PBKDF2 hash over PBKDF2 key derivation Imagine an app where any user provides a username and a password. This password is used to generate a 'strong' encryption key (for AES encryption) with the PBDKF2 key derivation algorithm. This encryption key is used to encrypt user data in a database.

Now, to identify a user and grant him access to his encrypted data, I used to hash its encryption key with the "SHA-512" algorithm and then compare it with the stored hashed key. I want to upgrade my strategy and better protect my app against brute-force attacks.

Since PBDKF2 is also a hash algorithm, my two questions are :

is it safe to use PBDKF2 to hash (and then store) an encryption key that has been generated by the same PBDKF2 algorithm (schematically PBDKF2.hash(PBDKF2.derivate(password)))?
is it equally safe to store the encryption key encrypted by itself (schematically AES.encrypt(input = key, key = key) ) instead of the key hash?

Hashing a derived key is not a security issue because cryptographic hashes are one way. There are two ways people could attack the derived key.

Guess a password, process it using PBKDF2, SHA-512 hash the result and see if it matches
Guess a derived key (128 to 256 bits), SHA-512 hash it and see if it matches

The amount of work performed per guess with method 2 is much lower, but the probability of being successful within n guesses is only n / 2128. Since the total amount of work is n times the work-per-guess, method 1 is always less work in practice. (Method 2 is never practical because brute forcing 128-bit or larger keys isn't currently possible.)

I estimate that typical "good" user chosen passwords have 30-40 bit strength. So you can expect them to be guessed within 240 guesses instead of 2128. You would only "break even" if PBKDF2 were made to cost 288 times SHA-512. No user, legitimate or not, would be able to login if that were the case. It would just take too long.

(Not that "breaking even" matters in practice. Method 2 is already out of reach for real world adversaries so it's a strategy that no one is going to bother with. People's passwords are the weakest link in the chain. Not an algorithm as reliable as SHA-512.)

Another issue makes it possible to bypass the second level of PBKDF2 brute-force protection. Hashing the derived key and comparing it to the stored hash is not the only way for a hacker to determine if they have the correct derived key.

If they have access to ciphertext, then they instead could perform trial decryption to get a good idea of whether or not they have the correct key. It's not even required to decrypt all the ciphertext. A few bytes should suffice.

Alternatively, they could use the message authentication algorithm. (Encryption without authentication is a really bad idea. You do use an authenticated-encryption mode, right?)

Any place where key material is derived from a user's password provides a potential pathway a hacker can use to verify whether a guessed password is correct. Using any one of these avenues gets the person trying to crack a password the same answer. so they are going to use whatever option is easiest.

This is another weakest link in the chain situation. Whether you use PBKDF2/SHA-512 or PBKDF2/PBKDF2, expect that your level of brute-force protection is only as strong as the first layer of PBKDF2.

PBKDF2/SHA-512 can actually be made stronger than PBKDF2/PBKDF2. If you have only one second to budget to verifying a password, then it is preferable to put nearly 100% of that one second into the first PBKDF2.

Using SHA-512 for the second-level check lets you do this because its run time will be near-instantaneous compared to PBKDF2. (But again, a 128-bit key (or stronger) is not brute-force-able because the actual cost of SHA-512 is non-zero and 2128 SHA-512 evaluations adds up.)

If you instead let the first layer of PBKDF2 run for 0.5 seconds then ran the second layer for 0.5 seconds, then you'd really only have half the brute force protection of what you could otherwise afford.


Upgrade-Insecure-Requests as an alternative for HSTS I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header.

So does the following line in the request fully alleviate the need for HSTS?

Content-Security-Policy: upgrade-insecure-requests;

From MDN:

  The upgrade-insecure-requests directive will not ensure that users
  visiting your site via links on third-party sites will be upgraded to
  HTTPS for the top-level navigation and thus does not replace the
  Strict-Transport-Security (HSTS) header, which should still be set
  with an appropriate max-age to ensure that users are not subject to
  SSL stripping attacks.


What should you do if you catch encryption ransomware mid-operation? You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and writing a lot to the drive. You immediately do a web search for the process name, and find that it's the name of a ransomware program. A news story also comes up, telling you about how a popular software distribution site was recently compromised and used to distribute this same ransomware. You recently installed a program from that site. Clearly, the ransomware is in the process of doing its dirty work.

You have large amounts of important data on the internal drive, and no backup. There is also a substantial amount of non-important data on the drive.

This question's title says "mid" operation, but in this example we have not yet investigated how far the ransomware might have actually gotten in its "work."

We can look at two situations:

You want to preserve as much of your data as possible. However, paying any ransom is out of the question.
If possible without risk, you want to know whether the important parts of your data are actually encrypted and overwritten. You also want to try and extract as much of your data as possible without making things worse. You would hate to pay a ransom. But certain parts of the data are so important to you that you would, ultimately, as a last resort, like to still be able to pay for a chance to get them back rather than risk losing any of them.

Step by step, what is the ideal thing to do in situation 1 and 2? And why?

Note: This is hypothetical. It hasn't actually happened to me. I always keep offsite backups of my important data and I've never been affected by ransomware.

Hibernate the computer

If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the malicious code may be running inside explorer.exe), and we need to dump it now.

Hibernating the computer is a cheap way to get a memory image¹ Then it could be mounted read-only on a clean computer for

a) Assessment of the damage inflicted by the ransomware

b) Recovery of unencrypted files²

c) Forensic extraction of the in-memory key from the malicious process, other advanced recovery of the files, etc.

Note that by read-only I mean that no write is performed at all, for maximum recovery chances. Connecting normally to another Windows system won't provide that.

For (c) you would probably need professional support. It may be provided free of charge by your antivirus vendor.

Even if you don't manage to recover all your files or you are told it is impossible or too expensive, keep the disk with the encrypted files. What it's impossible today may be cheaper or even trivial in a few months.

I recommend that you simply perform the new install on a different disk (you were going to reinstall anyway, the computer was infected, remember?), and keep the infected one -properly labelled- in a drawer.

--

As for the second question, where you really want to pay the ransom I'm quite sure the ransomware author could give you back your files even if not all of them were encrypted. But if really needed, you could boot from the hibernated disk after cloning it, and let it finish encrypting your (now backed-up) files…

¹ NB: if you didn't have an hibernation file, this may overwrite plaintext versions of now-encrypted files that could have been recovered (not relevant for most recent ransomware, though).

² Assuming they are not infected…


Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work? I am developing my site using server side sessions using redis as backend for saving the session.

Now the issue which is bothering me is of user leaving the website without logging out.
I mean user simply closes the browser which causes the cookie to be deleted.

Now session of that user still exists on the server and will not be used again as new login requires creating a new session due to security reasons. To avoid the case where hacker steals the old cookie and use it after user login again with same old session id.

In essence user leaves the website without explicitly logging out and his session will be deleted after certain time limit of inaccessibility. I am thinking time limit of 30-60 minutes. Also with every new request from user his cookie will also be updated  to keep track of when the user last time accessed the site.

But nowadays, people let site remain open for long time without accessing it. For example users open facebook and gmail in new tabs and forget about them for 2-3 hours and still they are not asked to login again.

Is letting a 2-3 hours old cooke access the session secure? My concern is someone steals user cookie and use it 2-3 hours later.

Thinking on this topic has also forced me to question how facebook manages security if user can use a session where they are not accessing it for long periods of time and still they remain logged in.
Or is it not secure for me to keep logged in when am not accessing the site session for longer period of time?

It can be the case also there is some pinging mechanism using which sites keep track of user having their site open in a browser and when browser closes they are notified and can work accordingly.

My website is a social network and needs all those security and usage features which a social network may need.

I am new to web security and web development in general and may be the case where my above questions may seem a little basic. If you feel that is the case kindly point to some good reference where I can read and find answers to my question.

It's a tradeoff between usability and security. Internet banking will close connection after a very short time of inactivity, and the sites you mentionated (gmail, facebook, etc) will not logout because their users would be upset to login every time.

Your decision will be much more based in this security x making users unhappy.

Technology about it: I'm not sure that a javascript would capture all movements the user makes in his computer, even if they are outside your web-page.


Is it okay for websites to send passwords as plain text if they hash them when they are stored? I was logging into a website and checking out the network requests, and in the network tab I saw the following:

method: "Login"
params: {username: "username", password: "password1234"}

With my username and password being sent in the request payload as plain text. While I don't know how its being stored in the DB, I log into this site potentially 5-6 times a day, and the fact that it sends my password as plain text was a bit troubling.

I read in this answer (even though its a bad answer with -6 score) that

  it is more secure to send passwords encrypted over the network, and store them in plaintext on the database, than sending the passwords in plaintext over the network and store them encrypted on the database.

Emphasis mine.

Is there any truth to this at all? I have changed my password on the site to ensure its not a common password, but is there anything I should be worried about?

The site probably (hopefully) uses TLS via HTTPS to encrypt the traffic between your browser and the webserver. Even with encryption, the browser displays the network traffic in cleartext since it has (obviously) acces to the traffic before it is encrypted and after it is decrypted.

You can find out more about the use of encryption by looking at your URL bar and looking out for a green padlock (in most browsers).

Encrypting the credentials via HTTPS and storing the password hashed (plus points for salt & pepper) with modern hashing algorithms is seen as reasonable secure. Nevertheless, there are more and more evolving techniques for authentication. Hashing the password on the client side and saving this hash as it is is a bad idea (described in Client side password hashing).

EDIT: I've just seen the comments, weren't there when I was writing this, sorry for duplicating.


Why CA are mandatory to trust our public key? What if we publish the public key via DNS like in DKIM? Why we need trusted third party to sign our public key to be trusted? we can publish it via DNS and it will be trusted. Isn't like that work DKIM? Why we don't do same thing for HTTPS?

DNS itself is not secure.  DNS allows for relaying, so any DNS server that is in the path that a client uses to resolve the domain could lie, or the DNS request itself could be attacked via a MITM.  DNSSEC attempts to correct some of this by signing DNS records so that only the owner of a domain can post DNS records authoritatively, but that only works if a) the DNS servers use DNSSEC and b) the attacker isn't able to attack in such a way that the domain is processed as if it didn't have DNSSEC.

Additionally, even if DNS was secure, third party SSL signing serves a different purpose for trust.  A CA's signature on a certificate means that someone other than the person issuing the cert has verified the details.  If I go to mybankphishingsite.com I don't know if they are actually my bank or not.  If they just post a certificate on their DNS (which they rightly control as they registered the domain) then they could say they are My Bank Corp.  With a CA signing the cert however, the details have to be verified.

When they ask for a cert that says they are My Bank Corp, they have to provide documentation that they actually are My Bank Corp, so mybankphishingsite.com can't get a cert that says they are My Bank Corp, but myactualbank.com can get one.  This lets me, as a user, know that I can trust myactualbank.com because a trusted third party has verified who they are.


What is Open Resolver Project and how does it solve DNS reflection attacks? What is Open Resolver Project and how does it give a solution for DNS reflection attack?

I also read that Open Resolver Project follows BCP38. What is BCP38?

The Open Resolver Projects tries to find recursive DNS servers which have no access lists to restrict which clients can use the nameserver. Nameservers like these can be used for DNS amplification attacks because they can be mislead using spoofed IP addresses for DNS queries. The attacker forges the source of the query to the address of its victim. The answer (which can be quite large, especially when DNSSEC is involved) will be sent to the spoofed address. When a large number of these spoofed requests are done simultaneously from many networks, the amount of traffic caused by answers will be large, possibly large enough to cause a Distributed Denial of Service Attack (DDoS).

BCP38 is a best practice in network engineering which can be used to stop spoofed requests within the network of the attacker. It basically says that no traffic should leave a network coming from IP addresses which are not assigned to that network. This can be done using techniques like access lists or reverse path filtering (RPF).

Open Resolvers are just one (very effective) way to exploit networks which do not implement BCP38 for performing DDoS'es. Other services are used as well, for example NTP seems to be quite popular in the last few weeks. Allowing queries on resolvers only from trusted source addresses (closing down the resolves so to say) is a good thing, but it's just stopping one type of attacks. Implementing BCP38 throughout a network is a much more effective solution, since it stops many more types of attacks.


Securely connecting a wifi client to an AP using a generated password I have two embedded systems, one acting as an AP with WPA2 and the other as a client. The idea is for a user to connect their client to the AP without any setup, so the authentication will all be handled automatically. The user will likely have multiple APs in their possession to connect to, but we intend to only connect to one AP at a time.

Is there a secure way of connecting these two devices to one another via wifi without the user entering a password? It might be ok to say "screw it" and rely solely on encrypting network traffic, but allowing an attacker onto the network would be more dangerous than not, right?

My initial thoughts are using one hardcoded password everywhere or basing the AP password on its SSID, neither of which are appealing.

Edit: I should mention, none of these devices will be connected to the internet

It sounds like 802.1x over WPA2 is the way to go. I won't say that this is necessarily easy to configure, but it may fit your requirements.

You'll need a CA. This could be your AD server for simplicity, you're enterprise might have one already, or you could designate any server you trust sufficiently to be an internal CA (if you're really a martyr, you could even use a public CA so long as you don't mind it taking weeks to add new clients and racking up thousands of dollars in fees). This will need to sign certificates for your RADIUS server and clients.

You'll need a RADIUS server. This can be the NPS service in Windows Server, FreeRADIUS on RHEL, pfsense, even some routers can do it (But if you make your router into a RADIUS server, I wouldn't admit it on the InfoSec Stack Exchange). This will need a signed cert to validate its identity to your clients. This will serve to authenticate your clients, it can be configured to do so by username/password, or it could do so by validating the client possesses a valid, signed cert. In some cases, you can configure the RADIUS server to check an LDAP directory (such as AD, IPA, openLDAP, etc.) which associates each identity (certificate in this case) with a set of groups. These groups could control which networks the user is authorized to connect to.

Your APs will need to be set to use WPA2 Enterprise, and configured to route authentication requests to the RADIUS server. Configuration varies wildly based on the make of your AP.

Your clients will need to have a signed cert loaded onto their system and configured to provide that cert as 802.1x authentication for the WiFi connection to your AP(s). Again this varies wildly depending on the device and configuration is left as an exercise to the reader. This is using client-authentication TLS over EAP and is thus usually decorated as the EAP-TLS option in many configs that I've seen.

Anti-Patterns

The issues with this depend on your environment and risk-acceptance. But these concerns should be addressed.

Getting certs to the client
You'll need a way to get certificates onto the client device. In a passwordless environment, that certificate allows network access and must be protected like a password and thus a secure method of transmission must be devised (in this regard, it might undermine the whole reason you're considering this option).

For laptops, if you can wire it into the network, do some automated validation (MAC Address, Active Directory credentials, or whatever you devise), then you could load a signed cert onto the system (or have the system generate the cert and send a CSR to your CA).

But if your environment has phones/tablets, the problem becomes trickier. Options might be transferring certs by USB flash drives connected to OTG connectors (make sure you sanitize that drive after each time you connect it to a yucky user device). Perhaps you could provide an easier-to-access WiFi network on its own isolated network/VLAN, this could use a single PSK that you rotate as needed, and on this network all you can do is validate your device and be issued a cert. These options come with their tradeoffs, send them through your own risk analysis.

Cert Compromise
The other concern is that certificates get compromised. Most likely this would only happen if a user's system is owned, but there could be a few other scenarios where a valid certificate is leaked. If you can identify this compromise early, you can have your RADIUS server validate against OCSP or a CRL. To combat against unknown compromises, you could set the certificates to expire quickly, but you have to have an infrastructure set up to automatically renew and install users certificates and ensure that most users connect at least once before their certificates expire. The best idea is probably a little bit of both and locking down network resources so that being on the network doesn't necessarily give you access to anything (i.e. don't use the same client certificates to authenticate to other network resources).

P.S.

This is not a quick and easy set-up, but it can be a robust one if you find a good level of trade-offs between providing access to users and protecting access from attackers. And it can allow you opportunities to expand and add additional functionality once you become more comfortable with your implementation.


Is it really secure to store API keys in environment variables? This site says it is best to keep API keys in environment variable out of the code. And here

Storing Credentials Securely
You should take great care to ensure your credentials are stored securely. If someone obtains your api_key or an access_token with the send or all permission, they will be able to send all the bitcoin out of your account.
In particular, you should avoid storing these credentials in your code base (which gets added to version control) or in your database unless you have encrypted them securely. Separating credentials from your code base and database is a good practice.
API key access is turned off by default on all accounts. So if you decide to do an API key integration, you will need to enable it first and take the necessary steps from then on to store it securely. You can always regenerate your API key (or disable it) if you feel it has been compromised.

However, whenever a program crashes, it often sends the environment as part of the crash report:
https://lists.launchpad.net/openjdk/msg01149.html

Environment Variables:
...

So... which is it? I don't see why storing keys in the environment is any safer than the source code. If someone gets to the system, they have access to both.

If your computer is able to use the API without a password, then the information has to be stored somewhere on your system.  The point of storing it in the environment variable is to make it so that you don't check it in to the version control along with the source, however really, the ideal would be to use something like a HSM or TPM to store the API key in an encrypted manner that you can retrieve programmatically or store it on disk encrypted with the account credentials for the service or application that uses it.

I personally would be hesitant to use environment variables, but if you are only worried about accidentally revealing the key (and not local security for someone with access to your box) then it is one option for how to separate the code and keys, just not the best one.


HMAC secret key for securing communication - how to keep private on DB I have a mobile app that communicates to server over HTTPS. To authenticate the client and to make sure its who I believe it is, I return upon successful signup (apart from the username) a secret API key (saved locally on the app). Every private method call following successful signup is SHA256 using the [method_name + parameters] with the API secret key.

My question is this:

How do I keep the secret API key safe on server side DB?

I mean, I need it in plain text so I can sign each request parameters with this secret key to make sure the signature matches that sent from the client, so if it is kept on server db as plaintext then any breach of usernames + secret key combination will be horrendous.

You need to store the secret key in encrypted form in the DB so that even if the DB gets compromised, your key is in encrypted form and is of no use to the attacker unless it gets decrypted. In addition, you need to have a mechanism using which your key gets decrypted on the fly whenever you need to use it.
Added
DB stores your data and  your application logic/code is separate from the DB storage. Your secret key will be stored in DB but used in application logic/code. It should not be hard coded in your application logic otherwise you won't be able to change it later, so you need to store it in DB. However, DB can be compromised so you need to store it securely. For securing the key you need to store it in encrypted form and decrypt it on the fly. But for applying this security(encryption/decryption) you need another key(or keypair) which also needs to be secure. One method of securing that key is that instead of using a well-defined fixed key you can use consider some parameter for example, user's date of birth or user's account creation data etc. (any parameter whose value can vary for each user, but can remain constant atleast for some time for a particular user). Take the value of that specific parameter, apply some transformation function on it and use the resultant value of that transformation as the key (you can use it directly as your secret key or the key needed for encryption/decryption of secret key). Your transformation function is the part of application logic and that parameter is stored in db. In case your db gets compromised, the transformation function will still not be exposed. In case your application logic/code gets analyzed, your basic parameter for key generation will not be available. In this way, you will be able to keep your system secure unless the attacker has access to both the db (for key generation parameter) and your application logic/code (for transformation function) for getting the knowledge required for encryption/decryption of your secret key.
Hope it explains your query.


Remove a privilege from a Windows admin account : good or useless idea? In order to protect a Windows administrator account from attacks such a Pass-the-Hash and other Token Passing tehcniques (e.g. via Incognito tool), can you tell me if it is a good idea to remove the privilege "SeImpersonatePrivilege" on which Incognito rely on ?
If this privilege is removed, it should be impossible to impersonate a token, right ?
(of course we assume the admin does not need this privilege in his tasks).

On the other hand, a malware with admin privileges can call PrivilegeCheck and then add the "SeImpersonatePrivilege" privilege to the admin account.

That's why I am asking if removing SeImpersonatePrivilege is a good & strong idea ? Or useless ?

Thank you.

On the whole, as long as Administrator has sufficient privileges to do his administration tasks, then he can more or less directly take full control of the machine. For instance, any user who can tap into kernel memory can alter the tables which define his own privileges, and give himself all possible privileges.

Removing a specific privilege may help only in the case that some malware runs on the machine and trips on the lack of privilege, even if putting it back would be easy. This assumes that installed malware is mindless. Moreover, if malware may break on the lack of SeImpersonatePrivilege, then non-malware software may equally break.

This is equivalent to putting a bear trap in your living room. A potential burglar, groping in the dark in search of your valuables and unaware of your cunning ambush, might trigger the trap and be incapacitated. However, this works only as long as burglars do not adapt: if too many people put bear traps in their living room, then burglars will learn to use a torchlight to see where they are walking. Moreover, no bear trap would change the disturbing fact that a burglar did enter your house, and can still enact considerable mischief without stepping into the living room. Finally, the trap may backfire: you could also inadvertently walk into your own trap.


Testing Web Application Firewall Configuration (ModSecurity) What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i  resolved by deleting many of the rules from the core ruleset. Now that i have deleted some problematic rules how can i now make sure that my configuration is still secure.

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack.

So you need to have an idea of what attacks you're trying to prevent so that you can test those. Are you attempting to guard against malformed HTTP requests? Try some. Are you trying to counter invalid UTF-8 sequences? Test it. Is there are a specific application vulnerability that you're trying to block at the WAF as a temporary measure because you can't get the application fixed yet? (This is what WAFs are really good for.)

(Are you trying to guard against application-level SQL injection by filtering out the word 'SELECT'? Then you're pretty much wasting your time. There are a lot of rules like this in the mod_security CRS which are pretty much entirely bogus.)


Safety of publishing last 4 credit card digits in age of fast computing? How safe is it to make public the last four digits of a credit card?

Credit card numbers have a specific format.  Digits tell you what type of institution issued the card, what bank issued the card, the account number, etc.  The whole 16 digits must conform to the Luhn formula, a simple mod 10 checksum.

Attackers have lists of valid first four digit numbers (which can be narrowed down using other information often provided with last 4; eg country).  Is it feasible for them to brute force matches to these first 4 and last 4 digits using Luhn and fast computers?

Creating Luhn valid credit card numbers is not difficult, if you need them they're available here amongst other places.

The trick for the criminal is tieing up the credit card number to the rest of the data to create a fraudulent transaction (CVV, expiry, name, perhaps address).

Even if I have the customers name, expiry date and last 4 digits, brute force shouldn't be a problem as it's an online brute-force and if you start iterating through valid numbers with a credit card processor, I'd expect that you'll get blocked very quickly by fraud detection mechanisms..


How does PHP's password_hash() BCRYPT cost factor translate into cracking computation times I am trying to fully understand the relationship between BCRYPT's COST factors and how much more time it would take a machine to crack a password with PHP 5.5's password_hash()

The encryption times I observed on an average server for password_hash() are:

COST 14 takes 1.23s to 2s
COST 13 takes 0.6 to 1s
COST 12 takes about 0.3s
COST 11 takes about 0.15s
COST 10 takes about 0.08s
COST 09 takes about 0.04s

Are the number of rounds linearly proportional to the time taken?
Is the computation time required to crack a password on the same linear scale or exponential like?

e.g. If a COST 10 hash took 1 minute to crack. How much time are we looking at with COST 14 for the same password? I assume this would vary depending on the password entropy. So let's take an average fairly weak 10 letter password such as "EasyCrack1" as basis for the reasoning.

As documented rather indirectly in the page for the crypt() function, the cost parameter is the base-2 logarithm of iteration count, or to put it another way, each +1 increase to cost represents a doubling of the number of iterations.

If a cost-10 hash takes one minute to crack, a cost-14 would take 2^(14-10) = 16 minutes.  Cracking a cryptographic hash like bcrypt consists of guessing what the password is, hashing it, and seeing if the hashes match, so the difficulty of cracking increases proportionately with the hashing time.  Just like increasing the cost by 1 doubles the hashing time, it doubles the effort involved in cracking the hash.


Why are people saying that the X Window System is not secure? Why are people saying that the X Window System is not secure? The OpenBSD team succeeded with privilege separation in 2003; why didn't the "Linux developers" do this?

To be clear: What security design flaws does X have? Why don't the Linux developers separate privileges in X?

This is a poorly phrased question.  For instance, it does not define what is meant by "secure".  That makes it harder to provide a useful answer.
Here are three possible security concerns, and how X11 fares:

Isolation between apps.  X11 does not isolate apps from each other.  If one app is malicious, it can log all keystrokes, tamper with other apps windows, steal the contents of copy/paste buffers, inject keystrokes into other windows, etc.  (Windows has similar security properties.)

Preventing privilege escalation. X11 apps run as a non-root user.  However, on most platforms the X11 drivers run as root, so they can access the display hardware.  This introduces the risk that a malicious app might be able to exploit some security vulnerability in the X11 code and use it to become root.  This is a serious risk, because X11 is a complex system with a tremendous amount of code, and all it takes is one security vulnerability anywhere in that code to make a privilege escalation attack possible.  This is indeed a concern.
The question refers to privilege separating the X11 code.  I do not know how easy or hard this is to do, or how effective OpenBSD's attempt is.  However, the aim of privilege separation is to reduce the likelihood of such privilege escalation vulnerabilities.

Enabling remote attacks. If I run X11 on my Linux machine, does that make it easy (or possible) for remote attackers to "hack" my machine?  The answer is no.  Remote attackers have no way to access or talk to X11, so running X11 on my machine does not make my machine insecure.

All in all, I would say that X11 does pose some security risks, but they are relatively minor, compared to the risks you are already accepting when you use any desktop OS.  In the desktop world, every app you run already must be completely trusted (since any one rogue app you run has access to all your files and everything, and can ruin your life); X11 does not make this fact any worse.
Therefore, I would not hesitate to use X11, at least not on security grounds.  If you find X11 useful, go ahead and use it.


Is it possible for a successful domain hijacker to fraudulently use the certificate issued to the real owner of the domain name? In other words, while visiting https://www.mybank.com, for example, can I always trust the site as long as I click the padlock in the address bar of my browser and find no problem with the certificate?

No, you can't trust it. It is possible that:

The real site has suffered a compromise of its private key
One of the many certificate authorities whose root certificates are in your browser has suffered a compromise of its signing key
One of the certificate authorities is not following procedures correctly and is issuing certificates that it shouldn't be
There's a bug in the browser or a certificate authority's software that allows an attacker to get a certificate issued that the browser trusts
A government agency has got its own root certificate included in your browser as a trusted certificate authority
There's a zero-day exploit of the TLS protocol

(Certificate pinning is a mitigation for numbers 2, 3, 4 & 5, but requires more knowledge and experience from the user, and is not yet widely implemented, although Chrome has some support for it.)


AES + CBC to encrypt individual local files, fixed IV? I am using AES and CBC to encrypt a local files separately. I don't plan to transmit them over any network.

What are the risks of using a fixed IV for my encrypting application? The only problem I can see, it is that two files encrypted with the same key would have the same starting characters if both plain texts start the same. Is there any other leak of information?

Predictable IVs in CBC mode are vulnerable to chosen plaintext attacks.

In short, there is zero defensible reason to use a static initialization vector. It is a terrible practice and invalidates many of the guarantees provided by your choice of encryption method.

Just don't do it.


School website exposes root FS, where to report? I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can assume this site is hacked?

I'm a bit concerned, as this is an elementary school and it exposes also (I think only normal) pictures of children to the outside world. Should I report this to the authorities, or just the site admin?

I prefer not to share the website url, for the sake of the privacy of the children.

Get in touch with the school by any means necessary. There will certainly be a 'contact us' form on the website; if not, pick up the phone and do them a favour and call them. Even if they are in a different country, VoIP calls are quite cheaper today and I'm sure you can afford the cost.

Explain the situation in good details, making clear that your intention is not to expose anyone's privacy nor to ask for a ransom but that you are doing your duty as a responsible citizen. This is because often non-techie tend to panic and call the police pointing you at the culprit.

If you are able to, offer your advice on how to protect the webserver or explain what should be done so they can independently verify your advice by going e.g. to OWASP or asking questions on Security Stack Exchange.

Offer some degree of personal information e.g. how to get in touch with you, what is your name, and make your e-mail as professional and polite as possible. It is very likely that it happened as a genuine mistake so there is no need to add fuel to the fire that will generate.

Imagine the person on the receiving end is e.g. your grandmother (or any non-techie -- no offense for grandmothers out there). How would you explain it to them? What details would you offer first?

Make sure you cc: other people e.g. the principal, vice-principal etc. so that there can be no "your word versus theirs" if it comes to litigation.

Lastly, if you think the data exposed is really dangerous, make it clear that you will report this to the police if you do not get an answer by XXX days (be reasonable and account for school holidays).


how to get mysql user password? I have a problem.

I am creating a mysql user, and mysql will store the hashed password in user table.
The problem is I dont know how to get the password back.
As it is hashed, we can't get it back.
If the user forgets their password, then we can't get it back.
Then we have to reset the password again.
I thought to save the password in some file, but would that be risky?

The purpose of password hashing is that not even you know the users password. Creating a backup of the cleartext password defeats the whole purpose, because then you have a copy which can get stolen.

Password hashing and telling the user their password are mutually exclusive. When a system uses password hashing, resetting the password to something else is the only possible way to recover a user account when the user forgot their password.


Save to setup localhost.example.com to test wildcard SSL? I have a domain with a wildcard SSL certificate (i.e. "*.example.com").
I also develop using WAMP setups, which I would like to be able to test HTTPS on.

There are several tutorials on how to setup a self-signed certificate on a WAMP, but since I already have a wildcard certificate for my domain, I thought I might as well use that and save me a bit of time.

Is it save (security-wise) to create a DNS record "localhost.example.com" pointing to 127.0.0.1 (and 0:0:0:0:0:0:0:1 for IPv6) while using a wildcard SSL certificate for *.example.com?

It is not a good idea to have a public DNS record which points to a non-public IP address. This can be used to circumvent same origin policies by exploiting issues on internal systems. For more details see http://www.securityfocus.com/archive/1/486606, where a vulnerability in CUPS on localhost was exploited this way.

Probably easier and definitly safer would be to just add a local record in the hosts file of your machine. In this case the impact of any such exploit would be restricted to your machine.


time to crack file-encryption password - more than just iteration I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it takes to check each iteration to see if it works? Wouldn't that make the process take far longer?

I'm most interested in a situation where there is a file which is believed to be encrypted but by an unknown method . (Not so much interested in web password logins). What is the procedure for trying billions of passwords on this file and how would it impact the total time to decrypt?

Enumerating through all possible password, having each one in memory at some point, is an extremely fast process. One can assume that a simple PC will be able to build one such password per clock cycle and per CPU core. So the PC will enumerate billions of passwords per second. If the figures you see are substantially less than that, then they include the password verification cost as well.

The password verification cost is highly variable. Normally, the system which wants to verify passwords stores salted hashed passwords. If the hash function is SHA-1, then an Intel Core2 x86 CPU, running at 2.4 GHz, will be able to try about 12 millions of password per second (and per core): this is what the speed at which the processor will be able to apply the hash function on each password (the password enumeration itself is less than 1% of that cost). My PC is a quad core, so that's 48 millions per second. I also have a not-too-bad Nvidia graphics card which can do password hashing, actually 160 millions per second with a simple raw SHA-1. At that speed, all 8-character passwords (with uppercase and lowercase letters, and digits) are checked in about a fortnight.

Good password storage schemes use iterated or concatenated hashes, in which the password is hashed thousands of times: this makes password verification thousands of times slower, which does not imply a user-noticeable slowdown, but makes the task much harder (namely, thousands of times much harder) for the attacker.


Is using sensitive information to generate a UUID v5 considered secure? Lets say I want to generate a name-based UUID using v5 of the RFC 4122 using sensitive information as the input (for example the password to my bank account). And lets say I give the generated UUID to a malicious user who wishes to reverse it and obtain my password. Given the following about how UUID v5 is generated:

Password and namespace are hashed with SHA-1, which is a one-way function, that is, a function which is practically infeasible to invert
Only the first 16 bytes of the 20 byte SHA-1 hash are kept

The malicious user cannot reverse the UUID to obtain my password. Is this a safe assumption to make? And if so, why does the RFC 4122 specification state "Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example."? Does the fact that SHA-1 is a one way function alone makes it fairly secure, assuming you're not using any data that is susceptible to dictionary attacks or rainbow tables?

Whether this is secure depends on the entropy in the secret.  If your input is a regular password, where entropy is low, any simple hash using your password and other determinstic data is insecure because an attacker can simply brute-force all the possible passwords to determine yours.  This is true of literally all such types of simple hashing of passwords, with or without additional data, whether in a UUID or not, and whether or not truncated.  There are many, many password lists of breached passwords and it's extremely easy to generate many possible passwords programmatically.
If this is a pseudorandomly generated token with enough (e.g., 128 bits or more) of entropy, then this is secure.  Using a cryptographic hash function on a high-entropy secret is secure because it is impossible to efficiently guess the input based only on knowing the algorithm and the hash, since the domain of the function is sufficiently large.


Is is possible to get the TLS implemetation information of the remote server? I am trying to devise a way to find side-channels that reveal exact TLS library (and its version) running on the remote server by adopting similar approach to JavaScript Template Attacks

However, if there exist an explicit channel, then I might not dive into this problem.

Are TLS libraries reveal their implementation information (I don't mean the protocol version) through the messages or during the key exchange?

TLS libaries don't reveal exact implementation details like type or version during handshake, i.e. there is nothing like the (easy fakeable) user-agent or server header in HTTP.


How to track back a dynamic IP address? Is there a way to trace back who was using a public dynamic IP address previously?

Would it be possible to find out the MAC address of the host using the IP address at a given time? (e.g., can you interrogate gateways to find this historical data?)

Or is it as good as gone once the IP address has been reassigned?

Internet service providers do typically keep a detailed record of which dynamic IP address is assigned to which customer at any given time. However, in general they will only give out this information to law enforcement if they receive a court order, to protect privacy.

As for MAC address, the ISP probably also knows the MAC address of the home router used at that IP address (assuming this is a residential Internet connection). However, most likely they will not know the MAC addresses of any devices behind that router, as MAC addresses are only visible within the same LAN. These MAC addresses may or may not be logged by the home router, depending on brand/configuration.


How to decode traffic on a LAN whose SSL certificates are expired We have a campus Wi-Fi at my university and we authenticate through a log in page which to me seems like we are using a RADIUS server.
Every time the page loads my browser warns me that the certificate(s) being used are expired/not valid.
Is there any way to capturer the authentication data (login and password) off the network and decode it since the SSL certificate(s) is expired?

The expired certificate itself wouldn't really allow you to decrypt the data, but it does open up a major "vulnerability", albeit it's more of a social one - most users are now accustomed to ignoring certificate warnings from their browsers.  Thus, if you perform a man-in-the-middle attack most users will probably click straight through the certificate warning, allowing you to capture their data.  They probably won't notice that the warning is slightly different from previous ones or that the certificate is different.


How do Software Development Processes, OWASP CLASP & MS SDL, and Security Standards fit together? How do these three concepts fit together:

The Software Development Process (SDP) indicates the different phases of creating an application. Well known processes are waterfall, spiral, agile, extreme programming, etc.

OWASP Clasp and Microsoft SDL are process to improve the security of applications.
They way I understand it is that they do not replace software development processes, but are to be integrated into them. Would I be right to assume that Clasp and SDL would have to be adapted to the chosen SDP?

And finally there are security standards, like the ISO 27000 family, and various others (NIST, BSI, IEC etc). How do these fit into the picture? Are these bigger frameworks into which the above points are embedded?

As for the ISO 27000 family, it has a list of controls which are part of the management system that you have to specify if they are relevant to your scope of implementation or not. Theses controls specifies the requirements of what you should do but gives you the freedom in how do you do it. Meaning, you have the freedom to inject the requirements of the ISO 27000 into your development processes.

An example of a control is "system acceptance testing" which requires those who are conforming to the standard to have acceptance testing for changes within the current assets. I let it to you to figure where this may fit in your organization processes.

HTH


How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"? I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail.
I am not sure what exactly the author of a particular point meant. Therefore, I have a request to you to explain item 1.1.1 from section V1.1 Secure Software Development Lifecycle Requirements.
Section 1.1.1 reads Verify the use of a secure software development lifecycle that addresses security in all stages of development.
How to verify that this requirement is met by the company?
What documents are required to verify that the company is complying with the SSDLC?
Is it sufficient that all five phases of the SDLC are completed and documented and that security testing has confirmed the security of the solution and/or application?
What is your practical experience to verify that this point has been correctly implemented by the organization?

Section 1.1.1 refers to Proactive Controls Controls C1: Define Security Requirements
I think Section 1.1.1 can be considered as a high-level control for making sure SDLC procedure discovered and documented, and security controls, procedures, and concepts properly defined, selected, and implemented.

How to verify that this requirement is met by the company?

Try to understand your SDLC, what security checks are missing, what checks can be implemented for your use-case?
Have you implemented application security testing concepts that are a must for every SSDLC:

DAST
SAST
IAST
SCA

Is it sufficient that all five phases of the SDLC are completed and documented and that security testing has confirmed the security of the solution and/or application?

Yes and no. From a high-level perspective, yes it is enough. However, from a low-level perspective, it is not. As you have mentioned, have you actually confirmed the security of the solution and/or application? I am not talking about "It looks okay in the paper" approach but "Hands-on" one.

What is your practical experience to verify that this point has been correctly implemented by the organization?

OWASP is somewhere good to start. In my experience, it may be looking good on paper. However, it is not about the solutions that check for the security of a version. It is more about security culture and maturity of controls that implemented. I would try to make sure that every stakeholder understood why are we doing these controls and adopted them.


Is it more secure for SSH clients to use a Private Key (RSA-2048) or a long random password (256 bits of entropy)? What is more secure? An RSA-2048 key or a cryptographic 64 characters-long random HEX password?

I am asking this because as far as I understand, since the RSA-2048 key is a mathematical key, a quantum computer can crack it pretty easily. But, I believe it would be almost impossible for it to guess or crack a 64 chars-long cryptographic  HEX password I have generated randomly.

Quantum computing is not yet a reality, so it is premature for you to invest resources in combating this ahead of the SSH standard.

Assuming identity of the server is verified, both options are equally secure, as they are both stored in a file on the client computer, and both have a sufficiently large amount of entropy.

If you accidentally connect to the wrong SSH server, the Private Key approach is more secure.

Personally, I'd go for both approaches combined. Include a private key, as well as a not-so-long password which you can remember. This way if your Private Key is stolen (e.g. physical access), the attacker still needs your password.


Can I be screen-recorded without my knowledge? Is it possible? If an enemy company's hacker has Remote access to my computer (RAT), can they spy on me and screen record my activities for proof without me knowing it? Can they screen record all my internet activities (writing emails, dealing with companies, Linkedin chat) in the background (i.e. without my knowledge)?
I use Windows 8.1 PC, and unlike Windows 10, the screen recorder app is not built-in.
PS: If I wanted to screen record my activities on my PC, I would have to download an app and run it. That would show on my PC screen (the download, installation and running). Can the hacker execute all this in the background, me being totally unaware of it?

Yes, of course they can, as any software can run in the background without any visual signals in the UI. Especially when a computer is compromised you can't trust anything it shows you, as it could be altered to hide the activities.
However, if the screen is constantly captured and it's sent to the perpetrator, it will probably generate a noticeable amount of outgoing network traffic.


ATM skimming and cloning Is it possible for a skimmer to copy the magnetic strip of a smart card (smart card contains microchip and magnetic strip) and clone the card only using the magnetic strip and use that at an ATM to withdraw money?

It is possible, and it's also possible to change the service code value on the clone card to trick terminals into believing this card never had a chip to begin with (otherwise EMV capable terminals would ask for the chip), however I would expect the banks (who know whether the card truly has a chip or not) to reject magstripe transactions submitted by an EMV-capable terminal.

As pointed out in the comments, tampering with the service code may get detected and declined by the banks but I wouldn't count on it. The best solution would be to either be careful or have a card that rejects non-EMV transactions - I am currently trying out Monzo and they reject such transactions by default, with an option to temporarily allow them on a case-by-case basis, so you may consider trying their card out.


JWT: Why is audience important? JWTs typically include an audience claim.  I've read in many places (articles, code examples, the spec itself) that you must check that the token is intended for you and not another audience.

I'm happy enough to accept that.  I'm not planning on building anything that sends to JWTs to the wrong audience.  But I'm curious as to why it's important to reject it.

You should be able to verify that the token was issued by an authentication server that you trust.  So you have to accept that the claims in there are not fabricated.

The only risk I can think off is if the auth server produced different values, for the same claim, to different audiences.  Other than poor namespacing, I can't think of a reason this would happen.

E.g.

{
  "aud": "foo",
  "roles": ["admin"]
}

Instead of:

{
  "aud": "foo",
  "foo.roles": ["admin"]
}

Perhaps the question could be better phrased as:

  What bad things can happen if I accept another audience's (valid) JWT token?

Suppose I regularly use JWTs from AUTH SERVER to sign in to several several websites, including A and B. Without the aud claim, the JWTs would be identical. This would allow a malicious admin from A to use my JWT to authenticate to B.


How to verify server ownership by public IP (without associated domain)? Company A has a set of servers with public IP address but not associated with any domain. The servers contain confidential information, so company A doesn't want to give access to 3rd party.

Company B has generated confidential security reports for those servers.

How does company B verify that company A owns all those servers before sending those reports?

You can do this, as Google does with their Web Master Tools. See https://support.google.com/webmasters/answer/35179?hl=en

Basically, Company B can require Company A to upload a small file (e.g. text file) with a GUID in it or with a GUID as a file name. Company B then verifies the availability of this file on every of the acclaimed properties.

However, evil Company C could place that file too, to get the reports also. Company B must make sure, they only send the reports regarding the IP, not for all IP's at once.


How can MS Access work with an encrypted field in a Linked SQL Server table? I have an MS Access .accdb file that acts as a front-end to a SQL Server database.  There is a table that holds SSNs in plain text.  We want to encrypt those SSNs in the table so that, the user can input them in plain text, they get encrypted when stored, then when they're read by certain forms/reports, they're decrypted.  What's the best way to go about achieving this?

If there is a solution in VBA, then what about forms where VBA isn't used to update/insert data?  MS Access forms are designed to update/insert data on the fly rather than rely on Insert/Update statements in VBA.  So, if a VBA option is the only option, then I have to basically scrap ALL forms and start over (or implement some kind of hidden field on each form that gets updated whenever the "plain text" SSN field is updated.

Note: I have a feeling that the answer to this question is, "You idiot!  You're using Access!" But, for S&G, let's pretend I work in a place where I have no control over what platform is being used and I have to make due with what I've been given to work with.

You idiot!  You're using Access!  Stop that!

However, if you absolutely have to, a quick Google search shows VBA can call the Windows API, so, per this link, here's some starting sample code (unverified):

'Paste this code in a Class Module, named clsCryptoFilterBox

Option Explicit

Private Declare Function CryptAcquireContext Lib "advapi32.dll" Alias "CryptAcquireContextA" (phProv As Long, pszContainer As String, pszProvider As String, ByVal dwProvType As Long, ByVal dwFlags As Long) As Long

Private Declare Function CryptCreateHash Lib "advapi32.dll" (ByVal hProv As Long, ByVal Algid As Long, ByVal hKey As Long, ByVal dwFlags As Long, phHash As Long) As Long

Private Declare Function CryptDeriveKey Lib "advapi32.dll" (ByVal hProv As Long, ByVal Algid As Long, ByVal hBaseData As Long, ByVal dwFlags As Long, phKey As Long) As Long

Private Declare Function CryptDestroyHash Lib "advapi32.dll" (ByVal hHash As Long) As Long

Private Declare Function CryptDestroyKey Lib "advapi32.dll" (ByVal hKey As Long) As Long

Private Declare Function CryptEncrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long, ByVal dwBufLen As Long) As Long

Private Declare Function CryptDecrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long) As Long

Private Declare Function CryptExportKey Lib "advapi32.dll" (ByVal hKey As Long, ByVal hExpKey As Long, ByVal dwBlobType As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long) As Long

Private Declare Function CryptGenKey Lib "advapi32.dll" (ByVal hProv As Long, ByVal Algid As Long, ByVal dwFlags As Long, phKey As Long) As Long

Private Declare Function CryptGetProvParam Lib "advapi32.dll" (ByVal hProv As Long, ByVal dwParam As Long, pbData As Any, pdwDataLen As Long, ByVal dwFlags As Long) As Long

Private Declare Function CryptGetUserKey Lib "advapi32.dll" (ByVal hProv As Long, ByVal dwKeySpec As Long, phUserKey As Long) As Long

Private Declare Function CryptHashData Lib "advapi32.dll" (ByVal hHash As Long, ByVal pbData As String, ByVal dwDataLen As Long, ByVal dwFlags As Long) As Long

Private Declare Function CryptReleaseContext Lib "advapi32.dll" (ByVal hProv As Long, ByVal dwFlags As Long) As Long

Private Declare Function CryptSignHash Lib "advapi32.dll" Alias "CryptSignHashA" (ByVal hHash As Long, ByVal dwKeySpec As Long, ByVal sDescription As String, ByVal dwFlags As Long, ByVal pbSignature As String, pdwSigLen As Long) As Long

Private Declare Function CryptVerifySignature Lib "advapi32.dll" Alias "CryptVerifySignatureA" (ByVal hHash As Long, ByVal pbSignature As String, ByVal dwSigLen As Long, ByVal hPubKey As Long, ByVal sDescription As String, ByVal dwFlags As Long) As Long

'API error function

Private Declare Function GetLastError Lib "kernel32" () As Long

'API memory functions

Private Declare Function GlobalAlloc Lib "kernel32" (ByVal wFlags As Long, ByVal dwBytes As Long) As Long

Private Declare Function GlobalFree Lib "kernel32" (ByVal hMem As Long) As Long

Private Declare Function GlobalLock Lib "kernel32" (ByVal hMem As Long) As Long

Private Declare Function GlobalUnlock Lib "kernel32" (ByVal hMem As Long) As Long

Private Declare Sub CpyMemValAdrFromRefAdr Lib "kernel32" Alias "RtlMoveMemory" (ByVal hpvDest As Any, hpvSource As Any, ByVal cbCopy As Long)

Private Declare Sub CpyMemRefAdrFromValAdr Lib "kernel32" Alias "RtlMoveMemory" (hpvDest As Any, ByVal hpvSource As Any, ByVal cbCopy As Long)

'constants for API memory functions

Private Const GMEM_MOVEABLE = &H2

Private Const GMEM_ZEROINIT = &H40

Private Const GHND = (GMEM_MOVEABLE Or GMEM_ZEROINIT)

'constants for Cryptography API functions

Private Const MS_DEF_PROV = "Microsoft Base Cryptographic Provider v1.0"

Private Const PROV_RSA_FULL = 1

Private Const CRYPT_NEWKEYSET = &H8

Private Const PP_CONTAINER = 6

Private Const AT_KEYEXCHANGE = 1

Private Const AT_SIGNATURE = 2

Private Const SIMPLEBLOB = 1

Private Const ALG_CLASS_DATA_ENCRYPT = 24576

Private Const ALG_CLASS_HASH = 32768

Private Const ALG_TYPE_ANY = 0

Private Const ALG_TYPE_BLOCK = 1536

Private Const ALG_TYPE_STREAM = 2048

Private Const ALG_SID_RC2 = 2

Private Const ALG_SID_RC4 = 1

Private Const ALG_SID_MD5 = 3

Private Const CALG_MD5 = ((ALG_CLASS_HASH Or ALG_TYPE_ANY) Or ALG_SID_MD5)

Private Const CALG_RC2 = ((ALG_CLASS_DATA_ENCRYPT Or ALG_TYPE_BLOCK) Or ALG_SID_RC2)

Private Const CALG_RC4 = ((ALG_CLASS_DATA_ENCRYPT Or ALG_TYPE_STREAM) Or ALG_SID_RC4)

'constants from WinErr.h

Private Const NTE_NO_KEY As Long = -2146893811 '0x8009000DL

Private Const NTE_BAD_SIGNATURE As Long = -2146893818

'clsCryptoFilterBox constants

Private Const CFB_BUSY = 0

Private Const CFB_READY = 1

Private Const CFB_VALID = 2

Private Const ENCRYPT_ALGORITHM = CALG_RC4

Private Const ENCRYPT_BLOCK_SIZE = 1

Private Const CRYPT_EXPORTABLE = 1

'private property buffers

Private sInBuffer As String

Private sOutBuffer As String

Private sPassword As String

Private sSignature As String

Private lStatus As Long

Public Property Get InBuffer() As String

InBuffer = sInBuffer

End Property

Public Property Let InBuffer(vNewValue As String)

sInBuffer = vNewValue

End Property

Public Property Get OutBuffer() As String

OutBuffer = sOutBuffer

End Property

Public Property Get Signature() As String

Signature = sSignature

End Property

Public Property Let Signature(vNewValue As String)

sSignature = vNewValue

End Property

Public Sub Sign()

'Create a signature for Inbuffer and place in Signature

Dim sContainer As String, sDescription As String, sProvider As String, lHCryptprov As Long

Dim lHHash As Long, lResult As Long, lSignatureLen As Long

On Error GoTo ErrSign

'switch Status property

lStatus = CFB_BUSY

'init Signature property

sSignature = ""

'Get handle to the default provider.

sContainer = vbNullChar

sProvider = MS_DEF_PROV & vbNullChar

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptAcquireContext!")

GoTo ReleaseHandles:

End If

'Create a hash object.

If Not CBool(CryptCreateHash(lHCryptprov, CALG_MD5, 0, 0, lHHash)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptCreateHash!")

GoTo ReleaseHandles:

End If

If Not CBool(CryptHashData(lHHash, sInBuffer, Len(sInBuffer), 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptHashData!")

GoTo ReleaseHandles:

End If

'Sign hash object.

'Determine size of signature.

sDescription = vbNullChar

lResult = CryptSignHash(lHHash, AT_SIGNATURE, sDescription, 0, sSignature, lSignatureLen)

sSignature = String(lSignatureLen, vbNullChar)

'Sign hash object (with signature key).

If Not CBool(CryptSignHash(lHHash, AT_SIGNATURE, sDescription, 0, sSignature, lSignatureLen)) Then

MsgBox ("Error " & CStr(GetLastError()) & " during CryptSignHash")

GoTo ReleaseHandles:

End If

ReleaseHandles:

'Destroy hash object.

If lHHash Then lResult = CryptDestroyHash(lHHash)

'Release provider handle.

If lHCryptprov Then lResult = CryptReleaseContext(lHCryptprov, 0)

'switch Status property

lStatus = CFB_READY

Exit Sub

ErrSign:

MsgBox ("ErrSign " & Error$)

GoTo ReleaseHandles

End Sub

Public Sub Validate()

'Validate InBuffer with Signature and assign Status with result

Dim bValid As Boolean, sContainer As String, sDescription As String, sProvider As String

Dim lDataLen As Long, lDataPoint As Long, lHCryptprov As Long, lHHash As Long

Dim lResult As Long, lSignatureLen As Long, lHCryptKey As Long

ReDim aByteData(0) As Byte

On Error GoTo ErrValidate

'switch Status property

lStatus = CFB_BUSY

'init internal valid flag

bValid = True

'Get handle to the default provider.

sContainer = vbNullChar

sProvider = MS_DEF_PROV & vbNullChar

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, 0)) Then

bValid = False

MsgBox ("Error " & CStr(GetLastError) & " during CryptAcquireContext!")

GoTo ReleaseHandles:

End If

'Create a hash object.

If Not CBool(CryptCreateHash(lHCryptprov, CALG_MD5, 0, 0, lHHash)) Then

bValid = False

MsgBox ("Error " & CStr(GetLastError) & " during CryptCreateHash!")

GoTo ReleaseHandles:

End If

'Add data to hash object.

If Not CBool(CryptHashData(lHHash, sInBuffer, Len(sInBuffer), 0)) Then

bValid = False

MsgBox ("Error " & CStr(GetLastError) & " during CryptHashData!")

GoTo ReleaseHandles:

End If

'Determine size of signature.

'sDescription = vbNullChar

'lResult = CryptSignHash(lHHash, AT_SIGNATURE, sDescription, 0, 0, lSignatureLen)

'Get handle to signature key.

If Not CBool(CryptGetUserKey(lHCryptprov, AT_SIGNATURE, lHCryptKey)) Then

bValid = False

MsgBox ("Error " & CStr(GetLastError) & " during CryptGetUserKey!")

GoTo ReleaseHandles:

End If

lSignatureLen = Len(sSignature)

'Verify signature.

If Not CBool(CryptVerifySignature(lHHash, sSignature, lSignatureLen, lHCryptKey, sDescription, 0)) Then

If GetLastError = NTE_BAD_SIGNATURE Then

bValid = False

GoTo ReleaseHandles:

Else

bValid = False

MsgBox ("Error " & CStr(GetLastError) & " during CryptVerifySignature!")

GoTo ReleaseHandles:

End If

End If

ReleaseHandles:

'Release signature key.

If lHCryptKey Then lResult = CryptDestroyKey(lHCryptKey)

'Destroy hash object.

If lHHash Then lResult = CryptDestroyHash(lHHash)

'Release provider handle.

If lHCryptprov Then lResult = CryptReleaseContext(lHCryptprov, 0)

Select Case bValid

Case True

lStatus = CFB_VALID

Case Else

lStatus = CFB_READY

End Select

Exit Sub

ErrValidate:

MsgBox ("ErrValidate " & Error$)

Resume

End Sub

Public Sub Encrypt()

'Encrypt InBuffer into OutBuffer

Dim lHExchgKey As Long, lHCryptprov As Long, lHHash As Long, lHkey As Long

Dim lResult As Long, sContainer As String, sProvider As String, sCryptBuffer As String

Dim lCryptLength As Long, lCryptBufLen As Long

On Error GoTo ErrEncrypt

'switch Status property

lStatus = CFB_BUSY

'Get handle to the default provider

sContainer = vbNullChar

sProvider = vbNullChar

sProvider = MS_DEF_PROV & vbNullChar

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptAcquireContext!")

GoTo Done

End If

'Create a hash object.

If Not CBool(CryptCreateHash(lHCryptprov, CALG_MD5, 0, 0, lHHash)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptCreateHash!")

GoTo Done

End If

'Hash in the password data.

If Not CBool(CryptHashData(lHHash, sPassword, Len(sPassword), 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptHashData!")

GoTo Done

End If

'Derive a session key from the hash object.

If Not CBool(CryptDeriveKey(lHCryptprov, ENCRYPT_ALGORITHM, lHHash, 0, lHkey)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptDeriveKey!")

GoTo Done

End If

'Destroy the hash object.

CryptDestroyHash (lHHash)

lHHash = 0

'Prepare a string buffer for the CryptEncrypt function

lCryptLength = Len(sInBuffer)

lCryptBufLen = lCryptLength * 2

sCryptBuffer = String(lCryptBufLen, vbNullChar)

LSet sCryptBuffer = sInBuffer

'Encrypt data

If Not CBool(CryptEncrypt(lHkey, 0, 1, 0, sCryptBuffer, lCryptLength, lCryptBufLen)) Then

MsgBox ("bytes required:" & CStr(lCryptLength))

MsgBox ("Error " & CStr(GetLastError) & " during CryptEncrypt!")

'GoTo Done

End If

sOutBuffer = Mid$(sCryptBuffer, 1, lCryptLength)

Done:

'Destroy session key.

If (lHkey) Then lResult = CryptDestroyKey(lHkey)

'Release key exchange key handle.

If lHExchgKey Then CryptDestroyKey (lHExchgKey)

'Destroy hash object.

If lHHash Then CryptDestroyHash (lHHash)

'Release provider handle.

If lHCryptprov Then lResult = CryptReleaseContext(lHCryptprov, 0)

'switch Status property

lStatus = CFB_READY

Exit Sub

ErrEncrypt:

MsgBox ("ErrEncrypt " & Error$)

Resume

End Sub

Public Sub Decrypt()

'Decrypt InBuffer into OutBuffer

Dim lHExchgKey As Long, lHCryptprov As Long, lHHash As Long, lHkey As Long

Dim lResult As Long, sContainer As String, sProvider As String

Dim sCryptBuffer As String, lCryptBufLen As Long, lCryptPoint As Long

Dim lPasswordPoint As Long, lPasswordCount As Long

On Error GoTo ErrDecrypt

'switch Status property

lStatus = CFB_BUSY

'Init sOutBuffer

sOutBuffer = ""

'Get handle to the default provider.

sContainer = vbNullChar

sProvider = vbNullChar

sProvider = MS_DEF_PROV & vbNullChar

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptAcquireContext!")

GoTo Done

End If

'Create a hash object.

If Not CBool(CryptCreateHash(lHCryptprov, CALG_MD5, 0, 0, lHHash)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptCreateHash!")

GoTo Done

End If

'Hash in the password data.

If Not CBool(CryptHashData(lHHash, sPassword, Len(sPassword), 0)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptHashData!")

GoTo Done

End If

'Derive a session key from the hash object.

If Not CBool(CryptDeriveKey(lHCryptprov, ENCRYPT_ALGORITHM, lHHash, 0, lHkey)) Then

MsgBox ("Error " & CStr(GetLastError) & " during CryptDeriveKey!")

GoTo Done

End If

'Destroy the hash object.

CryptDestroyHash (lHHash)

lHHash = 0

'Prepare sCryptBuffer for CryptDecrypt

lCryptBufLen = Len(sInBuffer) * 2

sCryptBuffer = String(lCryptBufLen, vbNullChar)

LSet sCryptBuffer = sInBuffer

'Decrypt data

If Not CBool(CryptDecrypt(lHkey, 0, 1, 0, sCryptBuffer, lCryptBufLen)) Then

MsgBox ("bytes required:" & CStr(lCryptBufLen))

MsgBox ("Error " & CStr(GetLastError) & " during CryptDecrypt!")

GoTo Done

End If

'Apply decrypted string from sCryptBuffer to private buffer for OutBuffer property

sOutBuffer = Mid$(sCryptBuffer, 1, Len(sInBuffer))

Done:

'Destroy session key.

If (lHkey) Then lResult = CryptDestroyKey(lHkey)

'Release key exchange key handle.

If lHExchgKey Then CryptDestroyKey (lHExchgKey)

'Destroy hash object.

If lHHash Then CryptDestroyHash (lHHash)

'Release provider handle.

If lHCryptprov Then lResult = CryptReleaseContext(lHCryptprov, 0)

'switch Status property

lStatus = CFB_READY

Exit Sub

ErrDecrypt:

MsgBox ("ErrDecrypt " & Error$)

GoTo Done

End Sub

Public Property Get Status() As Long

Status = lStatus

End Property

Private Function InitUser() As Long

Dim lHCryptprov As Long, lHCryptKey As Long, avProviderData(1000) As Byte

Dim lProviderDataAddress As Long, lProviderDataLen As Long, lDataSize As Long

Dim lResult As Long, sContainer As String, sProvider As String

Dim sUserName As String, lPoint As Long, lMemHandle As Long

Dim lReturn As Long, sBuffer As String

On Error GoTo ErrInitUser

'prepare string buffers

sContainer = vbNullChar

sProvider = MS_DEF_PROV & vbNullChar

'Attempt to acquire a handle to the default key container.

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, 0)) Then

'Create default key container.

If Not CBool(CryptAcquireContext(lHCryptprov, ByVal sContainer, ByVal sProvider, PROV_RSA_FULL, CRYPT_NEWKEYSET)) Then

MsgBox ("Error creating key container! " & CStr(GetLastError))

Exit Function

End If

'Get name of default key container.

lProviderDataLen = Len(avProviderData(0)) * (UBound(avProviderData) + 1)

If Not CBool(CryptGetProvParam(lHCryptprov, PP_CONTAINER, avProviderData(0), lProviderDataLen, 0)) Then

MsgBox ("Error getting user name! " & CStr(GetLastError))

avProviderData(0) = 0

End If

'Get sUserName from avProviderData()

lPoint = LBound(avProviderData)

While lPoint <= UBound(avProviderData)

If avProviderData(lPoint) <> 0 Then

sUserName = sUserName & Chr$(avProviderData(lPoint))

Else

lPoint = UBound(avProviderData)

End If

lPoint = lPoint + 1

Wend

MsgBox ("Create key container " & sUserName)

End If

'Attempt to get handle to signature key

If Not CBool(CryptGetUserKey(lHCryptprov, AT_SIGNATURE, lHCryptKey)) Then

If GetLastError = NTE_NO_KEY Then

MsgBox ("Create key exchange key pair")

If Not CBool(CryptGenKey(lHCryptprov, AT_SIGNATURE, 0, lHCryptKey)) Then

MsgBox ("Error during CryptGenKey! " & CStr(GetLastError))

Exit Function

Else

lResult = CryptDestroyKey(lHCryptprov)

End If

Else

MsgBox ("Error during CryptGetUserKey! " & CStr(GetLastError))

Exit Function

End If

End If

'Attempt to get handle to exchange key

If Not CBool(CryptGetUserKey(lHCryptprov, AT_KEYEXCHANGE, lHCryptKey)) Then

If GetLastError = NTE_NO_KEY Then

MsgBox ("Create key exchange key pair")

If Not CBool(CryptGenKey(lHCryptprov, AT_KEYEXCHANGE, 0, lHCryptKey)) Then

MsgBox ("Error during CryptGenKey! " & CStr(GetLastError))

Exit Function

Else

lResult = CryptDestroyKey(lHCryptprov)

End If

Else

MsgBox ("Error during CryptGetUserKey! " & CStr(GetLastError))

Exit Function

End If

End If

'release handle to provider

lResult = CryptReleaseContext(lHCryptprov, 0)

InitUser = True

Exit Function

ErrInitUser:

MsgBox ("ErrInitUser " & Error$)

Resume

End Function

Private Sub Class_Initialize()

If InitUser = True Then

MsgBox ("InitUser OK")

Else

MsgBox ("InitUser failed")

End If

End Sub

Public Property Get Password() As String

Password = sPassword

End Property

Public Property Let Password(vNewValue As String)

sPassword = vNewValue

End Property


OAuth 2.0: What is the advantage of authorization_code grant flow over Implicit grant flow? I'm not able to appreciate what is the advantage of having a autorization_code given to the client and then exchanging this for access token on webapp side. Instead why not just give access_token to the client and ask client to pass on this info to webapp to access secured resources. This is what happens in Implicit grant anyway.

Sure, you can do that, and in fact it's a supported flow as you mentioned. However, the point of the code is to prevent the client itself from having access to the token. This prevents stealing or leaking of the token because it's confined to the internals of the web app itself, instead of shared around with whoever needs to use the service.

Remember that the flows apply to different scenarios.

Implicit flows are used when you need access to the token, but don't/can't trust the client such as an app running locally on a user's machine -- a malicious user could easily impersonate the client.

Code flows are used when you can trust and verify the client because, for example, it's hosted on a remote machine you don't have access to.


How can I tell who's using my cookie information on an open LAN? I think someone is using my cookie info to log into my Facebook account on a public Wi-Fi network.  How can I determine if this is happening and from what IP address?

If you're logging in over HTTP (as opposed to HTTPS) on a wifi network (except with some versions of WPA2), anyone connected to that network can snoop on your traffic, and you will not find out. This is a purely passive eavesdropping attack. Your only defense is to never use Facebook through anything but HTTPS.

You may be able to find out which IP address accessed your account, if Facebook keeps a log of that (you bet they do) and they expose that log to you (I don't know about that). But that may or may not tell you anything: if the attacker connected from the same wifi network as you, he'll usually show up as coming from the same IP address.


Authenticode Certificate to avoid A/V If I sign an executable with an authenticode certificate will any A/V stop flagging it as a virus?

Authenticode will most likely help to bypass human check, as the victim has more chance to accept the execution of an application flagged as coming from a reputable source.
Anti-virus themselves, while they may take this into account, rely on multiple criterion to detect malware and authenticode will at most be only one criteria among the others.
What an anti-virus do is calculate a score based on these multiple criterion (executable file content, behavior, etc.). It is possible that a software gets a bonus point when it is certified, but if at the other side its behavior is considered malicious it will get flagged as malware anyway.
Microsoft gives a few high-level details on how they use Authenticode in their own security suite, Microsoft Security Essential (emphasis is mine):

When Microsoft Security Essentials first encounters a file, it performs a malware scan using all the technologies it needs to determine if the file is malicious. If the file is not malicious (which is hopefully the case), there's a background check that happens later, using idle cycles to see if the file's Authenticode signature or hash matches an internal list of trusted publishers and known clean files. If the file is on the list, it will be skipped in future scans, either on access or on demand.
Next, Microsoft Security Essentials uses its internal reputation lists to control what information on unknown files it sends back to Microsoft, or what files it may ask users to submit to Microsoft for further analysis. Under the hood is a sophisticated runtime behavior-monitoring system, which looks for software acting suspiciously, like modifying an autorun.inf file to AutoPlay. [...] Because of the need for speed and the fact that legitimate software will sometimes share behaviors with malware, that system will use the reputation lists to bypass files based on reputation.
Authenticode signing is key because it aggregates reputation for all your files, and applies your reputation to brand new files as well. [...] Authenticode signing doesn't explicitly say anything about the safety of the signed code, as we in the MMPC know well, but it's invaluable for determining reputation and separating legitimate code from known publishers from potentially dangerous code.

According to this post in their case they act in three step:

First check the file content and behavior using traditional AV means.
If nothing suspicious have been found, allow the file for now and schedule a check of the Authenticode for later.
If the Authenticode check reveals that the file has been signed by a trusted source (the post doesn't explain what is considered a "trusted" source and I guess Microsoft will not reveal the exact criterion to prevent abuse), Microsoft Security Essential completely stops checking this file and allow it on a systematic basis.

This related question has interesting answers regarding how anti-virus software work: How do antiviruses scan for thousands of malware signatures in a short time?, and this other question deals with the other side of the story: Techniques for Anti Virus evasion.


Windows Remote Desktop Tool What are the security risks of allowing the Remote desktop connection to be enabled on machines within an organisation?

From reading various blogs on the subject, I can stop the use of the MSTSC.exe command, but I am wondering what the benefit of it would be.

RDP is as easy protocol to scan for, and thus attempt a brute force login, especially if you still use the default user accounts on Windows PCs.  Never expose RDP externally for that reason.

That said, we still enable it internally for providing remote support to users.  Make sure you lock down the users that can use it internally via the local Remote Desktop Users group on the workstations.  You can do this through: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow Log on through Remote Desktop Services

If you do want to disable it, you'd be better off disabling it via group policy (Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow users to connect remotely using Remote Desktop Services) and/or blocking port 3389 on the client firewall, rather than trying to stop the execution of mstsc.exe.


How can programming knowledge help towards information security Im interested in becoming a cyber security expert. I feel comfortable with my networking skills but im worried about my programming skills. How important is for a cyber security expert to have advanced programming skills? And  what languages would you recommend.

Short answer: Start learning the security aspects of the technologies you already know.

Longer answer: the term "cyber security expert" is much broader than I think you realize. Like any technical field, there are lots of sub-areas, each requiring specialized knowledge. Even on this site you can see that no one person feels qualified to answer all types of questions - some people are cryptographers, others know about secure coding practices for C/C++, others know about secure coding for php / python / ruby, others know about firewalls and anti-virus configuration. You really have to be an expert in something before you can start thinking about how to penetration test it, or harden it against exploits.

Metaphor: your kid is sick, you take them to the doctor and the doctor says "I'm actually a plumber by training, but I recently took a course in what medicine to prescribe for which symptoms". Yeah, that's not good enough, I want my doctor to be a full expert in biology and understand why the medicine works, not just know which one to prescribe - similarly a "security expert" really should be a top-to-bottom expert in the technologies they are looking for weaknesses in.

Where to start:

If you already work for a company where you already have an assigned job, this will give you an area to concentrate your security studies. If you don't deal with a lot of code, then don't learn to code just for security, spend your time elsewhere!

If you are trying to apply to a "new grad" security positions at a company, then they will expect to have to train you anyway - you will have to learn their products and environment, looking for security holes along the way. You need to demonstrate that you "think like a gamer" - that your gut reaction to seeing something new is to say "what are the rules of this system, and how can I exploit them?". It's much easier to pick up the technical skills than to pick up this mindset.


Identifying the author(s) of a piece of malware When a new piece of malware appears, people can try to determine where it comes from, and who its authors could be.

How do security experts attempt to identify the authors of a new publicly disclosed piece of malware? What techniques (e.g. reverse engineering) are available?

There are a number of different techniques, depending on the skill level of the malware author:

Embedded metadata - compiled programs can contain details about their authors. This is most commonly seen in legitimate programs, and shows in the details screen if you look in Windows properties. Attackers who are out for fame might well put identifying details in these fields
Accidental embedding - compilers will often include details on compiler flags used, which may well include paths to source files. If the source file was in /users/evilbob/malware, you can make a pretty good guess that evil bob wrote it. There are ways to turn off these inclusions, but everyone makes mistakes sometimes
Common code - malware authors are like any other programmer, and will reuse useful bits of code from previous work. It is sometimes possible to spot that a section of compiled code matches a previously discovered section of code so closely that it seems probable that the same source code was used for each. If that is the case, can deduce that the second author had access to the code from the first, or may be the same person.
Common toolchain - if a developer tends to use Visual Studio, it would be unexpected to see their code turning up compiled with GCC. If they use a specific packer, it would be strange to see them using a different packer. It's not perfect, but it could suggest a distinction.
Common techniques - similar to the above, coders often have specific patterns of coding. People are unlikely to switch patterns, so you can make a reasonable guess that if some compiled code couldn't have been generated in a particular coding style, it probably wasn't written by someone who has previously been known to use a different style. This is much easier with interpreted languages, as seeing consistent use of, say, for loops rather than while loops is easier than spotting the differences between the compiled output of each (modern compilers may well reduce them to exactly the same set of instructions).
Malware origin - where did it come from? Does it have any text in specific languages, or typos which suggest a particular background? (e.g. colour would suggest that the author wasn't American, generale might suggest someone used to writing in a Romance language such as French or Italian)

None of these are on their own enough to determine an author, but combined, they might suggest a common author with previous malware, or even with other known code (e.g. from OS projects).


Which things can facebook access like contacts etc I had two incidents .

I added john to my skype account and i exchaged few messages. Then i went home and was checking facebook . Then at right side i saw Do you know  john and it was his acoount
Then i had stored one person in mobile phone with name and phone and i never had any contact with him. But i still sometime see his name in do you know him . I have no mutual friends with as well.

Does it mean that facebook read my phone contacts and skype messages

Yes, that, and a lot more if you use their mobile app. Also, they are not alone on harvesting everything; always read the app permissions list before installing an app, and consider whether you are willing to share your data with the app maker...


Can Google Docs be used to “sanitize” a Word or Excel document? Sometimes I have to download some Word or Excel documents from uncredible sites. I need not only to read but also to edit them. I heard that the Microsoft Office suite is a very popular attack vector. Although I patch my Windows and Office regularly I guess there must be many 0day vulnerabilities in them.

In order to mitigate the risk, after downloading a Word document, I would upload it to Google Docs, make some small changes and download it with a different format (for example, if the original file is a *.doc file then I would download it as a *.docx file and vise versa). My guess is that such conversion may "sanitize" (or at least break) the malicious code (if any) in the suspicious file.

Does anyone know whether it works?

The strategy you propose might indeed break malicious code, but with 0 day exploits there is no way to be sure.

If it is just the flat text that you want, the safest way to go might be to open the raw file with a different program. .docx can be opened as a zipped file (using unzip, 7zip or similar) and then you can open word/document.xml with your favorite text editor.


HTML Vulnerabilities My question is three-fold.

Background

I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the site. If I left the site, the text I entered left.

Questions

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?

2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.

3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?

1) How can I recommend a text field be secured (as far as validating
  input prior to be accepted to the html parser (which I learned runs
  before any of the other parsers))?

See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet for information on how to prevent cross-site scripting (XSS). You will need to do data validation on the server to make sure only permitted characters are submitted, and you will need to do output encoding (e.g., most likely HTML entity encoding, but see the previous link for specifics) prior to returning the data to the browser.

  2) Is the fact that the text is non-persistant relevant? I can still
  put a script tag in there and it seems to run.

"Reflected" XSS and "DOM-based" XSS is usually not considered to be as dangerous as "persistent" XSS, although the popularity of the site, the effectiveness of phishing/tricks by the attacker, and so on, have a big impact on how serious a reflected XSS attack truly is.

  3) This one, I don't know if I can really expect to be answered; but,
  I lack imagination as to what I can do with this "hole." If I can run
  a script, I should be able to do something, but I don't think I know
  enough java script for that. What can be done (not really looking for
  code... necessarily...) with this?

Stealing keystrokes, hijacking sessions, duping users into installing malware, changing the look and feel of a site, redirecting people to sites that look the same but are actually attack sites, etc. See http://www.zdnet.com/blog/security/obama-site-hacked-redirected-to-hillary-clinton/1042 for a simple real world example.


Securing a public computer meant for banking I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is meant for people who wish to access their account themselves, but are unable to do so otherwise.

I have never used that computer and remain highly skeptical about this.

My question does not involve the possibility of others capturing the keystrokes by watching or a camera facing the keyboard or the screen, as that doesn't seem to be the case in this particular setting.

Instead, I would like to ask: What measures can the bank take to ensure that no user installs spyware to track other users? Again, the camera can't really see what the user is doing exactly, and the employees are most likely too busy to pay attention.

I have no knowledge of what the system actually looks like, as I have never used that workstation. I don't know whether there is a regular operating system installed with a browser that can access only the bank's website, or, perhaps, rather a software application dedicated for the task, with the access to any other OS features being locked.

One thing that came to my mind was having a snapshot that could be rolled back at any time (ideally, each time a user would be finished with their work). Is that how it is done?
Do they employ simple forensics to make sure that the integrity of the system has not been tampered with?
If neither of the above is likely, what else could be done?
And finally, the most scary question: Do the banks even care?

Please note that my expectations toward possible answers either assume that the practice is more common in worldwide banking, or simply arise out of my interest in how it should be done properly (if that's possible at all).

Any form of hacking involves being able to change the underlying operating system or applications.  If an attacker were completely prevented from doing this, then attack is impossible.

Operating systems have vulnerabilities.  They always have, and they always will.  But what if the OS and all applications ran off of a medium physically incapable of being altered, say on a read-only medium and had no ability to write to permanent storage?  Furthermore, if the OS rebooted when each user was finished with the computer, and sufficient physical access to the computer was prevented, it would be exceedingly difficult to hack the computer.

So in my estimation, a secure public computer would need the following properties.

A read only operating system, at the physical medium layer.
No medium capable of writing information anywhere permanently (obviously you still need RAM).
The operating system reboots after every use in order to prevent someone gaining control of the running operating system.
Physical access is extremely limited.  No USB ports are available, the physical box is in a locked box that can't be tampered with easily.  Even the keyboard is "bolted in" and can't be removed.  Think the level of physical security associated with an ATM.


Practical DRM for pdfs An organization I am consulting for is trying to find a DRM solution for an ebook that they publish internally.  It is in pdf format.

Does anybody have experience with DRM for pdfs, and if so, any suggestions?

In order of inconvenience:

policy. Just tell internal users not to publish internal documents. If you can't do that, your problems are worse than leaky text. Whistleblowing, espionage and many other forms of data exfiltration are fundamentally HR issues.
password-protected PDF. Not much of a blocker but enough to put off accidental discovery should the files get leaked.
Adobe Content Server. Throw Adobe some dollars (quite a few dollars, actually) and they'll make it a bit harder to copy the PDFs using their DRM wrapper.

If you do all that and ban writable media, network connections, cameras, printers and pens from the environment, then there's only the employees' memory to contend with :-).


Generating tokens via PRNG and Hashing We are using Java and we are planning to create a reusable API that can be used to generate and validate custom tokens. This is how we will do it
Step 1: Generate a random number using a good a CSPRNG (Cryptographically Secure Pseudorandom Number Generator) . This will be the seed of the token
Step 2: Hash the seed using a salt. The hashed version will be the token.
My question is, if the token is created by hashing anyway, is it still necessary that the seed is generated from a good CSPRNG? would it matter?

In general, cryptographic techniques assume that the attacker knows everything about your scheme except for the secrets.  This is Kerckhoff's Principle.  That means that the attacker knows the techniques you use to generate the secret and the size of the set.
Under this principle, you need to generate the secret securely and from a large enough set, that is, with at least 128 bits of entropy.  Using a non-cryptographic PRNG won't be suitable for this because it's easily guessable.
If your goal is to generate some sort of verifiable token, you can use HMAC (with a cryptographically secure hash, such as SHA-256) to take your secret and hash any additional data you want (such as your salt) to generate the token.  If you just need a completely random token, then you can just use a CSPRNG.
Note that it is secure to generate a token with an increasing ID using HMAC as long as your secret is secure: token = N || HMAC-SHA-256(secret, N).  This is also true for any other non-secret contents in place of an integer.  HMAC is better than using a plain hash because it avoids length-extension attacks on common hashes.
Even if you think nobody will know if you use a non-CSPRNG, under your scheme, if someone knows the data being hashed other than the seed, they can brute-force your scheme to recover the weak seed and forge tokens.  Note that modern CSPRNGs can be faster than non-CSPRNGs, so there's really no reason not to use the right tool for the job.