Amazon let me place an order without me ever being asked for 3-D secure password I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in amazon.co.uk, I went through the whole process without ever being asked for that 3D password. I was asked for a card number and its expiration date.

Can anyone explain to me what happened?

I live in Bulgaria.

Note: I also wasn't asked for CVC.

Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a merchant who chooses to use them as part of their card processing merchant agreement to obtain a lower transaction fee, on the basis that the feature reduce the rate of fraudulent transactions and thus chargebacks.

If anything, these features actually hurt you as the cardholder, as they make it easier for the merchant to "prove" you authorized a transaction and harder for you to dispute it. See my answer to a related question here:

https://money.stackexchange.com/questions/54772/why-does-the-introduction-of-chip-pin-appear-to-be-so-controversial-in-the-uni/54780#54780


"Vaultless" or "Reversible" Tokenization - Is it really just encryption with a fancy marketing name? There are multiple vendors of products that claim that their products perform what they have called vaultless tokenization or reversible tokenization, without storing the token and associated tokenized data. However, they also say that tokenization is not the same as encryption, and that they have a proprietary algorithm which tokenizes and de-tokenizes input data.

My question is - isn't this really just fancy encryption (and if it keeps the shape of the source data, possibly even less secure than typical encryption)?

I thought the original idea behind tokenization was that you generate a set of pseudo-random data, assign that pseudo-random data to the input data, and store the mapping between the two in a hardened vault. If you then store the tokens in your less secure systems, and data is stolen, it will be virtually impossible for an attacker to de-tokenize the data, unless they also have a copy of the mapping in the vault.

If the token is derived from the source data, doesn't that make it much easier to attack (assuming the mapping is not also stolen by the attacker), since it's really just an encrypted version of the source data?

The line between Encryption and Tokenization is blurry.

The answer to your question is that it depends. There are different ways of accomplishing vaultless tokenization. These different breeds of vaultless can be categorized into two main ideas: lookup table techniques, and format-preserving encryption (FPE).

Using FPE is obviously encryption at the very core, so calling it tokenization is a little bit of a marketing play, however, the justification of calling it a token has to do with what is produces, not how it was created. FPE, although it is encryption, can produce a ciphertext that is the same length and format as what was passed in. In this way, FPE produces "tokens" in the aesthetic sense. However, these tokens were generated using a mode of AES encryption, and so in the eyes of security, these tokens must be treated like encrypted data.

The other breed of Vaultless uses pseudo-random values and maps them to the input (i.e. lookup tables). How is this method considered vault-less? Well in order to eliminate the need for a vault (aka a big database), you must reduce the number of entries in the lookup tables, to reduce its size. If you can come up with a way to keep the size of the table down (!!! while also maintaining the reversibility of the lookup process) then you can justify calling this thing vaultless. Most lookup table varieties of vaultless use tables that are small enough to be stored in cache or something.


Challenge Response across several hops This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption".

I need to send a certificate from the mobile phone to the server. Regardless of all the details, my real question is how can I do a challenge-response step between the client and the server, when the communication follow these steps:
Client->ReverseProxy->LoadBalancer->...->intendedServer

And that actually is behind my Question!

If you own/trust the Reverse Proxy, Load Balancer, and Intended Server(s) then:

Your client mobile phone has the client certificate (through some secure means) which it uses to authenticate to the Reverse Proxy.
The Reverse Proxy handles the SSL/TLS decryption, then forwards the traffic onto the Load Balancer and the intended server (unencrypted).
Load Balancer and Intended Server are hidden from the internet behind routers/firewalls.

The Reverse proxy is configured to only allow connections from the allowed client certificates.

Alternatively all the SSL traffic could be passed through the Reverse Proxy and decrypted on the Load Balancer or Intended Servers, but that only allows IP based load balancing.

Unless I am misunderstanding some part of your protocol, I am assuming here that the Certificate you are talking about is for Authentication to the SSL/TLS website and not some other certificate.

Edited to add:

You added a comment above to explain that it is the initial certificate creation (CSR being signed) that needs to be encrypted.

In this scenario you need to determine what initial authentication you require.

Are you tying the certificate to a real world or prior identity? Then apply some authentication such as username/password through the SSL tunnel to initially create it.
But if you are just creating a random certificate to hang a new identity on, then SSL/TLS from mobile app to server should be OK, verifying the server certificate first is probably a good additional security measure.


How many digits of my credit card number may be revealed on the merchant copy of the receipt (Europe)? The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was displayed! Since I save all of my receipts I checked with previous purchases where I correctly obtained the customer copy and on those customer copies only the last 4 digits displayed.

I think this is really bizarre – like why does my own receipt have to conceal my own credit card number all the while any employee at a bakery can easily use my number and go online and do a purchase (provided the site won't need the CVV code).

Is this normal? Does the merchant really need my full number black on white in case of potential accounting issues?

You're referring to the merchant copy of the receipt which should only be retained as long as the business is required to do so (vs the cardholder copy).

On a cardholder receipt the PAN (Primary Account Number) must be truncated (first 6 digits OR last 4 digits) for PCI compliance, if this is a cardholder activated terminal transaction and not an imprint, or some other kind.

PCI compliance does NOT forbid the PAN on the merchant copy, but does require they are stored securely.

There may be more restrictions for GDPR, but I'm in the USA and not familiar with those.


Remote Desktop over VPN to access other VPN My current situation is:

Site 2 can connect to site 1 via VPN. I'm on site 3. IT at site 1 doesn't allow creating a new VPN to site 1.

I'm thinking of using a Remote Desktop via VPN from site 3 to site 2, and the remote PC (in site 2) will connect to site 1.

My questions are:

Is this possible?
What kind of configuration do I need to setup in site 1 and site 2?

Yes, it is possible - although you may find that the connection is slower than a direct connection.

As for the configuration - it really depends on what systems you're running.  Windows? Linux? OSX?

Essentially, configure Site 2 to allow VPN connections from Site 3 (and only Site 3).

It may be worth checking with IT as to why they don't allow VPN connections from anywhere else.  You don't want to get in trouble :-)


Does reverse proxy between two web servers impact security of both? Situation:

Consider the site: example.com, hosted at web server A.
A WordPress blog is to be installed on a different web server, B.
In order to route a WordPress installation to a subdirectory on the
main site, e.g. example.com/blog/, most suggestions on
StackOverflow recommend to use the Apache mod_proxy module, to
set up a reverse proxy.

Question:

Is there any security threat to server A (holding customer, credit card, etc. information), or are the usual issues commonly attributed to WordPress mitigated by being on a separate server B?

Yes, there are possible issues. For instance, consider the Same-Origin Policy: this is one of the foundations of how Web sites are contained and don't attack each other. For instance, Javascript from a site can talk (send "POST" requests) only to the originating site. This prevents some evil Javascript from some site from siphoning your bank account by sending hidden request to your bank Web site. However, when server A reverse-proxies B, then everything seems to come from A, from the browser point of view. If B is hacked into, then it may send hostile Javascript which will run in the client browser as if it came from A, thus being able to send arbitrary commands to the rest of the site on A.

However, yes, some issues associated with WordPress are mitigated by the separation; namely, that if the machine B is hijacked, then A is not hijacked right away. As explained above, you are still in deep trouble, but not as deep as you would be if both machines had been the same. "Mitigation" might not be the right term; let's call it "partial damage reduction".

If you want a separation which is effective in the security model as implemented by browsers, then you should separate servers under two distinct domains. For instance, there is security.stackexchange.com and security.blogoverflow.com: that's what you should aim at. Reverse-proxying a vulnerable site is really looking for trouble.


What is the evaluation criteria that a site uses for a password as strong , moderate or less secure I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the website feels its vulnerable . I need to know how they measure up to this .

Password strength meters are universally limited by the amount of rules and lookups put into them compared to the amount of rules and lookups put into attacking tools, particularly of the offline cracking variety like oclHashcat.

Most common password strength meters use a simplistic algorithm that combines length and some approximation of keyspace to give your reading.  For instance, some will consider an 11 character password with upper case, lower case, numbers, and symbols to be "Very Strong".

  P@$$w0rd123

If you think that "password" with a leading capital, a little common leet-speak, and a 123 at the end is a "very strong" password, I suggest you read up on rules based attacks.  Note that some of the rule sets that come with Hashcat have in excess of thirty thousand rules, and rule sets are commonly used in combination with dictionaries of tens of thousands to billions of words (essentially cartesian joins - for every dictionary word, apply every rule in the rule set chosen), depending on how good the hashing was and how much the attacker invested in GPUs.

Some password strength meters include a small to medium dictionary and a small set of rules (which are much more efficient because they're operating on a cleartext password), such as zxcvbn; however, they're still limited compared to what a good attacker (such as a competitive cracking team at an event or a security research, not even counting real bad actors, using  leaked password list).

The summary is:
If a password strength meter says your password is weak, your password is weak (or the meter is completely broken).

If a password strength meter says your password is strong, ignore it; assume it knows nothing.

Long purely random passwords are as strong as you can get; I second the 14 character minimum, and that's only for a purely randomly generated passphrase.

Random word combinations can be ok, but "correct horse battery staple" as a specific example is pretty bad;three of the words are in a common Top 5000 english word list, and the last one's still in both the phpbb dictionary and the Ubuntu american english small dictionary.  Further analysis at my answer to should i reject obviously poor passwords, but it boils down to the fact that an attacker using a small subset of English words would find this example, and many examples humans would choose on their own, without needing to exhaustively search anywhere close to the entire 4 word combination English language keyspace.

At minimum, choose at random only longer words, after eliminating common words as well.

For instance, take the Ubuntu american english insane dictionary
then remove all words under length 7
then remove all the remaining words that are also in the american english small dictionary
then use a random number generator to select lines and random, and use whatever word is on the line
Even better, put some unique random separators in between them as well

The flaw in correct horse battery staple and the flaw in most password strength estimators is the same; they do math assuming it's randomly generated, and without help, very few humans even come close.  Attackers know this, and work with it and the results of what humans have chosen before that's already been cracked (or was stored in plaintext).


chkrootkit weird output DEBIAN 9 I recently had this in the chkrootkit output comparison :

+! 7:0|          255 0:0|242:0|243:0|245:0|253:1|254:1|7:0| -stringPrefs 3:7;release|174:3;1.0|191:332;  ¼½¾ǃː??։֊׃״܁܂܃܄᜵           ???‐’․‧??????? ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹

This happened since I updated to DEBIAN 9, so I guess it's a debian stuff.

Any advices would be great, thank you.

Possible bug, check what's in /var/log/chkrootkit, or just go and purge apt-get purge chkrootkit or try to reinstall: sudo apt-get install --reinstall chkrootkit


Can I use a domain name instead of an IP for msf persistence? After getting a shell (meterpreter) on the victim, the first thing to do is to migrate and get the system, and then you would install a persistence to connect back to you. But the problem is the dynamic IP of my attacking machine.

I was wondering if I can install a persistence in the victim to connect back to a website, so the victim will always be connecting to the the server that is running the website, so every time my WAN IP changes, I forward that domain name to the new IP. Maybe using  freenome.com ?

So is that possible ?

There are lots of better ways to do this. First, you could set up a free dynamic DNS service that will update with the changes to your IP, and you configure your persistence module to connect to the DNS name.

Or, you could use the website's IP in the persistence module, and simple tunnel/pivot/redirect traffic from there to your attacking machine.


SQL Injection through addslashes I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose.

After reading this topic and this topic, I try to understand how it can bypass with something like 0xbf27 that can be converted to 0xbf5c27 through using addslashes.

So I manually execute a query for setting Character Set.

set character set 'gbk';

The character for this purpose must be 뼧 that is bf27.According what they say in the above topics it must be convert to something like bf5c27 but when I test it in my lab with a PHP code like this :

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '".addslashes($id)."';";
echo $query;
$result = mysql_query($query) or die( '
' . mysql_error() . '
' );

And when I insert 뼧 in my text field the exact query that executes is :

SELECT first_name, last_name FROM users WHERE user_id = '뼧';

So it seems that nothing specially happened !

After this I try to build another PHP script to understand what is going on so I build a simple script without any MySQL execution (test.php) like :

  <title>PHP Test</title>

 <?php
$command = $_REQUEST[ 'id' ];;
$output = addslashes($command);
echo "
$output
"; ?>

Then I execute the file with URL like :

http://127.0.0.1/test.php?id=뼧

And if you see the above PHP code it echos:

ë¼§

The hex code of above 3 character is:

eb bc a7

Well I just think about what happened,

My questions are :

What are ë¼§ that it showed me ?(It seemed something unusual because it doesn't contain anything like 5c or 27 ?
Why the first script doesn't show something like above three character in echo $query; ?
How can I perform it truly like they describe(In above 2 topics) ?

Update 1 :
Thanks to what Goktay Kaykusuz says I understand that I have problem in my encoding. the POC for it is I test it on Terminal and it resaluts :

  <title>PHP Test</title>

뼧

so I understand that it converts the result to UTF8 (in Chrome) but in Terminal works normally.

But the problem is still alive because it works without any wonderful bypassing (It is just what a simple string should be.)

Funny thing, I've experimented with an online encoding converter. I think you have an encoding problem on the client side.

When I embedded the string inside the PHP code, it worked.

$test_var = chr(0xbf) . chr(0x27);
echo(bin2dex(addslashes($test_var)));

Resulted in: bf5c27

The problem is when you get the variable from the URL:

뼧 after addslashes() results in ebbca7

¿' after addslashes() result in bf5c27

but the online encoding converter shows bf27 for 뼧 and bf 27 for ¿'.

Can you set the encoding of your PHP configuration to GBK and UTF-8 in php.ini, then try with the ¿' characters again? The examples in the links that you've given does not echo the output directly so you might have got scrambled on the client side as I've mentioned.


Does it makes sense to change the LUKS password in every 90 days? Linux, NetBSD, etc. can be installed with LUKS, so besides the /boot, all other FS will be encrypted. Probably the kernel needs to be booted before the password prompt gets to the user. The LUKS password

My question: Does it makes sense to change the LUKS password at every 90 days?

(I mean how can an attacker gain the LUKS password? if it's with an Evil Maid.. then it's already lost since the attacker gained access to the kernel.)

Password rotation really depends on use and exposure. If the machine is always on and the password is only ever used during a monthly reboot, then rotating that password after every 3rd use doesn't make a whole heap of sense.

Instead of thinking in terms of time, think of password rotation in terms of risk. How often do you use the password, on how many machines do you type your password, in what sort of environment do you type it (e.g. in an airport, coffee house, or perhaps only standing alone in a server room), how many people know the password, etc.

If more than one person has access to the password, then you should rotate it regularly as a matter of course. Rotation decreases the exposure if the password is ever inadvertently disclosed; and the more people who see it, the more likely one will disclose it (either intentionally or not). Changing the password immediately revokes access from anyone who should not have access (assuming they haven't installed some sort of back door).

But most importantly, always, always, always change a password when someone has it who shouldn't (or who no longer needs it).

Your risk will never be zero, and there is no problem that changing your password is guaranteed to solve. But many times I've seen instances where the same password has been in use controlling a resource for years, no matter who comes and goes. I've seen businesses sunk because a password was given to a contractor 3 years earlier, who saved that password on a personal computer which since was compromised by attackers.

You don't need rigid, blind, senseless password rotation policies to be safe. But you need to be aware of the risk that a given password represents.


Do SPF records apply to all subdomains? Does a SPF record apply only on the domain it’s setup for or also for all it’s subdomains?

For example an SPF record that is configured for the domain example.com will set the policy for mails ending with @example.com.

So if that is the only SPF record, does it also apply on mails send from mail addresses ending with @www.example.com? Or should a second SPF record for the www subdomain be configured (and so for all other subdomains)?

I cannot see anything in the SPF standard which would imply that a SPF record covers all subdomains too. Given that subdomains are sometimes managed by different parties (especially in larger organisations like universities) it would also not make much sense to implicitly cover the subdomains. And the standard says in section 4.4:

  4.4.  Record LookupIn accordance with how the records are published (see Section 3
     above), a DNS query needs to be made for the <domain> name, querying
     for type TXT only.

"<domain> name" is here the domain from the email, not an upper domain.


Possible SSRF in image tag that takes (partial) user input? A webapp has an img tag that partially takes userinput like so:
<img src="/blah/blah/$USERINPUT.jpg">

where the first / is from the root of the domain.
Could there be a vulnerability here? Potentially using ../ and then attempting path traversal?

Few conflicting things here.
SSRF is where you make the server request a (usually foreign) URL on your behalf. It is not the exact same as path traversal. Path traversal might be possible but I would be surprised -- a better indicator of path traversal would be a filename inside of the query portion of a URL, or inside POST data.
Your best bet for finding an issue for reflected user input is usually cross-site scripting. If you modify the user input, are quotes escaped?


Revoke access from intranet if an employee leaves the organization A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed.

This organization has offices in maybe 50+ countries, and each office basically functions as a small company. The intranet is used to share transaction numbers between the different offices and sharing other knowledge.

This means that the individual offices may have different e-mail domains and servers, and may even operate under a different company name.

Say an employee leaves the company, we can assume that a country leader closes their e-mail account. Let's assume that the communication in the organization is not so great, so the system administrator of the intranet is not informed that the employee has left the organization... so the employee still has access to the knowledge inside the intranet.

My question is - is there a method to track whether an e-mail exists on the server side? Because if you could verify that the e-mail has become inactive, you could just revoke their access when they try to login again with a user that has been registered with that e-mail.

I've been doing some research, but as far as I can see, it is only possible to check whether a domain exists or not. If it is not possible to check this, how would one go about this?

One solution I can think of is that the intranet sends out an e-mail, for example, weekly confirming whether the e-mail is active or not. However, the employee could potentially still have access for a week. Another solution is a daily special code that is sent out to everyone in the organization, but this seems sub-optimal.

How is an issue like this solved in real-life? All input is greatly appreciated.

I think that if you continue down that line of thinking towards a rock-solid solution, you're going to have to consider things like "what if the weekly email is spoofed?" ... "Maybe I need to digitally sign those lists", etc and you are going to end up inventing something very similar to a Certificate Authority.

Use an in-house Certificate Authority

I think the simplest (and cheapest) way to accomplish your goal is to use a VPN with client certificates to grant employees access to the intranet. To issue and manage the certificates, set up a hierarchy of Certificate Authorities (for example with openssl): the root would be operated by the parent company and each local branch office would run an Issuing CA to actually issue and manage the certificates of employees at that office.

Configure the VPN to use client-certificates

Set up the firewalls for the intranet servers to only accept connections from inside the network, requiring users to VPN in. Configure the VPN server to require client certificates that trace back to the root CA operated by the parent company. Because of how certificates work, every time a user tries to log in, the VPN server will check with their Issuing CA to make sure their certificate is still valid - so each office manages their own database of employees. This means that local administrators at each office can add (aka "issue") or remove (aka "revoke") employees at their leisure and the VPN will automatically accept / reject their logins. I believe that most commercial and open-source VPNs support the client-cert mode of operation.

Another option: buy a COTS authentication product

A slightly more complex (and expensive) option is to purchase a certificate-based authentication web application that acts as a gatekeeper to your intranet and requires users to provide their certificate and a proof-of-possession of private key. I won't mention any specific products because my company sells one and I don't want to be accused of conflict of interest.


Is CloudFlare's SSL half-baked since they become the Man-in-the-Middle (MitM)? I recently read a somewhat funny article at crimeflair.net, questioning (read: murdering) the way CloudFlare provides SSL. In their words: "CloudFlare's half-baked SSL: suspicious sockets layer".

Note: The name crimeflair suggests some kind of propaganda against CloudFlare, and the text, design and images of the site almost make me feel like reading a conspiracy theory. Also the article has quite some unproven theories and assumptions. But...

  Local authorities could be sniffing the plaintext available at these data centers, and CloudFlare wouldn't have a clue.

This made me think about the current way CloudFlare works. CloudFlare is indeed a Man-in-the-Middle, encryption can never be end-to-end because then the CloudFlare CDN/proxy won't work.

Using CloudFlare's SSL to add a "free" SSL layer to some simple website of the local bakery (half-baked, got it?) seems to me like little risk. But using this in enterprise solutions with confidential data might be a thing.

It will probably protect the end-user against local network sniffing and spoofing fine! Since the connection from the end-user to CloudFlare is encrypted. But against a government or ISP that can just read the unencrypted connection behind the CloudFlare proxy towards the origin server? Probably not at all.

  ... it would make no difference whether the origin server has its own certificate.

Recap: CloudFlare might "secure" the availability by their great anti DDoS features but it might be a serious risk for the confidentiality and possibly even integrity of the connection due to the SSL tricks they need to use.

Interesting additional whitepaper: "When HTTPS Meets CDN: A Case of Authentication in Delegated Service" or mirror at ieee.org.

  While some of those problems are operational issues only, others are rooted in the fundamental semantic conflict between the end-to-end nature of HTTPS and the man-in-the-middle nature of CDN involving multiple parties in a delegated service.

Question: Is CloudFlare's SSL half-baked since they become the Man-in-the-Middle (MitM)? And so, should it be discouraged?

CloudFlare isn't promising anything they're not delivering.  Any service provider decrypts the data at the cloud end; they have to in order to perform their service.  CloudFlare's architecture simply decrypts it at the point of entry, instead of at each and every service endpoint.

This offers a couple advantages to their clients:  they don't have to do anything to maintain their certificates, and they aren't paying any performance or CPU penalties to re-encrypt the internal traffic.  Meanwhile, their customers see https locks, and are comforted.

Is the data from the CloudFlare server traveling in cleartext to the web service?  Sure.  Who can intercept it?  Backbone providers, and other large entities.  In some cases they're trustworthy, in others they aren't.

But if the NSA or other Three Letter Agency has a warrant, National Security Letter or other desire to view the data, they're going to find a way with or without this architecture.  In a repressive regime like Iran, China, or other, they're going to demand this access anyway.  No decision CloudFlare makes will change any of that, so they may as well use the cheapest architecture that provides the most benefit.


To avoid BREACH, can we use gzip on non-token responses? I work on a site that has a web interface an an API. I'm trying to determine if we can safely use gzip, or if that will open us to BREACH.
The site says:

If you have an HTTP response body that meets all the following conditions, you might be vulnerable:

Compression: Your page is served with HTTP compression enabled (GZIP / DEFLATE)
User Data: Your page reflects user data via query string parameters, POST..
A Secret: Your application page serves PII, a CSRF token, sensitive data...

Another site says:

It requires the attacker to be able to read the size of encrypted traffic and perform CSRF requests at will

We use a web framework that automatically adds a masked (different every time) CSRF token to every form that uses POST.
We have pages (eg search results) that reflect user input, but contain no sensitive data (the form to search uses GET).
We have an API endpoint that serves an API token, but it's a different value every time because it's cryptographically signed with a timestamp.
The majority of our responses are large JSON bodies that would benefit a lot from gzip.
Can we turn on gzip everywhere? Is it sufficient to turn it off when responding with an API token? Or can we just not have nice things?

I'm answering my own question because I think I now understand BREACH and how to prevent it. I'd love feedback.

How BREACH works (as I understand it)

(Expanding on an explanation here that helped me.)

Suppose you're an attacker. You are signed into a service as yourself. You notice that there's a search endpoint, and if you send the search term rabbits, you get back a response like this:

<SearchResponse>
  <AuthToken>d2a372efa35aab29028c49d71f56789</AuthToken>
  <SearchTerm>rabbits</SearchTerm>
  <Results>
    <Result>rabbits rock</Result>
    <Result>yay rabbits</Result>
  </Results>
</SearchResponse>

You also notice that the response is gzipped and encrypted (HTTPS).

You try searching for a string that's formatted like the <AuthToken value, likeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. The response is:

<SearchResponse>
  <AuthToken>d2a372efa35aab29028c49d71f56789</AuthToken>
  <SearchTerm>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</SearchTerm>
  <Results>
  </Results>
</SearchResponse>

There are no results for this. You then modify your search term slightly:

<SearchResponse>
  <AuthToken>d2a372efa35aab29028c49d71f56789</AuthToken>
  <SearchTerm>d2a37aaaaaaaaaaaaaaaaaaaaaaaaaa</SearchTerm>
  <Results>
  </Results>
</SearchResponse>

As you hoped, something interesting is happening. Because the search term is nonsense, the <Results> are always the same: empty. The only thing chaging is the <SearchTerm>. And because of compression, the more the <SearchTerm> value resembles the <AuthToken> value, the smaller the response is.

This is because of how gzip compression works: it removes repetition when compressing, and restores it when decompressing. The more repetitive the input, the smaller it compresses.

You search again, using the exact value of the <AuthToken>.

<SearchResponse>
  <AuthToken>d2a372efa35aab29028c49d71f56789</AuthToken>
  <SearchTerm>d2a372efa35aab29028c49d71f56789</SearchTerm>
  <Results>
  </Results>
</SearchResponse>

This time you make a note of how small the response is. Now you know that any time the response is this size, it means the search term matched the auth token exactly.

Now, because these are your requests, you've been able to read them directly. If you could do a MITM attack on another user of the site (eg, by running a rogue router), you'd be able to see the size of the encrypted response, but not the actual contents.

You think to yourself: if I can trick someone else into sending the search terms I want them to, and if I can see how big the encrypted response is, I can tweak the search term over and over. The closer I get to guessing the auth token, the smaller the response will be, and when it's the size of the response I just saw, I've guessed correctly. Once I know their auth token, I can sign in as them.

If you can somehow execute an XSS attack on your victim, you can get them to make the necessary requests.

Mitigation

This attack would not work if:

The server did not use HTTP compression (like gzip, in our example)
The request could not be made successfully without a CSRF token, which the attacker could not know
The server never put both sensitive data (like an API token) and user-supplied data (like the search term) in the same response
The server never returned the same API token twice (eg, if raw token values were timestamped and signed before sending, the timestamp would ensure the token in the response changed constantly)
The response always contained random-length padding, as @AndrolGenhald pointed out in a comment (although with enough requests, an attacker might separate the signal from this noise)
The request could not be made successfully without a session cookie, and site's session cookie had a SameSite attribute, and the would-be victim was using a browser that understands this attribute so that it understood not to include the cookie with requests originating from another site.


How to respond to a user requesting deletion of their online account My website occasionally receives requests from users asking for their account to be deleted. The website itself is a dating site that stores messages between users, personal information they add to their public profile, logs and stats about their usage, etc.

While the site currently lets an admin 'deactivate' a user's account such that it no longer appears publicly, actually deleting the user record and its associated data from the database is problematic. Information we'd be deleting about a user is occasionally necessary and always useful.

One alternative I have toyed with would be to attempt to anonymize the user by clearing all personally identifying pieces of information. Reading about the de-anonymization that occurred with the Netflix dump, it looks as though this could be quite hard to do effectively.

Should I have to comply with this request, legally or otherwise? ie. does the site need to have functionality that allows us to completely delete all traces of a user? Would attempting to anonymise a user be sufficient? I understand Facebook allow for your account to be 'deleted', but do their really remove all traces?

Besides the legal stuff, I consider your anonymization a step in the right direction. As a developer myself I know about the difficulties of delete data in a relational database.

As your customer I would like 2 things:

not being able to be identified by you, the website (this means
cleaning up the user name, address, IP-Logs etc...)
not being able to
be enumerated at the user creation / password reset page

As others said, consult a lawyer. You might be obliged to clean up better than proposed here.


How would one know if they have a rootkit? Are they impossible to detect? Seeing as the attacker has admin rights and could modify anti virus software that might otherwise be used to detect or circumvent a root kit. Are there certain red flags that point to a root kit? Can they see everything you do?

A "rootkit" normally tries real hard not to be detected. However, it cannot, in theory, be completely undetectable, since the point of the rootkit is to maintain an entry path for the attacker, so at least the attacker can know whether the root kit is in place or not.

A lot of methods have been used in the past. For instance, some rootkits install themselves in the kernel memory and leave no trace on the hard disk -- thus they are very hard to detect, but will disappear upon next reboot. More commonly, rootkits modify some files or some parts of the disk in order to resist reboots, but they then have to alter the kernel so that their modifications are not visible from processes on the machine.

So, basically, if the rootkit does its job properly, then you will not be able to detect it from the machine itself. You might find out about it if you reboot your machine on a live CD or USB key, and from that OS (presumed clean), inspect the hard disk. If the same files do not look identical, when inspected from the outside (the OS booted on a live CD) and from the inside, then this is a rather definite sign of foul play.

All of this assumes that the rootkit is good at what it is meant to do. There are a number of inexpert rootkits (or inexpert attackers) who will leave traces. For instance, weird files in the home directory of root (or Administrator).

A rootkit makes sense in situations where the attacker gained total control of your machine; the job of the rootkit is to maintain this level of control. The attacker can then see everything you do on the machine, and as long as the rootkit is active, he will be able to keep on seeing everything you do on the machine.

(The term "rootkit" has also been applied to escalation tools, i.e. tools which exploit local vulnerabilities to transform a user-level access into a full adin-level access on the machine. Same result: the machine no longer is your machine.)


Can software passwords be bypassed by reverse engineering? Let's say, on any software (that is installed on Client-Side OS), is it possible, to alter the software in such way (i.e. Zip Passwords) so for incorrect input it redirected to correct "result", like:

Is it possible to alter software logic to execute the command instead of another command? If so, then nothing can be protected from cracking?

In short, yes, you can modify the executable, use a debugger, etc. to alter the logic of the code being executed.

But, that may not be enough.

To use your example of ".zip passwords", password protected archives use the password to derive an encryption key. Unless you supply a correct password, the generated key will be wrong, and even if you modify it to use a wrong key, it will not successfully decrypt the ZIP file.

Another scenario might involve a setuid executable which runs with higher privileges. You could run it under a debugger, or copy it to your user account and make changes, but all this will achieve is running it with your user's permissions, thus defeating exploitation possibilities.


How Does The TPM Work With The CPU To Decrypt Data Okay, from what I've been reading,

At startup, the BIOS performs an integrity check and produces a hash value to set in the PCRs of the TPM (aka Core Root of Trust Module), and when all of the needed PCRs are correct the operating system will have access to an encrypted root key (which is used to decrypt the data stored in the hard drive).

Do correct me if I am mistaken :)

Now, what I don't understand is how the CPU uses this encrypted root key to decrypt data, as my knowledge ends there.

Is this process documented anywhere? If not, would you please explain how this process works?

Many thanks.

There are a few concepts that are applicable to what you are asking about. The TPM is a "core root of trust" for reporting and storage. In the Trusted Computing Group (TCG--the organization that maintains the standard for the TPM) specification for PC Client Implementation for BIOS, the BIOS bootstrap code is the core root of trust for measurement.

The BIOS bootstrap code measures itself (generally, by means of a cryptographic hash), and then the rest of the BIOS code and configuration. This measurement chain is carried through to the boot sector of the hard drive (or whatever other boot device is used). As these measurements are taken, they are extended into Platform Configuration Registers (PCRs) held in the TPM. With the exception of that BIOS bootstrap code, all code is measured, and the PCRs are irreversibly extended (until next boot), before the code is allowed to run. This system should ensure that any modification for the code running on the system should be reflected in a different set of PCR values.

The TPM also secure's keys and key material. When these keys are secured by the TPM, it can be specified that they should not be made available unless the PCRs have some specified set of values. This key material can be used by drive encryption software. There are a handful of different drive encryption systems that have been engineered to use the TPM in this way, and they all operate slightly differently. You'll need to investigate those systems to see how they use the key or key material from the TPM for drive encryption.

As for documentation, you can check out the TPM specification and the PC Client specification from the TCG. Microsoft uses Bitlocker. You can also check out this system, which uses LUKS, the TPM, and TrustedGrub for Linux drive encryption.


What is the relationship between HTTP response codes and successful execution of XSS attacks? What is the relationship between HTTP response codes and successful execution of XSS attacks? For e.g I am using a commercial vulnerability scanner that reports XSS vulnerability found in a certain web page. It further describes the attack by showing Request and response after XSS was injected. The response codes it gives are 0, Http 200 OK, Http 400 Bad, 403 Forbidden etc. If the developer asks what is wrong with 400 Bad or 200 ok, how a security analyst can prove XSS was executed? So is there a way to tell whether XSS was successful or failed by looking at response codes like 200 OK?

TL;DR: Successful execution of XSS is unrelated to the response code.

XSS is the execution of attacker injected code at the client side. The HTTP response which includes the response code is created at the server side. The server is not aware that the served content contains any problems (if the server would know this it would not serve it) and thus cannot set the response code based on XSS or not.

In other words: XSS can happen with code 200, 403, ... but just from looking at these codes you don't know if XSS was successful or not.


What can an iOS app tell about you? We all know while using a new iOS app it might ask for information like location or access to the camera. Those are both features we can deny to the app. There are, however, features apps can access without permission. For example I already know apps can get information like the name of your phone "Mason's iPhone" or the storage available in the device. What are some features apps have access to that doesn't need to be granted permission?

This might not be exactly what you're looking for but...

Having your iPhone near your keyboard can make you vulnerable to keylogging.
Before you call me crazy, I've actually conducted this experiment using neural networks and an Android's accelerometer and it could 80% guess what region of the keyboard the key press came from and could guess within a few keys away fairly often.

Privileges for reading data from the accelerometer are given by default to both iPhone and Android devices, and so a device making use of these readings could potentially figure out when you type in a URL, what passwords you type into the webpages you visit, and combining the probabilistic regions of the key presses with a dictionary attack or a common passwords list would easily break passwords in minutes to seconds, no issue.


Why rijndael.key value is different with rijndael.iv? someone can tell me how rijndael works?

for now i need to handle key and iv generated from C# (using rijndael + rfc2898derivebytes) to match with CryptoJS

code snippet of C#:

byte[] saltArray = Encoding.ASCII.GetBytes("20190925");
Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes("password", saltArray, 1000);
rijndael.Key = pdb.GetBytes(32);
//output c1b34ea814586db4a22dad37e11c7256322ab0eee3a14ed1898f93d7a264242f
rijndael.IV = pdb.GetBytes(16);
//output 063ead20a9d5f35ab83e1156ebe7c099

the result of rijndael.Key and rijndael.IV is different. I thought rijndael.IV will show half of rijndael.Key value because of pdb.GetBytes(16) is half of pdb.GetBytes(32)

i can match the key of rijndael+rfc2898derivebytes using CryptoJS using below code:

let key = CryptoJS.PBKDF2('password', '20190925', {keySize:256/32, iterations:1000})
//output c1b34ea814586db4a22dad37e11c7256322ab0eee3a14ed1898f93d7a264242f

but i don't know how to get the same IV with cryptoJS.
anyone has an idea?

By implementing your own encryption, you're doing a bunch of things wrong here. I don't know if this is a toy project to learn about encryption (nice!) or if this is supposed to be actually used by anyone, even yourself (don't do that).

The IV and key have very different functions and should not have overlapping values (the IV will be half the length, because indeed it is 16 bytes in length and the key is 32 bytes, but should absolutely not be the same value). The reason why deriving bytes from the same Rfc2898DeriveBytes object gives different results, is because it just continues the keystream. If you want the same value twice, you need to reinitialize the object so it starts again from the beginning. But that's not what you want, anyway.

The key is, well, the secret key. The IV is a unique value that is not secret, it just makes the encryption unique and allows multiple encryption operations (up to a certain number) to be done with the same key. (In algorithms that do not have an IV parameter, like RC4, using the same key twice can lead to full decryption. That's why an IV is useful and important.)

Deriving the IV from a secret key, which is what Rfc2898DeriveBytes will do, is a very bad idea. It means that the IV will be the same every time. Instead, you should generate the IV from a CSPRNG, such as Crypto.getRandomValues() in JavaScript or RNGCryptoServiceProvider in C#. You can attach the IV value to the encrypted value, typically in front of it so that you don't have to read the whole message to configure your algorithm.

All this can already be found in other questions. See:

AES using derived keys / IVs. Does it introduce a weakness?
When using AES and CBC, is it necessary to keep the IV secret?
Why does IV not need to be secret in AES CBC encryption?

Finally, you will want to be using authenticated encryption. This question explains what the role of authentication codes with encryption is: MAC vs Encryption


Isolate Android system when connected to wifi Is there any built-in feature or application that isolates the system when it's connected to a wlan, so that just a determined app has access to the net?

For example, let's say that you want to analyze a public access point with an application, but you don't want to recieve messages, email...  while you are connected to that AP. Is it possible to just allow that app access to the network?

Using something like NoRootFirewall gives you full access over what apps can access the internet. It sets up a VPN connection to route all traffic through so it has full control over what app can access the internet.

You could either install this app, or incorporate similar behavior in your app e.g. when this app runs block all others.


what role do hashes play in encrypted containers? I know that hashes are used to bring the plaintext password in the right length for the encryption algorithm key. But is the password hash stores outside the encrypted container to validate the password? If so isn´t this a security vulnerability? Instead of attacking the encryption the attacker could just crack the hash. Is that how tools like rar2john or zip2john work?

If not how do they work, and why is the hash stored on the outside of the encrypted container?

The hash is a part of a container with encrypted data because of the two main purposes:

integrity check - rather hashing the encryption key then encrypted container is hashed to receive a digest. Then other side of a communication channel would hash received encrypted data and verify whether hashes match. If they do match - data is untampered during the transmission and decryption process starts.
authentity check - what if the container was intercepted during the transmission and both encrypted data and hash was substituted? To make sure this never happens some kind of key-derived hashing like hmac is used. Then without knowing the key attacker has no way to tamper data so the other party would not detect it. The hmac key is obviously should be shared between parties separately prior the actual transmission of an encrypted data.

As of the encryption key - in AES scenario the key should be already known to both parties prior the transmission of an encrypted data. Usually it's shared using some assymetric cryptography like RSA.

Google SSL or TLS to read more about how both symmetric and assymetric crypto play their role in such a way of communication.


Did someone break into my email account? I just got the following email (and another similar one):

This message was created automatically by mail delivery software. Your email message was not delivered as is to the intended recipients because malware was detected in one or more attachments included with it. All attachments were deleted.

--- Additional Information ---:

Subject: sport
Sender: erelsgl@gmail.com

Time received: 9/1/2016 1:32:05 AM
Message ID:<000101d20422$ec2b823e$c0a80001@61.141.118.205>
Detections found:
veksport.zip     JS/Nemucod.TSF

________________________________

Wydawnictwo: Express Media Sp. z o.o., 85-058 Bydgoszcz, ul. Warszawska 13, tel. 0048 52 3226201, zarzad@expressmedia.pl, Sąd Rejonowy w Bydgoszczy, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego, KRS 0000022049, NIP: 967-10-55-458, Kapitał zakładowy: 43 508 640,00 zł, BRE Bank SA 58114010520000594180001001
Treść niniejszej wiadomości jest poufna i przeznaczona wyłącznie dla jej adresatów. W razie pomyłkowego przesłania Państwu tej wiadomości, prosimy o poinformowanie o tym nadawcy przez wysłanie odpowiedzi zwrotnej. Rozpowszechnianie, kopiowanie, rozprowadzanie lub inne działanie o podobnym charakterze bez zgody nadawcy jest zabronione i może być karalne.

Wydawnictwo: Express Media Sp. z o.o., 85-058 Bydgoszcz, ul. Warszawska 13, Poland, phone: 0048 52 3226201, zarzad@expressmedia.pl, District Court of Bydgoszcz, XIII Commercial Department of the National Court Register under No: 0000022049, VAT No: PL 967-10-55-458. Share capital: PLN 43 508 640,00, BRE Bank SA 58114010520000594180001001
The content of this message is confidential and is intended solely for its addressees. If you have received this message by mistake, please notify the sender immediately by replying to this message. Any disclosure, copying, distribution or any action taken or omitted to be taken without authorization in reliance on it is prohibited and may be unlawful.

I never sent any such email, and have not find such email in my Sent Items box.

Is it possible that someone broke into my gmail account and sent a malicious email?

It looks like a spammer spoofed their sender address, using your e-mail address instead of their own. Note that the subject of the mail is simply "sport" and the contents is a .zip file. This smells like spam.

What probably happened is that at least one of the intended receiving addresses didn't exist. The domain of the address did exist, however, and the mail server sent an error message to the apparent sender address - yours. It happens.

If the mail had been in your "Sent items" box, then yes, you'd probably been hacked.
The reverse does not hold, unfortunately - if you were hacked and a spammer (or botnet) sent a mail from your address, they might have removed the evidence.

However, I think the spammer just used your e-mail address for a mail they sent from their own machine.

Still, it won't hurt to change your password, just in case. And maybe apply 2-factor authentication on your e-mail as well, if you haven't already.


Does “Restore Factory Defaults” Wipe Out My Data Completely? I used to have a IBM Thinkpad (Lenovo) T440. I have been using that laptop for over 8 years.

This device has been reset to factory default multiple times (probably up to 6-10 times if not more)

Every time when I selected to reset the system, I chose the “Remove All Data / Do Not Save Any Data”. The way I used to reset was by following the step of Thinkpad’s Own Recovery System which could help you to reinstall WindowsZ

That laptop’s Screen was broken and I had to gave it to the computer repair shop to let them dispose it for me.

My question is this, I didn’t have the chance to wipe clean the data myself before I was ready to dispose it.

I am a bit regret now that I gave my trust to that computer repair shop to sort out the rest.

Bottom line is I don’t have critical files or personal data in that laptop after the last reset I made.

I am just wondering would any people be able to retract my data before my last reset or even up to the point when my very first test was made.

I know you’ll have to rewrite the hard drive multiple times over and over to completely erase the very old data.

My multiple resets were all happened when my system got so slow and even infected my virus or something.  So I assume my hard drive had been already overloaded multiple tomes my tons of new data over the old data, not to mention full clean resets multiple times as well.

Am I worrying too much that my oldest data would still be retractable by hackers or there is a mere chance they could only probably retract data up to the point when my latest reset was made?

Looking forward to your answers!

First of all, most computer repair places are not fully equiped forensics labs; so, they will probably only be able to see what you've saved since your last reset.

Now, if your computer repair guy is actually a data forensics expert moonlighting as a repair guy, it's a different story.  When you delete data from a computer, all the data stays there but the blocks get marked as deleted; so, a factory reset will generally hide your data without destroying it.  Then as you write new data over the old data, the blocks often only fill up partially leaving fragments of data in what is called the slack space.  There are many tools that can be used to scan slack space for deleted files, but the older a file is and the more often you write to or defrag your disk, the more likely you are to see that data overwritten.  Some tools are designed to make assumptions about previous states of bits based on residual charges meaning that the past few over-rights can be sort-of read, but not with 100% accuracy.

So to answer your question, there may be data left over from one or many of your previous resets for a really smart and unethical person to find, but the older the data is, the less like it is to be recoverable.  That said, having worked with enough IT people in the past, most professional repair places will drill or shatter your drives as a professional courtesy before disposing of it because they expect their clients not to know to do this.  Or, if they choose to refurbish a drive, they will do a multi-pass rewrite to protect your privacy, and their reputation.

As a final disclaimer: technically data can still be pulled from a shattered drive with very expensive forensics equipment, but unless you think you are high up on government watch list, that is not a very realistic concern.  But, if you think tin-foil hats are a reasonable security precaution, and you really want to make sure your data is unrecoverable, the only way to truly do that is to melt your hard drive... but that is supper bad for the environment and your health.


Syllabus for self-studying information security and Pentesting I'm someone who's distant, industry-wise, from technology. I'm actually in the medical field. That said, I'm very interested in technology and specifically in information security.

I'd like to make a roadmap to be a professional Pentester and may eventually switch careers (I'm 20, so that wouldn't be life changing per se), or the more probable possibility to be a professional Pentester of hospital networks and medical services (that way I can work in both jobs which is what I want).

So, as I said, I need to make a syllabus for beginners to professional Pentesting as self-study material for anyone following the same path.

I currently have a plan to study courses in:

CompTIA's Linux+
Courses on Kali Linux
CompTIA's Network+
CompTIA's Security+
EC-Council CEH

Note that I don't program in any language! Would you suggest adding programming courses, and which one? And how do evaluate this study plan?

Note2: This guide is not personal, it's general for ANYONE starting Pentesting. I hope it doesn't get deleted :(

EDIT FOR MODS:

So to narrow the scope of the question I'll add that this discussion hopes to produce a battery of opinions about the best way to approach Pentesting as a career for someone who doesn't have the ability to aquire a formal degree in the field or in Computer Science. The student/enthusiast will form his own personalized syllabus based on the opinions and experience (((which an outsider like me can't get ANYWHERE else due to not having the exposure to people in this field. I don't think there's one specific answer or one-size-fits-all model to learn any subject, and thus I think this should be open for discussion about experiences in the field and how to go about the path to learn.)))

To narrow it further I personally need to be a network and web apps Pentester. My interest here in these two specialties is derived from the fact that hospital networks are proven (by a security researcher) to be extremely vulnerable. And almost all devices on that network are also vulnerable. There are also some emerging technologies in Medical Social Networks and online medical apps with sensitive patients' data, I see a market or a career for such experience in the medical information field.

So to rephrase:
What is a path you, experts, advise an enthusiast to pursue for a career in Network and Web Apps Pentesting?

The list looks good and you seem to know where you want to arrive at. However, because the literature is so huge, what you may reckon as a good resource for you, might not be the best for someone who has other priorities, such as web, instead of hospital security testing. In this way, it becomes pretty hard to answer your question on a general list for everyone. You would benefit a lot more not on the actual material, but on the methodology. It is much easier to adapt an efficient methodology to other people's needs and let them decide which syllabus they should go hunting.

For my learning, for instance, I have thought of all subjects I needed/wanted to learn in order to improve my knowledge and skills. Obviously, because I cannot learn everything, I had to prioritize them  into these high-level categories:

Languages
Networking
Operating Systems
Databases
Web
Cryptology

So I devised a way to maximize the time and efficiency with which I learn those subjects. During college and university, I usually had two subjects per day. I would have classes in the morning and by 13:00 I would be back home and ready for my afternoon independent study.

I would first start my study at home by revising what I had seen on that day. This is one of the most important stages (revising what you LISTENED at college, because when you listen passively, you don't really learn, you mainly introduce what you will learn at home). This would take most of my afternoon. Discipline is vital and as it is very difficult to focus on the same subject for too long, I was (and still am) very rigid with time. For every 45 minutes studied, I would take an exact fifteen-minute break. Then I would carry on for another 45 minutes, followed by another break. By 17:00 I had finished studying the stuff from college/university. I would have a longer break and then start my own study on one of the subjects above; one subject per day. I would start around 18:00 and allow myself at least one hour for this study: sometimes I would go until 21:00. It doesn't need to be hard reading. If I was studying Operating Systems on one evening for example, and all I did was to install a FreeBSD VM and set up a user account, I would already consider that as a time well spent studying, as a lot of experience is gained troubleshooting the blockers we find on our way.

As for how I approached these subjects, here is what I have to say:

For languages, I would suggest you start with a higher level such as python for quick learning/results. However, those languages take many shortcuts, so if you really need to learn programming, also study C. If you understand those two languages, all others are just a matter of time.
Networking. Set up VM Labs and play with Wireshark. Understand how the protocols work at a lower-level. Play with packets, modify them and see the results.
Operating systems. I would suggest focusing on FreeBSD, Kali and obviously Windows.
Databases are pretty important too, start with MySQL
Build your own website, create a VM with FreeBSD and make it secure (as part of the OS study). Deploy Apache, make your first web-site, implement a login functionality and integrate it a database. Hack it, break it, nuke it, rebuild it all. OWASP and is your best guide.
Crypto - Schneier is the best place for you to start

The point to take is that 1) you first learn about the subject itself (OS, databases, etc). 2) Then you learn how they interact with other components (a web server integrated with a database). 3) Then you learn how trust between these components works and how they can be abused, so that 4) you can secure it. Nothing stops you from learning all these four points in parallel, however the logical order is more or less that.

To actually answer your question, there are plenty of good resources. To name a few:

CBT Nuggets (Not free). I only purchased one, for general networkings and it was money well spent.
Steve Gibson's Security Now! podcasts (also viewed on Twit.tv). There are hundreds and one of my favorites. Do listen to that.
Security Tube - Excellent videos and tutorials
Read everything you can from Bruce Schneier. He is not only about cryptography, but everything about security.
Go to security conferences, such as OWASP, BlackHat, Brucon, B-Sides, DefCon. If you can't go, search for their talks on youtube.
Reddit on hacking and security.
Krebs on Security

Tl;dr - There are plenty of resources out there. Knowing which one is right for you, and how to maximize your learning is where the wit lies.


How do I protect my OpenPGP key on my computer? How do I protect my OpenPGP key on my computer? If I make a backup of my private key I will keep it secure, but if someone gets access to my computer he/she will can get all my keys through Kleopatra or GPA. How do I avoid this?

What's your threat model?

If your threat is that you are protecting from physical theft, then encrypting the key (using passphrase) or full disk encryption would suffice.

If your threat is a malicious program running under your user account, then you want to run potentially malicious programs in a sandbox, or just not run it at all.

If your threat is a malicious program with root access, then you should use an OpenPGP Card.


How to implement authenticated encryption using pycrypto or a python library? I'm using pycrypto to encrypt files that will be stored in the cloud. I expect the user to enter a password to decrypt files, but encryption shouldn't require a password (to allow the script to be run by cron). So therefore I've been looking at public key encryption using RSA under the PKCS1_OAEP cipher.

I can see how to encrypt a file using pycrypto, but is there a pre-existing method to perform authenticated encryption, or am I expected to implement that myself? There's a parameter to pass a hashing algorithm to Crypto.Cipher.PKCS1_OAEP.new(), but will this be used to sign encrypted data?

Similarly to verify before decryption, is this all built into the decrypt() method?

Note: I don't have any particular attachment to pycrypto - if another python crypto library provides an authenticated encryption scheme, please suggest that instead.

Thanks

PGP (python-gnupg) really sounds like the way you want to go.

Public key crypto is messy because the actual asymmetric cipher is only used to encrypt a one-time session key, which is then used with symmetric crypto (e.g. AES) to encrypt your files. Managing all of that manually would be a headache. But PGP already has all of the details worked out, you just have to call the appropriate functions.

Plus, you have pre-built CLI tools (gpg) to allow you to work with messages outside your app.


Is software fuzzing safe? Is software fuzzing safe (Anerican fuzzy lop or AFL for example)? What's its probability of producing a random input that can make the program

Delete a file or
Connect to a random server

into a program?

There's no way to give you a probability for every program, but I can say that no it is not safe to run a fuzzer on a program with access to a filesystem that you do not want damaged. While programs that do not do any I/O at all are much less likely to delete or modify files, it is still absolutely possible. I have had data on filesystems damaged (and in one case, the filesystem itself got corrupted) as a result of fuzzing with AFL. Thankfully in my case, the program only had access to an empty partition...


Protect MySQL against brute-force attacks on dedicated CentOS 7 server I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not connect remotely (and close the port), but I need to.

My IP at home is dynamic but the first 2 bytes are the same. Can I block IPs that are outside of this range? Should this be done for the server in general, or is there a way to do it for MySQL only?

As a note, my provider has access to the server from a static IP, so I would whitelist it, in case my home IP changes and I get locked out.

Can I block IPs that are outside of this range

Absolutely, using iptables you can enforce accepting (whitelisting) of packets from an IP address range or a particular IP address on a particular port. Linux: Iptables Allow MYSQL server incoming request on port 3306

Then you can use Fail2Ban for brute force protection. E.g. if MySQL auth on port 3306 has 3 failed attempts within 5 minutes, close port 3306 for that IP address for 30 minutes.

Although, you can access MySQL externally without the need to expose the port directly to the Internet. Either set up a secure SSH server and tunnel the local port or deploy a VPN to achieve access to the internal network securely. Both will provide you internal access to port 3306, without exposing it to the Internet directly.

Port Forwarding via SSH Tunnelling:

(Client)===(SSH Tunnelling)---(MySQL Server)

The same idea is established with a VPN:

(Client)===(Secure VPN)---(MySQL Server)

Equals (=) are used to indicate encrypted traffic over the Internet, while the hyphen (-) indictes traffic within your internal network.


Has there been any documented cases where hackers have hijacked the phone number to a business? Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls to the business, recording the conversations, and updating/hijacking Google/Bing/Yelp listings for the business with their own phone number?

I've run into at least two businesses who I've confirmed their number, and both have said "That's not our number.", yet I was able to reach them. One was an insurance agency and another was a process server. I'm guessing someone may be able to record the conversation and extract credit card numbers or CCV numbers. Not every small business is up-to-date with their online listing.

This sounds like what you were looking for:

http://www.theregister.co.uk/2009/02/11/fugitive_voip_hacker_arrested/

The work the Kevin Mitnick did was on older Plain old telephone system which was analog based. However, open source projects like Asterisk use protocols like VOIP, which is not analog but rather digital communication.


Does expiring the OAuth refresh token at the same time as the access token have any utility? Or is it just security theater? We are integrating with a vendor who have a unique (to us) OAuth 2.0 implementation: with every refresh request, they send us a new refresh token along with the access token.

They say that this was required as part of their work around getting SOC2, but I can't help but think that they misinterpreted something that their security consultants were recommending.

Any thoughts on what the reasoning may be on this?

The refresh token is not being expired at the same time as the access_token, it's being rotated upon usage.

From section 5.2.2.3 of rfc6819:

  Refresh token rotation is intended to automatically detect and prevent
  attempts to use the same refresh token in parallel from different
  apps/devices. This happens if a token gets stolen from the client and
  is subsequently used by both the attacker and the legitimate client.
  The basic idea is to change the refresh token value with every refresh
  request in order to detect attempts to obtain access tokens using old
  refresh tokens. Since the authorization server cannot determine
  whether the attacker or the legitimate client is trying to access, in
  case of such an access attempt the valid refresh token and the access
  authorization associated with it are both revoked.

(Bolds mine)

FWIW, every OAuth2 provider I used worked this way.


Detecting Tor Browser using SIEM I'm looking for a possible way to identify Tor Browser activity using QRadar. We have Firewall integrated & IPS (Without Application Control. Hence not a possible option). I went through the link https://www.dan.me.uk/tornodes but not able to synchronize the link all the time with QRadar.

Do you have any recommendation to detect the Tor Browser activity in an environment using Firewall logs integrated in QRadar? I don't have access to the firewall. So can't make any changes in firewall. I can only make changes in QRadar.

As Tor uses port 443, 9001 & 9030, is there a way to synchronize the content of the URL https://www.dan.me.uk/tornodes or any other way to detect Tor Browser activity in the network.

I don't want to block. I only want to detect using QRadar.

I have done this very thing before, the best method I found was to create a job to periodically pull the IP’s from the tor exit node list, this list can  be used to test your rule set against.

The list can be found here.

These scripts can help with converting them into a CSV file to be pulled by your SIEM.


Is this how end-to-end encryption works? I want to use end-to-end encryption for communicating with other clients using my app. I had the following idea.

Every client creates a public and private key.
Everyone sends the public key to my server and anyone who wants to send messages to another client, gets their public key for that client from my server.
Then he encrypts his message with this key and sends it to my server.
I will save it in my DB until the receiver downloads it.

Is this end-to-end? Is this a secure method? First I wanted to use libusodium for end-to-end encryption but I think this should also work right?

Your general description is fairly standard end-to-end encryption. However, as in most cryptography systems, the main issue is key management, and that's where this can go wrong. For example, your scheme has no independent mechanism to verify the other party's public key. So consider the following scenario:

Alice generates keypair and sends public key (A) to server
Server secretly generates its own keypair (S)
Bob requests A, but server provides S.
Bob encrypts to S and sends to the server
Server decrypts with S, then re-encrypts with A and sends to Alice.

Unless there is an independent way for Alice to confirm her public key to Bob, Bob has to trust that you're not doing that.

This is but one possible problem with the system; there are many other ways it can go wrong. Without a detailed description of the design, implementation, deployment, and maintenance, it's impossible to judge whether it's secure.

libsodium doesn't change anything here one way or another. It's a perfectly good cryptography library, but designing a secure messaging protocol is a lot more than just good cryptography. A great many systems fail in their key management. It is very easy to mess this up. I would not recommend designing a crypto system of any kind without engaging someone experienced in the field.


IIS 6.0 - mitigating BEAST Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every guide I could find...

I changed my reg keys for my weaker than 128bit encryption to Enabled = 0.
completely removed the reg keys for the weaker encryptions.
I downloaded IISCrypto and unchecked everything but RC4 128 ciphers and triple DES 168.

My webserver still prefers AES-256SHA. Is there a trick in IIS 6.0 to get your webservers to prefer RC4 ciphers that I am not figuring out? It seems like in IIS 7 they made this very easy to fix but that doesn't help me now!

A possible fix is to totally disable all non-RC4 cipher suites. This will break connections from clients who have elected not to use RC4 (possibly, these would be quite rare), but at least it will guarantee that if a connection is made at all, then it will use RC4, which is immune to BEAST.

In true SSL/TLS, the server is supposed to follow the client's order of preferences: the list of supported cipher suites sent by the client is ordered, and the server should choose the first suite in this list that it also supports. The mitigation for BEAST that you are looking for is actually a way to make your IIS somewhat discourteous; it seems that Microsoft did not provide a setting for that in IIS 6.0.

Note that Web browsers may also include a fix, called record splitting. See for instance this fix from Microsoft; it appears that an up-to-date Internet Explorer will split the records by default, and thus be immune to BEAST, even if a CBC-based cipher suite is used. Therefore, one way to fix your potential BEAST-related vulnerability is to do nothing and let the clients fix their browsers, which they should anyway (a Web browser which is not up to date, that's another name for "suicide"). After all, the BEAST attack is an attack on the client.


Stealing Facebook oAuth code (not token) of no use? I'm testing a web app that has an option to connect to your facebook account. The oauth login flow starts like this:

https://www.facebook.com/v2.7/dialog/oauth?client_id=xxx&redirect_uri=https://comapny.com/part_of_url_that_i_can_change&response_type=code&scope=manage_pages

I am not able to change the domain of the redirect_uri paramter, but I can change the "resource" part of the redirect_uri, so that I can point it to a page where I can insert an img tag with the src attribute pointing to my site, and by that steal the oauth code via the referer header.

But is the facebook oauth code of any use to me? I dont see a way to exchange it for an access token. The response_type=token is disabled.

A code is exchanged for a token, by way of an authenticated call by the receiving application. That means the receiving application has a client ID and secret that it uses to authenticate itself before it can get a token on behalf of the user.

In this particular case, it's all a matter of whether you can get access to the client ID and secret. You can't do anything without them, so the code is effectively useless.

There's a scenario (IOW vulnerability) where any code can be used with any client ID/secret, so you could use the code if you created your own, but this isn't particularly common and I've no doubt Facebook already accounts for this.


PC reverting to infected state after virus removal Whenever I leave my PC with a technician to get rid of viruses, this happens; at the shop the technician demonstrates that all has been fixed, but when I return home and connect hardware, after 15-20 minutes all would reset to previous infected state!

Is there a possibility of a hardware virus(es)?

I can't say for sure, much like a car mechanic couldn't diagnose a problem without actually seeing it but here's what I can say.

Remember that your computer is only 1 of many devices on your network.  There's at least 1 more computer on your network, and that's your router.  You may not know it, but it's a computer running an operating system, and is capable of being infected.  There could be a bad firmware on the router, or it could be something simple like changing the DNS settings to redirect your web traffic to compromised IP addresses (DNS determines which IP to contact when you for example type in http://stackexchange.com).

I recommend you update your router if it's out of date, and reset to factory defaults, and reconfigure it.

You may also have external devices such as an external hard drive, a camera, or a cellphone which you connect to your computer, which may be infected.

Do you have a smartphone?  Do you connect it to your wireless network?  Have you ever installed an app outside of the Google Play store?

Do you have a printer?  Printers are notoriously insecure, and if they're exposed to the internet (some are), they're easy to find and compromise.

There's so many possibilities I really can't give you a solid answer, but I hope this can help you narrow down the issue.  Your first step is probably to determine which 'virus' you're dealing with.  What is the virus identified as.

Lastly this website is for security discussions, we can't be everyone's tech support, so I can't just walk you through how to fix this, but if you have specific questions, that may help other people in the future, feel free to post them.  Just make sure it's in a clear, concise manner, and you've done some of of your own research first.


How does Veracrypt proceed with small password? Veracrypt is a tool to encrypt disk.

It uses many encrypting algorithms, including AES.

I'm wondering if someone knows how Veracrypt proceed if we choose AES encryption with a password of 3 characters (considering that Veracrypt will use the password as the AES key, and the size key must be a fixed size, eg. 128, 192, 256 bits) ?

Thanks!

veracrypt will not use the users password as the AES key. The AES key will generated from random numbers and protected by a header key. This header key is derived from the password using a key derivation function (KDF) which both hides that the password is weak and also creates a key which is long enough. For more details see https://veracrypt.codeplex.com/wikipage?title=Header%20Key%20Derivation.

Of course, an attacker knowing that only a very weak password was used can brute-force it.


How can I calculate the entropy reduction in my system I'm going to introduce? I am the creator of LessPass, a deterministic password generator.

The core of LessPass is not very complicated.

I have 2 methods calc_entropy and render_password:

calc_entropy transforms the master password + site + login into a very large integer that I call entropy (I don't know if it's the right term, but it represents my amount of randomness in my system). It uses pbkdf2 100k iterations.

render_password uses/consumes this entropy. I have a loop that comes to pick a character from a list of desired characters thanks to the remainder of a long division.

To be sure to have a char for each rule (lowercase, uppercase, digits, symbols) I always pick 1 character for each rule and I insert it in a pseudo-random way in the generated password.

The detail of the algo with an example is available here.

LessPass allows its users to save on a server profiles for their generated passwords to avoid remembering sites rules. A profile looks like this:

{
    "login": "my_login",
    "site": "www.exemple.org",
    "lowercase": false,
    "uppercase": false,
    "symbols": false,
    "digits": true,
    "counter": 1,
    "length": 6
}

I would like to introduce a new functionality by allowing the import of passwords from other password managers.

Imagine that my old password for www.example.org is foobar.

I can generate a very large number which after passing in the function render_password generated the password foobar (randomly generated entropy).

I would like to store in the password profile the difference between the actual entropy and a randomly generated entropy which goes through render_password generates foobar.

To generate the old password, I calculate the entropy, apply the diff then render the password.

I did a naive poc here

If you have read me so far thank you!

My question: to what extent do I increase the brutuceforcability of the master password if an attacker stole the LessPass database (he knows the diff) and stole the user's password (he knows foobar) compared just knowing the foobar password?

So basically, this is a form of plain-text attack against your algorithm.

The question is how easy it is to guess your integer. If I know "foobar" and the new password, then I can create a set of equations that try to determine the original integer. As long as the integer is larger (in qty bits) than the password (the aqtial information in the password), then I can never really calculate the actual integer.

I might, however, get enough information to make the integer 'less random'.   That sounds abstract, but let me give a very simple example.

I try to determine the value of x, which is element of [1 - 10]. The original brute force would need me to test 10 values. However, I know that the remainder of x/3=2.  That means that x is element of {2,5,8}. So I now have to test 3 values, in stead of 10.

How that exactly works out for your algorithm, and whether you have sufficient entropy left requires quite a bit of calculation in the realm of information theory. And to be honest, my information theory is a bit too rusty for this.

Another question is whether the entropy is sufficient. Compared to what? A completely random password? or "qwerty123"?

I realize that I have not answered your question, but instead made the problem slightly larger. Or I may even have completely misunderstood the question. Sorry for that.


How secure is it to use secret directory names to share files on unix? There is an old trick on unix systems to allow a non-root user to "securely" share files with particular other users.

mkdir share
chmod 711 share #others can traverse share, but can't list its contents
mkdir share/d2ef7c19-5d7e-446f-ab97-d7d6c3dc8a8c #(randomly chosen secret subdir name)
cp -R /path/to/stuff_to_share share/d2ef7c19-5d7e-446f-ab97-d7d6c3dc8a8c
chmod -R 755 share/d2ef7c19-5d7e-446f-ab97-d7d6c3dc8a8c #allow others who know the secret path to access shared files

EDIT (clarification): I have to tell the people I want to share files with the secret path (in this case, ~myid/share/d2ef7c19-5d7e-446f-ab97-d7d6c3dc8a8c) in order to share the files with them.

My question is: how secure is this?  If a third party (non-root) does not know the secret share name (in the example above: d2ef7c19-5d7e-446f-ab97-d7d6c3dc8a8c), is there any way they can learn about it?

This is called "Security by Obscurity", and is not a reliable form of hiding files at all. There are plenty of tools that can search a whole filesystem and index the files within, regardless of what permissions you're assigning to some randomly named folder.

You have conflated an adversary not knowing something with them being unable to learn it. In your example, you aren't actually doing anything to stop someone who obtains the folder name from listing and reading the contents. Once the name stops being secret, the jig is up. This is unlike a password, as passwords are stored in a one-way hash, whereas folder names are in clear text on the filesystem.

An analogy: You have a house, with a door, and you want to keep people from just walking through your door. You can move the door to some hard to find spot on the house that isn't visible by just walking around the outside. But there's nothing stopping someone from pressing on various parts of your house to find the door.

Or, you can put the door in an obvious location, but prevent anyone from just opening it, with a lock.


Security standard for web-based Tele-Radiology software I am preparing a test plan for the security penetration testing of a software solution that manages patient information (HIPAA compliance) and allow the user to access to it from the web. Does anyone happen to know if there is any security standard for HIPAA that I can refer to as a blueprint for building the test plan?

Ly

I'll assume you're in the U.S., and are a Covered Entity, since you refer to HIPAA and are storing patient information.

First off, note that the HITECH act and related federal guidance put significantly more detailed guidance on the table; much more than the "reasonable effort" HIPAA guidance, and involving much more serious action in the case of a breach.

If you can afford it, get a consultant who specializes in the area.  You'll need a lawyer who knows the area whether you have a consultant or not.

For official HIPAA/HITECH guidance, as a bare minimum, start with HHS (Health and Human Services), NIST (National Institute of Standards and Technology), and FIPS (Federal Information Processing Standards) - I've outlined a few high points below - this list is in no way complete nor comprehensive - it's merely a starting point!

HHS.gov Health Information Privacy

HHS.gov Security Rule Guidance Material

HHS.gov Understanding Health Information Privacy

HHS.gov Breach Notification Rule - this is one of the most critical pages, as it links to important Federal Register articles.

Breach Notification Guidance and RFI (74 FR 19006) is the first; in particular, page 19010 refers you to various NIST Special Publications

NIST SP 800-52 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations is called out specifically; Rev.1 is currently in draft to replace the old version - READ IT.

Assess your web server and all other TLS system cipher suite choices - you can use Qualys SSL Labs for free to see the list of cipher suites your server supports; compare those against what's allowed in SP 800-52.

Breach Notification Interim Final Regulation (74 FR 42740) is another link on the 74 FR 19006 chain

Also see Omnibus HIPAA Rulemaking

Other NIST Special Publications of interest include, but are not limited to:

SP 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths came out Jan 2011, and almost all of the cutoff dates have already passed.

I haven't seen specific reference to SP 800-131A in the Federal Register documents, but it contains extremely good guidance, and certainly wouldn't be something you'd want to explain having ignored, on national media, after a breach
RSA < 2048 bits is no longer "Acceptable"
DSA with |p| < 2048 or |q| < 224 is no longer "Acceptable"
EC < 224 is no longer "Acceptable"
SHA-1 is no longer "Acceptable" for digital signature generation or digital signature verification.

It IS still "Acceptable" for non-digital signature applications, including in particular HMAC based KDF's.

HMAC < 112 bits is no longer "Acceptable"

SP 800-111 Guide to Storage Encryption Technologies for End User Devices is specifically mentioned in 74 FR 19006
SP 800-77 Guide to IPsec VPNs is specifically mentioned in 74 FR 19006
SP 800-113 Guide to SSL VPNs is specifically mentioned in 74 FR 19006
SP 800-88 Guidelines for Media Sanitization Rev.1 is in draft at this time, and is specifically mentioned in 74 FR 19006

FIPS 140-2 Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules is specifically mentioned in 74 FR 19006.

Note that DSA/ElGamal GPG and PGP keys do not qualify as FIPS 140-2 compliant - not only is ElGamal not listed, the DSA keys are almost always 1024 bit, which is too short per NIST SP 800-131A (above).


Criteria for Selecting an HSM A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course.
As an alternative to developing a custom solution around (standard) encryption and key management processes, the purchase of an HSM (Hardware security module) is under consideration.

Obviously this would depend (at least in part) on the specific application, company, data types, technologies, and budget - but I would like to keep this generic, so I am leaving it at a high-level view, and ignoring a specific workflow.

Let's just assume there is secret data that needs to be encrypted, and we are looking to hardware-based solutions to manage the complexity and probable insecurity of bespoke key management, and mitigate the obvious threats against software-based encryption and keys.

What are the factors and criteria that should be considered, when comparing and selecting an HSM? And what are the considerations for each?

For example:

Obviously cost is a factor, but are there different pricing models? What should be taken into account?
Are some products more suited to different forms of encryption (e.g. symmetric vs asymmetric, block vs stream, etc)?
Same for different workflows and lifecycles
What level of assurance, e.g. what level of FIPS 140-2, is required when?
Network-attached vs server-attached
etc

TO BE CLEAR: I am NOT looking for product recommendations here, rather just for how to evaluate any specific product. Feel free to name products in comments, or better yet in the chatroom...

Some technical factors that may be relevant:

Performance - across whatever matters for your application (if any): encryption/decryption/key generation/signing, symmetric, asymmetric, EC, ...
Scale:

Is there a limit to the number of keys it supports, and could that limit be a problem?
How easy is it to add another HSM when your application becomes more demanding (size, speed, geographic distribution...)

Redundancy - when one HSM breaks, how much of an impact is it on your operations, how easy is it to replace without loss of service, etc
Backups - how easy is it to automate and restore? Do you need to independently protect the backup's confidentiality and/or integrity or does the product ensure that? How likely are you to end up in a position where you've irrecoverably lost your data (how many factors need to be lost / forgotten, HSMs died, etc).
API support:

MS CAPI/CNG (easy to program from a Windows environment);
JCA (easy to develop for using Java. What version is supported?);
PKCS#11 (and a recent version? Wide support across applications, though it comes with known security issues);
vendor proprietary (probably the most flexible/powerful/secure-if-you-know-what-you're-doing but increases cost to move to another vendor), and whilst C is probably a given, does it have bindings for your preferred language?
a related note: is there guidance on integration with your application (e.g. DBMS, OS services)?

OS / hardware support
Management options - what GUI / command line tools are there for doing management tasks - i.e. anything that you do infrequently enough to not want to automate (key generation?; authentication factor management?). Do your admins need to be physically present to commission the device or perform additional tasks after commissioning?
Programmability - most of your development will likely be on the other end of one of the APIs, but sometimes it is useful to be able to write applications that run on the device for greater flexibility or speed (see Thomas' answer)
Physical security - how resistant to direct physical attack does your solution need to be (bearing in mind not just the HSM but the whole solution)? If for whatever reason you decide it is particularly important (your HSM is exposed but your clients aren't, or disclosure of the keys is far worse than merely being able to use the keys for nefarious purposes - ref DigiNotar?) then you might want to look for active tamper detection and response, not just passive tamper resistance and evidence.
Logical security model - can malicious entities on the network abuse your HSM? Malicious processes on the host PC?
Algorithms - does the HSM support the crypto you want to use (primitives, modes of operation and parameters e.g. curves, key sizes)?
Authentication options - passwords; quorums; n-factors; smartcards; OTP; ... You should probably at least be looking for something that can require a configurable quorum size of token+password authenticated users before allowing operations using a key.
Policy options - you might want to be able to define policies such as controlling whether: keys can be exported from the HSM (wrapped or unencrypted); a key can only be used for signing/encryption/decryption/...; authentication is required for signing but not verifying; etc.
Audit capability - including both HSM-like operations (generated key, signed something with key Y) and handling crashes (ref g3k's comment). How easy is it going to be to integrate the logs into something like Splunk (sane log format, syslog/snmp/other network accessible - or at least non-proprietary - output)?
Form factor:

network attached (for larger scale deployments, particularly where multiple applications/servers/clients need to make use of the keys);
desktop (for individual use; performance, availability and scalability not a big concern but cost is, especially good if your solution requires lots of people needing direct access to an HSM);
PCI (-express) (cheaper than network attached; more effort involved in making available to multiple applications);
USB token (easy server upgrade; cheap and slow (and easy to steal!));
PC card (as per desktop, but good for laptop users). (PC cards are pretty dead now)

Some non-technical factors:

Certifications - do you need any / do you want any because they give you confidence in the product's security? Ignoring what you need for regulatory reasons:

FIPS 140-2 provides useful confirmation that the NIST-approved algorithms work and have run-time known answer tests (check the Security Policy to see what algs they've got approved), but don't put much stock in it otherwise showing the product is secure; my rule of thumb for Level 3 hardware security means people with only a couple of minutes access to the device will be hard pressed to compromise it. FIPS 140-2 Level 3 is the de-facto baseline certification for HSMs - be wary if it doesn't have one (though that's not to say you need to use it in a FIPS compliant way).
Common Criteria evaluations are flexible in the assurance they provide: read the Security Target! There are no decent HSM Protection Profiles yet, so at the least you're going to have to read the Security Problem Definition (threats and assumptions) before you have an idea what the evaluation is providing.
PCI-HSM will be useful if you're in the relevant industry

Aside from certifications, how does the vendor look like at security? Having CC EAL4 certs is a good starting point, but remember Win2k has those too... Do they make convincing noises about supply chain integrity, Secure Software Development Lifecycle, ISO2700x, or something like The Open Group's Trusted Technology Provider Framework?
Do you like the vendor's policy on disclosure?
Support (options, reputation, available in your language)
Services - if you have a complex requirement, it might be advantageous to have the vendor involved in your configuration/programming.
Documentation:

High level documentation - HSMs are complex general purpose products that can require somewhat involved management; good documentation is important to allow you to develop a secure and workable process around them (see Thomas' answer for more discussion).
API documentation - good coverage, preferably including good examples of common (and complex) tasks

Cost (units + maintenance)
Lead time
Vendor patch policy / frequency (+support for and ease of firmware upgrade)
Country of design and/or manufacture - you might be a Government or company that particularly (dis)trusts certain countries
Vendor stability - are they likely to be around to support the product for as long as you're going to be using it?
What is the vendor's product roadmap, does it hold anything of value for you, and will you have access to the future versions via firmware upgrade?
How good the swag was that you got off of them at RSA

There are probably many more.

The SANS institute have a good introductory paper describing why you might want an HSM, the positive attributes it (should) have and some of the downsides.

It seems an HSM vendor agrees with most of this list, and produced their own (unattributed) version of it.