating system and antivirus got better. This means that more new and unknown exploits  need to be used to keep a high infection rate, that is more zero-day or half-day exploits where used. Money earned this way then will be used to develop or buy new exploits. There is actually a real industry now where some sell or rent exploit kits and keep them up-to-date, others use these kits to transport their own malware and more just using the services of established botnets to send spam or do DDOS attacks.


Secure messenger in web page I need to make the Messenger in the web page secure. For that I use encryption with AES.

So, when one person writes another, the message is encrypted, sent to the server, saved in the DB, and then showed in the messenger of another person.
So problem is, the server knows how to decrypt the message- it generates and stores all the keys (as a trusted side), therefore anyone, who cracks the server, may also read all messages.

The RSA and Diffie-Hellman is not useful, because people would not remember and input each time 1024 key. If they will not remember themselves, and the keys will be stored in the DB- it would have no sense.

May someone suggest any other tricky method?

I suppose, the best way would be to ask the user to remember/store the key himself. And ask the key each session for encryption/decryption. Therefore there is no trusted server, which may be attacked.
The keys may be synchronized using the Diffie- Hellman


What prevents someone from spoofing their public key when trying to establish an SSH connection? Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that searching it would give me the answer).
Basically, we add our local machine's public key to the server's authorized_keys file which allows us to be authenticated automatically when we try to ssh into the server later on. My question is: what if someone takes my public key (it is public after all) and replaces their public key with it? When the "attacker" tries to connect to the server, what part of the process allows the server to know that they do not have the correct private key?
I read somewhere that for RSA, it is possible for a user (let's say user A) to encrypt/sign a message with their private key, and then for others to decrypt this message using A's public key, thus proving that A is really who they claim to be. However, apparently, this is not true for all cryptosystems, where it is not possible to sign with a private key (according to What happens when encrypting with private key?, feel free to correct this information if it is wrong). In those cases, how does the server make sure that the user is really who they claim to be?

All forms of public key authentication support at least one of sign/verify or encrypt/decrypt (in practice, I'm pretty sure they all support sign/verify, I know some like DSA don't also support encryption but I don't know of any that can do encryption but not signing). Either operation can be used to prove identity.
I don't know the SSH handshake off the top of my head, but it's going to include a step where each side using public key authentication (the server, and sometimes the client) prove to the other side that they have the corresponding private key, by requiring the private key holder to do something that can only be done with the private key, and cannot be done by capturing and replaying traffic from a previous handshake. There's a few ways to do that (these are all from TLS, but SSH almost certainly does similar things):

Determine an unpredictable value (such as a cryptographic hash of all traffic in the handshake thus far) for the private key holder to sign and transmit, and then use the public key to verify the signature. (IIRC, this is how TLS client certs are verified).
Public key holder generates, encrypts, and transmits a secret value, private key holder must decrypt it to complete the handshake. (this is how TLS performs key exchange over RSA).
Private key holder generates a public and private ephemeral key exchange parameter pair, then signs and transmits the public part. The public key holder verifies the signature and then uses that parameter to complete the key exchange. Because the exchange depends in part on the private key holder's private key exchange parameter (which is generated anew for every handshake and never transmitted), an attacker can't just replay a previous signed public key exchange parameter; it would verify correctly but the attacker wouldn't be able to complete the key exchange, and thus couldn't communicate. (This is how DHE/ECDHE key exchange works in TLS).


Why is '@' a security risk in url? I'm making a Phishing Filter with Machine Learning and I'm using the features mentioned in this paper http://scialert.net/abstract/?doi=jas.2011.3301.3307

One of the features says "URL contains hexadecimal characters or @ symbol", why is an @ in URL a potencial security risk, and more especific with Phishing?

EDIT: The filter is in the email level, so the URL would be as part of the message

The URI scheme is composed like so:

scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]

As you can see, the @ is used to include (in this case, HTTP) authentication directly in the url.  The question then becomes "Why would a url that includes authentication be a sign of phishing?".

I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is.  For example, http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil looks very much like it's loading www.mozilla.org, but if you look close enough it's actually example.com/evil.  Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.


Signing webhooks with asymmetric keys I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography).

What is the recommended or standard way to publish my public key? Is there a standard place to host a public key? Should it rely on a CA? Ultimately, I'm trying to find the most "standard" way of signing webhooks with asymmetric keys.

Just post it on your website.

For most web services, your website is your identity. If you publish your public key on your website, anyone who visits it with a secure HTTPS connection can be reasonably sure that it belongs to you. If you publish it by any other means, you would need some way to connect it to your website to assure users that it is legitimate.


What are non-standard ports and protocols I am new to the security field and reading about how to check if an application is secure. One of the checks involves finding out if the app uses non-standard security ports and protocols. However, there are thousands of ports and quite a few protocols to look at.

What constitutes non-standard ports and protocols?
What are some port and protocols that should immediately raise red flags?

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry.

Running a service on a non-standard port doesn't really mean anything for security. It may reduce the amount of noise that a defender has to deal with in terms of automated scanning on the internet, where bots usually target common standard ports for vulnerabilities. Moving SSH from 22 to, for example, 55522 might reduce the number of drive-by brute-force attempts.

In order to find all services running on a system, one can use nmap or a similar tool. Here's an example command:

nmap -sS -A -Pn -T4 -p1-65535 <host>

Let's break these flags down:

-sS tells nmap to perform a TCP SYN scan.
-A enables a range of options related to OS detection, service detection, and script scanning. This is particularly important for identifying services on non-standard ports, as it actually talks to each open port to work out what the service is, rather than guessing based on the port number.
-Pn tells nmap not to use ICMP ping to check if the host is up. If the target blocks ICMP requests, this will result in nmap assuming that the host is down.
-T4 sets the speed of the scan. Valid arguments are 0 to 5. There's no reason to use anything but 4 here in my experience - anything less is just slower, and 5 reduces the accuracy of the scan because it doesn't wait long enough for TCP ACK replies.
-p1-65535 sets the port range. As we're hunting down both standard and non-standard ports, this is the only way to cover everything. You can also use -p- as shorthand for this.

The results of this command should show you any ports that are open and what services are running on them. From there it's an open question as to what protocols are considered a potential avenue of attack. SSH or Telnet might be useful, but unless they use a weak username and password it's probably not interesting. They might run a HTTP server on a non-standard port, with a vulnerable web application being served, and that might be of interest too. The possibilities are endless.


Is there a security difference between GPG signing a file directly or its SHA512SUM file? I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose.

Let me present you with two options:

Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with:

$ gpg --local-user <my_gpg_fingerprint> \
      --sign --armor \
      --output       "${backup_file}.xz.enc.asc" \
      --detach-sign  "${backup_file}.xz.enc"

which honestly takes a long time even on a higher-end laptop of mine; or
Create SHA512SUM of that big encrypted file and sing that one with:

$ sha512sum --binary "${backup_file}.xz.enc" > \
      "${backup_file}.xz.enc.SHA512SUM"

$ gpg --local-user <my_gpg_fingerprint> \
      --sign --armor \
      --output       "${backup_file}.xz.enc.SHA512SUM.asc" \
      --detach-sign  "${backup_file}.xz.enc.SHA512SUM"

which has actually proven to be way a little faster.

Please elaborate as to what security implications might the faster version have as a disadvantage to the direct signing the big file.

Benchmark

$ time gpg --personal-digest-preferences sha512 \
    --local-user <my_gpg_fingerprint> \
    --sign --armor \
    --output test_file_23gib_random_data.asc \
    --detach-sign test_file_23gib_random_data

result:

real    1m25,444s
user    1m17,059s
sys     0m4,728s

As opposed to signing the SHA-512 file:

$ time sha512sum --binary test_file_23gib_random_data > \
    test_file_23gib_random_data.SHA512SUM

result:

real    1m7,568s
user    1m2,810s
sys     0m4,567s

and signing it in ~ 0.4 seconds.

Final thoughts

So, there is a few seconds difference. Not really a big deal, but noticeable.

I am still interested in your view about the security implications, which this question was originally intended to be about.

Hardware:

Dell Inspiron 15 Gaming 7577, model number 7577-92774.
Processor: I have an Intel Kaby Lake CPU: Intel Core i7-7700HQ.
Storage: NVMe PCI-E drive.

System:

I am on Linux Mint 19.1; based on Ubuntu 18.04.

Most signature schemes already require hashing the data as part of the signing operation. Adding another hash before this shouldn't really be necessary (ie this likely indicates a performance issue in gpg), but as long as the hash used is at least as strong as the one used for the signature it shouldn't result in a reduction in security.

There is a minor difference in that sha512sum will output the filename as well as the hash, so your signature will be over the filename as well as the data.

Note that gpg allows you to specify the hash function with --personal-digest-preferences or --digest-algo, so selecting a different hash may be an alternate solution to your problem.


What cipher mode is usually used for network traffic encryption? I'm currently teaching myself about cryptography with the intentions of learning more about cryptanalysis. As of now I'm learning about cipher modes!
I understand that I should be looking into CBC, CFB, and OFB.

I understand that CBC mode is preferable when it comes to enciphering files and such but which mode is preferred for enciphering networking protocols?

I know that ECB mode is used for enciphering random data and is vulnerable to replay attacks. Though since it's easy to crypanalyze my assumption is that it shouldn't be used to protect the confidentiality of network data.

I'm open to the idea that my assumptions could be wrong. So once again, What is the best cipher mode to use for the encryption of data being sent over a tcp socket?

my goal this to implement AES though I still have many leaps to take. If the cipher modes can be used with other algorithms. please, don't hold back your knowledge!

Modern network traffic encryption uses GCM by default.

ECB is used for teaching students about encryption. It's not really useful for anything else.

CBC is the simplest secure mode for static files, but it lacks authentication, so should never be used over a vulnerable channel (network). It's been obsoleted or deprecated from such uses.

It's not really ideal for files either, just simple. File encryption is generally best served by GCM-SIV (opinions will vary). For disk encryption the current industry-standard mode is XTS.

GCM combines most of the performance of CTR with good security, authentication and moderate overhead. If you plant to implement AES, use open source GCM implementations. Write only as much of your own code as necessary to integrate and call third-party libraries.


How can waiting 24 hours to change the password again be secure? So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.

Now, I wanted to change it to a more secure password but instead I got a nice error message:

  The password you entered doesn't meet the minimum security requirements.

Which was interesting, considering this new password was using more letters, more numbers and more special characters than the last password.

I did some research and found out that the service I am using has a security rule where you have to wait 24 hours before changing the password again.

I asked my provider if they could do the change in the accepted answer of that link, but they said they couldn't do it and that the 24 hour wait was "for security reasons".

Which leads to my question.

How can waiting 24 hours to change the password again be secure? What are the pros/cons of making a user wait before they can change their password again?

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (generally 2 or 3) previous ones.

The one change per day rule is an attempt to avoid this trivial perversion:

a user has to change his password because it has reached its time limit
he changes it to a new password
he repeats the change immediately the number of saved passwords minus one
he changes it immediately back to the original one => hurrah, still same password which is clearly what the first rule was trying to prevent...

Ok, the rule could be the changing the password many times in one single day does not roll  the last passwords list. But unfortunately the former is builtin in many systems while the latter is not...

Said differently, it is just one attempt to force non cooperative users to change their password on a timely manner.

Just a trivial probabilistic analysis after comments saying that allowing users to never change their password is not a security problem. Say you have a rather serious user and that the risk for his password to be compromised in one day is 1%. Assuming about 20 work days a month, the risk of being compromised in a quarter is of about 50% (1-(1- 1/100)^60)). And after one year (200 work days) we reach 87%! Ok, 1% may be high, and just start at 0.1% per day, only one on 1000, pretty negligible isn't it? But after 1 year (200 work days) the risk of begin compromised is almost 20% (18% to be honest). If it is the password for holidays photos I would not care, but for something more important it does matter.

It means that what is essential is to educate users and have them accept the rules because we all know that rules can easily be by-passed, and that if a user does not agree with them it will not be cooperative. But asking users to regularly change their password is a basic security rule, because passwords can be compromised without the user noticing that, and the only mitigation way is to change the (likely compromised) password.


KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know:

Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password?

From what I know, the challenge is hard-coded, so an attacker already has this. So the only secret is the response, which is 20bytes SHA1.

A normal 40 character password has 40*~7bits (stripping non printable / usable chars in ASCII) as usable secret. So it should be more secure as that results in a 280 bit secret versus 160bit SHA1.

Edit: Assuming both, the Yubikey and the normal Password secrets are created using true randomness. So we're not talking about the improvements over the typical "Password1234" passwords.

If I'm missing anything feel free to correct me.

If the challenge is hard-coded, then yes, the random password is probably* more secure, but meaninglessly so. 128 bits is so far beyond our capability of brute-forcing that there's really no need to go higher unless you're concerned with very long term secrets. 256 bits can be justified with the generous assumption that quantum operations will eventually be as cheap as classical operations, but even in this case the 160 bits of HMAC-SHA1 is far from trivial.

(*) One method of avoiding timing attacks on string comparison is to compare a hash of each string, if this hash is 160 bits or smaller you're limited to that many bits of security regardless


How secure are iPhone/Android/Windows 8 "PIN"/Pattern Lock features? Most modern (and tablet-oriented) operating systems now offer alternative ways of logging on other than a strong password. For example, iPhones offer a 4-digit PIN, Android devices offer this and a 'Pattern Lock', and Windows 8 devices offer the 'Picture Lock' in addition.

Obviously, these passwords are not terribly secure, and so (as with bank cards) some sort of lock-out applies. For iPhones, you get dramatically increasing delays, and for Windows, the PIN option is taken away leaving only the password entry option.

What is not clear to me is how these methods actually get enforced. What stops someone from attacking the system outside of the operating system? Or (at the very 'worst'), simply taking a copy of the storage and reloading the image onto the original device repeatedly? It's my understanding that even having Bitlocker on a Windows system wouldn't protect against the latter... or am I wrong and there is something clever with the TPM chip going on?

Also, as a semi-related question: Windows obviously encrypts credentials (such as those in Credential Manager) against the logon password. But since a PIN can bypass the logon password, does this mean the logon password is weakly encrypted somewhere (against the 4-digit PIN)?

Thanks,

Chris

You are missing the point of the lockscreens of the various mobile operating systems.

They are not an effective deterrent for attackers who has stolen your phone and has an unlimited period of time to attack it. However, they are effective in deterring chance attackers who happens to walk by and only has a short period of access to your phone.


The requirements of gathering information data without any limits? It's a well known fact that phones, computers and other devices can be tracked and be used as a means of collecting user information if the situation permits it, for example in crime investigations. I don't know exactly how this is done, what technical methods that are used and one could think whether it's built-in back doors that are used or just a brute-force approach.

I think it's good to know in terms of personal data security and the ever growing demand for total control slowly becoming a reality which can be witnessed today in some parts of the world.

This is not about any laws because I'm well aware of the laws regarding this subject. What I didn't find information about is how someone can collect data or track a device without any limit distance-wise and to what extent this data collecting can occur without getting further help from other sources, for example if the suspicious person leaves the region/country.

When authorities tracks down criminals or gathers data for a case, is their method of retrieving this information only dependent on one source with complete access or do they contact various of different sources to help them achieve this? Can anyone with enough knowledge use the these same methods or do they require certain accessibility that goes beyond that of an ordinary citizen?

Thank you in advance.

The question very broadly asks about "information gathering" in general. Only, there are lot of different sources for information with different amount of detail and different ways to get these information.

Sometimes all is needed is to combine public information in an intelligent way (e.g. monitor activity on social networks), sometimes hacking of devices like phone or computer helps, sometimes service providers will provide the data after some court order or similar. Thus, it depends on the kind, source and required detail of data if "enough knowledge" is sufficient or of "certain accessibility" is needed which ordinary citizens don't have.

And even if some information gathering requires "certain accessibility"  it might be possible for an ordinary citizen with enough money to pay knowledgeable criminals or bribe the right persons in order to get access to the information of interest.


Can you scan unmanaged switches with vulnerability scanners? The target switches do not have IP addresses and most scanners require IPs as targets.

Can you scan unmanaged switches with vulnerability scanners? What scanners can target layer 2?

The target switches do not have IP addresses and most scanners require IPs as targets.
Can you scan unmanaged switches with vulnerability scanners? What scanners can target layer 2?

It's useful to keep the OSI model in mind.
A unmanaged switch without IP solely operates on layer 2. It doesn't know about the higher layers, nor does it care. It looks up the destination MAC in it's table, and switches the packets accordingly. This is done in silicon.
Vulnerability scanners work on layers 4 and up, depending on what they target. For instance a vulnerability scanner looking for problems in Apache doesn't really care about anything else than the application.
Running such tools against an unmanaged switch is just a waste of time. You won't learn anything. Instead you should look at how the switch behaves if you do attacks targeted against L2 devices. Can you fill up the MAC table? Can you crash the switch by malformed packets? Can you do arp poisoning successfully?
That said: unmanaged switches are simple devices. They commonly do not have a general purpose CPU, and no code are running on such switches.


Can my employer see the actual video chat if I use Facebook messenger on work WiFi? I used my personal iPad over work WiFi (Verizon jetpack) to have a video chat with a friend over Facebook messenger. Can my employer actually see the video or just that I used messenger?

I will disagree with the other answers here:

Going directly to your specific scenario: You are using the company Wifi, so they control it and could capture its traffic. However two other important things are mentioned: you are using your personal device and acessing a service outside of the company that uses SSL/TLS. So they capture encrypted traffic.

Since it is your personal device and a service outside the company control, it is NOT trivial to sniff this TLS/SSL traffic. SSL sniffing requires control of your device trust anchors (trusted CAs) or control over the service endpoint, and that should NOT be the case on your personal iPad. One can only sniff an SSL connection using an MITM attack, and to have a MITM attack without a lot of warnings poping up (I guess the Messenger app would not even show a warning, would just not work) one needs to be able to inject trusted CAs on your device. That is common on company managed devices, but would not happen in a personal device (not without your explicit approval, at least).


exploiting CVE-2020-0668 problem I've been trying to get mentioned security error working on my machine so I could fully understand how it works. I've been following those instructions: https://itm4n.github.io/cve-2020-0668-windows-service-tracing-eop/
and using this tools:
https://github.com/googleprojectzero/symboliclink-testing-tools/

Create (or copy) a file with a size greater than 0x8000 (32,768) bytes. (Done this)
Create a new directory (C:\EXPLOIT\mountpoint\ for example) and set it as a mountpoint to \RPC Control. (It's the point I'm currently having problem with)
Create the following symbolic links:
\RPC Control\RASTAPI.LOG -> \??\C:\EXPLOIT\FakeDll.dll (owner = current user)
\RPC Control\RASTAPI.OLD -> \??\C:\Windows\System32\WindowsCoreDeviceInfo.dll (Done this)

My point is only to replace any dll inside system32 directory with this bug.
How can I create mountpoint to \RPC Control. Let's say my directory is at C:\EXPLOIT\mountpoint and i want to set it as mountpoint. How can I do this?

I'm currently working on this as well, I'm not an expert but I think you have to understand the Windows objects part as well, I couldn't find RPC Control till I read about it, you can use the Sysinternals tool WinObj this will show you a bit more.

I was able to use create mount point between two folders but not to an object, there is more details here https://offsec.provadys.com/intro-to-file-operation-abuse-on-Windows.html


Android screen lock vs device encryption I know the basic idea that device encryption would encrypt all data and decrypt it on the fly as it is used when authorised.

However i do not know how this makes phone more secure than s standard screen lock ?

Device  encryption asks me a password at startup and similarly the screen lock is enabled and locks phone right after startup so in this case both should be equally restrictive since both use the same pin.

Finally why fingerprint cannot be used for device encryption and has to be a pin?

In laymans terms, its the difference between having a guard, and a locked vault.

When you have only a lockscreen, its just like having a human guard that will ask you for a password/PIN. If this can be circumvented or bypassed - either via a vulnerability - which would be equvalient with social engiinering the guard into giving you access without knowing the password/PIN, or if the lockscreen can be forcefully removed, would be equvalient with killing the guard, access is subsuquently granted.

If you instead have the device encrypted, its like a locked vault. No matter who you kill or bypass, you can't get into the vault without the correct code or key.

Using device-encryption while off, along with screen lock while its on, is more equvalient with the bank vault being closed and locked during closing hours, and a human guard during opening hours. The guard is more convient during daytime since you dont have to open and close the heavy vault door all the time.

The reason you can't use fingerprint authentication with encryption, is because a encryption key cannot be derived from a fingerprint. Instead, you have to have some hardware that performs an authentication - like the guard - and releases the key upon correct authentication.
A fingerprint authentication isn't like providing a password, since everytime you place the finger, you are not placing it exactly like you did when enrolling. Instead, a very complicated mathematical calculation needs to be made, to judge if the fingerprint is enough similiar to the enrolled fingerprint, to be accepted.

Imagine like taking a photo of your house. Next day you see a house and want to know if its yours. You take  a new photo. If you would hash these photos or compare them bitwise, you would always come out to a false decision, because the photos will be slightly different lightning and angles.

Thats why you cannot derive an encryption key out of a biometric authentication.


Password manager login with compromised certificates This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual.

Opening up Chrome and browsing to a site with HTTPS however gave me a certificate authority not trusted warning.

Group policy changes overnight had installed a company wide certificate. Is my Dashlane password compromised?

The important question here is wheater you trust your company or not.

If your company isn't trustworthy they could easily steal your password without a certificate (e.g. by using a key-logger).
If your company is trustworthy the fact that they have installed a certificate on your system doesn't matter, since you trust them anyway.

Should the fact that they installed the certificate make you rethink how much you trust them? Probably not - companies doing this is quite common, and there are legitimate reasons besides spying on employees.

Would the certificate help them if they wanted to get your Dashlane password? It doesn't seem that way, but I am not 100% sure. They claim to "never store even a derivative of your Master Password" on their servers. Instead, they decrypt the data locally:

  You use your Master Password to only decrypt your own data locally on your computer, and your data is successfully decrypted only if you provided the right one.

So I see no reason why they should send it over the internet, and if it is not sent over the internet the certificate would not help your company to steal the master password.

The passwords the master password protects, however, will be visible to your company if you use them to login to websites, since the certificate will enable them to read your HTTPS traffic. But again - back to the basic question - do you trust your company?


Are there sha 512 rainbow tables available? Are there sha 512 rainbow tables available for download or what kind of dimensions and processing power would be required to generate them?

Possibly, but given their size - much more likely to download a generation tool and a word pattern list.

Rainbow tables are a carefully comprised collection of dictionary words and probable combinations in order to save on space.

A rainbow table sufficient for alphanumerical passwords of up to 9 characters is 864 GB in size. A rainbow table for this level entropy will be the size for any hash (MD5, SHA-1, SHA-512, etc) as rainbow tables are actually hashes hashed down to the entropy of the passwords (say, 254). The uniformity distribution requirement of the cryptographic hash makes this possible, but hashes with much larger bit space than the password entropy will have some collisions when hashed down to lower entropy level. Hence the "success rate" column of the rainbow table.

As 900 GB is tolerable for a determined hacker and as people that use alphanumeric passwords less than 10 characters exist, websites will use random salting to foil a rainbow table plus often use a slow key derivation function like PBKDF2 or scrypt.

None of these truly stop matching of a hash to password in a (much slower "sparse" meta-mega) rainbow table if the attacker got their hands on the server's user table. Which is why not using the same password across multiple sites is important.


How to solve the problem of secure randomly generated GUIDs when the size of the data outgrows the GUIDs I've been struggling with this problem for a little while... How to hide the order that records were created in, basically. You typically do this by generating a "GUID". But this GUID is arbitrarily chosen to be a very large number, essentially a number so large that it will encompass all records ever created.

But the question is, if it is too small. If later on down the road there turns out to be a number twice as big as the last "biggest" number. Then we can know from the IDs that the ones with the length of the first GUID are part of the first group of people that were using the system. So there is the creeping in of that original problem: the order of the records is now no-longer hidden.

If you simplify the problem, you can say at first there are 100 possible slots, so everyone out of the possible hundred get a random number 1-100. When it reaches 100, then you grow to the next chunk, let's say 200 or 1000. So then everyone from that point forwards gets a random number 101-1000. But this means the first group is still identifiable. Once this number becomes too small, we go to lets say 10,000. Then numbers 1001-10000 are for the next set, but we can now tell the first two groups of people from the third.

To hide this, it is as if you need to recalculate every ID and do a batch update of all possible URLs using these IDs, or cross-references. Then you would just provide a new random number out of the random set. But the problem with this is if the IDs were written down on paper or used on a platform outside of what you own (like they post a link on twitter), then it would break with this approach.

So it seems the only viable solution is to pick a number large enough that it will never, ever be crossed. But this seems like a moving target. It seems you could always need a bigger number.

As such, I'm wondering if there are any alternative solutions instead of picking an arbitrarily large random number as the size of the set of GUIDs.

It seems you could always need a bigger number.

Not really. In theory perhaps, obviously there's always a bigger number, but you'll run into limits of physics pretty quickly.

With a random 128 bit ID, you could store around an exabyte of IDs before running into problems with collisions. That's just storing the IDs, presumably you'll want to be storing data associated with those IDs.

If you increase the size to a 256 bit ID it's difficult to even conceive of the number of records you could store without issue. With 512 bits you'd only be a couple orders of magnitude short of being able to randomly generate an ID for every atom in the universe without worrying about collisions.

Wait, you want more IDs?? Ok, since you don't care about practical limitations (such as the likelyhood of the human race going extinct before turning the entire universe into a storage medium, or the lack of desire to use the entire universe as a storage medium in the first place), let's just look at the math behind it then:

Let n be the number of IDs you want
Let p be the chance of collisions (ie p = 0.01 is a 1% probability)
Let b be the minimum number of bits each ID requires

Then, from Wikipedia (also here):

n = sqrt(2 * 2^b * ln(1 / (1 - p))

Solving for b and simplifying:

n^2 = 2 * 2^b * ln(1 / (1 - p))
2^b = n^2 / (2 * ln(1 / (1 - p)))
b * ln(2) = ln(n^2 / (2 * ln(1 / (1 - p))))
b = ln(n^2 / (2 * ln(1 / (1 - p)))) / ln(2)
b = log2(n^2 / (2 * ln(1 / (1 - p))))
b = log2(n^2) - log2(2 * ln(1 / (1 - p)))
b = log2(n^2) - log2(2 * ln((1 - p)^(-1)))
b = log2(n^2) - log2(2 * -ln(1 - p))

Calculating this is another problem, as 1 - p can be small enough to cause significant error (n^2 isn't so much of an issue as any exponent from n can be multiplied outside the log2). You can use log1p to avoid the issue:

b = log2(n^2) - log2(2 * -log1p(-p))

As an arbitrary example, let's suppose the universe can hold 101000 bits of information, and we want to assign each bit of storage its own random identifier with 10-15 chance of collision:

b = log2((10^1000)^2) - log2(2 * -log1p(-10^-15))
b = log2(10^2000) - log2(2 * -log1p(-10^-15))
b = 2000 * log2(10) - log2(2 * -log1p(-10^-15))

Evaluating with the following python:

from math import log, log1p
log2 = lambda x : log(x, 2)
2000 * log2(10) - log2(2 * -log1p(-10**-15))

We get 6692.6851 bits, rounding up to 6693 bits required. Now you can plug in your estimation for the number of bits it's possible to store and you have your answer.

But now we have another problem. If the universe only has 101000 bits of storage space, we can't store 6693*101000 bits of IDs (that's what you get for trying to assign a random ID to every bit of information the universe can store, you maniac).

Let's add some variables and improve the equation:

Let d equal the number of data bits to be stored alongside each ID (not counting the size of the ID itself)
Let n be the number of bits you can store
Let r equal the number of rows you can store (a row being the size of b + d)

Now we can come up with the following equation for r:

r = n / (b + d)
r = n / (log2(r^2) - log2(2 * -ln(1 - p)) + d)

I don't believe this is solvable, but it can be approximated with only a few rounds of recursion starting with a guess of r = n. Since n is so large, some tricks can be used to get an approximate answer:

Let t = log10(r)
log10(r) = log10(n / (log2(r^2) - log2(2 * -ln(1 - p)) + d))
t = log10(n) - log10(log2((10^t)^2) - log2(2 * -ln(1 - p)) + d)
t = log10(n) - log10(2 * t * log2(10) - log2(2 * -ln(1 - p)) + d)
t = log10(n) - log10(2 * t * log2(10) - log2(2 * -log1p(-p)) + d))

Our example of 101000 bits of storage in python, supposing that you only want to store IDs and no associated data:

# -*- coding: utf-8 -*-
from math import log, log1p, ceil
log2 = lambda x : log(x, 2)
log10 = lambda x : log(x, 10)

def id_size(d, n, p):
    t = log10(n)
    old_t = 0
    while t != old_t:
        old_t = t
        t = log10(n) - log10(2 * t * log2(10) - log2(2 * -log1p(-p)) + d)
    n_log = log10(n)
    n_string = str(10**(n_log % 1)) + str('e') + str(int(n_log))
    print "Given " + n_string + " bits of storage, to generate random IDs with " + str(p) + " chance of collision, each associated with " + str(d) + " bits of data would require " + str(int(ceil(t))) + " bit IDs (t ≈ " + str(t) + ")"

id_size(0, 10**1000, 10**-15)

Resulting in:

Given 9.99999999999e999 bits of storage, to generate random IDs with 1e-15 chance of collision, each associated with 0 bits of data would require 997 bit IDs (t ≈ 996.176051348)


How can American Express Serve login be PCI-DSS compliant? Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process.

Here are the steps involved:

Enter a valid email Serve email address into the Email box.
Type at least one character in the Password box.
Tab out of the Password box.
"Please enter a valid password." is now shown in red below the password box.
Go back to the Password box and start typing characters.
With each character typed, the password is checked. Once the password is valid, the red text goes away, indicating a valid password.

Now, once the Log In button is hit, the user is asked security questions. This seems to mitigate the problem, but the password is already known at this point!

Edit:

Comments in this question are correct: The password isn't being checked. What is being checked is whether the characters entered match the password requirements. This does seem to be a reasonable behavior.

start typing characters., Once the password is valid, the red text goes away, indicating a valid password.

This kind of behavior doesn't necessarily violate PCI DSS requirements.

If the site works the way you describe, it's not very good from a security point of view because it makes brute force attacks more difficult to detect -- but that doesn't make it non-compliant.

The reason it's not very good from a security perspective is that there is no difference from the system's point of view from a user typing a 10 character password to a user trying 10 different passwords, so any type of request throttling or account lockout would have to account for the "attempts" made while entering the password.

How can this be PCI DSS compliant?

Many of the PCI-DSS password requirements do not apply to customer logins - only to "non consumer users".

For example,

  8.1.6 Limit repeated access attempts by locking out the user ID after not more than six attempts.

does not apply to the "customer user":

  Requirements 8.1.1, 8.2, 8.5, 8.2.3 through 8.2.5, and 8.1.6 through
  8.1.8 are not intended to apply to user accounts within a point-of-sale payment application that only have access to one card
  number at a time in order to facilitate a single transaction (such as
  cashier accounts).

So even though this is not good security, there is nothing that prevents PCI compliance.

Standard disclaimer: I am not a QSA, and even if I was I am not your QSA, therefore my opinion would not affect yours (or anyone else's) compliance.

Alternatively

As Ian Cook notes, the site appears to be simply checking the password meets strength requirements, not the password itself. Therefore my answer above reflects the site behaviour as stated in the original question. If the site is only checking password strength, then the site will have no problem detecting and responding to any brute force attacks.