Use password to calculate checksum for API requests I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it "impossible" for a third party to make requests in the name of someone else or alter the content. The content of the request would be non-private.

Imagine an API that allows a user to save a text, then the request (containing the user id, text, other information) would be hashed together with the password of the user which acts as a common and non-hardcoded secret between a client and the server. The server then checks if the checksum is correct and knows that the request has not been changed and originates from that user.

Is this something that is commonly done and if it's a bad idea - why and what can be done instead?

Using a hash for authentication is very reasonable, but it is a bit tricky to get right. You should use a hash based message authentication as it circumvents some subtle flaws. You can find reputable libraries that support it for most languages/platforms.

One drawback of this strategy is that it requires that the server have a clear text copy of the password. This is rarely advisable for user passwords. But using it for generated secrets is very useful.

One way to avoid the password storage is to require a username/password (or other) authentication step that returns a secure token generated by the server. The client can then use that token for signing and the server could validate it. If the token is an HMAC of key information from the login such as username, session timeout, etc..., the server doesn't need to store the token to verify it. But, at this point, you've basically recreated OAuth and should probably just use it.

All of this assumes that you're using SSL. Without that, it will be very hard to prevent MiTM, replay, and similar attacks.


Notifications (RSS or mailing list) of CVE with high scores for Windows and Red Hat? I'm looking for a RSS feed or a mailing list that would allow me to be alerted of new CVEs impacting Windows or Red Hat that have a very high score, such as the recent ones for Shellshock and Winshock for example. Basically, a simple way to be proactive about updates that require immediate action and can't wait until the next month's patch cycle.

Is there such a list or is it just wishful thinking?

So far I found the NVD's 8-days analyzed CVEs RSS feed (https://nvd.nist.gov/download/nvd-rss-analyzed.xml), but you don't see the score in the subject, so it's hard to filter (i.e. if I wanted to alert whenever I see score > 8 for example).

Red Hat and Microsoft both have some form of mailing lists or RSS feeds, but none show the actual CVE score, and you need to open the related CVE separately and read the details. It's a bit time consuming to open each notification one by one to do this.

CVE Details allows you to create a customized RSS feed with certain CVSS scores.  : http://www.cvedetails.com/vulnerability-feeds-form.php

However, I'm not sure if there's a way to filter out only Windows & Red Hat OS vulns.. but perhaps someone has an idea?


Why does the government/military not use special operating systems? Why does military and government not use special operating systems? I mean, if they do not use generic operating system based on Windows, Linux and Mac and create their own operating system, they will be much secure.. Or am I mistaken?

There are a number of reasons why building their "own OS" is not a viable option.

1. Research Cost

To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT.

2. Security through obscurity

It's a proven concept that security through obscurity rarely helps. Yes, it's a new OS so no "hacker" knows how it works, but it is a fact that overtime information about it will be revealed through ex or disgruntled employees. Maybe even through the researchers themselves.

Being a "custom" OS, it will have security issues of their own and no one apart from the original researchers would be able to identify or fix them.

3. COST, COST and COST

Even if such a OS was made, to patch various issues a dedicated maintenance team would have to be kept. You'd additionally need to tailor defensive software, etc to work perfectly on that machine. Any vulnerabilities in that software if emulated would just pass on. In order to make custom software, the OS specifications would have be disclosed, thus we'd need to make custom office software, mail clients, etc.

Ultimately, it's just not viable to make an OS system and use it solely for defense. As I've said earlier security through obstructed rarely helps security, it just makes it more "time-consuming-ly" difficult, but at the end of the day, the cost outweighs the benefits largely.


Is it secure to use UUID as authentication? I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless you have physical or remote access to the device? Is this approach strongly discouraged?

This question addresses the use the UUID as input in a text field, while my question is to use UUID as authentication after a login complete state. If you type it in a text field, the user has to know the UUID. (Talking about my application) First of all, the user does not know his/hers UUID. Second of all, the UUID is encrypted inside KeyChain.

No, you should not use UUIDs as authentication tokens.
UUIDs are designed to be unique, not to be random or unpredictable. See wikipedia for a list of methods used to generate UUIDs. Let's take, for example,

Version 1 (date-time and MAC address)
Version 1 concatenates the 48-bit MAC address of the "node" (that is, the computer generating the UUID), with a 60-bit timestamp, being the number of 100-nanosecond intervals since midnight 15 October 1582.

If I was an attacker trying to predict the next UUID your server will generate, well once I've seen one one of your UUIDs then I know your MAC address, then I sync my system clock close to yours and I have a high chance of predicting your UUIDs. Your UUIDs are giving you ... maybe the equivalent of a 3 digit PIN's worth of security.

Now, you're proposing to use this as a super secret value that only the server and the logged in user know...
I could make some specific suggestions to improve your scheme, but you could probably benefit from doing some broad ground-up reading about "web authentication" and "session management". Here's a good primer to get you started:
https://www.owasp.org/index.php/Session_Management_Cheat_Sheet


Running a single NVT via OpenVAS? OpenVAS has many NVTs, and running regular scans is very noisy.

Is it possible to run a single NVT on a target (e.g., IP address and port)?
If possible, how can I do it?

Yes it's possible, but it's not particularly pretty and I'd recommend against this route if you need to do this for more than a handful of NVTs.

In the GUI this can be achieved by creating a new Scan config. Click on Scan Configs (under Configuration), and then click on the star icon in the top left to create a new one. Name the configuration as desired, make sure that in base "Empty static, and fast" is checked (This is the default), and press enter.
In the screen that will appear you can select NVT families. To the right of each family is the icon of a wrench. If you click on the wrench next to a family a new menu will appear enabling individual selection of each test. You can check only the one you want. Click on save. After creating a scan config you need only select in when you create a task next time.

Bonus; Next to each individual test in the scan config creation is a wrench. You can click it to edit variables (most commonly timeout) in the NVT.


How does Firefox's "first-party isolation" feature function? First-party isolation (privacy.firstparty.isolate in about:config, set to false by default) originated from the Tor browser and was recently added to Firefox. Unfortunately I haven't found enough official documentation and don't fully understand the functionality. Does this setting fully separate first-party cookies (third-party cookies can generally be safely disabled in web browsers, but additionally, how are they handled?) and related identifiable data (what data?).

From a cursory look, they isolate the cookies (and other data) on silos based on the domain you navigated to.
So eg. a load to facebook.com when visiting www.stackexchange.com, would put facebook cookies inside a different silo than the facebook load when accessing twitter.com (however, the facebook loaded from meta.stackexchange.com would use the same silo as www.stackexchange.com)

  Does this setting fully separate first-party cookies (third-party cookies can generally be safely disabled, but additionally, how are they handled?)

This is not "separating first-party cookies", as much as making a more detailed origin based on where you initially navigated to.

  and related identifiable data (what data?).

cookies are just a part of the data a page could save. I'm pretty sure this would also apply to localStorage, maybe even partition the cache.


OAuth2 with client credentials v/s other auth mechanisms For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client credentials grant type for the authentication.  Would that be the correct choice, and if so, how is it better than some other authentication mechanisms like Http basic/digest, or certification based mutual authentication?

OAuth is an authorization protocol, not an authentication protocol. Its role is not to tell you who is at the other end of the wire, but what that person can do. It so happens that OAuth can be abused into an authentication system: this is called OpenID Connect. The idea is that in order to give you authorization information (is the client allowed to do this or that ?), the OAuth server must first make sure of the identity of the client (who are we talking about ?); OpenID Connect is about reusing that inner authentication protocol ("if the OAuth server granted access, then, in particular, the OAuth server authenticated the client, and we have faith in the protocol used by the OAuth server, whatever it is").

If you do not have faith in what the OAuth server does to authenticate clients, then you can use other authentication methods such as passwords or client certificates. In that case, your server does the authentication, and then talks to the OAuth server: "I have Bob online, what is he allowed to do ?".

The question then boils down to: is the authentication layer in the OAuth server appropriate for your situation, or not ? This is up to you to decide. IF you decide to do the authentication yourself, then there are several methods with various characteristics. Which one is the best depends on the context; only a few remarks can be made in a generic way:

Whatever you do, use SSL. This is necessary to ensure that the authentication and authorisation you perform really applies, in a not-alterable way, to whatever requests the client subsequently sends to you.
Since you use SSL, don't do HTTP digest; use HTTP basic instead. SSL offers a much better protection than what HTTP digest offers (when compared to HTTP basic); and HTTP digest is not compatible with proper password server-side storage mechanisms (bcrypt...).
Client certificates are more complex for users, and make sense mostly when the authentication and the identity management are done by separate entities. If you just want to authenticate your users for your server, then certificates are overkill and probably not a good idea.


Does the HTTPS protocol consume a lot of CPU time? If every TLS message has to be encrypted / decrypted by both hosts involved in the secure connection, is this consuming a lot of CPU time?

I believe the website "Is TLS Fast Yet" https://istlsfastyet.com can answer your question. Here's a quote from the top of the page:

  "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." -- Adam Langley, Google


PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.

I have trouble figuring out if it is possible to do all that and to be PCI DSS compliant and SAQ A eligible.

PCI DSS glossary defines service provider as follows: “ Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS and other services as well as hosting providers and other entities.”
From the definition above it is clear that the payment processor is a service provider.

From the payment gateways listed on WooCommerce, only Paypal Checkout, PayPal Powered by Braintree and Stripe offers payment processing for companies registered in my country.

It is stated in PCI Data Security Standard SAQ-A that in order to be a SAQ A merchant:
“merchants confirm that, for this payment channel:
▪ All processing of cardholder data is entirely outsourced to PCI DSS validated third-party service providers;
▪ Your company does not electronically store, process, or transmit any cardholder data on your systems or premises, but relies entirely on a third party(s) to handle all these functions.”

As far as I understand, in order to be eligible for PCI DSS SAQ A (not collecting, storing, processing or transmitting cardholder data) I need to use URL redirection method from my website to a third-party page or iFrame method.

Question 1: Are in this case WooCommerce, my website’s host, third party security, backup and other plugin providers considered as service providers in case I use URL redirection method or iFrame for payments? Meaning that they should be PCI DSS validated? Or does that apply only to the payment processor/gateway as others are not involved in collecting, storing, processing and transmitting cardholder data?

What confuses me is that as it is stated in WooCommerce website Paypal Checkout, Paypal Powered by Braintree and Stripe plugins are developed by WooCommerce. As I understand WooCommerce is not PCI DSS validated.

Question 2: Does it mean that if I use any of these plugins as a payment gateway, I cannot be SAQ A eligible?

I checked the documentation provided in WooCommerce website for Paypal Checkout, Paypal Powered by Braintree and Stripe and I do not really understand how can they be set up for WooCommerce.

Question 3: Can any of these 3 payment gateways be set up using URL redirection or iFrame method? So that all collecting, storing, processing and transmitting of cardholder data is done by the payment gateway enabling me to be SAQ A eligible? For me it seems that PayPal Checkout allows only API that would not be compatible with SAQ A requirements for my company.

Question 4: Has the payment processor/ payment gateway such as Paypal Checkout or PayPal powered by Braintree be PA-DSS validated? On the list of validated payment applications available on the website of PCI Council, I cannot find PayPal or Braintree. Does it mean that to be PCI compliant I cannot use any of these two payment gateways?

Question 1: Are in this case WooCommerce, my website’s host, third
  party security, backup and other plugin providers considered as
  service providers in case I use URL redirection method or iFrame for
  payments? Meaning that they should be PCI DSS validated? Or does that
  apply only to the payment processor/gateway as others are not involved
  in collecting, storing, processing and transmitting cardholder data?

If you're using URL redirection or iFrame for payments, then you are ensuring the cardholder data flow stays outside WooCommerce and related providers.  Your last sentence is correct, the PCI validated part does not apply to them as they aren't touching the cardholder data.

  Question 2: Does it mean that if I use any of these plugins as a
  payment gateway, I cannot be SAQ A eligible?

As long as those plugins are correctly doing URL redirection or iFrame payments, you're fine.  You're just taking advantage of someone writing a plugin to integrate what you'd have to do yourself if the plugin wasn't there.

  Question 3: Can any of these 3 payment gateways be set up using URL
  redirection or iFrame method? So that all collecting, storing,
  processing and transmitting of cardholder data is done by the payment
  gateway enabling me to be SAQ A eligible? For me it seems that PayPal
  Checkout allows only API that would not be compatible with SAQ A
  requirements for my company.

"Stripe Developed by WooCommerce" boasts "PCI-DSS compliance with Stripe Elements," and Stripe Elements supports SAQ A with Hosted Fields, so look into Hosted Fields and make sure you use it.

"PayPal Powered by Braintree for WooCommerce" can "Achieve PCI DSS v3.0 SAQ-A compliance using Hosted Fields functionality for card detail collection," again note the focus on Hosted Fields.

I believe "PayPal Checkout" also supports SAQ A compliance via Hosted Fields, but can't find a succinct reference.

  Question 4: Has the payment processor/ payment gateway such as Paypal
  Checkout or PayPal powered by Braintree be PA-DSS validated? On the
  list of validated payment applications available on the website of PCI
  Council, I cannot find PayPal or Braintree. Does it mean that to be
  PCI compliant I cannot use any of these two payment gateways?

I suspect these plugins are not covered by PA-DSS, which is kind of a shaky standard that's going away.  These plugins are basically ensuring that the data PA-DSS is concerned with stays far away from your site.  But caveat lector, IANAQSA.


Is it possible to implement a secure game without having a reliable arbiter? N players are playing a perfect information game (the kind of game where everyone knows moves of everyone) by making moves by turn (P1, P2, ..., Pn, P1, ..., Pn, ... till the game will finish). Game has specific rules for every player (if a player makes a move against the rules - he loses automatically) and can finish only if one of the players win. I am trying to figure out whether it is possible to implement a secure game without having a reliable arbiter (who can be trusted). By secure I mean that none of players would be able to cheat and be unnoticed.

Here are some of my thoughts about it:

If none of the players cheat, than nothing should be done: players just make move and in the end the winner is announced. But if players can cheat, each next player can verify that the previous player has not cheated (it is perfect information and the rules are known) and if previous player cheated - he will lose right after this. If players can start to cooperate with each other (player 1 cheated and player 2 decided to cooperate) every player can verify all previous moves and players who cheated or cooperated will lose.

But here is a problem. Nothing prevents a next player to tell that previous player cheated even if he is not. Of course next players can check for this, but if only 2 player are in the game it will not work.

On the other hand it is possible to have a trusted arbiter who verifies every move. Player 1 makes a move - gives it to arbiter. It verifies it and transmits it to other players. And so on.

So is there a way to make a secure game without the arbiter?

P.S.

if this sounds too abstract, think about this as a chess game. 2 players, perfect information, rules are rules of chess how to move, players can cheat by making illegal move
I am not really sure that this is a correct place. I hesitated between mathematics, security and cryptography. If I am wrong, please move it to another place.

If everyone has a complete copy of the game state at time T, and the permitted moves can be deduced strictly from knowing the game state, then it's possible to identify cheating without an arbitrator, though telling who is cheating requires that the majority of players are honest.

Everyone starts the game with a complete copy of the game state (implicit in this being a perfect information game), and making a move involves broadcasting it to all the other players.

Claiming person P1 cheated isn't simply a matter of telling the other players that they cheated.  Instead, a claim of cheating would be for player P2 to tell all the other players "Given game state S, player P1 told me they made move M, which is against the rules".  Everyone can verify this by comparing S against their idea of what the game state should be, comparing M against the move they received from P1, and checking to see that M is against the rules.

At this point, the main issue is distinguishing cheating by P1 from lying by P2.

You can eliminate tampering with moves by having every move cryptographically signed by the player who makes it: if P2's claimed M has a signature that doesn't check, they're lying (if P1 sent a move with a signature that didn't check, P2 would have rejected it).

There's another way of cheating, though: if P1 sends a consistent series of legal moves, but the moves sent to P2 are different from the moves sent to everyone else, it can give P2 a false idea of the game state and induce them to make a false claim of cheating.  If the majority of players are honest, this can be thwarted by having everyone compare what move they think was just made, but if the majority are collaborating with P1, they can lie to P2 about what move they just received.  In this case, I'm not aware of any way to prevent it.


Changing malware trends in VM I recently came (Dunno, since when it was happening) to know that malwares can detect if they are running inside a VM like Vmware, and thus can change their behaviour.

So my question is how the security guys going to properly investigate a malwares behaviour, since running them in VM might not be a good idea anymore for those kinds of malwares ?

Running inside real machine (not VM), you might loose some inputs of that malware ?

The concept you're referring is to is called red pill detection..  The bad guys have gotten wise to the fact that the good guys can easily put a malware in a virtual sandbox to do dynamic analysis, so some are building in red pill action.  For common hypervisors, doing a simple driver check will show whether the guest is running on vmware, xen, or other hypervisors.

This has little impact on forensics.  Any good forensics investigator will have resources to do analysis outside a VM environment.  Simply, using a VM guest (i.e. automation) to do malware analysis simplified forensics for the good guys.  Not all malware does detection today.  Considering the bad guys usually prefer to keep packages small, embedding additional functions like vm detection adds additional complexity to code.  Such detection may only be present when the bad guys are really concerned about being detected.  Since most malware packages target the lowest hanging fruit (which there are plenty of), additional features (i.e. encryption, vm detection, steganography, etc) really aren't necessary.  So, existing models of automating forensics are still effective.


How to report abuse spam with X-AntiAbuse header which was added to track abuse? I've received the following spam e-mail (with the link to viagra site):

Return-Path: <silviani@server04.funet.co.il>
Received: from server04.funet.co.il (server04.funet.co.il. [212.29.215.70])
Received: from silviani by server04.funet.co.il with local (Exim 4.82) (envelope-from <silviani@server04.funet.co.il>)
From: silviani@server04.funet.co.il
Date: Tue, 09 Sep 2014 12:43:55 +0300
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server04.funet.co.il
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [816 32007] / [47 12]
X-AntiAbuse: Sender Address Domain - server04.funet.co.il
X-Get-Message-Sender-Via: server04.funet.co.il: authenticated_id: silviani/primary_hostname/system user
X-Source:
X-Source-Args: /usr/sbin/proxyexec -q -d -s /var/run/proxyexec/cagefs.sock/socket /bin/cagefs.server
X-Source-Dir: silvianimberg.com:/public_html/wp-content/themes/ultimatum
"And that's it, then," Kira said. "He'll lose face, coming home like that. That's all the dangerous ones, if Gul Kaidan was right."
"Wesley, we all-"
"The circumstances are somewhat incongruous," Picard agreed. "It usually takes some compelling motivations to prompt such a rapprochement. Investigating those motivations will be part of our assignment. Mr. Data, the pertinent background, if you please."
"Now you are practicing telepathy," he observed. "But," he added, "you are not strange, Tasha."
Amazingly, other people were just walking past as if nothing was happening. What the blazes was wrong with these people?

which says that this message is tracked so I can send the abuse report. How I can do that? What's the procedure?

When you read the headers, you see that the system you received that message from is server04.funet.co.il. [212.29.215.70] so that's where the spam should be reported.

Now that domain does not appear to be available in English so your first option is to follow RFC 2142 recommendation and send the complain in English (with all the details about this spam) to abuse@funet.co.il.

The second option is to find someone who can read Hebrew or use an automated translation tool to check the target domain (funet.co.il). if you do that, you'll notice that it's actually an alias for http.co.il and that the abuse report address they suggest you use is actually abuse@http.co.il

Another possibility is to use an automated spam reporting service to do that for you.


How do I protect a secret from rubber-hose cryptoanalysis? So let's suppose I have a secret file. Assuming I don't remember/know the contents, how do I insure it is protected against the rubber-hose cryptoanalysis no matter what, even if I break under pressure/coercion and give out all passwords that I know?

The only way to protect against a human leak is making sure the potential leaker doesn't know the secret.

This usually come by redefining the condition of access. Unfortunately for you, there is no magic bullet here: what will work and what won't is typically dependent on what condition you want to setup.

Let me give you a few examples:

In the case of code escrow, a contract is passed with a third, trusted, party that will release the secret (the source code) in specific case.
In the case of bank vaults, it could be setup to only open during business hours.
In some spy stories, you might have someone mailing the decryption key to themselves (creating a period of time during which they have no access).

In the end, as often, it all depends on your threat model.


MySQL Server Hardening Following the hardening theme....

What are some best practices, recommendations, required reading for securing MySQL.

Run only MySQL on the Server - If possible run only MySQL on the server and remove any unused services.
Firewall - Limit access by IP address to only the servers / clients that require access.
User Privileges - When creating users always give the minimum amount of privileges and expand as needed. Also try to avoid using '%' wildcard for hosts and instead limit to the host that requires access.
Bind Address Appropriately - If you only require remote access to the server within the same network and the  machine has both an external IP and an internal network address. Setup MySQL to only listen on the internal address.
Enable Logging - Enable logging if the database doesn’t handle to many queries.
mysql_secure_installation - Use the mysql_secure_installation utility which does a number of things including removing anonymous-user accounts, removes the test database etc.
Root Account Accessible Local Only - Its best to limit the root account to be accessible only directly from the machine. The mysql_secure_installation does allow you to remove any remote access for root accounts easily. I usually then either ssh to the machine and use the mysql command prompt or MySQL Workbench has functionality to tunnel over SSH.

Additional Resources

MySQL Security Best Practices (Hardening MySQL Tips)
MySQL Best Practices: User Security
Security in MySQL


Risk of getting MySQL database compromised with a client application I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server.

However when i googled ways to do this, I found that to establish such a MySQL connection I should provide an SQL user with write permissions and also provide that SQL user’s password (All these should be in my code).

This leads to a problem; if someone decompiled my application, they could get my SQL user and password, and they could see and do anything to my SQL database.

Is there anyway to prevent this?

Yes and no.

First the no: As you have realized, if any data you put in an app that you send to a client can be extracted from it. You can take steps to make it harder to find the password (obfuscation, encryption, etc) but as a general rule of thumb, never put anything in the app that isn't supposed to be public.

So how do you protect your database password? Simple: don't store it in the app. Make a small web application that the app sends the registration details to, and then have the web application store things in the database. This way credentials never leave your control.


Web-Application with CORS Origin: * using authorization header As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:

  When responding to a credentialed request, the server must specify an
  origin in the value of the Access-Control-Allow-Origin header, instead
  of specifying the "*" wildcard.

  Because the request headers in the above example include a Cookie
  header, the request would fail if the value of the
  Access-Control-Allow-Origin header were "". But it does not fail:
  Because the value of the Access-Control-Allow-Origin header is
  "http://foo.example" (an actual origin) rather than the "" wildcard,
  the credential-cognizant content is returned to the invoking web
  content.

So if I read this correctly, if the Access-Control-Allow-Origin is set to *. CORS requests can't be accomplished with credentials, so - for example with a Authorization: Bearer 123 header.

This only applies if the request comes from an different origin, than the web-application (SOP). Otherwise it would be impossible for a web-application to use Access-Control-Allow-Origin: * and Authorization: Token 123.

Did I understand this correctly?

Pretty much, yes. The key here is that the browser doesn't pay any attention to the ACAO header for requests to the same domain: therefore you can put anything you like in the ACAO header, and it'll work for your application running on the same domain.

For requests to a different domain, the browser does pay attention to the ACAO header - if the origin is acceptable, it then looks at what other Access-Control headers are included, and takes action based on those (e.g. ignoring authentication headers if there is a wildcard, or no Access-Control-Allow-Credentials: true header)


Is it safe to create a session from an auth token? My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on every request in the webview, so I use the auth token for authenticating this endpoint and then create a session from it. This is the code:

class CreateSessionView(APIView):
    authentication_classes = [TokenAuthentication]
    permission_classes = (permissions.AllowAny,)
    throttle_classes = [ScopedRateThrottle]
    throttle_scope = 'auth_token_verify'
    renderer_classes = [TemplateHTMLRenderer]

    def get(self, request, format=None):
        return Response({}, template_name='pages/create-session.html')
        # this template has a <form> that includes a {% csrf_token %} and authtoken

    @method_decorator(csrf_protect)
    def post(self, request, format=None):
        try:
            user = Token.objects.get(key=request.POST['authtoken']).user
            login(request, user, backend='django.contrib.auth.backends.ModelBackend')
        except:
            raise AuthenticationFailed()
        return redirect(reverse('home'))

My question is: Is there a vulnerability here? If so, how can I secure it?

See the answer here, it may help: Session Authentication vs Token Authentication

From what I understand from the answer, there is nothing wrong with using a token to authenticate, and then generating a session from the aforementioned token.


is it possible to find the original value of a hashed string, if you don't have the entire hash I'm wondering if there is a faster way than bruteforcing to find the original contents of a string if you have/know:

60 % of the original string (30/50 characters)
the amount of characters the string has.
know a range of the 8 first possible characters in the hashed string

is it possible to find out what the original string was, or will it not matter how much information you have?

Finding the original contents won't be helped if you only have part of the hash value. You still have to try possible input strings until you get lucky, i.e. hit the exact right one. In all generality, you can see it in the following way: if working with a partial hash value helped, then any attack on a full hash value would start by truncating that hash value.

Finding a matching input string, i.e. one that outputs the same partial hash value (but not necessarily the string that was really used in the first place), can be made easier if the target hash output is truncated. For instance, if the SHA-256 output was truncated to, say, 20 bits (out of the original 256 bits), then it is expected that about one string in a million will yield these same 20 bits (because 220 is about one million), so finding a matching input string would only be a matter of trying a million or so inputs, which can be done in a fraction of a second on a common PC. However, if the truncation still leaves 60% of the output, i.e. about 150 bits, then forget it (2150 is way beyond what can be done with existing technology).


Why do XSS strings often start with ">? One of the ways, XSS can be exploited, is to use following tag:

"><script>alert(document.cookie)</script>

Here, What is the meaning of "> before script (<script> tag) and why it is used?

This way you escape from a double-quoted attribute (") and close the previous tag (>) before opening a script tag that contains your payload. It's one of the most basic XSS patterns.

Example:

<input type="text" value="$XSS">

With your sequence it becomes:

<input type="text" value=""><script>alert(document.cookie)</script>">
 ^- a completed tag                  ^- payload           garbage -^

Note that your vector only works if HTML entities aren't filtered.

So if you can't escape from that attribute, it's XSS-safe. This doesn't trigger:

<input type="text" value="<script>alert(document.cookie)</script>">

You can see the same idea with XSS inside Javascript (e.g. '); to end a string and a function call) or with SQL injections. The first characters of an injection sequence often have the purpose of escaping from the current context.

As for @Mindwin's obligatory SQL injection xkcd strip, I freehand-circled the part I'm referring to:


Is there any way to track the status of a document sent to an external entity? I'm wondering what the capabilities for document (PDF/DOCX/XLSX/PPTX) tracking are , specifically to determine whether a client has broken a non-disclosure agreement.

Here's a scenario:

Service provider has confidential documents which can be released under NDA
Client requests these documents, signs NDA
Client then alters documents somewhat (possibly by way of rebranding) and stores internally for their use

Is there any technical way for the service provider to track whether their documents have been altered such as a beacon?

Edit: Had some constructive feedback here regarding the question being rather broad. To focus the scope, I'd be keen to understand the actual techniques for one of the noted document filetypes if possible (i.e, How do you track changes made to a remote PDF file you have created?)

There's no way to really protect any document against this kind of leak. As soon as anyone have a copy of the document, it can be altered in order to remove the protections:

print and scan
change format: pdf to text, or doc to text, or anything to image
copy and paste

Those operations can be done on an offline computer, so any beacon have no chance of working.


Can website exploit kits contain bootkits? Can a website exploit kit theoretically contain a bootkit (it flashes your UEFI/BIOS)?

An exploit kit focuses on exploiting certain application (typically a browser). After that it generally downloads a second stage payload which adds the computer to a botnet/installs ransomware/steals your banking credentials/etcetera.

As part of the later stages, it will try to gain persistence and escalate even more if possible, May one of them be attempting to flash the BIOS/UEFI? Yes

Could it all be included in the exploit kit? Yes, although highly unlikely. That would be  usuallyleft for a later binary, in the rare case it was done at all. Note that nowadays you have a group an exploit kit, which is sold to a different group, that infects computers and sells them to other groups with completely different goals... It's no longer the case that each group did everything on its own from exploitation to persistance and <whatever is their goal>


Custom surveillance protection I want to make a secure network because of government surveillance.

Is there a way I can configure or build some type of custom hardware to be able to detect and to access the network, but only using that hardware the network becomes visible. Is it possible to make the network access be controlled using custom nic for example.
Is it possible to make the network behind a network to prevent traffic analysis.
What security measures should be taken to secure and hide a darknet

It is impossible to make a network where it is not possible to tell you are communicating.  You can build a network that will hide what you are communicating or even make it look like you are communicating something else.  You can make it impossible to tell who the end user of your communication is if you have enough participants, but you can't make it so it can't be noticed that you are using that network.

Any form of communication involves sending messages and those messages can be observed by not only the recipient but the attacker.  The best you can do is make it look innocuous or unintelligible.


What kinds of attacks are possible with credentials to a read-only Postgres user? Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple attacks could be just flooding simple queries. But is there another potential risk?

I already noticed some issues to mitigate:

The public role needs to be completely revoked of all permission and never granted anything.
Some functions might be more time and cpu intensive. I do wonder if there's a way to limit the exposure to these other than a simple time out.
In general exposure to too many tables and columns.

Because this is a web service I control - I can constrain the contents of the SQL query, so that's something I'd love to hear if there are functions, keywords or characters that I need to strip to make sure people are only making reasonable SELECT queries.

I realize this is somewhat of a vague request, but then again, security is a bit vague.

A few things:

Bugs

There are two sources for bugs here: Your role definition, and the database software itself. If you configure the role wrong, or the database software has a bug which allows people to do things they shouldn't, then... well, it depends on the exact bug, of course, but really anything can happen.

"I can constrain the contents of the SQL query"

Given SQL's complexity, that's a lot harder than I think you realize. Sure, it's possible, but there's really only one way to do it effectively: Make a query builder client, and build the actual query serverside. You might still introduce a SQLi vuln by accident, but it'll be easier to constrain than arbitrary SQL.

A better way?

I'm basically stealing this from Anders, but in my defense, I did also have the same idea independently -- funnily enough, even with the same inspiration.

In short, use a throwaway database. Postgres natively supports read-only replicas, where the data only ever flows one way, but if you want to be paranoid you could always set up a job to manually move files over. Postgres supports that, too.

Then, once you have your read-only replica, you can expose it to the world and basically not care about it. It's read-only at the database level, so there's no chance of any privilege bugs; your attack surface is now smaller. It's much easier to reset than your real production database -- just nuke and reinstall. You can filter out data you don't want them to see and entirely exclude it from the database they have access to. As a nice plus, because this is so well-supported by Postgres, it's really easy to scale up to meet demand. Likewise, if one of the servers gets DoSed, you can just tear it down and spin up a new one in its place.


Which unicode (control) characters should a web app (not) accept? THIS IS NOT ABOUT XSS

Threat: Mallory enters control characters in a public web application text field that other users might use in a terminal program (via copy+paste or by running a script).

Another threat is a user enters a phishing domain (that is later displayed) and uses a RTL control character so that it looks non-phishy.

http://www.moc.lapyap

is actually http://www.\u202Emoc.lapyap

(Another minor reason is that Postgres barfs if a user enters the null character).

I am not talking about a regular XSS injection that runs javascript. I am using JSoup to prevent XSS and it works fine, but doesn't block control chars (unless they happen to make an XSS)

I looked at OWASP ESAPI Validator but it only validates ASCII chars (ex in the getValidPrintable() method).

It seems like there's no good reason to accept:

\u0000 - \u001F (except carriage return, line feed, horizontal tab)
\u007F - \u009F
\u202E

Which others should I be concerned with?

Escaping / encoding on save is as incorrect as it is with XSS.

Accept them all, just encode them into a safe format upon receipt. Furthermore, if you are asking this question, I would first consult an encoding library for a basic implementation before moving on. Encoding can be trickier than you think, and I see custom implementations fail all the time.

In many cases, it is not the character itself that is problematic, but how it fits into a group of characters.

So I shall refrain from giving you list, as it shall be extensive, and not lead you to success. If this is for production, use a peer reviewed code base to do your filtering and encoding. If this is for the purpose of writing a library, study one of those peer reviewed code bases.

Just to be clear:
On the way in data should be sanitized, to prevent injection (make sure and use parametrized queries as well.)
On the way out data should be encoded, to prevent XSS.

Most modern Web Frameworks have a decent encoder class. If you use Java check out the implementation that OWASP provides: https://www.owasp.org/index.php/OWASP_Java_Encoder_Project


From SQL Injection in SQLite to shell I need to obtain a shell from an SQL injection over an application with sqlite database.

Currently my exploit looks like the following:

lucian@0x90:~/$ proxychains nc 10.185.10.55 1101
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:9999-<><>-10.185.10.55:1101-<><>-OK
Input please:
1 UNION ALL SELECT 42,'qvzbq'||'LOHpyNMpQSCCIaWebmCZHjvwrZhYczWfJGiXVBzV'||'qzzxq',42;-- sdasdasd
1 UNION ALL SELECT 42,'qvzbq'||'LOHpyNMpQSCCIaWebmCZHjvwrZhYczWfJGiXVBzV'||'qzzxq',42;-- sdasdasd

Parsing results...
Customer information: Damy Roali qvzbqLOHpyNMpQSCCIaWebmCZHjvwrZhYczWfJGiXVBzVqzzxq 42

lucian@0x90:~/$

Following this link http://atta.cked.me/home/sqlite3injectioncheatsheet I discovered that I can either ATTACH DATABASE (by creating a .php file in the document root of a web folder) or load_extension (by loading a dll file from an smb path) in order to gain the shell.

Is this by default in SQLite or do I need to enable something or check something?

Is this by default in SQLite or do I need to enable something or check something?

This SQLite cheat sheet

https://github.com/unicornsasfuel/sqlite_sqli_cheat_sheet

says

File writing (php to web folder)    "...requires either direct database access or (non-default) stacked query option enabled..."

Arbitrary Code Execution (load dll)  "...Requires non-default configuration..." and more specifically the link you provided above says "...Unfortunately, this component of SQLite is disabled in the libraries by default ... "

Here is how you enable extension loading

https://www.sqlite.org/c3ref/enable_load_extension.html

sqlite3_enable_load_extension(dB, 1)


Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method.
I have used this old tutorial for setting up my own CA and generating the certificates and adjusted the older parameters to match the current ones.
So far I managed to authenticate my iPhone 6 running iOS 11.1.2 as a test device, for that I have:

Installed the root CA's(the one I created) certificate on my iPhone
Installed a test identity profile on my iPhone with the name "Test" and test passphrase, which I converted to a .p12 file

Now when I connect to the network with the freeradius server running in debug mode, I can select EAP-TLS as the auth type and tell it to use the identity certificate. It then prompts me to trust the server's certificate and I get a successful connection.
I have 2 questions:

Why do I need to trust the server's certificate if I have the root CA's certificate installed? As far as I understood the way the authentication works is as follows:

The server and client each send their respective certificate for the other party to authenticate with the root CA's certificate. After both are completed there is an optional challenge for the client to complete? (I'm not sure about this) and the client is authenticated

The server doesn't need to be told to explicitly trust the client certificate but the client needs to explicitly trust the server's even though they are both issued and signed by the same root CA and both parties have the certificate needed to be able to verify it

AFAIK the whole point of certificate-based authentication is to prevent MiTM attacks that other methods are vulnerable against. If the user initially connects to a spoofed access-point and accepts that certificate it will refuse the correct RADIUS server and leak the client certificate to the wrong server, this would be avoided if the client can verify the server certificate on its own without user intervention

There is a username option when selecting the network on the iPhone, which does get matched against a backend SQL database by the freeradius server regardless of that username existing the server accepts the authentication. This page notes that the username is used in inner and outer authentication but to me, that doesn't seem to make sense as there is no inner and outer identity in EAP-TLS. I assume there is a way to tell the radius server to only accept requests that match a username in the database but if it is not configured that way by default what is the point? Doesn't the certificate already uniquely identify the device/user and what is the point of the username field if anything can be entered?

I would appreciate an explanation to these concepts, I'm relatively new to certificate-based authentication and RADIUS in general so I'm still learning the basics.
The goal of this endeavor is to deploy the server in an eduroam-like environment where users can generate certificates for their devices on some website, download the two needed certificates and get access without having to trust another.
I should also note that I have complete access and control over the server and my CA so I can modify anything as needed, so no quirky workarounds here.

Please bear in mind that whatever you are trying to use is dependent of mutual support on the server/authenticator and client sides. This is not always trivial to achieve.

Why do I need to trust the server's certificate if I have the root CA's certificate installed?

This behaviour is entirely dependent on the client's implementation (the supplicant). Yes having the server cert signed by the CA should be seen as a significant proof of trust, provided it's not expired or revoked (if the client checks).
On a windows workstation for example you can either trust CAs specifically or let the user review and accept the server side certificate at the first connection. But if the server side cert is signed by one of the selected CAs, the user doesn't get a dialog about the cert.

AFAIK the whole point of certificate-based authentication is to prevent MiTM attacks that other methods are vulnerable against.

Conceptually it is instead about mutual authentication, and providing solid proof to the client that the server is being spoofed. It is up to the client to decide what to do with that information. Hopefully and usually it drops the connection. If not, it's as much at risk of MiTM as if it didn't use cert based authentication.

There is a username option when selecting the network on the iPhone, which does get matched against a backend SQL database by the freeradius server regardless of that username existing the server accepts the authentication. This page notes that the username is used in inner and outer authentication but to me, that doesn't seem to make sense as there is no inner and outer identity in EAP-TLS.

Conceptually you could have another EAP authentication dialog within the EAP-TLS channel once that is established. For example EAP-TTLS is often used to protect less secure authentication protocols like PAP. So this is left as an option for the server and client implementations to negotiate through the existing supported protocols and/or custom implementations.
This could also be used for a kind of multi factor authentication whereby a station and a user authenticate separately so that the admin can revoke access to the device or the user independently.


How does X-UIDH user tracking work and how can I detect it? See these two EFF articles about how Verizon puts a tracker ID in the header of a http request, circumventing anti-cookie measures:

Verizon Injecting Perma-Cookies to Track Mobile Customers, Bypassing Privacy Controls
How Verizon and Turn Defeat Browser Privacy Protections

How does this technically work? Can the user see that this header is inserted?

I don't have Verizon, so I can't test it. The EFF article mentions two websites that can test for this header. They require that you do not use wifi. Apparently Verizon only uses this for mobile browsing, but I guess this can be used for all browsing - not?

When I do the test on Am I Being Tracked with my phone (4G in Europe) I get the following message: Oops, we received a strange result. Is your Wifi still on? I'm not afraid that this is going on right now, just testing for fun, but still this is strange. Can I test this myself on a private website?

Is there a way to mess with this value? Insert a random user ID in the header with a browser addon or something?

Verizon uses X-UIDH. Other providers may use something else. Is there a way to test for this?

Somehow I ended up on your question when googling for something else. Anyways:

Here is a website to test for the header: http://uidh.crud.net/ .

Verizon achieves this (adding the header info) by what is essentially a man in the middle attack on all HTTP traffic on port 80. Since they control the ingress and egress of your unencrypted data, it's pretty easy to modify the HTTP header information. That are tools out there, like fiddler for Windows, or any proxy server, that you can use to do the same thing to HTTP traffic.

Here is another site that will show you all the header information coming in your HTTP request upon arrival: http://browserspy.dk/headers.php .


How long do HTML password fields (sent to the server as postdata) remain in memory? In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is  Request.Form("the_field"), where Request.Form is a dictionary-type object where the values are parsed from the POST data into key/value pairs.

There are also various recommendations for only keeping passwords in memory for minimal time, up to and including using a mutable character array instead of an immutable string, pinning it so it cannot be paged or copied, and zeroing each array element when done (or using something like .NET's SecureString, which does the same).

Given these, what mechanisms might exist for telling the web server that it needs to treat the posted form data as secure, and to do the pinning/clearing for, say, an HTML <input type="password" /> field?

One might reasonably expect the browser to go the extra mile for password fields (although I expect they don't), because they can infer from the markup that such protections are necessary.

The transport layer is covered by HTTPS, and is not in question.

But nothing I have seen provides the web server with the semantics of post data, so it can choose to apply in-memory protections.

I've had a couple of ideas how such a thing might be handled in a web server if designed by scratch (note that I am not designing a web server from scratch!):

Apply in-memory protections to all requests:  This seems like it might be the most straight-forward, but may negatively impact performance for pages that are not strictly sensitive but are served under SSL (e.g. all-SSL sites or 'My Account' pages that don't have 'New Password' fields).  Might be configurable at an 'all requests' / 'HTTPS only'
Standardise an HTTP header that defines the fields to be protected:  Mitigates the all-SSL issue, but would provide an obvious starting point for inspection (although I'm sure txtUser=foo&txtPassword=bar is already a good-enough indicator).  Would take x years for the W3C to agree on a standard, and another y years for browsers to implement it.
Register secure post fields in server config (or through language integration):  The server's request stream parser would be responsible for reading each post key, checking against the internal list and apply in-memory protections to the subsequent post value.  Maybe even excluding it from the normal Request.Form in lieu of a Request.Passwords object with a fit-for-purpose data structure, or substituing the Request.Form value with an object reference to the SecureString.

So are there any web servers that already do this (or something like it), or allow you low-enough level access to implement these protections manually?  I thought maybe IIS7's integrated pipeline, but I can't see an event that runs early enough.

Are such protections even necessary, or is this just a solution looking for a problem?  If so, what makes this unnecessary where a desktop app's in-memory password handling is not?

Whether traditional "protections" for sensitive data in desktop RAM (e.g. SecureString) are really needed or not, is debatable. When attackers can read the RAM contents, they already have a lot of control on the machine. We can still justify some proactive measures in the following sense:

RAM in a machine may leak to disk, through virtual memory.
The hibernation mechanism on laptops is also prone to copy RAM contents to disk.
Desktop machines may be infected by malware (through the user's gullibility) which might run with limited privileges but still be able to explore the RAM contents of other process running for the same user.
Physical security of desktop computers (and especially laptops) cannot be ensured at all times; the attacker may grab the machine and run away.

For these reasons, it is best if the passwords and other sensitive data are "protected", i.e. prevented in some way from leaking to disk, and forcibly removed from RAM immediately after usage, thereby reducing the vulnerability window.

None of these reasons apply to servers (even the bit about "virtual memory": if your server hits swap space, then it does not have enough RAM; RAM is cheap nowadays; good servers don't use swap space at all). Therefore, it can be argued that servers don't need to apply the traditional in-RAM protections for passwords.


How to interpret virustotal, virusscan scan? I was looking at a popular file sharing app called Zapya and really liked it's functionality.
I scanned the Windows executable ZapyaPC28Lite.exe, on two online virus scanners:

https://virusscan.jotti.org/en-US/filescanjob/8e462hjw1m

https://www.virustotal.com/gui/file/6210d10145358e05ea5e2852277a393c51a8dde8308f003e101a6efe7df84479/detection

The majority of engines report it's clean, but some report Trojan.
What makes this further confusing is that on VirusTotal McAfee reports it as bad, but on MetaDefender, McAfee reports it as okay:
https://i.imgur.com/2DY7r1F.jpg

(https://metadefender.opswat.com/results#!/file/39b75b9272d9a98df2fd2068bc0812e1/hash/multiscan)

How should I interpret these results?

I'm not asking for an analysis of this particular file, but general guidelines around:
Identifying false positives?
Determining which engines to pay more attention to?

Thanks.

You need to check the exact description of the malware that was detected, because antivirus software nowadays doesn't just detect "viruses", but may also warn you about other kinds of software, like adware and riskware. If you look closely at the descriptions in your scan, you will notice, for example:

Clyance: Unsafe. They don't tell you it's a virus, trojan, etc., they tell you "unsafe".
Fortinet: Riskware/Funshion. Again, it's labeled "riskware", not anything more specific.
Comodo: ApplicUnwnt@#t95vgdillac6. Again, the label seems to say "Application Unwanted", not more specific malware.
McAfee: Artemis. Artemis apparently is what McAfee calls "unknowns" that are detected by its heuristic engine. This is probably stuff detected by the engine, but that it's not included in the malware database. Source: McAfee support community.
ESET-NOD32: A Variant Of Win32/FusionCore.AQ Potentially Unwanted. Note they say it's "potentially unwanted". Also, what's Win32/FusionCore? Google brings up several results from reputable sources that link that description to PUAs (Potentially Unwanted Applications), adware, or software with poor reputation.
Kaspersky and ZoneAlarm: Not-a-virus:HEUR:Downloader.Win32.Funshion.gen. Not-a-virus is what Kaspersky calls adware and riskware. They include P2P software in riskware. What is riskware? It's legitimate software that has potentially dangerous functionality, so you should be aware of it. P2P software is ok if you installed it, but not ok if a malicious agent installed it on your machine without your consent. So they decided to call it riskware. Source: Kaspersky, not a virus.

As you can see it's not enough to just rely on "detection". You also need to check who detected what, and look up some more details before you can decide if it's a real known threat, or if the scanners are just warning you. In this case, the most popular scanners seem to tell you it's not malware, but it's riskware, so you need to make sure you know what you are doing. Of course you also need to remember that malware scanners don't tell you for sure if a piece of software is malicious or not, but they just tell you if it is known to be malicious, or if it might be malicious because of its behavior and functionality. Does Zapya have a good reputation? Does it introduce huge security holes in your system? Can its developers be trusted? Malware scanners won't answer such questions.


Air-gap implementation for personal computer use I recently read over Bruce Schneier's article on setting up an air-gapped computer and am looking to improve my setup (compared to my current "use one Windows PC for everything" model).  The main threat I want to protect against is getting hit with malware via a drive-by-download or e-mail attachment...and then having that malware send off sensitive data from my computer to hackers. I have a plan in my head and am hoping to get some feedback on it.

Note: I am looking only for security against remote attackers, not against people breaking into my house, attacking my WiFi network with a van full of antennas, etc. Also, anonymity is not a goal for me.

My plan is: Buy 2 new laptops.  One will become the air-gapped machine and one will become the networked machine (used for web browsing, logging into e-mail servers, online banking, chat software, etc).  Buy cheap ones that only have WiFi, and no cellular or bluetooth cards.

Air-gapped laptop setup:

Before turning it on, open up the case and take out the WiFi card.  Tape over the web cam.
Install a linux distro via a DVD I've already burned (yes, I plan on going through the process of verifying the signature on the ISO and all that).
Connect via ethernet to my router so I can get to the internet long enough to a) run the software updater and b) install gnupg2 and keepassx via apt-get.
Disconnect it from ethernet and never connect to a network again.
Generate a PGP key pair.
Generate and store new strong passwords for my various web sites / e-mail accounts using keepassx.

Networked laptop setup:

Tape up the web cam.
Install the same linux distro via the DVD.
Run the software updater.
Install VirtualBox.
Set up a linux VM and run the software updater on that.
Try to harden the Firefox verison on the VM by tamping down the settings, installing NoScript, HTTPS Everywhere, etc.
Take a snapshot of the VM.

Web browsing:

Only browse the web using the VM (not the host OS).
After each switch in context (from online banking to security research to personal e-mailing etc.) restore the VM to its last good snapshot.
Run the software updater on the snapshot periodically and store that as the new good snapshot.

E-mailing:

Use networked machine to retrieve people's public keys. Burn them to CD. Transfer CD to air-gapped machine.  Compose and encrypt e-mails on air-gapped machine.  Burn to CD and transfer to networked machine to send.
When reading e-mails, use networked machine to retrieve the e-mails from servers and save them to text files.  Burn the text files to CD and transfer to the air-gapped machine for decryption.  Then repeat from step 1.

Important note: The only tasks that should be performed on the host OS on the networked machine would be:

Running the software updater
Running VirtualBox
Transfering files to/from the virtual machine via the shared folder VirtualBox feature
Burning CDs to be used by the air-gapped machine and reading CDs burned by the air-gapped machine.

My questions:

Is there any particular linux distrubution that would be more resistant to malware coming from drive-by downloads or attachments?
Are there known instances of malware tampering with the CD-burning process on a networked linux machine such that it can pass the infection to an airgapped linux machine?  I realize that an infected air-gapped machine can burn extra data onto a CD (to be read later by malware on the networked machine).  But my concern is specifically how malware might infect an air-gapped linux machine via a CD. Windows has its AutoRun vulnerabilities when a DVD or USB stick is inserted, but does linux have something simlar?
In general, are there missing pieces to my plan or things that could be improved?

Thanks in advance!

I will focus only on some problems with your approach:

The insecure system writes the CD and thus can tamper with both the data on the CD but also with the format of the CD, i.e. the file system.
This CD is then read by the secure (air-gapped) system and mounted there. Mounting is done inside the kernel (i.e. system level access) and there were bugs in the past in this area.
It does not matter if there is existing malware which hijacks this process. With your setup you are aiming more in the area of defending aganst targeted attacks and there it only counts if such malware could be developed. And I think this should not be too hard.

Also, while you encrypt outgoing mails on the air-gapped machine you need to decrypt incoming mails on the insecure machines, because otherwise you could not transform these to plain text like you want. This means that the decrypted and probably sensitive information are available on the insecure machine. If you instead transfer the encrypted incoming mails to the air-gapped machine you then have to deal with (possible malicious) attachments there.

And, while product recommendations are off-topic (but you requested these): I would not recommend any general purpose Linux distribution. Go at least for something hardened with Grsecurity or just go with OpenBSD. They are more focused on security by design and on security in depth than Linux is.


Will there be a grace period for the CA change to mandatory 1 year? As I can see some sites were working yesterday and today they are not working so my guess is browsers have a grace period set in them. certificate lifespans limited to 1 year in browsers.
Maybe this is based on the Certificate Authority.
TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error)

Where is the best place to check for this? Will the canary build handle this check for me so we can see the failure early on? What is the best way to handle spread out certificates in a centralised location?

There is already a grace period build in. To cite from digicert:

... Apple announced that beginning Sept. 1, newly issued publicly trusted TLS certificates are valid for no longer than 398 days.

Thus, this is only about certificates issued after Sept. 1. and it does not affect already issued certificates. This also means that there is nothing to worry about when hosting a site, since already issued certificates are not affected. Note that there was already a limit in place how long certificates issued by public CA should be valid, this limit is now only made shorter.


Explain OWASP Data Validation best practice example I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here:

  Example - Scenario

  You are to populate a list with accounts provided by the back-end system
  The user will choose an account, choose a biller, and press next

  ...

  Best Method

  The original code emitted indexes  rather than
  account names.

  int payeeLstId = session.getParameter('payeelstid');

  accountFrom = account.getAcctNumberByIndex(payeeLstId);

  Not only is this easier to render in HTML, it makes validation and
  business rule validation trivial. The field cannot be tampered with.

The other (bad/acceptable) examples listed are dismissed since it is easy for the user to tamper with the parameters.

Why would a user not be able to tamper with the payeeLstId in the "Best Method" thus casuing the accountFrom to change? Are they no longer using a form?  How does the user selection end up in the session? I find the example unclear.

This example doesn't prevent against changing the value intentionally because the explained functionality says that the user is allowed to set the payeeLstId parameter. However, the example provided does prevent against multiple attacks because the parameter is first cast to an int before being used to query for the account. By tampering I'm assuming OWASP means that the value can't be used to exploit the vulnerabilities listed (buffer overflows, XML injection, etc) in the Why this is bad section not setting the value to reference another account.


When and where do I hash a password? Say I have a client and a server. I want the user with the client to login to the server with a username and password combination.

To login, they have to enter the right password which (when hashed) matches the details stored on my server.

Where do I perform the hashing function on the password entered by the user? Should the client's computer perform the hashing function and send the hashed result to my server (hoping that nobody figures out a working hash to send)? Or, should the server perform the hash on the password (hoping the connection between the two is secure)?

I'm keeping this as abstract as possible in hopes of applying it to multiple situations.

Ideally, we should do most (but not all !) of the hashing on the client side.

The overall need for password hashing, with all the involved iterations and salts (see this answer), is to make sure that the value which is stored (the "password verification token") cannot easily be used for an offline dictionary attack (the attacker tries potential password, until one which matches the stored value is found). For that specific functionality to be fulfilled, it suffices that the slow-and-salted password hashing occurs "somewhere", and the client machine is a reasonable place for that.

However, protection against offline dictionary attacks is only one part of the security goal. In particular, we do not want an attacker to be able to obtain "password-equivalent" values. If you do the complete hashing client-side, and store the value "as is" on the server, then a glimpse on the server's database (as happens all too often with SQL injections and lost backup tapes) will reveal the hash values and allow the attacker to log in as any user immediately. Thus, you still want to do some hashing server side.

What works, for instance, is to have the slow-and-salted hash on the client, resulting in a value V, and the server stores SHA-256(V). Since the slow-and-salted hash has been done, the protection against dictionary attacks is there; and since the server does not store V but still requires the client to send V to be granted access, read-only breaches are not trivially escalated into full read-write compromise.

Client-side hashing has the very interesting feature of using client-side resources, not server-side, thus allowing a given server to process many concurrent clients without running out of CPU, while still having an overall slow-and-salted password hashing. However, this is not often done in practice because of some drawbacks:

The client cannot hash without knowing the salt, which is stored on the server. The protocol thus implies an extra roundtrip: the client must send the username, the server responds with the salt, and then (only then) can the client do the slow-and-salted hash.
Clients are heterogeneous: some can be quite feeble, which implies a hard limit on the number of iterations that can be applied (because a slow smartphone as client does not mean that the human user is more patient). This is especially true for Web-based clients, because Javascript computations are awfully slow (when compared to native code or even Java or Silverlight applets).
Client-side hashing means client-side code, which may not be easily upgraded or modified. With server-side hashing, the hash function choice is entirely up to the server and can be switched without having to alter installed clients in any way.
Some servers like to have access to cleartext passwords occasionally, not for storage, but for other features such as automatically detecting very poor user passwords, or sending a copy of the passwords to the relevant Law enforcement authorities (where applicable -- I am not saying that this is good or bad, but when it applies, it is not subject to a choice by whoever designs the login system; if you are in a country where you must allow governmental agencies to peek at passwords, then, well, you must, so this becomes an element of the context to be dealt with).


Harden a server against mass SSH DoS attacks How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately login to the machine?

The server already uses only SSH key based access and does not allow root logins, so the password brute forcing is not a concern.

One usually evoked solution is Fail2Ban: this is a system which uses the firewall rules (iptables) to block incoming connections from IP addresses from which some kind of exhaustive search attack is apparently in progress.

This, of course, won't work with a distributed DoS, coming from thousands of distinct IP addresses. In general, very few things resist a distributed DoS.

Fail2Ban can also be problematic in case of large-scale NAT: it has potential for locking out a whole network of normal users who just happen to share the same IP address, as seen from the outside.

It is highly recommended, when you begin to configure tools such as Fail2Ban, to also run another SSH server on another port, not covered by the Fail2Ban rules, just to allow re-entry in case a bad configuration locks you out.

Another completely different strategy is to keep a connection open at all times. E.g. you have a long-standing SSH between your server and your own desktop system; you may even multiplex other connections on it (with SSH abilities for tunnels, and/or SOCKS proxying). This avoids the allocation problem: you don't need to get a free port for your root connection since you already have one.


Does PUT or DELETE offer any security advantage over GET or POST? I have a REST API and I want to handle all HTTP requests via POST.

Is there any security issue in using just POST to perform all CRUD operations requested by a user, which sends JSON specifying the operation to be performed (and other informations)?

The GET (as well as HEAD, OPTIONS and TRACE) is defined as a safe method (RFC 7231, 4.2.1). By this definition you should never use GET to replace PUT, DELETE etc.
The  PUT and DELETE are idempotent methods (RFC 7231, 4.2.2):

  A request method is considered "idempotent" if the intended effect
  on the server of multiple identical requests with that method is
  the same as the effect for a single such request. Of the request
  methods defined by this specification, PUT, DELETE, and safe
  request methods are idempotent.

The POST method doesn't have these restrictions, but keep in mind that Representation State Transfer REST is a software architechtural style. From W3C Working Group Note 11 February 2004, 3.1.3, emphasis is mine:

  An even more constrained architectural style for reliable Web
  applications known as Representation State Transfer (REST) has been
  proposed by Roy Fielding and has inspired both the W3C Technical
  Architecture Group's architecture document [Web Arch] and many who see
  it as a model for how to build Web services [Fielding]. The REST Web
  is the subset of the WWW (based on HTTP) in which agents provide
  uniform interface semantics -- essentially create, retrieve, update
  and delete -- rather than arbitrary or application-specific
  interfaces, and manipulate resources only by the exchange of
  representations. Furthermore, the REST interactions are "stateless" in
  the sense that the meaning of a message does not depend on the state
  of the conversation.

Therefore, despite using POST in place of PUT and DELETE doesn't have direct security implications, your API wouldn't be RESTful anymore, but an arbitrary application-specific interface.


Methods for encrypting user data on server, Authenticate with client TLS certificate I am using user client TLS certificates (from smartcards) to authenticate on a web program. The users store data on the server and I would like to encrypt the stored data to protect the information if the database is compromised. I would like to not store the data in plaintext.

What are recommended methods to encrypting or protecting the data at rest? I don't believe that I can use the smartcard private key to decrypt the data as it is stuck on the client side and inaccessible to the server. The users' sole method of authentication is by smart card so I cannot use a normal 'user password' as a encryption key. I am using Go as the web server, but a solution in any language is good.

UPDATE: The type of compromise I am thinking of is an attacker getting a full database dump. I would like to encrypt the data in a Redis database at the level of the “value” of the key/value storage. An example would be encrypting certain sensitive datas using the user’s password (if I was using passwords) so that only the user supplied password will successfully decrypt the data.

I am not looking for an OS or database wide encryption as the database is hosted by a third party. The user accesses the web app over HTTPS and the web app program communicates with the database. I know that IE has the S/MIME plugin that allows use of client smart card to decrypt email in Outlook online but that is basically a client side program.

Any suggestions?

User platforms targeted are Windows, OS X, Linux

User browsers targeted are IE, Chrome

An easy way is to enable BitLocker, FileVault, and equivalent in Linux. If someone steals your machine or disk, the data is encrypted. It is done at the OS level, so you do not need to make any changes to your applications.

This is very effective esp. with legacy databases, file stores, and applications.

If you are concerned about DB compromised remotely on a machine that is already unlocked and running, then the same can happen with your application. So you will need to threat model and figure out why the attacker who can compromise your DB cannot compromise your application and use it to get the data in the decrypted form.


Verify password hashed with nonce when the password is already hashed on the server? I found this picture in the Wikipedia nonce article:

To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (nonce) and one from the client (cnonce). I assume that the server, who knows both random numbers, compute the same hash and compare to verify.

My questions are:

Am I right to say that this won't work if the password is not stored in plain text on the server? I fail to see how the server could verify the hash if the password is already hashed (with salt and pepper) on the server.
Can this scheme be extended to work with hashed passwords somehow?
Does using salt and pepper somehow complicate this even further?

Am I right to say that this won't work if the password is not stored in plain text on the server? I fail to see how the server could verify the hash if the password is already hashed (with salt and pepper) on the server.

This scheme does require the password to be stored in clear-text. Very bad.

  Can this scheme be extended to work with hashed passwords somehow?

I'm sure it can, but there's no need. The scheme you've referenced is the HTTP digest authentication protocol. It was written in a day when SSL was considered to expensive to implement in many systems. Digest authn provided a way to login over clear-text channels without exposing the password. There's absolutely no reason to do that anymore. SSL is now effectively free.

In general, the risk of storing passwords on the server is considered to outweigh the benefit of having the server not having your password in memory for a short period of time (time from reception of password message until hashing begins and the cleart-text password's memory can be erased).

There are some situations where client-side hashing can make sense. For example, LastPass implements a unique authentication mechanism that involves both client and server hashing. They do this because they use your password as the basis for creating your encryption key and they never want the server to know your encryption key. So what they do is:

Many rounds of PBKDF2 on client to create a strong encryption key.
One round of SHA-256 to turn encryption key into what is effectively your password.
Send password to server. Note that the properties of SHA-256 make it computationally impossible to reverse the password back to your encryption key.
Server performs standard server-side hashing using PBKDF2 and salt.

Basically, the LastPass server does standard password storage but what it gets as a "password" is the result of client-side hashing.


How do I block Chrome extensions from making network requests unless whitelisted? I see extensions such as uMatrix that allow you to whitelist requests for URL patterns. How can I have the same functionality but, instead of for websites I visit, for Chrome extensions I have installed?

Have you tried this extension ? https://chrome.google.com/webstore/detail/chrome-apps-extensions-de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc
It's made by Google itself and seems to have the functionnality you need. Since I have Firefox I can't test it myself, but let me know if it works.


CMP - Simply get certificate, knowing some information My company is migrating its CAs. Actually, it's Unicert CA using a UPI client. But in the future, they want a CA supporting CMP (it should be EJBCA, I'm actually testing this).

So I analyzed the CMP and CRMF protocols. I can see all the basic stuff like register, revoke, change key pair. But how to simply retrieve information? I mean, for example, how to get the already generated certificate if we know the serial number ?

The actual implementation we have can do it. BTW, it doesn't use CMP. But strictly using the CMP protocol, is it possible to do it ?
I can easily find workarounds here, but I'm trying to be as close as possible to the actual implementation we have.

There is no obvious standard for retrieving already generated certificiates using CMP. In RFC4120 there is the PKI Information Request, https://tools.ietf.org/html/rfc4210#section-6.5, but this is rather generically described without standardized methods for getting this information.
EJBCA does not support retrieving this information through CMP.


Deleting a Java Object securely I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be feasible for the String objects.

Now on BlackBerry which is Java based, I was not able to find an API to handle data as character array but i am obliged to use String. Thus my question, in case I store a password in an object, how can I securely delete it?

Actually you cannot really "safely erase" an array of characters in Java. Java does memory allocation through a garbage collector, a tricky piece of software which, in practice, will move memory objects in physical RAM on a regular basis. So what you think as "a char[] instance" will be copied in several places, and the erasure will physically happen only in one of those places.

In that context, "secure deletion" cannot really exist in Java. If you use Java, you must ensure that the usage context is such that secure deletion is unnecessary: "secure deletion" is needed mostly when the OS may allocate non-zeroized RAM blocks (thus an application may get excerpts of old RAM from other applications), or in the presence of virtual memory (parts of the RAM being copied to a hard disk). I guess that these do not apply to a BlackBerry, so simple String instances ought to be fine.

An other way to state it is that if String instance are not fine for passwords, then you have bigger security issues than mere password leakage. After all, you use a password to protect access to some data, so if you need "secure erasing" for a password, then, quite logically, you would also need "secure erasing" for the protected data as well, and everything you do with it.

(One can guess that I am not a big fan of the concept of "secure erasing".)


In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys? Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified below - thank you @bonsaiviking) is that an active MITM can alter the TLS negotiations between the client and the server to only offer to the server EXPORT strength ciphersuites. This tricks an accommodating server into choosing an EXPORT strength key. The MITM then ensures that the reply back to the client looks normal, but still uses the lower strength key. Vulnerable clients accept this lower strength key even though they didn't offer that option during the negotiation. This clearly isn't secure enough, and can therefore be bruteforced.

How come these keys are still active in so many devices and services? Especially Apple devices - we all know how they often cut loose dated technology quickly. I would have thought once the export of crypto from the States was relaxed, these weak keys would have been pulled much quicker than appears to be the case.

Further reading: Blog post by Matthew Green, the official website (appears down as I post), Hacker News thread.

While your question, why are there so many servers offering export ciphersuites, is valid, your description of the problem is in error. FREAK is:

a class of client-side bugs
exploitable due to server-side configuration.

The vulnerable devices you list are not configured to use export-grade ciphersuites, but they can be tricked into using export-grade key lengths with standard ("full-strength") ciphersuites. The scenario works like this:

Vulnerable client sends plaintext ClientHello message containing supported ciphersuites, none of which is EXPORT.
Attacker intercepts the ClientHello and replaces the ciphersuites with EXPORT ones.
The server selects one of the EXPORT ciphersuites and responds with the reduced-length export key. If the server is not configured to use EXPORT ciphersuites, then it issues a fatal alert instead, and the connection stops.
The attacker modifies the ServerHello response to replace the EXPORT ciphersuite with the non-export version, but leaves the weak key alone.
Because of the bug, the client accepts the export key and negotiates a weakened TLS connection.

There are obviously more subtleties involved, and Matthew Green does a great job of explaining them, but these are the basic facts.


Is my Postfix and Dovecot configuration secure? Today I set up my first server with Dovecot and Postfix.

These are excerpts from the configuration files:

Dovecot:

disable_plaintext_auth = yes
ssl = required
ssl_prefer_server_ciphers = yes
ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
ssl_protocols = !SSLv2 !SSLv3
ssl_cert = /etc/dovecot/private/4096-rsa-public.crt
ssl_key = /etc/dovecot/private/4096-rsa-private.key
login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k"
protocols = imap sieve

Postfix:

tls_ssl_options = NO_COMPRESSION
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
tls_preempt_cipherlist = yes
; Outgoing connections
smtp_use_tls = yes
smtp_tls_security_level = may
smtp_tls_protocols = !SSLv2, !SSLv3
; smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
; smtp_tls_mandatory_ciphers = high
smtp_tls_cert_file = /etc/postfix/private/4096-rsa-public.crt
smtp_tls_key_file = /etc/postfix/private/4096-rsa-private.key
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_loglevel = 1
; Incoming connections
smtpd_use_tls = yes
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3
; smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
; smtpd_tls_mandatory_ciphers = high
smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
smtpd_tls_dh1024_param_file = /etc/postfix/dh_2048.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_cert_file = /etc/postfix/private/4096-rsa-public.crt
smtpd_tls_key_file = /etc/postfix/private/4096-rsa-private.key
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_received_header = yes
smtpd_tls_loglevel = 1

Can you spot any missing settings mandatory for security ?

IMAP connections should be as secure as possible, SMTP connections should also be as secure as possible but I don't want to reject mails from senders who don't support TLS.

Regarding encryption, your postfix and dovecot configuration was fine enough to send and receive email, especially encryption-related configuration. Your SSL configuration was safe enough to secure the email transportation when travel from and to your server.

Anyway, in the question you don't specify how your MTA handle mail client. For that, you should force mail client to go through encryption. For postfix, set smtpd_tls_security_level = encrypt for submission port should be enough.

You still half way to securing public mail server, as earlier specification of  SMTP wasn't designed for security. You need think about securing from malicious email

Regarding outgoing email, you need to secure mail server so (1) it won't become open relay (fortunately your comment about smtpd_recipient_resctriction indicating that you won't become open relay). Another concern is (2) spammer hijacked your user/password (via phising or weak password) and start to pump out spam from the server or (3) the web/server was compromised and spammer treat your mail server as spam bot. Many question on SO and SF deal with this stuff :)
Regarding incoming email, the user should be kept safe from spam, malicious email, phising and another threats who use email as vector. You can setup SPF, DKIM add-on to postfix to help it battle against email spoofing. Spam and virus can also be filtered via external content filter from postfix.


User authentication + database encryption with same password I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES encryption key from a more simple user password.

I also want to be able to tell the user if he is using the correct password when logging in. Speed is not an issue: the program will run on the user's device and not on a multi-user server.

So summarizing: I want to use one password both to encrypt data and authenticate users.

I can see two options for doing this:

Generate a SHA-256 hash from the scrypt output, store the hash in StoredHash and check if SHA256(scrypt("supplied password")) == StoredHash.
Encrypt the scrypt-output of the password using AES in EncryptedScryptOutput using the scrypt-output as the key and store that, and check if scrypt("supplied password") == AESdescrypt(decryptionKey = scrypt("supplied password"), EncryptedScryptOutput).

I (think I :-) am aware of the technical way this should be done, using salts and/or initial vectors. My questions are: Am I correct that both versions will be secure? Would you say that one option is better than the other, and why?

Thanks!

As far as I can tell, your scheme is this:

Compute scrypt(pass) and store it as the authentication key in your database.
Compute sha256(scrypt(pass)) and use that as your data encryption key.

The problem with this technique is that an attacker with access to your database can simply compute the SHA256 hash of your scrypt hashes to gain the encryption keys.

A better solution would be to use a second scrypt hash as your data encryption key, with a surrogate key to facilitate easy password changes:

Generate two salts (s1 and s2) and store them in plaintext.
Generate a cryptographically secure random key k - this is our surrogate key.
Compute scrypt(pass, s1) and store it as the authentication key in your database.
Compute scrypt(pass, s2) and xor k with it. Store this value in your database.
Use 'k' as your data encryption key.

When decrypting, you compute scrypt(pass, s2) and xor it with the stored key value to get the original value of k back.

This protects you against cases where the database is breached, and allows you to change passwords by computing the original value of k, then xoring that with scrypt hash of the new password and salt. Keep in mind that if a user forgets their password they will not be able to recover the data.


Is there any security difference between login via iFrame, Pop-up, or redirect? There seems to be a number of techniques to authenticate a person on the web. Most commonly there are

Javascript Pop-ups (Google, Firefox Persona, Disqus, etc)
HTTP Redirects (OAuth, Facebook)
IFrames, with sandboxing set as needed.

Question

Is one approach more secure than the others? What are the tradeoffs?

Come to think of it, I think Facebook may offer both OAuth Redirects and a JS based popup.

Iframes are dangerous as the user has no easy way of verifying that the embedded page is indeed, say, facebook.com and not some phishing page. Depending on how it is set up, allowing embedding might also enable clickjacking.

Using a popup versus redirecting the current page is just a matter of user experience and has no impact on security.


Problem with the security certificates on parents' WiFi I went to my parent's house for Easter and my cousin asked me about why he started getting certificate errors on his iPhone. I didn't think much of it until I went to show my family an Android application I've been working on and suddenly ran into similar issues.

Some background:

The application is using Auth0 to handle OAuth login and I'm using my Google account to login. When attempting to login, I get the warning above with the error:

  There are problems with the security certificates for this site.

When I clicked View Certificate, I get the following for itunes.apple.com:

And when I click View Page Info, you can see the page is definitely accounts.google.com:

When I run the application, not on their WiFi, it works fine (no certificate errors) and verified my cousin stopped getting the certifcate errors as well.

What is going on here? Any ideas on how to troubleshoot this further? Their router is an old Linksys WRT160N which hasn't had firmware updates since 2009 so maybe it got hacked?

Update to include nslookup:

That particular router was found vulnerable in 2014 for the MoonWorm. It's possible you have fallen victim to someone who's trying to phish credentials or credit card information from your home.

I recommend verifying your payment details, changing passwords and replacing the router.