Why improvising your own Hash function out of existing hash functions is so bad I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.

After reading that cooking up your own password hash out of existing hashing functions is dangerous over and over again I still don't understand the logic. Here are some examples:

md5(md5(salt) + bcrypt(password))
scrypt(bcrypt(password + salt))
sha1(md5(scrypt(password + md5(salt))))

The typical arguments against these go as follows:

  You're not a cryptographer! You've got no idea if these hashes are more secure. Leave it to the experts who know what they're doing. These add no extra security.

Granted they don't improve the function as a hash (i.e. make it harder to reverse or find collisions etc.), but surely surely they don't make it worse as a hash? If they did then hackers would be able to re-hash standardly hashed passwords into these wacky hashes as they see fit and weaken the hash? I don't buy it.

Second argument:

  Kerckoffs's principle: A cryptosystem should be secure even if everything about the system is known.

Agreed. This is basically the motivation for not storing your passwords as plaintext in the first place. But if my response to the first criticism stands then these wacky hashes still function as secure hashes, and our system doesn't break Kerckoffs's principle anymore than it would with a standard hash.

Here are two possible (and worthwhile, as far as I can see) advantages to using a "wacky" hash over a normal hash:

Sure, your system should be secure if the attacker has the source code, but it's a very likely possibility that your attacker wont have access to your source code and probably won't be able to guess your wacky hash, making any attempt at a brute force impossible.
(This one is the real motivation behind me asking this question) BCrypt is thought to be secure, hard for the CPU and GPU (great) but can be very fast with specialized hardware. SCrypt is said to be hard to bruteforce on CPUs, GPUs and currently available specialized hardward but is more recent and not trusted by the cryptographic community as much as BCrypt due to the lack of exposure it's had. But doesn't the hash BCrypt(SCrypt(password + salt)) get the best of both worlds?

I appreciate that the passion/anger behind most rants against these home-brewed hashes comes from the average programmer's lack of knowledge of what makes a good hash, and a worry that encouraging this sort of wacky-hashing will inevitably end up with weak and useless hashes getting into production code. But If the wacky hash is carefully constructed out of solid and trusted hashes, are the gains in security not very valuable and real?

Update

I got a bunch of good answers on this, thanks. What I seemed to be overlooking in my assumptions was that, although combining hashes can't make it easier to crack the original password and therefore crack the constituent hashes, the combination of two or more secure hashes can - at least in principle - be weaker than any one of its inner hashes due to the unstudied and complex interactions between them. Meaning it could be possible to find some string that got past the wacky hash without necessarily breaking the hashes that made it up.

The fact that you need to ask this question is the answer itself - you do not know what is wrong with stacking these primitives, and therefore cannot possibly know what benefits or weaknesses there are.

Let's do some analysis on each of the examples you gave:

md5(md5(salt) + bcrypt(password))

I can see a few issues here. The first is that you're MD5'ing the salt. What benefit does this give? None. It adds complexity, and the salt is simply meant to be unique to prevent password collisions and pre-computation (e.g. rainbow table) attacks. Using MD5 here doesn't make any sense, and might actually weaken the scheme since MD5 has known trivial collisions. As such, there is a small possibility that introducing MD5 here might mean that two unique salts produce the same MD5 hash, resulting in an effectively duplicated salt. That's bad.

Next, you use bcrypt on the password. Ok. Well, most bcrypt implementations require a salt internally, so this is already technically invalid. Let's say you know that, and you meant to say bcrypt(md5(salt), password). This part is still falling to the weakness I described above, but it's not too shabby - remove the MD5 and it's a standard use of bcrypt.

Finally, you MD5 the whole thing. Why are you doing this? What is the purpose? What benefit does it bring? As far as I can see, there is no benefit at all. On the detriment side, it adds more complexity. Since most bcrypt implementations use the $2a$rounds$salt$hash notation, you're going to have to write code to parse that so that you can extract the hash part and store the rest separately. You're also going to need an MD5 implementation, which was unnecessary.

So, in terms of code footprint for potential attack vectors, you've gone from a simple bcrypt implementation, to a bcrypt implementation with custom parsing code, and MD5 implementation, and some glue code to stick it all together. For zero benefit, and a potential vulnerability in salt handling.

Next one:

scrypt(bcrypt(password + salt))

This one isn't too bad, but again you need some code to parse out the results of bcrypt into hash and salt / round count separately. In this case I'd guess that there is a slight benefit, because bcrypt and scrypt work in different ways for roughly the same goal, which would make it a little more difficult for an extremely well-funded attacker to build custom ASICs to break your scheme. But is that really necessary? Are you really going to hit a situation where a nation state will devote a few million dollars to just to break your hash? And, if that case ever arises, will it really bother the attacker to have to spend a few extra million to double their chip count?

Another potential issue with combining bcrypt and scrypt like this is that there has been very little study into how the two interact. As such, we don't know if there are any weird cases that can cause problems. As a more obvious example, take the one time pad. We compute c=m^k for some message m and some equally long perfectly random key k, and we get perfect security. So let's do it twice, for even more security! That gives us c=m^k^k... oh, wait, that just gives us m. So because we didn't take the time to properly understand how the internals of the system worked, we ended up with a real security vulnerability. Obviously it's more complicated in the case of KDFs, but the same principle applies.

And finally:

sha1(md5(scrypt(password + md5(salt))))

Again we're running into the MD5'ed salt issue. I'm also intrigued by MD5'ing the SHA1 hash. What possible benefit could that have, if you're already using a slow KDF like scrypt? The few nanoseconds it would take to compute those hashes pales in comparison to the hundreds of milliseconds it would take to compute the scrypt digest of the password. You're adding complexity for an absolutely irrelevant layer of "security", which is always a bad thing. Every line of code that you write is a potential vulnerability.

Now remember that point I made at the start of my answer. If, at any point in this answer, you thought "oh yeah, I didn't think about that", then my point is proven.

You're running into what I would describe as Dave's false maxim:

  If I add more crypto things, it will be more secure.

This is a common trait among developers, and I once believed it too. It goes hand-in-hand with denial of other principles, such as Kerckhoff's Principle. Ultimately, you have to realise and accept that obscurity isn't a safety rail; it's a crutch for weak crypto. If your crypto is strong, it needs no crutch.


Is this Data Encryption/Storage Method Secure? Let me first say that I know it is a bad idea to store sensitive information in a mysql database, so please don't respond by saying "DON'T DO IT" or something to that effect. I am building a website for which it is absolutely essential to store Social Security Numbers, and I have to be able to retrieve that data back out of the DB (no hashing).

That said, I have researched the best way to encrypt/decrypt the data, and built a custom function to handle the encryption. Here is my encrypting function:

function my_data_encrypt($value){
    $salt=substr(uniqid('', true), 0, 20);
    $key=$salt.MY_PRIVATE_KEY;
    $enc_value=base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($key), $value, MCRYPT_MODE_CBC, md5(md5($key))));
    return array("enc_value"=>$enc_value, "salt"=>$salt);
}

So basically I am generating a random string for my salt, then appending to the salt a private key MY_PRIVATE_KEY which is defined in a separate config file. I then use mcrypt_encrypt to encrypt the data, then base64_encode to make the encryption safe to store in the DB. The encrypted string and the unique salt are then returned and stored in the DB together.

My thinking was that throwing a "private key" that is stored in the config file (not the DB) into the mix would add another level of security to the encryption, that way even if someone hacks the database and gets the encrypted value and the salt, they still wouldn't have everything they need to decrypt the data.

Can you security experts review my function and let me know if/how my data could be hacked and if there is anything else I could do to improve it?

You are using a 128-bit key (output of MD5, hence 128 bits) with a block cipher which expects a 256-bit key (Rijndael-256). If PHP was properly implemented, it would blow in your face at that point. However, the documentation states that the key is merely padded with zeros up to the required length. If you use a 128-bit key, you'd better use a cipher with expects a 128-bit key, i.e. Rijndael-128.

The "salt" is either useless, or poorly applied. Salts are meant to deal with weak keys, which can be realistically recovered by exhaustive search, i.e. when keys are passwords. If your key is a real, properly generated, fat and random key, then the salt is useless. On the other hand, if your key is a password, then you are in the real of password hashing, which will require more effort.

On the other hand, the IV should be random, instead of being the hash of the key. Appropriate use of the block cipher would be:

Have a unique 128-bit key, generated with a cryptographically strong PRNG (e.g. /dev/urandom on Linux systems).
When encrypting a new message, create a new random IV with a strong PRNG (i.e. openssl_random_pseudo_bytes(), which internally feeds on /dev/urandom or equivalent).
Forget about any "salt". Encrypt with your main key and the randomly generated IV. You then have to store the IV along with the encrypted message (for a SSN, you will end up with 32 bytes: 16 for the IV, and 16 for the encrypted block).

Then the following caveats apply:

This is encryption; it ensures confidentiality, not integrity. Someone who can modify parts of your database may play havoc with your SSN (if only by switching them around between users). Database integrity is a hard problem and the best known solutions are not good; they imply significant overhead.
Confidentiality is maintained only as long as the key is not revealed. But we envisioned an attacker who got an unusually privileged read access to the server contents, and the server, generally speaking, knows the key. If you keep the key in a file, separated from the database, then you may get some extra protection against basic SQL injection attacks, which work on the database contents only; but be aware that you have fixed only some vulnerabilities.


Off the shelf JavaScript based CSP alternative - is it safe? Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest Open/Send which then check the requested domain against the list of allowed domains. Anything attempting to talk to unapproved domains get a fake response. Is this approach as safe as CSP? Is it possible for any scripts to remove Ensighten's bindings and set it back to native code?

It's definitely not as safe as a CSP. All you would need to do is create an empty iframe and you can get a full set of unmodified globals from that iframe's window object.

Without a CSP, it would also be relatively easy to send data out to another domain using GET parameters in the src of an img tag for example. You could also use a form to send POST data via JavaScript (using an iframe you can even avoid a redirect).


Understanding a Burp Capture I am thinking of taking up ethical hacking as a hobby. So, I installed Burp Suite Community Edition and set it up with Firefox. I opened Instagram and tried to login with these details (just for testing):

Username: admin
Password: 123456

However, when I intercepted the request in Burp, although the username was still admin , the password had been encrypted to something else. How can I find the 'formula' Firefox used for converting 123456 to that string?

Passwords are not encrypted inside a POST request.

If any encryption is done it is either at the transport layer (i.e. HTTPS instead of HTTP) and/or there is some application specific client side encryption done. In your case it seems to be the latter and you have to look at the applications code (i.e. the Javascript executed by the client) on how exactly this is done with this specific application.


Encrypting Backups on Linux I'm working on an automated backup solution to protect my files on my Linux servers. However, I'm not sure about how to securely encrypt the resulting archives. I am using 64bit linux, and I am looking for a solution that would have a separate key/password for each individual archive backed up.

I've seen solutions such as:

Using TrueCrypt to create a small container for the individual archive
Creating a luks?/dmcrypt volume and just putting everything in there

How would I do this where each backup copy would have its individual key/key files? I'm looking for a solution that where all of the private keys would not be exposed on the machine being backed up? [I.e. I have a key file, and it has a generated keyfile just for that backup]

First of all, I wouldn't recommend using disk encryption tools for this particular purpose as they are optimized for (surprise) hard disk encryption:

https://en.wikipedia.org/wiki/Disk_encryption_theory

It is possible that some implementations can adjust themselves for "simple" file encryption, I suggest to consult the appropriate documentation about this matter.

If you don't want to expose your decryption key in any way to the machine to be backed up (that sounds like a good design decision) an obvious solution is using hybrid crypto-systems. An obvious choice would be OpenSSL that is easily scriptable as described here:

http://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/


Windows CTF/war games/reverse engineering/exploit challenges War Games are fun but mainly deal with Linux reverse engineering.

Example: http://blackbox.smashthestack.org:85/

Does anyone know of similar online games for Windows security?

Microsoft has annual "Build the shield" contest annually.  https://buildtheshield.microsoft.com.
This might interest you


Do Git Commit signatures prevent repository modification? Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture.

If I have a repository which began unsigned but moved to a signed model, can a malicious user with write access perform any of the following tasks without invalidating the latest signature:

Modify data committed with a signed commit message
Modify data prior to the first signed commit in a way that results in the latest commit being different (Eg modify a part of the code that signed commits do not touch, meaning they won't create any diffs which overwrite the maliciously modified component)

Both of those things are impossible, unless they can break SHA1 (which is currently vulnerable only to collision attacks, not preimage or second preimage attacks, so they would have had to trick the legitimate user into accepting a dodgy binary file). And that's exactly the point of commit signing; if it didn't prevent those things, it would be worthless.


Is session expiration for all web applications possible? In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically useless?

I'm trying to protect myself on the client-side. A smart way to expire all the sessions without dealing with manually visit every site.

Is there such a tool?

Browsers have builtin settings to delete all cookies or particular cookies. Thus it is possible that a user can force the "immediately expire" (i.e. deletion) of cookies this way. What is not possible is that a visit to one site can force the deletion or expiration of cookies belonging to other sites.

EDIT: after the edit of the question it looks like that you effectively ask how the server can detect that the cookie is misused (i.e. session hijacking) and invalidate the cookie. Some sites do this by embedding some kind of browser fingerprint or the client IP address into the cookie so that use of the cookie from a different browser or IP gets detected. Once this is detected the cookie can simply removed from the database and thus gets invalid. For more information see OWASP about Session Hijacking.


An authoritative source for why you should NEVER give your password to anyone? I know this might be a bit subjective, but it's based on this popular question here.  Hopefully this is acceptable.

The problem with that question and answer is that I can't send it to my boss and say "See, this guy on the internet agrees with me!".

So, what is a reliable and respected source that clearly explains why you should never give your password to someone, even an IT guy?

In a corporate environment, there are a few places you can look. Company Acceptable Use Policies generally will have a clause saying not to share accounts or disclose passwords. If your company is subject to certain regulations (PCI-DSS, SOC2, HIPAA, etc.) they will have similar requirements.

Because you want to communicate with your boss, there is a non-technical route you can take.

Those regulations and policies are based on the same general principle: liability. This is a legal concept that has to do with the idea that once you share that access (that is what you are giving them) then they are now liable for that access. In this case, you are sharing liability. What happens if the IT guy uses your account to do something illegal? Because it is your name on the account, you are primarily liable for that activity, but if it is a "shared" account, that liability is shared with those who have access to that account (the IT guy or the rest of the company). If it cannot be known who did something, then there are much fewer options to try and correct or remediate problems.

So, you can tell your boss that you simply do not want to share liability with the entire IT staff. Accounts are intended to be personal so that proper attribution can be made, and that lowers the risk for the company.


Strange traffic on my NAS, need to worry? My network structure is as follows: EDGE ROUTER -- SWITCH -- Synology NAS / PCs / AP

I forward L2TP/IPSec UDP ports 1701, 500, 4500 on my EDGE ROUTER to those ports on my NAS that is running VPN Server. I also use Synology DDNS for my public IP Address.

I have events like this happening in a daily basis:

Destination IP is my Synology NAS local IP, e.g. 192.168.0.7

Should I worry about it?

UDP port 123 is for NTP- Network Time Protocol. That IP is in the pool of public NTP servers. Your NAS is simply keeping its clock up to date.


If the code to shuffle an array is known, is it possible for the randomized shuffle to stay secure? I recently was looking at Poker shuffles that were hacked and made to be guessable within a reasonable degree and this was because of the weakness of the shuffles. Is it possible to make a shuffle that is cryopgraphically secure, even if the code for the client and server is available?

Yes. In fact, most of these broken shuffling mechanisms are actually broken because they're using "secret" shuffling algorithms.

Generally speaking, a shuffling mechanism has two components:

Shuffling algorithm.
Pseudo-random number generator (PRNG).

While the shuffling algorithm can have a certain bias of its own, the whole shuffling mechanism cannot have any less bias than the PRNG itself has. In other words, a shuffling algorithm cannot be any more random than its PRNG. Let's look at one of most efficient shuffling algorithms out there, the Fisher–Yates shuffle.

The source code (or, rather, the pseudocode) of the modern Fisher-Yates shuffle has been publicly available since 1964, with implementations in tens of languages.

To shuffle an array a of n elements (indices 0..n-1):
  for i from n − 1 downto 1 do
       j ← random integer with 0 ≤ j ≤ i
       exchange a[j] and a[i]

However, it still remains one of the most widely used algorithms for this purpose.

If you look closely, the algorithm depends on random integer. This is where the PRNG comes into play. If your PRNG is unbiased and your implementation is correct, then your shuffles should be unbiased as well.

Plenty of good PRNGs which are well-vetted, time-tested, and proven to be unbiased are available. Since a PRNG is deterministic (for the same initial state, it always returns the same value) the security/randomness of the whole shuffling mechanism relies on the randomness of the PRNG's initial state, its seed. This reliance on the quality of the seed is an extension of Kerckhoffs' Principle, since without knowing the seed knowledge of the algorithm tells you nothing.  Luckily, most good PRNGs utilize good "randomness sources" provided by the operating system, such as /dev/urandom.


Biometrics: false rejection rate vs Hamming distance in iris scan In biometrics, most people talk about False Acceptance Rate (FAR) (i.e. what is the chance that two samples of different individuals match).

DNA and iris biometrics, for example, have a very low FAR. However, I found that it is very difficult to find numbers about the False Rejection Rate (FRR) (i.e. what is the chance that two samples of the same individual do not match).

Now, specifically about the iris biometric, the Hamming distance (HD) is often used to distinguish between iris samples of the same person and iris samples of a different person. One can look at the HD as a probability measure that the phase sequences for two iris samples might disagree in a certain percentage (the HD) of their bits. It has been researched that setting a HD of 0.27 will maintain a false match probability of 10^-6 for a database of 1 million different iris patterns (John Daugman).

It is a good thing that the false match probability, or the false acceptance rate, is extremely low. What I'm wondering is, how does one deduct the other rate, the false rejection rate, from the HD (if possible at all). So, i've taken a simplified figure of the HD (see below, source), and as you can see, a perfect distinction between the HD of irises of the same person (left) and the HD of irises of different persons (right) exist in this figure. Let's say this perfect distinction happens at a HD of 0.33.
Can I (in this figure, when setting a HD of 0.33) assume that both the false acceptance rate and the false rejection rate are 0?

If not, can anyone point me to studies/research where the FRR of irisscans has been researched? For example in this paper, the false rejection rate is investigated, but it is unclear to me how it relates to the Hamming distance.

Ultimately, I am looking to complete the following table. The FAR is already there, but I also need to know the FRR (table based on this paper):

NOTE: the 'Handbook of Biometrics' of Anil K. Jain et. al. provides a more detailed version of this table.

After having contacted John Daugman, he was so kind to respond. Basically, he pointed me to this study, which shows the ROC curve for two top-performing iris recognition algorithms. The ROC curve is as follows:

On the x-axis, you see the FAR, on the Y-axis, you see the 1-FRR where I was interested in. This curve shows that the FRR is only marginally impacted, no matter how much the FAR changes. Mr. Daugman informed me that we can roughly say that each reduction in
HD threshold by 0.01 (one percentile point) causes a 10-fold reduction in FMR. However, the cost in FRR from becoming more conversative in HD by 0.01 is trivial.

A more unpredictable issue with the FRR is the image acquisition quality. In case an iris scan is of bad quality, it is almost impossible that this iris will be false accepted (FAR). It is much more likely that that iris will be false rejected (FRR).

As a conclusion, current studies show that the FRR is marginally impacted by a change in FRR or HD.


Relationship between penetration testing and false positive results I had read through several research papers that discussed the trend of existing automation scanners to produce false positive results. I also read through some articles that showing the manual penetration testing could be solution to false positive results by manually identifying each investigated exploits.

So, here is my question. Are the false positive results produced by  automation scanner a problem in penetration testing? If the answer is 'yes', from which perspective it will affect the penetration tester job in conducting the testing?

You ask a lot of different questions.

I would say that as a whole, an automated tool that produces 100% accurate results is impossible. Else all the penetration testers in the world would be out of a job.

To give one example, RedHat backports security patches to older versions of software under their long-term support. An automated tool might detect that the server is running a particular kernel version that has a privilege escalation exploit and report it as such. However, due to RedHat's security patches, that particular privilege escalation vulnerability is fixed and no longer exploitable. A penetration tester however, would use that automated tool's report as a starting point in the exploitation process and find that the vulnerability is actually fixed. This tends to remove a lot of the false positives produced by automated tools.

Sure, weeding out false positives does consume a fair amount of time in a penetration test. However, I wouldn't consider it a downside. It is just part of the whole penetration testing process. It probably will not cause any delays in the penetration testing process or affect it's quality as a good penetration tester should have already taken into account these factors at the start of the test.

A good penetration tester uses the tools available to him to make his job more efficient. Automated tools are no replacement for proper skills, knowledge and experience.


Safe to reply to a suspicious email? Can something happen to me (or my computer) if I respond to a suspicious plain text email?

I received an email from an unknown address, and I am not sure if this is a "real" person.

I would have never read this email if it would have had an attachment, but it is just 3 sentences in plain text. The content is somewhat personal, but when I think about it, it is also general enough that it could be from and for anyone.

I would like to know if this email is from the person that I think it is, but I am not sure if I should respond in terms of security risks.

Your machine will immediately start to disintegrate and you will have 5 seconds to evacuate the building before it explodes!

If you are sure it is plain text the only things that could happen as a result of you replying are:

Someone on the other end knows your email address.
You might now be on some spam lists.
You may now have leaked information if you are a reconnaissance target.

However, if you looked at the email in a web client (like google) and it looks like plain text, don't kid yourself, it could be html, or something else, and it could have something like an embedded image or some other content you didn't realize was there. Clients like Outlook could fool you as well. So be careful. The "text only" email may be more than text only.

My general rule is if I don't know them, or if I don't need to reply (or if I am not curious - in a controlled environment to investigate) why waste my time or risk the issue?!


Why don't ISPs filter on source address to prevent spoofing? I'm under the impression that if all the ISPs were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.

Are any ISPs implementing this practice?
Should they?

One of the main issues is with fast switching at the core routing level. A long time ago when I was a Cisco Engineer, the cisco core routers could fast switch very effectively and provide minimal latency, but if you wanted to source filter then this would turn off fast switching and add hugely to the latency - No ISP is going to be willing to have multiple seconds of latency when they like small numbers in the millisecond region.

One of the other issues can be around encapsulation. For example, if you are using an MPLS routed networks then you were unable to see inside of the packet to conduct source filtering.


Travel information and passport I travel a lot and I am looking a good way to send my travel information, like hostel, passports etc. to send to my family before leaving.

This information is confidential. Actually, I am using a Zip to send this information to my family by email, but I am sure there's a better way to do it.

I do not trust sites like Microsoft, Google, or Facebook. They get a lot of information on us, so I did not want to give them more.

I've shared fairly sensitive info with people over email and used 7zip do to it. As @forest points out, zip does not do encryption well.

Use the "encrypt with password" feature (or whatever it's called in your 7zip program). Select AES-256 encryption if it gives you the choice and pick a strong password. Don't email/text the password, instead read it to them over the phone or hand it to them on paper.

Assuming you chose a strong password, that zip file should be ok to email, put on Google drive, wtv. The one caveat is that zip doesn't encrypt the names of the files, so make sure there's no personal information in the file names.


Can home routers get infected? I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?

I used the search bar but found nothing relevant.

Absolutely. Given that you can modify the firmware on a router, you could infect it with a virus if you were so minded. DD WRT is Linux-based; some routing equipment uses OpenBSD or one of the other BSDs.

However, generally speaking, routers are fairly stripped down pieces of kit - i.e. they run very cut down versions of Linux, or OpenBSD - and as such, the attack surface is much, much smaller than your desktop - in English, there's fewer places you're likely to find a security hole. Short of persuading a user to upload a malicious update, your average router probably doesn't have that many vulnerabilities in it, especially when the default configuration is to drop all incoming connections (connections that originate from the internet side of the router).

That's not to say people won't try though; for example, there have been a number of published exploits against Cisco kit, for example this one.

There is also a value-of-target factor to consider. With home routers, there are many different possible configurations and no standard operating system; they're not even guaranteed to be running x86 processors - I'd suggest an ARM variant would be more likely. Cisco kit is likely to be a much more attractive proposition since there is a lot of it in big businesses and the software on it is likely to be similar, meaning attacks might work across multiple models. This is the same idea that attacking Windows is a much more attractive proposition than attacking Linux, because there are many more Windows installs to target.

If you're asking "is my router likely to be compromised?" I'd say the chances are pretty slim. If you want to check if exploits exist, have a search for vulnerabilities against that model and see what you find.


what makes envirnments vulnerable/protected vs shellshock bug I just tested whether or not my university's environment was vulnerable to the shellshock bug using

env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" (code from http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html)

The output was stuff, as such the environment isn't vulnerable to the shellshock bug. However it is a bash environment so why what possible reasons are there for it not being vulnerable?

It sounds as though your systems may have been patched already. If you want to perform more due diligence, you would have to check the version of bash against the patched versions. You can do this with the command bash --version or echo $BASH_VERSION. At that point I would consult your distro's documentation to ensure the version appears to match the patched version.


Can correlation attacks (end-to-end confirmation) be used as a defense? Just speculating here. So just like timing and data sizes are used to correlate from end to end on a Tor network to deanonymize a user, can the same method be used on a single device to monitor and correlate incoming with outgoing traffic. This ensures that the device being monitored is not being use by as remote or as a relay (such as Tor) and if the data or timing is correlated then the server can deny login, a transaction, a service, etc.

I've tried looking up this notion but can't seem to find if it exists in practice or in another form. So I decided to ask openly. Thanks.

So just like timing and data sizes are used to correlate from end to
  end on a Tor network to deanonymize a user, can the same method be
  used on a single device to monitor and correlate incoming with
  outgoing traffic.

Yes, it is possible to guess that the device is used as a relay if you can watch all its communication patterns. And the less traffic sources the device gets/sends traffic to, the higher would be the probability that your guess is correct.

  and if the data or timing is correlated then the server can deny
  login, a transaction, a service, etc.

Unless the "server" here is the only Internet gateway to this device, it is not in position to see all traffic coming to/from the device. Thus it will not be able to tell whether the device is used as a proxy.


Following redirects from HTTPS to HTTP - Secure? So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)

This means, in theory, if you POST to say https://example.com then it can redirect to http://example.com and the POST request will be sent in plain-text. This is very unintuitive, but is it insecure? Is it possible to stage an attack using this assumption if you have control of the routing and/or DNS of the client? Could you somehow hi-jack say https://facebook.com to redirect to your plain-text server and get away with their login info?

Note: it will of course error out on certificate mismatches or other certificate errors, but it will blindly allow you to redirect a POST or GET from an HTTPS link to an HTTP link

Is this exploitable from the point of view of a captive portal?

A redirect is when the server responds to the client: "to get what you look for, you must ask again as that URL". If the POST target, from the client, is an https URL, then the request and the response will be protected by SSL. In particular, SSL protects against "injection" by an attacker of a "redirect" response.

However, if the SSL server really wishes to redirect the client to a non-SSL address, then the client will do just that, and send its POST again, this time with plain HTTP. This second sending, being unprotected, is vulnerable to all the usual attacks since it is not protected: eavesdropping, alteration, misdirection...

It is like living in a bunker, then stepping outside. You decide, securely, to exit the bunker; and you take that decision while you are still in the bunker. But, once outside, anything goes.


Why are the embedded versions ("overlay", "embed") of the auth0 lock considered safe? If you scroll down at https://auth0.com/lock/ to modes it will display multiple modes: "overlay", "embed", "hosted" and "mobile ready". I am allowed to embed the login from auth0 to show up on my site (without redirecting to their site hosting their login service).

Thiefs can easily fake the layout of the login, couldn't they? I thought end-users could only be sure their credentials aren't stolen by entering it on a fake site if the end-user can compare the url of the current site to the site his account is on/the service he wanted to lock in with. Why does auth0 still offer me to embed their login on my site?

I mean there are some sites on the internet you would trust to not steal your auth0 (or any other login service provided by auth0) credentials, but they offer it to everyone.

Why does auth0 still offer me to embed their login on my site?

The authentication system that auth0 provides doesn't offer users to enter their "auth0 customer credentials". Rather, the credentials are unique to the site that's embedding the form.

You are right in that it's only safe to enter your login details in an embedded form if you trust the page hosting it. That's why social login features like "Login with Google" always redirect you to a secured login page of the social identity provider and should never ask you to enter your credentials directly on the initial (potentially untrusted) page.


Do WPA-Enterprise implementations have built-in anti-IP-spoofing? i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean:

it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. when you've authenticated, the router knows that your personal encryption credentials are associated to the IP it grants you, say 1.2.3.4. thus if a packet not encrypted with your credentials comes in with source 1.2.3.4, it's not from you but from a spoofer; if a packet encrypted with your credentials comes in with source other than 1.2.3.4, you're a spoofer; and last but not least, no one can send a packet encrypted with someone else's credentials.

given the above, i'd like to know

is my understanding correct (i.e., can one easily identify IP spoofers and IP spoofed packets under WPA-Enterprise)?
is it standard/common or unheard of/uncommon for routers to drop/reject spoofed packets under WPA-Enterprise?
in the latter case, does anyone know of any (ideally OpenWRT-compatible) packages that do this or alternatively have any pointers about where to start to implement one?

thanks!

I don't think there is any inherit protection against IP address spoofing in a WPA-Enterprise environment and from a security preservative,  this doesn't really matter because there are other implicit mitigations against ip address spoofing.  Snort and other NDIS solutions have rule-sets to detect IP spoofing,  and ARP table poisoning.  These technologies are usually deployed in an enterprise environment.

Being able to spoof the ip address of another member on the network isn't very helpful if you can't see the response. WPA-Enterprise uses a unique key for each member on the network so you cannot see the response (and you could see this repose if the wifi was unencrypted).

MAC address spoofing and ARP table poising are much MUCH  bigger threat than ip address spoofing.  You can always forge a packet with an arbitrary source address,  if you are unable to receive traffic on this IP address then you cannot complete the TCP three way handshake,  and thus unable to establish a TCP connection.  UDP and ICMP are fair game,  but even then there is a very limited impact.


How could one avoid virus infection via software updates Almost all useful software get updated with time. Operating system updates, I "guess", might be less stringently checked by the normal anti-virus programs, since their sources could be considered to be fairly trustworthy. But what if the updates were in fact virus infected and anyway exceed the capability of the anti-virus programs employed? I ask this question because in a recent news about a variant of Flame a security expert is said to have suspicion of the update system of a popular operating system being infiltrated by certain secret services. Is that an inherently hopeless issue?

Updates are usually digitally signed with the private key of a digital certificate, which can be later verified by the operating system using an embedded public key. If the signature is invalid, the update is not installed.

In the case of Flame, they exploited the fact that Microsoft was using an MD5-based certificate on a particular code signing server. MD5 is vulnerable to collision attacks, which allowed the creators of Flame to create a fake certificate and sign their executables as being created by Microsoft. The certificate has since been revoked, and Microsoft have (supposedly) ensured that all their certificates now use SHA1 or better.


CSRF methods: img vs iframe vs form/javascript I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an email message that sends two malicious requests to a web app the that the recipient is logged in to. The first request sets a money transfer amount. The second is a confirmation request sent when the user would click "confirm" on a confirmation page.

I solved the task using JavaScript code that sends the requests as HTTP Post requests. I suppose another option would be using forms and JavaScript to submit the forms automatically.

My question is why do most people seem to solve the lesson using img tags or iframes with src set to the target URL with the necessary parameters? I'd expect a money transfer to be done using HTTP POST requests, not GET. Is there an aspect that would make using JavaScript code or forms an invalid or problematic method for CSRF? Is there a practical difference when compared to the aforementioned tasks? I believe authorization isn't it because you can have cookies sent JavaScript fetch and when submitting a form.

I can think of two major reasons why one might favour using img and iframe over a JavaScript proof of concept for the scenario you described above.

There is this common mentality that I see among members of the security industry that simplicity is key when it comes to building proof of concepts. You will often encounter people trying to build the shortest payloads to exploit specific issues. Based on personal experience, your proof of concepts tend to be easier to understand and to share with fellow security researchers (this isn't always the case though as we see with XSS polyglots [1]). On top of that, it is also fun to try to shorten your payload (see "Code golf").
When it comes to exploiting the issue, an adversary will probably want to cover as many edge cases as possible. Some users disable JavaScript in their browser which would render your exploit harmless. A non-JS-based exploit would solve this potential problem.


Certificate authentication with jQuery's ajax() function I need to sync with my server with the client certificate abc.pfx which is generated by the server using Ajax. How do I send my certificate with Ajax object. Can I do this certificate authentication with JavaScript?

There is no interface to SSL authentication (either server-client or client-server) from JavaScript. It is all dealt with by the browser UI.

On IE, you may be able to use the CertEnroll (previously XEnroll) ActiveX control as a way to get a newly-generated key into the user's keystore; otherwise you would just have to require them to install the certificate themselves.

Either way, when a request is made that requires the client cert - be it AJAX or normal web page access - the browser is repsonsible for using the cert (which may involve popping up a dialogue for the user to pick which cert they want).


Has my network/computer been breached? I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes.

A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to change my password. So I did, and went on with my business. All fine and dandy, until about a week or two ago. My Skype name had suddenly changed to "Dick" instead of "Dirk". It couldn't have been any of my coworkers, considering my laptop hadn't been turned on prior to it happening. Later, the same thing happened to my Hotmail account, Hotmail claiming "there had been an unusual amount of spam and/or junk mail coming from my address". Ever since this point, I've been a little paranoid and changed every single important password.

It had gotten me a little curious, so I went out out of my way to regularly monitor the active connections and bandwidth usage. Most of the time, the usual: Skype, Chrome, my games etc. However, I was just checking again and there were an unusual amount of (assumingly) failing connections coming from the same IP address, with incrementing ports each time. I'm by no means an expert in networking (hence this question), but this most definitely raised a red flag for me.

Here's a screenshot of it. By the way, "Kan gegevens van de eigenaar niet verkrijgen" roughly means "Cannot retrieve data from the owner".

Should I be wary or am I fine? If I'm not, what should I do?

Thanks in advance.

If you find such unusual traffic again, use tcpview to find the application which generates/listens to that suspected traffic, tcpview is capable of giving you the path to the application listed in its view. Test the respective application  with your updated anti-virus software or upload to online virus scanning tools. More detective work on any process could be done using Process Explorer. Check the start-up applications during system bootup or login this could be done with Autoruns for Windows. Think before you re-installing the OS.
One I had similar situation and end up finding a Trojan horse in my pc, OS re-installation was not necessary in that case.


Is enough to remove ".." from strings to avoid directory traversal attack? Lets say I want to build a simple PHP script that let me access files inside a folder:

$path = $_GET['path'];
$path = str_replace('..', '', $path);
$path = "./static/" . $path;
readfile($path);

Is the line 2 on this example enough to avoid people reading files outside the 'static' folder?

I can't presently think of a good reason why removing all ".." strings doesn't work, but the most appropriate way would be use the realpath() function and ensure the start of the string matches the intended full directory path.


I store my passwordstore.org data in the cloud. Are my passwords safe? I use pass to manage my passwords and sync this manually to a private git repo in the cloud.

I believe this is safe because the repo is not public and, more importantly, the data is GPG encrypted.

Am I at risk doing this?

Pass leaks the names of the entries: if your password is named web/site.com, it will be stored in the file ~/.password-store/web/site.com.gpg, and in the git repository it will just be web/site.com.gpg.

So anyone with access to your repo (in your case: github) is going be able to see the name of your passwords. This is not so great for privacy: say there is a file named web/pornhub.com.gpg, this might give a hint about your browsing habits ;)

Moreover, the size of the files might also gives a clue about which accounts might have small passwords. If a file is very small, chances are that your password is small too. An attacker could use this information to select which account of yours is most likely to have a weak password.


Are there any workarounds for CVE-2017-0561 (Broadcom Wi-Fi remote code execution) on Android? Google has developed a fix for a critical remote code execution vulnerability in Broadcom Wi-Fi firmware. There is a huge amount of information (and possibly this) available around it, but as an end user my primary concern is this: how do I avoid being hacked while waiting for a patch?

According to the detailed report this specific problem can be triggered by specifically constructed Wi-Fi packets. From my understanding this kind of attack should possible for an unauthorized attacker and it does not matter if the victim is associated with a Wi-Fi network or not.  This means that the only workaround to protect a vulnerable device is too completely disable Wi-Fi.


Block OS fingerprinting without using iptables? I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but that stops the communication altogether on the port. Is there some other solution to this so as to block only the OS fingerprinting and not the communication using nmap or any other tool?

OS fingerprinting also detects OS depending implementation specifics in network responses. A simply port block will not work. For these specific topic an application proxy with a different OS could make your Windows PC invisible.


Viruses on video cards? Steve Gibson of Security Now fame claims that viruses can attack a video card and infect it. I assume that he means it can infect the Video BIOS. However I'm skeptical. BIOSes are so numerous and different, what are the chances of someone writing a virus to infect the Video BIOS?

Any clues?

It is certainly conceptually possible for a virus to attack firmware such as video BIOSes. The virus would have to be tailored for each firmware, so there would have to be a large variety, but that's only an economic argument, not a technical argument. The economics means that you're only likely likely to see firmware viruses in targeted attacks (where at least part of the virus development is specific to one target) or in attacks against popular, standardized hardware platforms (iPhone attacks technically count here).

For an example of a real firmware vulnerability, try CVE-2010-0104: Broadcom NetXtreme management firmware ASF buffer overflow. This is a bug in some Ethernet firmware that allows a remote attacker to take control of the network firmware (and so at the very least actively attack all network traffic), and potentially of the whole computer (I don't know if there's an exploit for that, but once you have access to the PCI bus, I doubt that much is barred). Interestingly, the bug is in a remote management protocol parser, which in particular handles wake-on-LAN — so a computer is more likely to be vulnerable when it's switched off.

At Black Hat USA 2012, Jonathan Brossard presented “a generic proof of concept malware for the intel architecture, Rakshasa, capable of infecting more than a hundred of different motherboards”. The proof-of-concept (not publicly released) infects many BIOSes and common peripherals including network chips. It's only a matter of time until someone adds support for video cards.


Prevent DNS leak in terminal I understand how to fix DNS leaking in browsers.

My question is, what happens when you use tools like OWASP, nikto, recon-ng or any tool for that matter that can take a URL?

It's obviously going to have to resolve the URL into an IP somehow so it must be using a DNS server. Is there a OS level setting in Kali that would forward all DNS requests to a random DNS server?

You can do this yourself. Just edit the /etc/resolv.conf file and add the IPv4 and IPv6 DNS servers. Most modern operating systems cache the requests to limit unnecessary requests, you might want to flush this first. Restarting the network interface will do.


How can I protect my "try it with one click" service? I have a service with "try it now" experience that currently offers a "one click" effort.

This service has a pool of N resources (lets say 50).

Each new resource takes about 1 hour to generate.

How can this service be protected from a malicious user to empty my pool of resources?

We have circled around some suggestions but so far nothing seems to resolve the issue:

Using email validation (emails can be easily faked today - for example with yopmail)
Using some external Login (Google , Facebook etc.. ) - again, users can open as many accounts as they want.
IP request throttling - IPs can be changed easily.
Services like Incapsula or Cloudflare can't really help in this scenario.
Captcha will have no effect

Serious candidates have serious user-experience implications and do not seem to be sustainable - such as call each user that wants to run the demo and talk to them, and then manually pass them some link.

perhaps using email validation with some sort of email blacklisting by regex (e.g.: .*@yopmail.*)  can do the job.

What is the right way to tackle this scenario?

First idea: Use SMS or automated phone calls to give a one time password. Put their phone number on blacklist after this. You can use any SMS authentication cloud service, or any phone based authentication cloud service for this.
Getting a new mobile SIM card or phone number is too cumbersome for a user to get Another free resource.

However:

This is a question many companies struggle with.
Most companies solve this by simply requiring setting up a payment method to try the service. I guess you meant that 1st is free and the rest cost Money.

Then you simply do that to get the 1st free, they have to enter their credit card number, like they will have to pay. You can then put that their credit card number has got 1st free resource. Next time they try with the same credit card, they will be debited.

Of course, according to PCI DSS, you are not allowed to store plain PAN's. However, when you use a external payment service, you does not need to care about PCI DSS, and you will many times get to hold a obfuscated version of the CC number, something like:

1234 5678 **** 1234

thus you can still identify returning users.
You will simply do this by debiting the user the full price of service (since the external payment provider will debit all entered CCs with the price you passed them, even if its a free user). But if its a free user, your system will sense that the obfuscated CC is "unknown" and immediately process a refund, causing the Money to go back into users account within a week.
Make sure to inform that the Money will be pulled temporarly from account when getting free service.

Most companies use this method, even large companies like Netflix, spotify and Google, to prevent people from getting multple free months. Many VPN providers also use this method to prevent users from aquiring multiple trial accounts.

Getting new cards from their CC provider cost Money in most cases, and is more expensive and cumbersome for the user (for the purpose of getting more free trial time) than actually paying for the service.


Thinkpad X1 Yoga refusing to restart. Was this a regular Windows failure or due to a hack? So I tried to copy ~200MB worth of files to a blank CD and after starting that operation, I tried to move those files to a different folder on the internal SSD, which caused the CD write operation to fail, corrupt and make the CD unreadable, and Windows Explorer to freeze until I used Task Manager to force it to close and restart it.
I did retry that operation on another blank CD, which appears to have all its data intact, so I think that operation completed successfully.

Anyway, I then tried to restart the computer which made it get stuck on the red "Lenovo" logo with the words "Press Enter to interrupt normal startup" for a few minutes (pressing Enter didn't do anything) until I restarted it again while repeatedly pressing Enter until I heard the beep.

I then tried to use the built-in repair tool, which prompted for my Bitlocker recovery key, so I decided to use the command prompt with sfc /scannow, which was unable to be performed, so I tried sfc /verifyonly, which confirmed that it found integrity violations.

So do you think my computer was hacked or was this just a botched Windows Update (update KB3194798 came out right before I tried to restart)? I've been hacked by China at least once or twice before in the past two years, but it doesn't make sense that a government hacker would modify system files if they knew that Secure Boot may or may not be enabled (which would reveal the hack for a questionable reward if they already had the ability to do that anway), so I think there's only a small chance this was an actual hack.
Unless of course, they didn't expect the built-in BIOS Device Guard to be enabled and that was what caused it to refuse to boot into Windows?

And since everything except the kernel and the system files needed to show the login screen would be encrypted and therefore unreadable by the recovery OS, it's only a small number of files that could have been corrupted by a freezing Windows Explorer operation.

What can I do to further diagnose this problem without risking more data being leaked (assuming it was a hack) and/or the BIOS itself from being hacked (and forcing me to trash another $2000 machine)?

Summary of my setup:
This is on a ThinkPad x1 Yoga running Windows 10 Pro with Secure Boot enabled
- Built-in Device Guard (not the Windows 10 Device Guard) was enabled
- Firmware password was enabled (but BIOS updating was enabled, though rollback prevention was enabled as well)
- And of course, since I carry this thing around with me, Bitlocker with TPM and PIN was enabled, and I don't see how someone could have had physical access to the machine itself

Machine specs:
i7-6600u with vPro
8gb RAM
1TB SSD
Mobile broadband
Wifi and Bluetooth was not disabled

UPDATE: I just disabled Device Guard in the BIOS (leaving every other setting untouched, including Secure Boot) and it asked me to type in my recovery key because Secure Boot settings were changed, so I changed the setting back. Then it still asked me for the recovery key, and after typing it in, Windows booted up successfully. Is that a bad sign? How would disabling and reenabling Device Guard "fix" the problem?

UPDATE 2: I just went back into the recovery OS and ran sfc /verifyonly and it still found integrity violations (keep in mind that it still can't access any files encrypted by Bitlocker), but I thought Secure Boot would have blocked Windows from booting up if it found problems with the kernel (which would check the other system files before booting)?

UPDATE 3: Today I went into the BIOS to disabled all wireless interfaces and logged into Windows and used sfc /verifyonly again, which didn't find any integrity violations, even though sfc /verifyonly in the recovery OS did find integrity violations (I just did it again to be sure)

Many users tend to blame computer failure on getting "hacked", I'm glad that you are open to the possibility of it being something else. You very well could have been hacked.

From experience, when I have a problem like that, it is a botched or corrupted update. I had a little bit of connection trouble during an update, and somehow (maybe it didn't verify the md5) my computer just died. I did a fresh install, and everything worked again.

Considering you have bit locker, I would decrypt everything, then use another os to try to rescue all the files, then do a fresh install and put everything back.

I hope this answers your question, if not please tell me in the comments so I can fix my answer.


Wrapping system call (in reliable and secure way) It there reliable method of "wrapping" system calls under Linux ?
(Like LD_PRELOAD for wrapping shared library function calls.)

Is there reliable, secure method of "wrapping" system calls (and, maybe receiving signals), that process can not break (assuming proper Linux implementation) ?

Yes.  You use system call interposition.  One portable method is to use ptrace, though this can introduce a non-trivial performance overhead as it forces a context switch on every system call.  On Solaris, you can use /proc; /proc lets you specify the subset of system calls that you are interested in wrapping, which lets you achieve better performance at the cost of compatibility.

Take a look at Plash, Systrace, and Subterfugue, to see some worked systems that use these sorts of methods.  Also look at Chrome's sandbox, which uses a variety of mechanisms (including seccomp on Linux).


How can clicking a link in a Facebook users news feed compromise their account I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared to be some kind of Phishing scam. "99% of people couldn't watch this for more that 1 minute!!!" etc etc. We've all seen it. Clearly their account had been compromised and some malicious software or human was posting this content on their behalf.

Reading through some of the threads here I came across this : Don't understand how my mum's Gmail account was hacked

This seems like a similar scenario but I've been told reliably by my friend that they didn't input any credentials recently to sites that were anything other than Facebook. Of course we all know that a good Phishing site will indeed be indistinguishable from the site it is trying to capture details of users from.

So my question is two fold:

How can clicking a link and browsing to a page, without inputting any credentials compromise your account.
How can sites that do get control of your account by asking for credentials through what appears to be a legitimate site still appear to have the right URL.

Thanks everyone! I'm very interested to hear any response.

Though I'm not much of a Web security person, there are at least three ways for your account to be "compromised":

You installed a malicious browser extension: as long as you have a cookie allowing you to autoconnect on Facebook, it may be able to go there and use your account as it pleases (that depends on what the extension API of your browser allows, I'm not up to date with that). It could also spy on you when you login and steal your password. Solution: don't install dubious browser extensions!
You installed a Facebook app: if it asked for the permission to post on your behalf, look no further. Usually those apps also ask for some information about your contacts and/or your account so they have a means to spread and some data to sell. As a rule of thumb the vast majority of Facebook/Android/iOS free apps are here to steal and monetize your data.
You visited a page asking you to connect with your Facebook id: usually to "verify your age". These get you to connect on their page and then make your browser run a JavaScript routine that'll post on your behalf. How exactly? I'm not sure, that depends on what the JS engine of the browser allows (e.g., can you influence the contents of an iframe from the outside? can you simulate clicks or text input in that frame?).

Hopefully someone can develop a more precise answer.


Prevent users from copying sensitive data I got a strange requirement as part of a recent project that our company is involved with. The project involves sensitive information and hence the data is restricted to only the team members involved in the project. We have a network share, and the NTFS and Share permissions have been secured to allow only the members of an active directory security group (this security group has all the project members).
The members of this security group can Create / Modify / Delete files & subfolders inside the folder.
The real requirement now is to stop these users from doing the following activities.

Copy the files from this folder or subfolders to another location
Restrict users from opening the word document (or any other type of document), use 'Save As' function to save it to a different location
Open the word document (or any other type of document), copy the contents to a new document

Is there a way of achieving this requirement? Any help / guidance towards achieving this is fine. I can research more on that and come to a conclusion. Thanks for your suggestions / help on this.

When someone can read data they can also copy it.
Preventing copying and/or distribution of data is an age old problem in the entertainment good industry. Data such as movies and games are protected via DRM (Digital Right Management).

If the project members look at the data from their work computer then it doesn't matter how well-secured the folder or the document editor is. They would still be able to use a phone camera to record their screen and/or use pen and paper to copy the information. Similar to how you can copy a copy-protected movie by recording your TV with a camera or video recorder. They might be able to remember the more interesting parts of the document which is also a kind of copy. Similar to hoe you don't need pen and paper in order to spoil your friends about a movie plot twist.

We could have a separate secured room which is guarded like a previous answer stated. But I assume this is too expensive and/or unpractical for your use case.

Your best option is to enforce the copy-protection via contracts instead of using expensive physical means. Let the people of the project sign a non-disclosure agreement.

(Please notice how I use "movie" as a consumer-grade anology to showcase that digital means of static content copy prevention only has marginal to none effect)


How can I detect possible spyware/keyloggers in my computer? The reason is because of a recent data leak. I suspected that someone may have inserted keylogger to my computer. (a software, trojan).

Some people think that the only way to really make sure there is no trojan or keyloggers on my computer is to reformat the computer.

Some think that there are other things that's also almost 100%. Things like checking which program to start.

What are those other things? What can I do to detect (and then remove) any keylogers or trojan from my computer?

What I used
1. I used Malwarebytes.
2. I think someone would use other software like hijack this and stuff.

What else can I do to ensure that nobody can keylog my computer?

Some of the answers are here

https://www.wikihow.com/Detect-and-Remove-Keyloggers
https://electronics.howstuffworks.com/how-to-tech/how-to-scan-for-and-remove-spyware1.htm

I could use something more low level. Like scanning any start up programs.

I wonder if there is anything else. Hijackthis? Other scanner I should try?

I may be just paranoid and there could be no keyloggers at all in my computer. However, I handle financial sites and the last databreach cost significant amount of money.

You could check who is hooking the keyboard API in the system using something like this or this and work back from there.
However there are many other techniques to achieve this so unless you are experienced with win32 systems and plan to spend a bunch of time I would recommend you to just do a clean install.

p.s
If you want to validate your assumption you could create a new account somewhere and monitor whether someone logs into it, sort of a honeypot account...


IIS password protected website I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows login account as website logon account.

However this will cause security leak because the there is no https connection so the windows logon password is transported on the network in "clear text". If anyone captured the password he/she can use it to logon the server. So can we use HTTPS in this case?

Or if we can use https, there is another concern which is that we don't want the website user to logon the server using that same windows account. We only want the user to access the website but not the windows server. Can we disable this particular windows account user to login the windows while allow this user to access the password protected website?

When doing any kind of web based authentication you always want to perform the action over an encrypted channel. So, yes. Get a cert and turn it on. You shouldn't have any problems.

Forbidding access to the server itself, when using machine accounts, is definitely doable but can sometimes be tricky depending on your exact use-cases. First, make sure the user accounts are in neither the Administrators nor Remote Users groups. This will prevent Terminal Services connections.

You will also want to forbid them from logging in locally. I don't have the necessary Windows expertise to explain how, unfortunately.

As an additional step, I would also make sure you firewall rules are appropriately restrictive. If the users can't hit port 3389, then they can't Remote Desktop even if they have an account.


How to distinguish malware from system crash? Recently, I browsed to a website, which appeared to consume all the computer's resources.  Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon stopped responding to commands. The screen did some odd things - coloured boxes of pixels where I would normally see text, etc. After a short time, the machine rebooted itself.
I was able to repeat the same behaviour with more than one browser, and more than one window manager (it is running under linux). Note that I visited the url but did not explicitly download any files, etc.
I checked the logs after a reboot, and it shows that the X server suffered a segmentation fault.
If that had happened in everyday application use, I would just assume that the application had a bug. However, because a website was clearly the catalyst, I wondered whether malware may be involved.
It seems plausible to me that malware has nothing to do with it. A quick web search indicates that a segmentation fault on X is a problem that has occurred before, and is broadly consistent with the other things I saw. (How a website could cause that, I don't know, but it does look like the simplest explanation.)
But I realise that if malware is the cause, I wouldn't know the difference.
Is there any sensible way to corroborate that this was not caused by malware?
I realise that in theory that could never be ruled out entirely.

Indicators of compromise may be in the memory, files, network traffic.
Try looking for the logs, maybe you can activate some of them (secure, auth). Try monitoring the traffic using a sniffer in the same machine or in the network gateway, looking for differences before/after reaching for this site.


How can I prevent forwarding a manipulated email? How can I prevent someone from modifying the contents of an email they received and then forwarding it to others?  Some employees cheat managers by changing the content of emails and forwarding the modified email to them.  I need  a policy  that  prevents this backdoor.

Email is unsafe -- deal with it.

Email can be made safe for an adequately defined value of "safe", through the use of signatures (S/MIME or OpenPGP). This is not as easy as it seems (I mean, it does not look easy, but in reality it is worse). The cornerstone of the system is that unsigned emails should be rejected automatically; human users should never see them at all, because if they read them, they will always believe them a little, regardless of how much you may have explained to them how insecure and unsafe plain emails are. Therefore, switching to signed emails is like a big jump into the unknown. In practice, it is essentially a way to break emails (or to induce users to switch to gmail...).

What you can do is to educate and then to educate again:

The smooth education: explain to your users how untrustworthy email is as a medium. Show how easy it is to forge an email (e.g. with this answer). Try to prevent the "wizardry effect" which makes most human beings lose common sense as soon as a computer is involved (as Clarke was putting it, computers are beyond the "magical horizon" of most people -- solution is to make them understand how a computer works). As a bonus, this makes the users more resilient to phishing.
The less smooth education: let all the might of the Law fall on wannabe fraudsters. Have it known that the slightest phony game with email is a shooting offense; the guilty will be fired, jailed, shot and flogged (not necessarily in that order). The idea is to make faking emails not worth it. This works well: this is how the non-computer world deals with handwritten signatures, and it has done so for several centuries.


Does the separation of the OS partition (C:) and data partition (D:) in Windows increase security? I have to manage the security of thousands of laptops. Nowadays our laptops have two partitions, C:, hidden to users but accessible and D: where users store documents, images, etc.

Do this separation increase security?

My opinion is that with correct permissions, in Windows, the separation of partitions does not increase security because what is most important are the permissions and the separation of the partitions do nothing.

Can I put everything in C: and mantain the same level of security?

Related: If there is a malicious attack on one partition, is the other one safe?

My opinion is that with correct permissions, in Windows, the
  separation of partitions does not increase security because what is
  most important are the permissions and the separation of the
  partitions do nothing.

You are quite right. Malware is not concerned with partitions, although I recall a few that do. Partitions are just a division of space that makes sense to the user (Docs on D, games on C, etc..).

I must note; this applies to Windows, but in Unix it is well known practice to separate partitions and mount them with special permissions (nodev, nosuid, noexec) and this does increase security.


If a hacker were to obtain a shipping tracking number what could be compromised? Lets assume you just bought something and it is getting shipped via a major package shipping agency (such as FedEx or UPS etc.).  You are given a tracking number which you can use to view where the package is.  Now somehow a hacker is able to obtain this number.  What could possibly be compromised?

Would the hacker be able to change the package destination to themselves?

Could the hacker steal personal information from the number (assuming the did not obtain any from the original method they got the number in the first place)?

An ideal answer would include a comparison of the different package carriers and additional information that could answer future questions

I just had my iPad shipment re-routed from FedEx to a local store where the thief signed for the package with a name almost exactly as mine.
I ordered the iPad via cell phone/internet without wifi connected.
I checked the routing a few times via the same cell phone...

Somehow the thief now has my iPad and FedEx says there is nothing they can do about it.


How to identify which storage USB device is BadUSB-free at store? Are there certain things I can look for when buying a new external hard drive or flash drives to ensure that the one I purchase does not contain BadUSB? Would popular commercial brands, such as Seagate, be a safe choice?

Popular commercial brands are not going to have the BadUSB exploit "installed" when it comes from the factory.

You must understand how the badUSB exploit works. BadUSB is an exploit that can be executed against almost ANY USB drive. It's not something that can be exploited on some vendor drives and not other drives.

For your drive to become compromised, one of three scenarios would need to happen:

Vendor gets compromised and unknowingly starts sending out USB devices with firmware malware (BadUSB) installed.
Someone gets their hands on your USB drive and compromises the firmware without your knowledge.
Malware on your PC infects your USB device's firmware.

The chance of any of these scenarios happening are honestly quite small.

A quite detailed blog article by Sophos security on this topic can be found here:
https://nakedsecurity.sophos.com/2014/10/06/badusb-now-with-do-it-yourself-instructions/


How does Google know who I met and in what room? Last week I took my wife to see her new doctor doctor who is independent and located in the same office at 7 other doctors. Today I noticed that the doctor's name was on the map not the office building not any of the other doctors but the specific doctor that that my wife met. And I never even met the doctor nor have I received any emails from this person just one phone call during the week. I never went inside the office but was just in the waiting room yet out of the seven doctors she was identified in Google Maps. How?

Facts

If you type the building address on Google map Your wife's doctor name appear but not the others docs working in the same office.

Google map

If you know the other doctor's names, try to search them on google map.
By doing this lookup, we can eliminate the possibility that this doctor of yours is the only one among his colleague who is registered on google map.

If none of the other doctor's name point to the building, you can assume that, for google map, your wife's doc is the only one who works there.

Google map relies on its users, it waits for them to feed the app with data. For example, if I activate the location on my phone (Android), Google will trace my movement, ask me to rate the place where I eat, if my work office has an elevator, or if my train station is open still open at 1 am.

Most of the time google map questions are accurate. On rare occasion, the app has misunderstood my movement. For instance, I was chilling in a coffee shop, the app thought I was in the dentist's waiting room next door and asked me if patients can receive a treatment without an appointment.

Google is a data gathering freak.

Answer

Being logged into her Google account, your beloved one went in the building with the location activated on her phone.
Your wife's doctor, you or your wife book the appointment in google calendar using Mail address that Google knows about.


Receiving Junk Email that is related to Skype conversations My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft).
This account is not linked to my phone (Android).
I don't use this account for Email (I use Gmail for email).
Absolutely sure I don't have private data/conversations in OneDrive.

Today I have looked at my "Junk Email" on my Microsoft email account.
I have a number of spam emails about "tinnitus", "tired of that ringing in your ears", "the sound from inside your head".
And emails about "home security equipment", "loan", "keep your home safe", "never pay for covered home repairs".

I had conversations about these 2 subjects recently on Skype (in the past months).
I don't use Bing or Cortana to search about these subjects. I always use Google on Google Chrome to search.

This makes me very worried, as this makes it very suspicious that my Skype chats are being shared with 3rd party or similar.
I really can't think of another way these spammers would know that I have interest for "tinnitus".

Any ideas or explanations?

When you search on Google or Bing you have an advertising identity associated with you. Any terms that you search for then become part of that profile. Your keywords of interest are then sold to third party advertisers who can then target you for future adverts. These advertisers then share the data between each other in data markets, each adding in whatever information they know about you in order to build a more rich profile. They want to know things like your age, your gender, marital status, what car you drive, what sports you're into, etc. so they can show you ads that you're more likely to click on. This is often called "tailored advertising" or "customised advertising".

Now, technically those advertisers shouldn't get your email address. My guess is they've correlated it from another advertising platform that didn't properly redact your identity. This is common practice for shady advertisers and there are hundreds of them out there, so it's hard to track.

If your concern is that advertisers are snooping on your Skype conversations, I'd say it's unlikely. That kind of advert metadata extraction is done on some platforms (e.g. Facebook messenger conversations on the web client) but as far as I know it isn't done on Skype.


Is LocalStorage in web browsers safe enough to store passwords? I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage, before redirecting the user to the signup page.

The signup page then checks the LocalStorage and autofills the email and password from the previous page.

My question is, how safe is LocalStorage for storing that type of data? Storing RAW passwords in this fashion seems like it could be a bad idea. That being said, it is all local on the users device. It isn't being sent to any server or anything, so the chance of attack is reduced.

I've also considered deleting the item from LocalStorage after retrieving it on the signup page. Which would make it safer.

How secure is LocalStorage for storing RAW passwords and this type of data?

Terrible idea. Don't store the password in clear text between pages, not on the client and not on the server. Redesign your page flow (for instance by only entering the user name on the first login page, then branch to the registration page if it does not exist), or if you can't, let them re-enter the password.


Could an IPS have blocked an attack on a vulnerable router/firewall? Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-infecting-500k-devices/ .

Theoretically, could a Intrusion Prevention System (IPS) appliance (Snort, Suricata, Cisco, Juniper, Barracuda, etc.) placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

More interestingly, is anyone aware of any evidence that an IPS did block such an attack?

Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

Usually, IPS is seen as a tool to protect end-users from malware, though, as more websites are encrypted, IPS is seen by some as moot since it cannot easily inspect such encrypted traffic. But could it still be useful to block attacks on the router/firewall itself?

Theoretically, could a Intrusion Prevention System (IPS) appliance ... placed in between an ISP/gateway and a vulnerable router/firewall have blocked the attack, assuming a matching signature was already installed in the appliance database?

There are several parts of the attack which could be used for signatures:

The initial infection, which was maybe done by accessing the remote management interface of the to-be-infected systems. While attempted access to such interface might be considered malicious in most cases there are still valid reasons for such an access so a relevant signature might result in false positives.
The C2 communication after a successful infection. According to the available information the communication was done using Tor or SSL. The use of Tor itself might be suspicious but is also legal, so the chance for false positives is here too. SSL is hard to analyze but one might only check SSL to specific destinations  and then check for atypical client-side fingerprints (i.e. ClientHello). But again, the chance for false positives exist.

If you look at the report from Cisco you'll see at the end the coverage for this issue by Cisco products and you'll see that it seems to rely on detecting the C2 communication.

  Or–even if blocking such an attack were possible–would it have been too late if this was in fact a zero-day attack?

While the initial infection might have been zero-day (or not, since systems with known issues were attacked) the later C2 communication was not. Thus the ISP might not have been able to protect systems against infection but might (with maybe considerable efforts) be able to detect infected system and limit what they could do by informing the customers and/or limiting traffic from these systems.


Hosting an "IP Rental" address. Is this common, safe? I have a supposed opportunity to get in with an individual with advertising and a side business of his, renting IP addresses. He has asked me to set a dedicated DSL account at my house. Is there any risk for me? I have other devices on a separate DSL account and modem. I'm a novice at networking and not too advanced on computers, just wondering what my risks are, if any, of him taking advantage of me, due to the amount of scammers and hackers?

Yes, there is significant risk to you. The value of allowing someone else to "rent" access to a DSL connection at your house is so that they can pretend to be you in their online behavior. If it's your name and address on the agreement with the ISP, then typically you're the one responsible for what happens on that connection. Actual legal liability varies by locality, but your exposure it typically pretty significant.

There have been several instances all over the world (Austria, Germany, USA, and others) where individuals have been arrested and charged because of illegal traffic (usually child porn) going through their Internet connection (typically TOR exit nodes).

Whatever this individual is planning, there's a decent chance that it will end up with you in jail.


OpenSSO and Basic Auth together Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that OpenSSO allows for an Exclusion List, but I'm wondering if Basic Auth will still be enforced by the Apache webserver?

For example, this is what I would like to happen, I'm just not sure if it would actually work:

User requests url.com/open_area
OpenSSO recognizes that open_area should be left unprotected.
open_area is protected by an ACL in Apache, so Apache denies with response 401, or accept if Authorization string in Http Request is correct.

Yes, you can combine several authentication methods using the Satisfy {any|all} directive.

To apply BasicAuth only on some URLs, matching a pattern:

SetEnvIf Request_URI ^/webservice/* do_basic_auth
<IfDefine do_basic_auth>
    AuthName "Authentication"
    AuthType Basic
    AuthUserFile /somewhere/.htpasswd
    Require valid-user
</IfDefine>


Could a request sent by a XSS attack in a change password module be cosidered as a CSRF? My partner was testing a web application and he found a XSS vulnerability on a change password module, this module places the old password in a hidden field, then it's possible to use a XSS attack to change a password of a user, because the old password can be got by XSS exploit. Also this module doesn't use a token or CAPTCHA to ensure if a request is valid, then my question is: could this vulnerability be consired as CSRF? Why?

I'm not sure because if I mitigate XSS vulnerability and change the hidden field by text field to ensure users introduce their old password a CSRF could'nt be exploited. My partner told me that it could be considered a CSRF because althought we don't know the old password, the web application doesn't use a token or CAPTCHA so we can change a password using brute force and this a kind of CSRF. Is this correct?

I wouldn't classify it as CSRF.

The protection mechanism that is failing here is XSS protection, not CSRF protection; If there would not be an XSS vulnerability, you could not perform a CSRF attack. It is true that all XSS vulnerabilities can be exploited to bypass all CSRF protection that are not challenge-response based (passwords, captchas, etc), but that doesn't mean that all XSS vulnerabilities should be classified as CSRF.

There is also no separate classical CSRF vulnerability here. Even though there is no token protection, the form is protected from CSRF via a challenge-response mechanism as a password is required. Your partner does have a point regarding the bruteforce scenario via CSRF though. I would consider it a vulnerability if there is no bruteforce protection for the form, and I would suggest adding whatever CSRF protection is used in the other modules. I would classify it as a bruteforce vulnerability (via CSRF) though.

Apart from that, the fact that the password is even shown is a vulnerability by itself, as is the fact that the passwords are apparently stored in plaintext; You should first check though that the password is actually given by the application, not by the browser- or a plugin-based password manager.


Does anti-virus/security software protect against NTFS ADS? I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?

Symantec says yes for at least two version of their Entreprise products:

  Problem

  Can the Symantec Endpoint Protection (SEP) product scan and detect
  virus or other malware stored within NTFS Alternate Data Streams?

  Solution

  Yes, Symantec Endpoint Protection 11.0 and 12.1 is able to scan and
  detect threats within NTFS Alternate Data Streams (ADS).
  Realtime Protection or File System Auto-Protect can scan within
  Alternate Data Streams associated with both files and folders.

Source: http://www.symantec.com/business/support/index?page=content&id=TECH173434


HeartBleed - How to detect compromised websites Is there a way to determine as an end-user which HTTPS sites use OpenSSL?  Due to heartbleed it is recommended that clients change their passwords that were sent over TLS recently as private keys may have been compromised so eavesdropping and MitM attacks were possible.

However, I haven't seen any notices from any HTTPS sites saying, yes we used OpenSSL, please change your password.  Is there anyone compiling a list of big sites?

Preferably including ones that are already patched, but use OpenSSL and quite possibly were vulnerable?

Yes, I've seen that there are HeartBleed checker tools, except these tools seem incomplete -- they only can tell if the site is currently vulnerable.  If a site is currently vulnerable, its quite possible that someone could MitM your traffic to said site with a copy of their private key (but on the MitM not be vulnerable to Heartbleed).

As an end user, not easily, unless an attacker brags about it or a site owner discovers it, you can't tell what's actually been lost.

For the technically adept, anyone (end user or site operator) running Snort or another IDS/IPS can look for indicators of realtime compromise in Snort rule form, as the attack can go both ways (your client can be attacked, too, if it's vulnerable).  This doesn't tell you if someone else has attacked the website in the past, but it might tell you if someone's attacking you right now.

alert tcp any [!80,!445] -> any [!80,!445] (msg:"FOX-SRT - Suspicious - SSLv3 Large Heartbeat Response"; flow:established,to_client; content:"|18 03 00|"; depth: 3; byte_test:2, >, 200, 3, big; byte_test:2, <, 16385, 3, big; threshold:type limit, track by_src, count 1, seconds 600; reference:cve,2014-0160; classtype:bad-unknown; sid: 1000000; rev:4;)
alert tcp any [!80,!445] -> any [!80,!445] (msg:"FOX-SRT - Suspicious - TLSv1 Large Heartbeat Response"; flow:established,to_client; content:"|18 03 01|"; depth: 3; byte_test:2, >, 200, 3, big; byte_test:2, <, 16385, 3, big; threshold:type limit, track by_src, count 1, seconds 600; reference:cve,2014-0160; classtype:bad-unknown; sid: 1000001; rev:4;)
alert tcp any [!80,!445] -> any [!80,!445] (msg:"FOX-SRT - Suspicious - TLSv1.1 Large Heartbeat Response"; flow:established,to_client; content:"|18 03 02|"; depth: 3; byte_test:2, >, 200, 3, big; byte_test:2, <, 16385, 3, big; threshold:type limit, track by_src, count 1, seconds 600; reference:cve,2014-0160; classtype:bad-unknown; sid: 1000002; rev:4;)
alert tcp any [!80,!445] -> any [!80,!445] (msg:"FOX-SRT - Suspicious - TLSv1.2 Large Heartbeat Response"; flow:established,to_client; content:"|18 03 03|"; depth: 3; byte_test:2, >, 200, 3, big; byte_test:2, <, 16385, 3, big; threshold:type limit, track by_src, count 1, seconds 600; reference:cve,2014-0160; classtype:bad-unknown; sid: 1000003; rev:4;)

Site owners might detect compromises on a site that was recording a full packet sniffer trace, and was actually able to inspect the response sizes of heartbeat requests; other than that, it's very difficult to detect after the fact.

Other possible ways for site owners to detect it would be traffic analysis - having sent too many outbound responses of just over 64KB would be a warning sign, for instance.

Right now, though, there are several Heartbleed vulnerability detectors/checkers that I'll list for the community.

Qualys SSL Labs is more or less the canonical free SSL test site; they added an experimental Heartbleed test hours ago (and set the security grade to F for every site that's found to be vulnerable.

titanous on github appears to still be under active development, and titanous also released Go programming code for Heartbleed detection, had better messages than Filippo as of this morning, and was last updated 32 minutes ago.  It appears to be under the Go license, though I didn't do a full comparison; similar to a BSD 3 clause license.

Filippo.io was one of the first Web sites, and they released their code on github with an MIT license (Go programming language), and was last updated 4 hours ago.

musalbas on github released the Python program "ssltest.py" about 10 hours ago that can do mass/bulk tests in only 178 lines (including a few comments), no license listed.  Musalbas also released lists of the results of scanning the top 100, 1000, 10000, and 1 million Internet sites as of about 7 hours ago.  This is a variant of Stafford's code.

possible.lv is another web site that does Heartbleed vulnerability scans.

Codenomicon Defensics appears to do detect Heartbleed as well.

@Lekensteyn released the pacemaker python client checker, modified a few hours ago, as well as the original Stafford version of ssltest.py.  No specific license is listed.

Metasploit is also gaining Heartbleed tests very rapidly, including both the server check linked here and a client check from @HDMoore and @Lekensteyn.

Per @DrJimBob, the LastPass Heartbleed checker is a very nice setup for a Web checker; in particular, it also checks the SSL cert!  Output looks like this:

Site:   security.stackexchange.com
Server software:    Not reported
Vulnerable: Possibly (might use OpenSSL)
SSL Certificate:    Possibly Unsafe (created 9 months ago at Jul 2 00:00:00 2013 GMT)
Assessment: Wait for the site to update before changing your password


Segregation of Duties of 3 tier Applications This is a tricky issue I'm dealing with at the office.  Management has a very... interesting concept of segregation of duties when it comes to traditional 3 tier applications.

I'm trying to figure out if this is an internal culture which grew out of a broken telephone game, or if it is part of some framework which I haven't encountered before.

Application Administrators
~~~~~~~~~~~~~~~~~~~~~~~~~~

                        Management       Me
                        ~~~~~~~~~~       ~~
Application Reader          X            X
Application Admin           X            X
OS User                     O            X
OS Admin                    O            O
Database User (ro)          O            O
Database User (rw)          O            O
Database Admin              O            O

OS Administrators
~~~~~~~~~~~~~~~~~

                        Management       Me
                        ~~~~~~~~~~       ~~
Application Reader          O            O
Application Admin           O            O
OS User                     X            X
OS Admin                    X            X
Database User (ro)          O            O
Database User (rw)          O            O
Database Admin              O            O

There are vague comments about ITIL, and other vague comments about "external" policies.  No specifics.

Does anyone know of any principles of segregation which might prevent an Application administrator from having any OS level access?

I'm specifically speaking of 3-tier apps.  Keep in mind the OS admins do not have expert knowledge of the Application.  Application Administrators are responsible for providing customized install guides to the OS admins, who quietly mess it up, leaving us to troubleshoot without access to see what they did wrong.

It sounds to me like a very fractured adaptation of a software development model, but I can't quite put my finger on it.

This is not something out of the ordinary but you need to keep in mind that, ITIL is not a set of rules but guidelines. It is upto each organization employing ITIL guidance, to set up their own interpretation of these guidelines.

And it is not unusual, although unfortunate, to have application admins messing up a procedure and handing it to the less knowledgeable personnel as gospel and watch them fail. Sometimes, again unfortunately, some of this effort is concerted, especially if the segregation of duties are fresh and they are resenting their privileges being stripped off of them.

Unfortunately there is no solution or explanation to the security rules in an environment, handling sensitive data. The best method I cam to realize is NOT TO avoid the steering committee meetings and assert your views on the security matters. I personally fought tooth and nail when they wanted to strip my team from accessing root account. At every organization, one or two people should be carefully selected and be trusted with these elevated privileges. Security decisions made in vacuum by people who don't know what goes into those decision but only making them because the decisions will make them look good on paper, should be avoided at all costs. If this means killing a couple of hours of your already busy schedule, sitting in nonsense meetings, let it be.