Could my mobile number have been used without my knowledge? I've had an unusual experience today. A phone number (not withdrawn number) texted me demanding to know who I was. Their tone was aggressive and I simply told them I don't know their number. When I asked how they got my number they told me I'd just phoned them, and backed that up with a screenshot showing a missed call from my mobile phone number calling moments ago.

Needless to say, I did not phone this unknown number, there's nothing in my call history.

I've tried googling my number to see if anyone else is getting cold calls from it, so far, no reports. I am concerned that someone's found a way to make calls from my phone number without my knowledge or consent.

Details:

My mobile service is provided by EE in the UK
My phone has been right by my side the whole time, nobody else here.

So here's the questions:

Could someone have made calls from my number? If so, how can I guard against this?
Are there sometimes random calls due to network issues?
Could this be first contact for any known scams? Pretending to have received a call from someone?

Any information on this would be helpful. Thank you!

Just like you can send a mail and make it look like it came from an adress you don't own, there is ways to make a phone call and make it look like it came from another number.

Basically, when a phone call is made, your phone provide your number so the recipient can see which number called them.
But as it is your phone that provide the information, one can manipulate it to make it look like it came from someone else.


USB Flash drives and data theft: x355 Can somebody have stolen files and data from my desktop PC just by inserting a USB Flash drive in my computer, without dragging files over to the Flash drive?

Yes, easily. Removable devices (such as USB, or CD-ROM disks) have "AutoPlay" support on Windows. This is designed to auto-run installation CD-ROMs; just insert the CD and the installer starts.

It works like this: if in the root of the newly inserted device an "AUTORUN.INF" file is found, then its instructions are executed; they may tell the system to display a special, cooler icon for the device, but also to execute a program from the device. Both the autorun file and the program may be hidden so that you don't see them on the device, and it appears empty.

This executable could then do anything the logged-in user can do: it could run a search on the hard disk, and copy matching files on a hidden folder in the USB key. Or install a virus (that's how USB viruses such as Conficker propagate) that could then trasmit files at leisure through the Internet, if the computer was online.

It is easy to write such an autorun INF file using Notepad, and the executable can be built with any of several tools such as AutoIt, or it could even be a .CMD or .BAT file, which too can be created with just Notepad.

There are even "ready made" tools out there, such as, if memory serves, Slurper:

install the program
insert the USB key
choose the file search parameters (e.g. "Files newer than one week")
click "OK"
and the utility saves on the USB key an autorun file and executable that...

...

...when you insert the USB key in a computer, will search matching files and "slurp" them on the USB key, optionally even deleting them.

UPDATE: There also happens to be a howto on Superuser.

Workarounds: on Windows XP, keep the "SHIFT" key pressed while inserting the flash drive. This disables autorun execution. Also works on Seven, haven't tried on Windows 8.

And of course, you can disable the autoplay functionality (also here), which is always a good idea. You never know where those USB keys have been, after all.

(IPQ sells a write-protectable USB key that allows you to let someone copy a file on his untrusted-by-you computer, without said computer being able to infect the USB key with malware. Other WP keys are available e.g. on Amazon).


MITM attack between me and TOR entry node In which ways can my ISP, who by the way controls the WiFi router I connect to, do a MITM attack on my TOR connections and hence read the traffic?

They can not read your traffic, because the communication between you and the entry node is already encrypted.


Does a password manager's master password significantly improve security? I use the KeePass password manager, which allows me to change the key derivation/encryption settings. I'm tempted to take time to choose very strong settings and an enormous passphrase.

But does it really improve security ? My understanding is that when a malware runs on a user account (which is the only way it could try to attack my password database), there's not safe way to hide data : it could register keystrokes, or take screenshots when passwords appear on the screen, or try to read the password manager's memory when the database is decrypted, or monitor the clipboard.

Moreover, I don't see the point in investing so much effort in securing my password database when other personal and sensitive data sits unencrypted in my user folder, like connection cookies or my photos archive, which is arguably more sensitive than my passwords : the latter can be changed after a breach, but if the former gets stolen, I've lost. Also, it would bother me more if someone stole my photos than the passwords to my social media accounts.

Finally, I use full disk encryption, preventing someone with access to my computer from using any data on it, including my passwords.

Because of those reasons, I'm considering using KeePass with only a keyfile that would sit in my user folder, making the encryption totally useless as the key would be as accessible as the encrypted file. I know it's not considered good practice, but for the above reasons I don't see the point in securing only this particular part of my data.

Is there any reason I've overlooked that would make this decision stupid ? More generally, how can a master password be a significant improvement in security as a malware would have other easy options to see the passwords ?

All depends on what threats you consider. You are right, if your system is deadly compromised with keyloggers everywhere, there is little that can be done. But what if the attacker can just take a copy of a file and if that file is the password vault?

The common usage of a password manager like Keypass, is the assumption that there is a hierarchy in data sensitivity:

not so sensitive data can live in unencrypted files on the disk
highly sensitive data (passwords to bank accounts, PIN code of your credit card, etc.) should be protected with a master password in case of data theft.

If your data does not respect that hierarchy, it is possible that the security of the password vault is not worth a complex master password. But that means that you use Keypass only for its ability to store passwords and no longer for its ability to protect passwords. In that case, you could as well store passwords directly in your browser...


Is there a FIPS 181 like standard for random password generation with alphanumerical seed? NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords.
As far as I understand the standard:

it will generate a password that is lowercase, and with some pronouncebale syllabuls

My question is whether there is an alternative standard which:

includes besides lowercase alphabet, uppercase alphabet as well as numerics
not necessary easy to remember

If there is no standard for such a password generator, should simply change the seed for FIPS 181, or is there a better alternative?

Note that FIPS 181 is from 1993, which is ancient, in computer security terms, and I doubt that NIST is actively recommending it, especially since as you say it only includes lower-case ASCII letters, making the passwords much easier to crack.

At a deeper level, since the goal is for passwords to be unpredictable, it is not generally good to promulgate a standard which would simply serve to restrict the set of possible passwords.  That would make the attacker's job easier.

I recommend incorporating random inputs into your thinking when making a password, but then tweaking it in your own way to make it even less predictable.  The apg program looks like what you're looking for, and is suitable for that kind of use, since it is easy to tweak the parameters, and to then tweak its suggestions.  It refers to FIPS 181, but actually by default generates passwords that include symbols, digits and capital letters as well as lower case letters, and which can either be limited to more pronounceable ones or not.

The first thing you'll probably want to tweak (depending on your threat model) is to use the -m option to increase the minimum length to at least 12 characters so there is enough entropy in them.  See entropy of FIPS-181 automated password generator - Information Security Stack Exchange for some background on the entropy of such passwords.

Note that I don't recommend using any of the many web pages that generate passwords using apg or the like - that's just asking for someone to remember (or spy on) all the ones that are handed out and add them to their cracking dictionary.  Evidently that wasn't clear way back in 1986 to the authors of RFC 972 - Password Generator Protocol, which amazingly still lives on in my /etc/services file....

See also RFC 4086 - Randomness Requirements for Security


This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F I am verifying my domain name with SSL LABS and got Grade F

and i got this message

This server is vulnerable to the OpenSSL Padding Oracle vulnerability (CVE-2016-2107) and insecure. Grade set to F.

i am using Ubuntu and implemented following steps:-

**sudo apt-get update && sudo apt-get upgrade**

and following steps

sudo apt-get install make (Install compiling library Make)
wget https://www.openssl.org/source/openssl-1.0.2g.tar.gz
tar -xzvf openssl-1.0.2g.tar.gz
cd openssl-1.0.2g
sudo ./config
sudo make install
sudo ln -sf /usr/local/ssl/bin/openssl which openssl

after this i run this command
openssl version -v and i got the result OpenSSL 1.0.2g  1 Mar 2016

Any idea why i am getting this **OpenSSL oracle padding vulnerability (CVE-2016-2107) issue?**
My ubuntu version is

Distributor ID: Ubuntu
Description:    Ubuntu 14.04.5 LTS
Release:        14.04

Thanks in advance.

You are getting that result because you are using a vulnerable version of OpenSSL... if you check the OpenSSL Vulnerabilities page (search on page for 2107 to find this CVE), you'll see that it's not fixed until OpenSSL 1.0.2h. 1.0.2g is vulnerable. Why would you choose to wget 1.0.2g, anyhow? The current version of the 1.0.2 branch is 1.0.2j, which was released in late September.

If you're asking why the Ubuntu 14.04 repo has a dangerously outdated version of OpenSSL, I can only offer two responses:

You're using Ubuntu, which in my experience is not very good about backporting software to older versions (yes, even LTS versions). Once they cross the 24-month line, they drop you like a hot rock.
Your version of Ubuntu is 2.5 years old, and you should have moved to 16.04 (or 16.10).

OpenSSL 1.0.2h came out two months after 1.0.2g, and in that time crossed out of the two-year support window for the 14.04 Ubuntu build, so they stopped caring about it. Ubuntu 16.04 or 16.10 should be fine, or any distro that backports security fixes for more than two years (which, admittedly, not many do).

To upgrade, use the command sudo do-release-upgrade (see this page for more info) from the command line. LTS (Long-Term Support) builds will only upgrade to new LTS builds. The upgrade itself will take a while, but afterwards you will be running Ubuntu 16.04 and have access to its repositories. This will let you keep your software updated, at least until the support period for that version ends in another 17 months.

After upgrading, you should run sudo apt-get update && sudo apt-get upgrade again, to make sure all your packages are up to date.


Tools needed to setup a paranoid remote backup server I'm a system admin with little security experience.  I want to schedule the copying of our backups to protect our data in case of fire.  The best solution would be to copy the data onto a new hard-disk and lock it in a safe.  Practically, however, the chances of someone doing this regularly are slim.  I therefore want to automate the copy to a computer/hard-disk that is far away from the building.

The data is very sensitive and the chances of a sophisticated attack are considered to be fairly high.  I am therefore looking for solution that has very limited functionality.  This is largely to prevent myself (or a system admin in the future) misconfiguring the solution in ignorance.  In short, I want my server to be able to communicate to a well defined external computer and only this computer.  Is this something that is possible to guarantee?

The company cannot afford a leased telephone line, which is the only way I currently think of to achieve this aim.
(I worry, for example, that a VPN has too great a functionality, and causes me to become a security risk.)

Currently the office server (that makes the backups) is isolated from the internet.  Desktop users (who do have the internet) have access to only low privilege accounts on the server.  I would like to keep the server and the backup server as isolated from the internet as possible - allowing only the scheduled copy to be communicated to the outside world.  Is there any alternative to VPN for this?

Finally, since the server in the distant location is only required to copy the backup onto a hard-disk  - is there a way of locking this system down so that only transmitted documents are saved to the hard disk (preventing malware from accidently being installed).

Currently all the solutions seems that I have found involve either VPN or a leased telephone line.  I think the first is far from foolproof and I can't afford the second.  Any advice welcome.

EDIT:  I'm not discounting using VPN, but I would need to convice myself (and my supervisors) that this method is near idiot proof.  This is because I have not used this technology before.

You need just the most recent copy of the data, or a historic backup, like version control?

supposing you have two computers running linux (easier) or even any other OS that have the needed tools implemented and you want only the latest backup:

install SSH and create a tunnel between the two computers. You can choose to use the strongest key you need
configure firewall to only accept communications between the two computers
configure Rsync to make the backup between the servers, in the needed frequency (ex.: daily backup running every night)
the destination computer (remote one) could have disk encrypted. And he could get the keys from the source server.

And be sure that physical access is limited on the destination server.

This way:

at a specific time, the backup server mounts the encrypted disks asking for the key that is in the source server
after some minutes the rsync begins to update the files in the dest drive
when it's finished, you have the files in the recent state.
umount the drive, and you're done.

Rsync is good because it only copies what is different between the files, so it's very fast to do backups with it.

It's possible to use rsync to make incremental backups too: take a look at this site


Iframe postmessage fraud I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered.

From what I was able to understand, the information is exchanged between the iframes using internal browser APIs, without any network communication. In other words, even if the two iframes exchanging information between them are hosted in two different servers originating from two different domains, I will not see any traffic being exchanged between these two servers when messages are posted.
Before implementing this on my website, I just want to be sure -
How does the browser validate the origin of the posted message?
Is there any way an attacker can "spoof" a message and make it look like it originated from a legitimate iframe?
I am guessing the answer is no because that would require reverse engineering the browser and exposing its internal APIs, but I just want to make sure that my understanding is correct.

Thanks in advance

If origin was spoofed in this context, this would be down to a flaw in the particular browser that had been exploited. There have been such flaws in the past, such as this one on Safari.

So assuming the user is using a fully patched browser and no zero day flaws exist (!) then your method of verifying the origin cannot be spoofed within the browser when receiving postMessage events.

At the end of the day you have to trust the browser is behaving as expected for it to hold up the client-side end of your security. Yes, a malicious user could cause their browser  to spoof the origin, however if they cannot attack other users or your system itself by doing so and could only attack themselves you should be safe. Of course you should not use the origin value to verify things where a malicious user can gain advantage by spoofing it - you should only be using this value to verify that a user session is not being attacked, and not as a means of validating the user's actions. This is the same reason why you should not have client-side validation only for webforms as the user themselves can bypass it.

To summarise, in your scenario you should be able to trust the origin of the postMessage event.


Authenticate WCF call to ADFS through Web Application Proxy (WAP) Currently we authenticate WCF calls TO a service via ADFS, using the following procedure:

Firstly, we get a SAML token from ADFS

using (var factory = new WSTrustChannelFactory(
   new UserNameWSTrustBinding(System.ServiceModel.SecurityMode.TransportWithMessageCredential),
   new System.ServiceModel.EndpointAddress(new Uri(_aDFSUsernameMixedUri))))
    {
        System.IdentityModel.Configuration.SecurityTokenServiceConfiguration serviceConfig = new System.IdentityModel.Configuration.SecurityTokenServiceConfiguration();
        factory.Credentials.UserName.UserName = _apiUser;
        factory.Credentials.UserName.Password = _apiPassword;
        factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = serviceConfig.CertificateValidationMode;
        factory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13;
        WSTrustChannel channel = null;
        try
        {
            var rst = new RequestSecurityToken
            {
                RequestType = WSTrust13Constants.RequestTypes.Issue,
                AppliesTo = new System.ServiceModel.EndpointAddress(_endpointUri),
                TokenType = "urn:oasis:names:tc:SAML:2.0:assertion",
                //KeyType = KeyTypes.Symmetric
                KeyType = KeyTypes.Bearer

            };

            var token = factory.CreateChannel().Issue(rst) as System.IdentityModel.Tokens.GenericXmlSecurityToken;

We use the /adfs/services/trust/13/usernamemixed endpoint (_aDFSUsernameMixedUri variable). This endpoint is proxy enabled.

Secondly, we use this SAML token to contact our service:

using (HttpClient httpClient = new HttpClient() { BaseAddress = baseAddress })
        {
            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("SAML", saml);
            httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            string jsonString = JsonConvert.SerializeObject(model);
            HttpResponseMessage response = await httpClient.PostAsync(Url, new StringContent(jsonString, Encoding.UTF8, "application/json"));
            return response;

        }

It is worth mentioning that the service only accepts authenticated requests, and it will read out the authorization details from the SAML token (which is signed & encrypted). That is how the service is secured.

We now want to protect our ADFS server by using an ADFS Proxy (Web Application Proxy). The call to ADFS for the SAML token still works, and returns a SAML token. However, the second step fails. The HTTPRequest is blocked by the ADFS Proxy server, and redirects the call to the ADFS login page, which is of course not what I want.

I have already tried setting the passiveRedirectEnabled="false", but this does not help. Any idea where I have to put the SAML token in the HTTPRequest to let the proxy know that this is an authenticated request?

UPDATE

The ADFS Proxy uses an EdgeAccessCookie to decide whether or not it redirects the request back to the ADFS server. In case I could add this EdgeAccessCookie to the request, the proxy would probably stop blocking the request. How can I retrieve this EdgeAccessCookie in a WCF request?

The Web Application Proxy uses an authorization token to decide whether or not it sets the EdgeAccessCookie. If you can request the authorization token and put it in the URL of your HTTPRequest, the WAP will let you pass. Code snippets:

        List<KeyValuePair<string, string>> postData = new List<KeyValuePair<string, string>>();
        postData.Add(new KeyValuePair<string, string>("UserName", username));
        postData.Add(new KeyValuePair<string, string>("Password", pw));
        postData.Add(new KeyValuePair<string, string>("AuthMethod", "FormsAuthentication"));
        HttpContent content = new FormUrlEncodedContent(postData);

        WebRequestHandler webRequestHandler = new WebRequestHandler();
        webRequestHandler.AllowAutoRedirect = true;
        webRequestHandler.MaxAutomaticRedirections = 1;

        HttpResponseMessage response;
        using (HttpClient client = new HttpClient(webRequestHandler))
        {
            response = client.PostAsync(https://FQDNADFS/adfs/ls?version=1.0&action=signin&realm=urn:AppProxy:com&appRealm=REALMOFAPI&returnUrl=RETURNURL&RedirectToIdentityProvider=IDENTITYPROVIDER, content).Result;
        }

        authToken = HttpUtility.ParseQueryString(response.Headers.Location.Query)["authToken"];
        return authToken;

The above snippet will give you the authorizationcode, which you should include in the URL of your HTTPRequest:

HttpResponseMessage response = await httpClient.PostAsync(Url + "/?authToken=" + authToken, new StringContent(jsonString, Encoding.UTF8, "application/json"));

In combination with the code from my question (no changes there), the WebAPI is secured by the WAP. Good luck.


Exploitability of use-after-free vulnerabilities Use-after-free bugs are a particular class of memory safety bugs.  How often are they exploitable, in practice?  When you find a use-after-free bug in a program, is it often exploitable, rarely exploitable, or does it vary based upon some other factor I'm overlooking?

I'm particularly interested in how often use-after-free bugs in C programs are exploitable (specifically, C, rather than C++).  How often are use-after-free bugs in C programs exploitable?  If I discover a use-after-free bug in a C program I'm testing, what should I estimate as the likelihood it is exploitable?  90%?  50%?  10%?  When triaging bugs (e.g., fuzzer crashes, Valgrind warnings, warnings from static analysis tools), how highly should I prioritize fixing use-after-free bugs, compared to other kinds of memory safety bugs?

Research I've done.  I have been doing some research.  It looks like use-after-free bugs in C++ programs are often exploitable (because the memory layout of a C++ object always contains a pointer to a vtable, and overwriting this leads easily to code injection).  OK, good.  Now what about C programs?

I can also see how use-after-free bugs can be exploited in certain special cases.  For instance, use-after-free bugs in browsers or other programs with user-controllable scripting seem to often be exploitable, because of the ease of doing heap spraying and the great deal of control over the contents of objects stored in memory.  And, yes I've seen some sophisticated methods of exploiting use-after-free bugs in certain special cases (e.g., using them for information disclosure, which then lets you derandomize ASLR, after which....), but those seem pretty application-specific and like you might need to get lucky for the attack to work and even then it'd take a bunch of work to build the exploit.  But I'm interesting in knowing what the "typical case" usually looks like, rather than the special cases where the attacker gets lucky.

Use-after-free attacks require the attacker to be able to allocate some memory reliably on heap.

Say I have an object that takes 16 bytes, and happens to be allocated in memory to 0xb00000004 (completely made up numbers here). I delete this object and the memory is returned to the heap. Now I request another heap allocation for 16 bytes (a string for example) and the heap allocates it on 0xb0000004. Now a pointer referencing the old object instead calls the new object, not even realizing it.

As you've previously mentioned, this is popular with scripting languages for a reason. That reason is because scripting languages can reliably allocate memory on the heap.

Therefore to know if you're going to be vulnerable, you need to assess how difficult it would be for an attacker to be able to allocate memory, and if that attacker could allocate it reliably.

In a C program, the potential risk appears to be less since any such pointers or references are going to be on basic data types, not objects. How is an attacker going to execute arbitrary code when the program treats it as data instead? In that case you need to analyze if your data can be trusted.

For example, let's say your program stores a string "http://xyz.com/super program.zip", and you have code to download, extract, and execute it. If an attacker is somehow able to overwrite that string to http://superbadplace.com/supervirus.zip/", then your program could unintentionally be installing a shell.


Does HSTS preload includes subdomains? i know that you can preload your domain if you have everything with a valid HTTPS vertificate, but after preloading the domain if i go to subdomain.example.com is it going to me preload the same way as example.com is preloaded?

Yes. You can see at https://hstspreload.org/ that it is a requirement to include subdomains:

  The includeSubDomains directive must be specified.


Is reading ISO 27000 official publication sufficient to prepare for exam? I was at the ISO/IEC 27001 official web page. I saw a the publication for the norm. It's about 23 pages. So I was wondering if studying those 23 pages would prepare me enough, lets say at 80%, to passe exams for foundation, lead auditor or lead implementer exams ?

Is reading ISO 27000 official publication sufficient to prepare for exam?

No.
ISO 27000 is only 23 pages since it is only the overview and vocabulary list.


Security/Privacy OS With Boot On Thumbdrive I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot partition and carry on a thumb-drive? How would you go about removing the /boot partition, and automatically mounting the thumb-drive so the computer will boot?

This idea has been answered before on Unix StackExchange. Furthermore, you can do this yourself with nearly any Linux based distribution. Also, for insight What is the /boot partition really for?.

Preparing a USB flash drive to store /boot/. So, then you will specify your BIOS to boot from the USB drive to access the GRUB bootloader and the Linux kernel, instead of the storage drive where the OS is installed.

  (1) Prepare your usb flash boot-device under existing Debian
  installation using package gnome-disk-utility the following way (which
  is not necessarily the only way but tested and works for me).

  (1.1) Format device with MBR scheme.

  (1.2) Create single ext2 partition making it occupy all available
  space.

  (1.3) After step 1.2 completes go to "Edit partition" and set the
  bootable flag.

  (2) Install Debian using its standard installer.

  (2.1) Boot your installation media, i.e. Debian installation cd/dvd or
  another usb stick with .iso image written on it.

  (2.2) Choose country/language, setup users and passwords, answer all
  the routine questions (no interest here) till disk partition dialog.

  (2.3) Select manual partitioning.

  (2.4) Create your raid/lvm/encrypted volumes on your main disk drive.
  On top of it there will be a file system, probably ext4.

  (2.5) Go to properties of this file system and select mount as / and
  "done with this partition".

  (2.7) Find the usb stick in the list, it should have ext2 on it.

  (2.8) Go to its properties and select mount as /boot and optionally
  noatime in additional flags. There is an option of formatting the
  partiton, DO NOT do it! "Keep the files".

  (2.9) Select "Done with this partition".

  (2.10) Select "Finish partitioning" or similar, installation process
  should continue with some dialogs that are straightforward.

  (2.11) After a few other dialog that are straightforward and not of
  our interest here, there will be a dialog with a question where to
  install GRUB, which you should agree to install in your /dev/sdX,
  where X is your usb boot flash.

The key part is LUKS cannot encrypt /boot/. So, this is vulnerable to modification. Instead, we will move the /boot/ partition onto another storage device, particularly a USB flash drive due to portability and boot from it to then load and decrypt the OS. However, this USB drive is still unencrypted and vulnerable to unauthorised modifications.


What kind of certificate to be used to consume web services? I have my own application. My client wants me to use their web service. This web service sends some data to my database. For this, my client wants a certificate from me. In this scenario, what kind of certificate should I provide?

A self signed certificate of sufficient key size (2048 bit) would be fine. You wouldn't need a CA signed certificate as the client can add the certificate to their credential store. Use OpenSSL for the purpose.


Is autocorrecting typos in passwords secure? Technology Review's Why Autocorrect for Passwords is a Great Idea says:

New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and documents: autocorrect.
“This is, in our view, a pretty big deal,” says Ari Juels, a professor at the Jacobs Technion-Cornell Institute at Cornell Tech, in New York City. “Websites should be changing their password policies to make users’ lives easier. The security degradation is pretty small.”

The article also cites the paper pASSWORD tYPOS and How to Correct Them Securely, which starts with:

We provide the first treatment of typo-tolerant password authentication for arbitrary user-selected passwords.

While they say that it is safe, this sounds like a bad idea to me.
How secure actually is this idea?

Full disclosure: I am one of the authors of the paper.

An exact password checking system stores a standard salted,
slow-to-compute hash of the password. When a password, such as
password123, is registered with the authentication service, a random salt
"sa" is selected (this should be 16 or more random bytes) and a
slow-to-compute hash function H is applied: H(sa,password123). The result,
call it h, is stored in a database along with the salt sa. As mentioned,
one should pick H to be slow (10s or 100s of milliseconds to compute).
Good choices are argon2, scrypt, or PBKDF2, properly configured.

When a user later attempts login, if they type in their password the hash
is recomputed and checked against the stored value. In the example above,
if the user sends password123 then one recomputes (again slowly)
H(sa,password123) and checks the result --- it matches the previously
computed h and login can be allowed.
Any deviation in the submitted password from the previously registered one
results in a totally different hash value, and login fails.

Our idea is simple: if the first check fails, the system can additionally
apply a small number of "corrector" functions to the submitted password,
and then apply the hashing algorithm to the result. For example we might
fix a caps lock corrector function F_caps that takes as input a password
and outputs the password with the capitalization of all letters changed:
F_caps(PASSWORD123) = password123 and F_caps(pAsSwOrD123) = PaSsWoRd123.
We might also fix a first-letter capitalization corrector:
F_first(Password123) = password123 and F_first(pASSWORD123) = PASSWORD123.
Note that these are simple to implement.

Then to do typo-tolerant checking one would apply the following logic for
a previously registered salt, hash pair (sa,h) and submitted password pw

If H(sa,pw) = h or H(sa,F_caps(pw)) = h or H(sa,F_first(pw)) = h then
allow login

As an example, if one submitted PASSWORD123, the checks would be on
PASSWORD123, password123, and pASSWORD123, with the second check
succeeding.

A few points:

1) The efficacy of offline brute force attacks are exactly the same as
before. Why? Because we only store sa,h. The attacker, given sa,h, will
only learn the password via a brute-force attack that tries the correct
password, in our example password123. There is no loss in security here as
we haven't changed how H is computed.

2) There is negligible change in the security against remote guessing
attacks. We show this via extensive analyses in the paper, but it boils
down to the fact that in the real world the best strategy is to submit the
most likely passwords up to some threshold (e.g., many sites lock an
account after 10 failed attempts). The extra checks performed due to typo
correction may help the attacker get a little bit more lucky, but we show
that it is essentially negligible. If one is worried about it we give
techniques that reduce it even further.

3) Typo-tolerance will increase CPU utilization for the login server (and
possibly memory load, when H is a memory-hard hash such as scrypt or
argon2). This is because of the extra slow-to-compute invocations of H. In
practice this doesn't seem to be as much overhead as you might expect (3x
in our example above) because anyway users would have ended up
resubmitting after rejection and you pay the price for each attempt.

4) We do not suggest allowing arbitrary typos. This isn't even possible
currently, as it would require recomputing H a prohibitive number of times
(remember it is slow!), and anyway this would be insecure. One needs to
carefully choose which typos to allow based on a principled analysis. We
believe the two correctors mentioned above, caps lock and first letter
capitalization, are a no-brainer for secure deployment, beyond that it
starts getting more nuanced.

We added an FAQ that provides additional information:
https://www.cs.cornell.edu/~rahul/projects/pwtypos.html


What additional protection does seccomp provide when compared to capabilites? From this answer I understand that seccomp-bpf filters the list of syscalls a process can call.
Similarly, the capabilites mechanism will cause a syscall to fail if the caller does not have the capability necessary for that syscall.
What I want to understand if there are scenarios in which one mechanism is more powerful than the other.
In other words: Given a process running with a minimal set of capabilites, is there any additional protection a good seccomp profile can provide?

Seccomp and capabilites serve different purposes, for starters. Capabilities are used to add slices of root privilege to an otherwise unprivileged process. By contrast, seccomp removes the ability to perform certain functions by taking away normally-available syscalls.
You don't need special privileges to perform syscalls normally, as syscalls are the mechanism through which an unprivileged user program can open files, network sockets, devices etc. There are many use cases for seccomp; perhaps you want to sandbox your program from the filesystem or the network. Or perhaps you simply want to lower the attack surface for privilege escalation by disabling unneeded syscalls.


What to consider in an SLA to ensure secure software when outsourcing software development? To ensure secure development in the off shore team what are considerations to be taken into account in the SLA?

I got this as a reference: http://www.it-director.com/enterprise/technology/content.php?cid=10427

Does anyone have any templates and sample documents to refer to?

As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset:

How does the organisation test their own security?
Do they use approved testers, internal teams, or both?
Will you have a right to audit using your own staff or consultants?
How do they manage incidents, vulnerabilities and exceptions?
Will you have visibility of incidents, vulnerabilities and exceptions during the development lifecycle?
Do they use a framework such as OpenSAMM?
What responsibilities do they retain after delivery?
How rapidly can they respond to advisories, whether from you, a CERT or a vendor?
Do they have an escrow agreement in the event of financial collapse?
Who will own the code - could it end up being published without your approval?
How do they screen or check their employees prior to employment?
Within what jurisdiction do they operate?

And so on...

Get a lawyer who knows this stuff!


Does the local network need to be hacked first for IoT devices to be accessible? I completely understand how IoT devices were used in the massive DDoS attacks because they are easily manipulated due to lack of firewalls, default passwords, etc.

What I don't understand is although easily hacked, most IoT devices are connected to secured private wifi networks.

Here's the question: So is it assumed that these thousands of IoT devices' networks were hacked first, then the device itself was hacked?

The devices are designed to be accessible from outside the home. To offer this service to their owners, they make themselves accessible through the homeowner's router/firewall. The way they do this is by sending a UPnP packet to the owner's router that tells the router to open a port that connects back to them. They then listen for connections that arrive directly from the internet.

In other words, the devices first hacked their owner's routers by design, which exposed their own vulnerabilities.  (This has nothing to do with secured, private, or open WiFi, other than many IoT devices connect via WiFi; UPnP exposes the exact same vulnerabilities on wired devices connected by Ethernet cables, too.)

To protect yourself, disable UPnP on your router.


Can https with an invalid certificate automatically redirect to http? Lately, I've had a problem. I have visited a website many times. Sometimes, when I use Charles proxy to detect the network flows, the ssl certificate is found to be invalid.  At the time, I communicated over http not https. But when I normally access the website, I use https.  If the SSL cert is invalid, can an https connection automatically redirect to http?

If the SSL cert is invalid, can an https connection automatically redirect to http?

The redirect is sent with the HTTP protocol. With HTTPS you first establish a TLS connection and then HTTP is spoken inside this TLS connection.  This means  a redirect from a https://site UrL to a http://site URL  most first establish a successful TLS connection and only then the redirect will be sent by the server and executed by the browser.

But if the certificate is invalid the TLS connection will fail already and thus the redirect will not happen.


Does creating a hash on a malicious file lead to opening a malicious file? I want to know if it is safe to hash a file in a non-sandbox environment.

Unless the target of the malicious file is the hash program itself, it is safe, because the file is only use through it. And hashing program are normally simple enough to not suffer from such vulnerabilities. So IMHO it is safe if you use a command line hashing program.


Does Using VPN on a Dubious Custom Mobile ROM Reduce the Risk to the Network? I have flashed an old Samsung phone with a custom ROM. The OS (and all the needed software) come from a website that "should" be safe, from users that "should" be trustworthy. Still, I like to be a bit paranoid when it comes to security.

And so, let's assume the mobile is now compromised, as a result of something nefarious in its ROM, and I connect it to my home WiFi (WPA2-secured). For our purposes, let's assume I'm not planning to enter any userID/passwords, and simply use the device to browse the Internet (not logging into anything).

If I installed and used a VPN on this device, would that reduce the risk to my network and the other devices?

I know that you're not supposed to use open public WiFi (I've also checked this question: How to use public WiFi safely?), but my situation made me wonder, if my fears are true, doesn't that mean a malicious user could, say, go to a public library that offers secure WiFi to their clients, to whom it provides the password, and connect to the network, compromising any other devices that use it?

A VPN sits on top of, and is dependent on, the Operating System and the hardware. If the Operating System or the hardware is custom, it can simply choose to ignore the VPN for its malicious activity.

That means that it is possible for the compromised phone to attack the network at will, targetting the WiFi Access Point/Router or creating an "Evil Twin" network in order to capture traffic of other nearby devices.

Note that just having a malicious device does not mean that all other devices are instantly compromised. Those other devices need to have vulnerabilities that the malicious device can access. So you can't say that the situation reesults in "compromised" devices, but rather that they can be attacked.


How do I map the information in snort u2spewfoo output to the rule which triggered the alert? I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.

I think that I understand the generator id, signature id, and revision tell me why the alert was generated, but I'm not sure how to make sense out of them.

For instance, I have (sans packet data):

(Event)
sensor id: 0    event id: 3     event second: 1516750250        event microsecond: 585397
sig id: 527     gen id: 1       revision: 8      classification: 3
priority: 2     ip source: 0.0.0.0      ip destination: 255.255.255.255
src port: 68    dest port: 67   protocol: 17    impact_flag: 0  blocked: 0
mpls label: 0   vland id: 0     policy id: 0

I believe what I need is in the third line (sig id:). What does this tell me, and how do I map it to the rule which generated the event?

If it helps, I have a vanilla Debian installation with only the snort and snort-rules-default packages installed. The alert above was generated by processing a pcap file I had from a few months ago using the command:

snort -c /etc/snort/snort.conf -S HOME_NET=[192.168.1.0/24] -r daemonlogger.pcap.1516xxxxxx

This dumped several alerts to /var/log/snort/snort.log, which I then parsed with the u2spewfoo utility.

When gid is 1, it refers to the rules engine.

Snort maintains its rule files in the /etc/snort/rules directory (debian default).  Each rule explicitly declares its sid (signature id).

Drawing from the example above, 'sid' is 527, so a simple grep returns the answer:

root@debian:~# cd /etc/snort/rules/
root@debian:/etc/snort/rules# grep 'sid:527' *.rules
bad-traffic.rules:alert ip any any -> any any (msg:"BAD-TRAFFIC same SRC/DST"; sameip; reference:bugtraq,2666; reference:cve,1999-0016; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:8;)

This returns all of the required information.


Using sudo to secure git deployment via web script I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.

Briefly, how it works it:

I commit to Bitbucket
Bitbucket POSTs to a specified script (which only runs if it's called from BB's IP Address)
My script chdirs to the appropriate directory, runs git reset, and git pull to update to latest version (it's a php script using exec()).

I got the idea from:

http://www.stephenradford.me/blog/tutorials/deploy-via-bitbucket-or-github-service-hooks

And overall it seems ok, but it has one major security concern for me - to make it work, you'd need to give apache write access to/ownership of the site directory to do the deployment.  This strikes me as a Bad Idea, because then an attacker use apache to write arbitrary files within the directory.

My idea as an alternative is to:

Create another user, 'deploy' then make that the user which owns the site directory.
Use sudoers to enable apache to run a specific shell script as user deploy, and put my git reset, pull command etc in that shell script.
In my exec() calls, do e.g. "sudo -u deploy shell-script.sh"

Can anyone see any flaws/holes with this?

Calling sudo from apache just doesn't sound right, despite the fact that I can't put my finger on the exact set of reasons why it would be a bad idea.

I would suggest instead of doing sudo to just run a very simple CGI as "suexecusergroup deploy" that would receive the postback from bitbucket and perform the git commands. This is a lot more straightforward and sane.


HTTPS Apache2 Information Leakage Hello IT Security!

I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.

When I visited website http:// securesecret.com:443 I got this message:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">

<title>400 Bad Request</title>

Bad Request

Your browser sent a request that this server could not understand.

Reason: You're speaking plain HTTP to an SSL-enabled server port.

Instead use the HTTPS scheme to access this URL, please.

Hint: https://securesecret.com/

There is information about domain. How can I prevent to show it?
Where is appropriate configuration in apache?
I have disabled ServerToken, ServerSignature etc.

You cannot really hide the domain name, because if someone connects to the port 443 of your server and begins initiating a SSL connection, your server will respond by sending his certificate... which contains the server name.

Actually, the client may send the intended client name as part of a Server Name Indication, which is a rather recent extension which is not supported everywhere (Internet Explorer on Windows XP will not send it, it requires IE 8 and Vista or later). The server may theoretically wait for an explicit SNI before sending his certificate; however, both the SNI and the certificate will travel unencrypted at this point, so the server name cannot be considered as really secret. And you cannot realistically mandate a SNI from clients right now (maybe in five years, when the current crop of WinXP has mostly died out...).

Also, the server name is part of the data which the DNS sends to whoever asks, on a regular basis, and without any encryption. A server name is definitely not a secret.


Launch a game client with custom protocol and auto login the user using web server's session I am creating a MOBA game and I will host tournaments which will be visible on the website.
to join the game, you must be logged in on the website and browse the tournaments list and select a tournament and click play.

Clicking play will launch a custom protocol like thegame://launch-tournament/tournament-id/

and the game client will open for the given tournament id.

Now, I don't want the players to login again on the game client, I want them to automatically login because they are already logged in.

How can I securely log them in automatically with this idea?

You could use something like a unique session ID. This means, your custom protocol would be

thegame://launch-tournament/tournament-id/VERY-LONG-UNIQUE-HASHCODE

How it works:

When the player klicks on the selected tournament in his webbrowser the server generates a unique identifer and stores it for some time. Just a few minutes.
Then this code will be appended to the link.
When the Gameclient launches, it sends this code to the server. It works like a one time login token.
The Server checks if the code is valid. If so, it will transmit the user information to the client and the player can start using his account.

To prevent fraud, the whole communication should be encrypted.

Additionally the server could store the IP of the Webbrowser together with the token and checks if the IP of the client using the token to login is the same.


SQLi-protection ORDER BY What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable?

I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too paranoid or maybe even not enough?

EDIT:

Just to clarify: I'm looking for a way to remove any SQLi from an ORDER BY $unsafeVariable - not a general SQLi-prevention solution. I'm already using prepared queries and pdo::quote where needed but since I needed to include an unsafe variable in a order by statement I thought I'd ask for someone elses opinion.

Best solution is if you know all allowed ORDER BY columns in advance and check your $unsafeVariable against that whitelist.
Another option: after removing all invalid characters check that your $unsafeVariable is a substring of the query you are building. It would become extremely difficult to misuse that.


How do hackers get into servers? I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website is secure? I want to setup a web server for my client for the first time, so I am a little bit scared. I just don't understand if I setup LAMP for example, and have 32 chars password or something, and login to the server via ssh, how can it be not secure? You can give examples not only for LAMP running servers, but anything else too. Or it happens only when server owner has a very weak password, and hacker just bruteforces the password?

I can't understand how do hackers get into servers when the website is secure?

Just some question you might ask yourself to understand how an hacker might compromise your site which are mostly not covered by the post you referenced.

How do you know that the website itself is secure? What did you check (possible file uploads, SQL injection, remote command execution...)
How do you know that your server platform is secure? Shellshock and Heartbleed show that the platform itself might be vulnerable.
Who has access to your system.? How do you deal with brute force password attacks?
If you run your site inside a VPS - who has access to the host system?
If you login from home - who has access to your home system and how you can be sure that it is or gets compromised so that a hacker can sniff your passwords or get access to the SSH keys? And you should ask this question for everybody who has access to the system which includes the administrator of the machine which hosts your VPS.
If you run a dedicated system - who has access to the data center?


How to respond to Indicators of Compromise? We've received frequent emails from our Threat Intelligence Group with IoCs artifacts, such as file names, hashes, domains/urls. They request us to do preventive measures for the given attributes.

However, I find it very hard to follow their request. Should I block all given IOCs? If so, it is very time-consuming and not effective when it comes to security.

I think that some risk assessments need to be carried out to ascertain whether such IOCs artifacts expose any risk to and also their impact on our environment before applying any applicable preventive measure.

Updated: The IoCs are related to coronavirus and are sent on alternate days or even almost on a daily basis without any relevant risk assessment. Moreover, when I take a look at the actors, they targeted a specific European country, while our entity is located in Asia Pacific. This leads to an apparent mismatch or redundant efforts from our side

Just a question on your statement

  "Should I block all given IOCs? If so, it is very time-consuming and not effective when it comes to security."

Wouldn't it be less time consuming to block all given IOCs?
I would consider the following steps:

Block all network IOCs (URLs/IP addresses)
Scan network logs for traffic going outbound to network IOCs
-If there is, proceed with IR
Evaluate each IOCs whether if it affects your organization (Some organizations do use public IP so there is a chance that the IP used internally may be a known IOC, but this can either be ignored or rectified)
Based on evaluation either unblock or continue blocking network IOCs

I see the step of first blocking the network IOCs before taking necessary steps would immediately cut off any further communication between a potential C2 Server and your network. But my solution did not cover files and it's hashes.

Do let me know what you think about this flow


Does StackGuard prevent Format String Attacks I am aware that Format String Attacks work by having a vulnerable function which allows the user to read values from the stack using %x and write by using %n.

Since one of the goals of a Format String Attack can be to overwrite the address of a function in the Global Offset Table, I was wondering does StackGuard prevent this?

I know that StackGuard protects save-return addresses of functions to be overwritten, however, will it help against a Format String Attack if that attack aims to change the GOT values?

No, StackGuard is not intended to protect against these types of attacks, nor does it in practice.

StackGuard specifically targets buffer overflows. When a buffer on the stack is overwritten, an attacker typically tries to overwrite the saved return address at the top of the stack frame. StackGuard inserts a canary value before the saved return address, and typically checks that it matches the known good canary before returning. If it doesn't match, then there was an overflow attempt and the program should exit.

Format strings are not buffer overflows and usually do not have the same goal. While a buffer overflow blindly "smashes the stack", format string exploits are a bit more precise. If you wanted to change the saved return address and knew the stack address where it's located, you could write directly to that address, leaving the rest of the stack (and canary) intact. This provides greater flexibility for an attacker in many cases, since buffer overflows don't allow you to simply skip over the canary.

StackGuard also has no affect on the GOT overwrite you mentioned, since this doesn't affect the stack at all. The proper mitigation to GOT overwrite is full RELRO (Relocation Read-Only). Due to startup performance costs of full RELRO, most binaries (and gcc defaults) only use partial RELRO. Partial still leaves the .got.plt writable, which is the part used for this type of attack, so it is not effective for preventing format string attacks either.

The -D_FORTIFY_SOURCE=2 option to gcc prevents strings stored in read-write memory from using the %n specifier, preventing an attacker from overwriting memory. It does not prevent read primitives, however, so an attacker may still be able to leak critical data from the stack (e.g. the canary).


How secure is my DPAPI Master Key if I enable biometric login? I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password?

If I understand that correctly, it means that physical access to the computer isn't enough to get the master key.

If I enable fingerprint login (in Windows 8.1, if it matters), what changes? I can now login with either my password or my fingerprint. Does Windows then store a duplicate copy of the master key encrypted with my fingerprint data?

The obvious concern is that stealing my fingerprint and my computer is then enough to decrypt the master key.

EDIT: or, even worse, given Is it possible to reliably derive a key from a biometric fingerprint?, is there a completely unencrypted copy?

If you don't log with a password, but instead with a fingerprint, then DPAPI plays an elaborate charade of encrypting keys with other keys, but the tower of encryptions must still end at some point. So what really happens in that case is that someone who steals your laptop will be able to extract all your secrets -- albeit with a substantial amount of reverse-engineering and cursing (though it can be widely automated, of course).

Or possibly quite easily. Indeed, right beside the fingerprint reader are 90+ keyboard keys, each of which adorned with a copy of the fingerprint of one of your fingers. Fooling the fingerprint reader with a printout of one of your fingerprints might be easier than wading through the swamp of encryption layers produced by the Microsoft developers. The raw truth remains that all these encryption layers are just smokes and mirrors: since the fingerprint itself cannot be converted into information suitable for cryptography (you cannot reliably turn a fingerprint into a key, contrary to a password), then your laptop with fingerprint-based login really contains, as it is, all the information needed to recover your DPAPI secrets.


Difference between virtual and full patching of vulnerabilities? What is the difference between virtual patching and full patching of vulnerabilities?

Virtual patching tries to block the attack vectors, i.e. using some IDS, firewall or similar. But the vulnerability itself is still unfixed and if someone finds a new attack vector which bypasses current blocks the vulnerability can still be exploited.
Full patching instead fixes the vulnerability itself so it cannot be longer exploited by any attacker vector.

See also OWASP: Virtual Patching Best Practices.


Initial requests sent over HTTP by default Before the invention of HSTS security policy, if a user didn't specify the protocol in the URL, were all the initial requests sent over HTTP by default for every website?

FIrst request is made over HTTP then the site redirects you to the HTTPS website.
Check out this post
It says it in an example of how sites used to work:

More specifically, these are the steps for logging into the bank’s site:

You type “www.mybank.com” into the address bar and hit enter.
The browser assumes “www.mybank.com” should be requested over HTTP by default, so the initial request is unencrypted.
The server at “http://www.mybank.com” responds with an HTTP redirect to “https://www.mybank.com”
The secure connection is established, and a login page is served via HTTPS.
You enter your password and do your banking.


How secure is GSSAPI single-signon over SSH? I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords.

However, I have been unable to find much information about the security of this solution.

Perhaps someone could assist by explaining the security model and any inherent weaknesses?

Edit: Let me clarify that I am looking specifically at implementing GSSAPIAuthentication in openssh.

This is really broad question and not exact. There are two ways how to use GSSAPI for SSH logins:

GSSAPI Key Exchange - not implemented in openssh, but distributed as a patch (part of RHEL, Fedora, but probably also Debians)
GSSAPIAuthentication - part of openssh

GSSAPI Key Exchange

The plus is certainly the manageability - with GSSAPI key exchange you don't have to even care about host keys. Just register the host to domain.

For key exchange, there are used basically these methods. The first is considered possibly vulnerable, because they use 1024 b primes. They are based on respective DH key exchange methods.

gss-group1-sha1-*
gss-group14-sha1-*
gss-gex-sha1-*

GSSAPI AUthentication

About the GSSAPI Authentication, you use normal SSH key excahnge methods (ECDH preferably), which has to be managed somehow else (certificates?) to mitigate MitM. Then authenticate to remote host using kerberos. This communication is already encrypted so there is no different security question than authenticating to any other service.


HDD password vs Bitlocker I have a Samsung SSD 850 with an HDD password set. It seems from articles such as this and this that the data is fully encrypted, and requires the password to view. Is there any requirement or advantage to having Bitlocker as well?

There's no practical way to inspect the Samsung disk's implementation of AES-256.  The same is true of the Bitlocker algorithm, but the software implementation has a few advantages:

Microsoft can issue patches if vulnerabilities are discovered
Runtime entropy sources are more varied than whatever entropy source is used to encrypt the Samsung disk  (remember that these disks ship encrypted, the password merely scrambling the keys.  If you can find information about how the disk is initialized and entropy is generated, I would love to hear it.)
In software you can inspect the raw disk image to ensure the content is being encrypted.

There was a similar question on this a few years ago:

Is hardware based disk encryption more secure that software based?

This said, I actively use this kind of disk-level encryption, but I'm only considering a threat model where a break-in to my apartment causes somebody to snag my hardware... no state secrets here.


SSL certificates and cipher suites correspondence I have been learning about the SSL/TLS protocol (from https://tools.ietf.org/html/rfc5246) and have a few conceptual questions about the protocol.

The client and server exchange "hello" messages during which
they choose the SSL/TLS version and the cipher suites. More
specifically, the client suggests a list of cipher suites and the
server picks one (If the server does not pick anything, the
handshake fails). Now, does the server choose the cipher suite
corresponding to the ones used in the certificate?

For ex: running openssl x509 -in <server_cert>.pem -text -noout gives you information about the server certificate. On a sample certificate, I see that the public key algorithm is rsaEncryption (2048bit) and the signature algorithm is sha256WithRSAEncryption. Doesn't this already predetermine part of the cipher suite used in the handshake?
Let us suppose that the server and client agree upon a cipher suite. Now, I also see that clients can also present a certificate later in the handshake. Does that mean that the ciphers on the client certificate must be compatible with the cipher suite chosen?

(Similar question, but does not answer what I want: Picking cipher suites for HTTPS)

For the server certificate: the cipher suite indicates the kind of key exchange, which depends on the server certificate key type. You basically have the following:

For TLS_RSA_* cipher suites, key exchange uses encryption of a client-chosen random value with the server's RSA public key, so the server's public key must be of type RSA, and must be appropriate for encryption (the server's certificate must not include a Key Usage extension that says "signature only").
For TLS_DHE_RSA_* cipher suites, key exchange uses an ephemeral Diffie-Hellman, and the server signs its part of the DH key exchange with its RSA key. So the server's public key must be of type RSA, and must be appropriate for signatures (there again, the certificate must not restrict the key usage to only encryption).
TLS_DHE_DSS_* and TLS_DHE_ECDSA_* cipher suites use an ephemeral Diffie-Hellman key exchange, and the server's key must be of type, respectively, DSA and EC, and must be appropriate for signatures.
TLS_ECDHE_* cipher suites are similar to TLS_DHE_* cipher suites, except that the Diffie-Hellman key exchange is an elliptic curve variant. Conditions on the server's certificate remain the same.
TLS_DH_* and TLS_ECDH_* cipher suites are different (mind the lack of 'E' after the 'DH'). For these suites, the server's certificate directly contains a Diffie-Hellman public key (or an elliptic curve variant thereof), and the cipher suite then qualifies the algorithm used by the issuing CA to sign the certificate. For instance, TLS_DH_RSA_* means "server has a DH public key stored in a certificate that was signed by some CA with RSA". This is the only case where the signature type on the certificate has any relation with the cipher suite. Since in practice nobody uses that kind of certificate, this case can be neglected.

For the client certificate: the client presents a certificate when the server asks for it. The client certificate type has no relation whatsoever with the cipher suite (except for the extremely rare case of static DH certificates, but I have never seen that used in practice). The client certificate must be appropriate for signatures. As part of the handshake message that requests a client certificate, the server sends some information about the supported algorithms (see the standard). In fact, TLS 1.2 further expands that mechanism by giving a flexible list of supported algorithm and hash function combinations.


How to get gain the knowledge to be a beginner penetration tester on my own? I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer.

I started to work with Burpsuite, ZAP, Metasploitable2, Juiceshop, and I've started to do some stuff locally. I want to gain more experience and do some challenging stuff but don't know what to do.

It was suggested that I should learn Rust & Go and develop security applications.

I don't know how to start off and get my hands dirty on developing security applications to gain enough experience to apply for that job. (I'm planning to complete it within a month.)

Any Advice?

You don't need to be a pentester to develop a security tool.
Having a nice security tool under your resume is a big bonus from a job searching perspective, but your skills and knowledge also matter a lot. You can train up reading security write-ups and playing CTFs. To get a glimpse into the pentesting methodology you could look at Ippsec videos from HTB.

Programming languages:

For exploit development it's mostly:
Python, Javascript, Perl

For security tools creation it's mostly anything that you feel comfortable with. Do keep in mind that there are a bunch of benefits to use GO lang, because it's very easy to deploy on any platform, but it's definetly not a must, there are loads of security tools written in Python, Java, Perl.


How useful is the default configuration of ModSecurity for a generic web application? Scenario:

ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown), for which specific rules are not provided by ModSecurity.

How useful is ModSecurity in this situation? What percentage of attacks is it going to prevent? What kind of attacks?

Reason for asking this question: there is a web application that, to avoid issues with ModSecurity default rules, suggests to disable it for this specific application if it is causing any trouble. That doesn't sound like great advice to me, however I'm not sure if the default ModSecurity configuration is actually significantly more useful than having no ModSecurity at all (disabled).

TL;DR: Not really useful for security, and will probably break the app somehow.

A lot of ModSecurity's default rules are the textbook example of how not to protect from attacks. XSS is the best example: they block requests that look like they contain certain HTML tags, thus breaking any site where people try to post innocuous code samples. (The correct way to defend against XSS is to escape user-provided data that ends up in HTML, without having to block any data outright.) The rest of its rules follow similar patterns, blocking things that "look" dangerous but aren't actually dangerous if the app is written correctly, and are highly prone to false positives. As such, all ModSecurity is really good for is security theater, or checking a box that you have a WAF to satisfy some regulation. There's no real harm in turning it off, and it doesn't reflect badly on the software at all that it tells you to. (Even MediaWiki, which powers Wikipedia, tells you to turn it off.)


Cryptomining Malware - Ubuntu - Stratum tcp My LAMP server has been hit with some kind of crypto mining malware. Crontab is clear and unused, Clam can't seem to detect anything.

It appears to automatically create these files in my /tmp folder at random times of the day.

phpIij8W8.c
phpIij8W8_fkk2qr2rqjikiewz (Always has a random name after I delete)

Inside of this phpIij8W8_fkk2qr2rqjikiewz:

threads = 1
mine = stratum+tcp://44XNuUyCFUgjG23yPfCHp(cut for content...etc):x@monerohash.com:3333/xmr

They all begin with "php" so I'm assuming some kind of PHP script is on the server that is automatically creating these files in the tmp folder and running them.

I've attempted to use iNotify to determine what/how these have been created and all I've been able to determine is this:

File phpvlnebP_fkk2qr2rqjikiewz has been just created by MOVED_TO

Can anyone give me some tips to narrow down the script that is creating these random files? Or if there's some way to get iNotify to give me more information when the file is created/accessed. Or heck, if there's a better tool our there to diagnose this problem.

Ubuntu 16.04.3

I had same problem, and I've narrowed down, hackers were able to intrude in some old and non-upgraded, wordpress.

Probably the best and fastest way to see who is consuming how much time on your Ubuntu 16.04.3 server is to install htop

sudo apt install htop

then type sudo htop

It will show you under which username is eating how much CPU

And if you identify some process that's eating much cpu, you can check it by lsof -p <pid>

lsof stands for list open files, to see it's full set of commands, type man lsof

However, it all depends upon how is your PHP being executed, and what hackers actually have done to your system.

Another good way to see, what is Apache exactly doing is to enable mod_status

Usually, on newer ubuntu's it's:

sudo a2enmod status

And after that add this to your 000-default.conf website:

<Location /server-status>
    SetHandler server-status
    Require ip 127.0.0.1
    Require ip ::1
    Require ip X.X.X.X
</Location>

Replace X with your actual IP...

Or you can access it with lync for example from your server's console like

lynx 127.0.0.1/server-status

And the output should look like:

On my other post https://security.stackexchange.com/questions/172396/some-bot-keeps-posting-this-to-my-server/172571 you can see how to improve security of your server and prevent such attacks.


Will blocking outgoing traffic from port 80 and only allowing port 443 from my home network lead to more security? Is blocking outgoing HTTP connections from a home network and only allowing HTTPS
connections reasonable? Will it reduce the chances of a man in the middle attack?

Yes, it will add security, but not as much as one could expect.

Many web sites have HTTP port open, but redirect your requests to HTTPS port. -> Blocking HTTP will not give more security. Your first request sent via HTTP will be visible to possible interceptors. After web site redirected you to HTTPS port, all further requests will be not visible. So you more security during the 1st request only.

Some sites support HTTPS only. -> Blocking HTTP will give more security when accessing sch sites.

Some sites support both HTTP and HTTPS. -> In such cases you will get more security because the traffic will be protected by TLS/SSL.

Some sites still support HTTP only. -> Blocking HTTP means such sites will be not accessible from your home network. But yes, information that is potentially available to any interceptor in case of HTTP will be no more available (because you just don't access such sites).

There are also sites that combine HTTP and HTTPS. They provide some resources like images and fonts via HTTP and other resources via HTTPS.

Only you can decide if blocking HTTP is reasonable to you.


How to send authentication token via SMS for a REST API I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need  authentication, When user have internet connection, JWT tokens are sent and everything is good, But if I want to call the same method with SMS, Sending JWT token makes my request very long which is not acceptable for me.

I was wondering instead of JWT tokens, I store information inside token into a table named token and only send encrypted id of that table to mobile client and since the id is much smaller than token, It satisfies my requirement.

I was wondering what is drawback of this approach? I mean instead of sending a signed token, I send an encrypted id to client. All the information about token(userId, timeStamp, clientIP, user mobile number ...) are stored in a table named Tokens which has foreign key to signed in user.

Replay attacks, Stolen token I guess are handled by client IP or mobile number, What else do you think?

Another point I want to add is that my server is only used by a web client and a mobile app and nothing more !

By storing the token in the database and sending the (encrypted) id of it to client you've just created new token. Forget about JWT tokens, you new token is the encrypted integer ID in the database.

You shouldn't use ID as the new token: IDs are usually incremented (and therefore predictable), and in some encryption schemes flipping the bit in cyphertext flips it after decryption in plaintext, so attacker can increment the ID without being able to read its plaintext. You can skip the whole encryption step and just use a (cryptographically secure) random number. Better yet - use longest acceptable string of random characters that are valid to transmit in SMS.

Encryption is a bijection between plaintexts and ciphertexts, so encrypting a random number doesn't make it harder to guess. Also encryption can't check that cyphertext wasn't modified before decryption unless you've added MAC to the protocol, but MAC would be too long for your case.

Also you shouldn't rely on the sender's phone number to identify the sender (or on confidentiality of SMS), SS7 is pretty vulnerable to eavesdropping and impersonation attacks. However everyone acts like it's secure for some reason...


Can I safely store credit card data in an app? I am using a payment gateway in my app.
I'm thinking of storing credit card numbers without the CVC numbers in my app.

Storing the CC number eliminates the requirement of re-entering the CC number. However, the user must still enter the CVC number.
The CC number itself will be encrypted with AES and a user defined key.

Questions:

Is it secure to store credit card data in an App this way?
How secure is this implementation in Android versus other OSes?

It is as secure as the place where you store the CC encrypting key.
Android features a keystore, which handles key generation, storage and usage for you. Your app talks to it via the KeyChain API. It offers some advantages:

Each app can only access their own keys. The keystore enforces this for you.
Key material is protected in case of app process compromise.
It performs all the crypto for you.
If the device features some piece of secure hardware, key material can be stored there, so that it is hard to extract it from the device.

Reference to Android keystore is informative only. Using it won't necessarily make you neither secure nor PCI-DSS compliant. Others have posted references for that.


Vulnerability scanner tools to use with Snort We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic as per our needs. So basically i will be writing rules for Snort for our specific needs.
But before beginning all that, i need to use a vulnerability scanner tool- to know the vulnerabilities which are not being detected presently by the Snort-firewall combo, and then i can start writing rules for Snort for those vulnerabilities.
Given my situation, can i have suggestions for the right tool - I know but a few names like Nessus, Metaslpoit, OpenVAS, nmap....

Just download the Backtrack 5 distro (http://www.backtrack-linux.org/downloads/) as it's free and comes with Nmap, Nessus, Metasploit, Openvas and much more. IMHO, nmap is the best scanner but everyone has their own preference. Metasploit has some nice integration with nmap

Out of the box Snort will detect a lot of the default scans because the packets sent have a signature/form that's been out there for years and so is well-known.

Additionally, there's so much scanning these days on the net that people (rightly or wrongly) generally ignore such noise on the firewalls or ids/ips systems.

You'd be better going the extra step and seeing what you can detect or do post the scanning phase (assuming you have permission to launch further attacks/testing). A vulnerability scanner isn't going to necessarily tell you what attacks are possible, only what vulnerabilities it feels your systems have (and these may be false-positive).


Is signing an encrypted PGP message redundant? Is it necessary to sign an encrypted PGP message, or is that redundant?

The encryption secures the data from people that cannot decrypt it.  The signature is so that the receivers can verify that the message really came from the sender (non-repudiation).


Private Tor networks: what are the benefits, and how would it be accomplished? What are the benefits of someone building a private Tor network? ...One that is disconnected from the well-known network being used on the Internet at-large.

My intent is to make Tor more corporate-friendly so that it:

Prevents nodes from being operated by untrusted/hostile parties (exit node eavesdropping)
Prevents local Tor deployments from abuse (spam, etc)
Maintains anonymity while using the technical means to enforce security.

Question

Aside from anonymity, is there any other benefit Tor can be used for?  Would these benefits be seen in a private Tor Network?

How would one go about achieving these goals?

Is it technically possible?

The anonymity provided by Tor stems for the large number of cooperating nodes; a "private Tor network" looks like ultimate counterproductivity. Wait, no, a private Tor with peer authentication is even better in that role: anonymity is so much more guaranteed when you make sure of who you are talking to.

Nevertheless, Tor is free software so you could download the source code, compile it, and start from that point.


Encrypting UDP? (not using DTLS) We are exploring options on encrypting messages to 3rd party devices which operate on UDP messages.

Since each vendor will need to implement the encryption-decryption process as well, we would like to re-use the existing standards as much as possible.

But DTLS is considered a no-go because we are using Java, and DTLS only came to Java in version 9 (which is also a no-go). Apart from that, it has several issues which I believe can causes latency.

Apart from DTLS, what other options exist for UDP message encryption?

If you can have an additional TCP channel, you could use this channel for TLS and exchange (random) key material which you can use in turn for encrypting the UDP packets. Don't forget to apply a packet counter and possibly timestamps for detecting replay etc. attacks. And use AES-GCM, so you have authentication for (almost) free.

But I don't the part about getting delays because of using DTLS? We are using it in the 500 KB/s range and don't see any delay - having a complete delay of about 1 ms (which is the resolution of the used timestamp^^)


Securely editing encrypted text files My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them.
What I'm worried about is information from my text files being transferred to non-volatile memory drives (for example by the creation of temp files in the drive in which Windows is installed).

How could I edit text files directly in a RAM drive without having information from the text files being transferred to non-volatile memory drives?

A slightly radical approach, but if you really want to ensure that no (unencrypted) information from those text files ends up on non-volatile memory drives, I recommend you to use a Live CD (such as Knoppix), and only from there, mount the hard disk, copy the encrypted files to a ramdisk (everywhere else will be in-memory), decrypt and edit as needed.

The main advantage of using a live disk is that by having the whole OS in-memory you are barring most of the potential leaks, such as unexpected temporary files or the OS deciding to page the text editor. You will mostly only need to:

Ensure that the distribution you are using in the Live CD does not automatically mount a swap partition you might have in your disk.
Copy the encrypted file itself to a different location than the mounted drive, for safely decrypting and editing. If you feel extra paranoid you could even unmount the normal disk before decrypting and remount after deleting the plantext version, but it isn't needed.


How to detect cookie stuffing attacks? So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore consider this GET request as well as sent cookie invalid.
But what about iframe-based cookie stuffing?

There is no one solution to this complex problem.

A client can enable the Do Not Track http header element.  But there is no guarentee that the server will respect it.  The PrivacySuite addon goes one step further to actively block tracking gadgets.  There are *MANY* other anti-tracking addons for firefox as well as some for Chrome and I have no idea which one(s) are the best.

Ad-block Plus will keep your browser from loading many of these tracking gadgets, and even if such a gadget where to be loaded it will block the targeted ads.  This solves the symptom but not the root of the problem.

NoScript might help,  but this doesn't stop a server from setting a cookie via the http cookie header.  It does however prevent some evercookie techniques.

Relivent TED talk:  Tracking the Trackers

Also its wroth while to learn about Google's "Remarketing" feature for advertizes.


Multi-Function SSL Digital Certificate Is there a problem with using a single SSL certificate for both SSL/TLS/HTTPS communication as well as to sign (external) digital timestamp certificates? Other than the obvious: if one key is compromised then both functions can be compromised as well. However, if I devise a secure method of handling keys, and also use them on the same system, then both keys should be handled the same way anyhow and would end up getting compromsied together.

Technically, there's nothing prohibiting you from using a certificate for multiple purposes.  A correctly implemented client should check the certificate's key usage and basic constraints extension values to determine if it is allowed to be used for the purpose that it's being presented for, but a certificate can certainly be created to serve two purposes.

That said, should you do this?  Almost absolutely not.  When you have two systems with very different security requirements such as these, it's not just a matter of "if one is compromised, they both are" but also that the system that needs the strongest security is exposed to the vulnerabilities of the system that requires the weakest protection.  So, you either have to waste resources protecting the weaker system beyond its requirements, or unnecessarily exposing the system that requires stronger security and accepting unnecessary risk.

An example:  Take a CA that uses their root CA cert as their web server cert.  If they were susceptible to Heartbleed, not only would they have to  deal with the revoking and re-issuing a server cert, a mere annoyance, but their extremely precious root cert private key would have been exposed, and potentially used to create wide-spread havoc which could be truly disastrous.

So, when you have systems with widely disparate security requirements, doesn't share certs (or critically limiting infrastructure) between them.


Windows registry debug is there any way to monitor, debug changes made by a installation to the OS registry ? I'm aware of Process Monitor but I look for something that I can enable and that will run in the background.

thank you

Many tools can do that. Regshot, InstallWatch Pro, InCtrl5 are some of them widely used. Get one that fits you well and use it.

From Windows itself, you could use WMIC to track changes using the RegistryKeyChangeEvent class. You would have to create a WqlEventQuery object and use the ManagementEventWatcher to watch over these events. When a change occurs, the EventArrived of the ManagementEventWatcher class is activated.

There are disadvantages to this:

"HKEY_CLASSES_ROOT" and "HKEY_CURRENT_USER" are not supported.

WMI event does not return the changed value and changed type; it only detects the change itself.


What to use as 'state' in OAuth2 Authorization Code Grant workflow I'm using csrf protection in my web app.

Now I'm planning to trigger a OAuth2 Authorization Code Grant workflow, starting with a static template opened in a new browser window using window.open(myOAuth2StartEndpoint?oauthstuff&state=mystate).

But as in this case the mystate variable is exposed inside a static href tag when starting the workflow, I'm wondering if it's dangerous to just expose my default csrf token as mystate?
I can make a csrf check inside myOAuth2StartEndpoint, so the token is not exposed for free, but is this enough?

If not, are there recommendations for how to handle this case?

Disclaimer : Couldn't find any reference on the subject so I will use a questionable tool called "logic". If someone find any good reference, please add them.

CSRF is dangereous

There is no doubt about it and OAuth2 is no exception. In fact, there are multiple ways that you can exploit CSRF attack while using OAuth2. The reason is that there are multiple message that are sent that could be use to trigger a CSRF attack. The section OAuth2 Spec Section 10.12 gives a good overview of what you could do with CSRF

But, let's look at what happen in details when a user want to login using OAuth2. In our example, we will have the following actors :

The user (you and your browser)
The attacker (usually a malicious website)
The client (web application you are using)
The provider (oauth2 server that authenticate the user)

Then, let's look at what happen from the user point of view when he tries to authenticate with the provider.

The user click a link on the client website and get redirected to the provider authentication form
The user authenticate with the provider and get redirected to the client website where he gets authenticated too, automatically

Where can we attack?

From the user point of view, it's just 2 simple steps but there is multiple places where you can attack it. One of the root problem here, is that often the OAuth2 provider will redirect you automatically, if you are already logged in. A good example, is stackoverflow. See this answer for details :

OAuth2 Cross Site Request Forgery, and state parameter

So the different attacks are :

An attacker can replace the authorization code with his own to make you login into his account instead of yours. Might look like a crazy idea but if you decide to enter some confidential information in his account, he now has access to it. Ex.: bank information
An attacker can generate a valid provider link on his machine and then he serves it to you, if the provider is redirecting automatically then you will be logged in to the service the attacker want to attack.
The attacker make you generate a valid provider link from the client website (only works if the link is generated via a post/get on a static url), then if the provider is redirecting automatically you will be logged in to the service of the attacker want to attack.

How to protect against them?

Simple, you just need to pass your CSRF anti-forgery token in the state parameter of OAuth2 to protect against #1 and #2. Then, to protect against #3, you need to make sure that the link cannot be generated without the user interaction, meaning protect that link with CSRF protection. But back to #1 and #2...

By including, a CSRF token as the state, you will defeat those attacks as it will be impossible for the attacker to serve you links that you didn't generate yourself. A simple implementation of a CSRF token is a random number that is stored in the session and then included in every form sent by that by a user. If the form contain the token, the client consider it as valid. If it doesn't contain it, then the client assumes that the request is invalid.

Usually, that CSRF token is only accessible to the user/browser and the client, but in the case of OAuth2, more parties get access to it. To understand what to do, we need to know which are these additional parties.

The Answer : Just send the token

So, in that case, the token will be known to

The client (the one who created it)
The user
The provider

It's a simple round trip over HTTPS. An attacker cannot insert himself in that conversation so you don't need to worry about that.

Do you need to protect the token against the provider?

No. If the OAuth2 provider is malicious you have already lost. He doesn't need your CSRF token to take over all your accounts if he wants. When you chose to use OAuth2, you basically made him god of all your user accounts.

Conclusion

Don't worry too much how you send the CSRF token; just make sure you send it. Also, the fact that it's sent as a url parameter would be another point to worry for a permanent password but since those tokens are temporary is shouldn't be much of a problem.


Can VPN provider see my data? I have a 2 questions:

If I use a VPN and I go to any websites via HTTP - does VPN provider will be able to see the traffic? Those. logins, passwords, all the texts that pass through the channel (in the case, if the data is not encrypted).
The same option only when using HTTPS (I guess in this case - they can not see).

Yes, the VPN provider is able to see your data. If the data are not encrypted (i.e. HTTPS) the provider will be able to get to the clear text and will also be able to manipulate the data.
The usual protections of HTTPS apply, i.e. the provider will see which site you visit but not the clear text data itself because they are encrypted. The provider will also not be able to modify the data undetected. Based on traffic pattern (size, timing...) the provider might still try to narrow down the specific pages you visit on this site.


Calculating D-Wave's integer factorization capabilties D-Wave has teased the ability to perform integer factorization previously, but if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization using quantum annealing and at ~12:10 they can produce a D-Wave machine (maybe as an NSA special order) that can factor 2n bit number with 2n2 qubits.

How many qubits does this translate into using their architecture, i.e. is their "chain length" caveat relevant here?
Is there a simple way to apply this to ECC?

The numbers are seriously fuzzy (annual vs biannual qubit doubling, coherence limits, etc) but if it is simply a matter scaling up their raw qubit counts, then the expected lifetime for key length estimates get flattened out a bit for larger RSA lengths.  If ECC is affected in a linear manner, then their expected lifetimes could be half that of the current estimates (2030-2060 vs 2050-2100).

Note: Please do not simply repeat generic complaints about D-Wave here.  There are plenty of forums for that discussion, this is not one of them.

if you jump to ~10:00 in this presentation they actually appear to outline how they can perform integer factorization using quantum annealing and at ~12:10 they can produce a D-Wave machine (maybe as an NSA special order) that can factor 2n bit number with 2n^2 qubits.

First he describes that you can describe RSA as an optimization problem. But you can do that is a large class of problems, many of which are not believed to be efficiently computable on QCs. It should be straightforward to encode SAT problems like this, and those are NP complete. I'm also pretty sure that you can encode breaking symmetric crypto that way. The optimality results around Grover's algorithm make it unlikely that there is a generic algorithm that can efficiently solve all problems that can be encoded like this.

He does not mention any RSA/factoring specific insight. It's theoretically possible that the specific structure of factoring means that the optimization algorithm would solve the problem efficiently. But the talk did not contain any hint of evidence towards this. It's also lacking any evidence for a speedup beyond grover or even classic computing.


Implementing SRP without storing the salt anywhere I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.

Looking at the SRP procedure, when a client registers with the server it sends v (verifier), s (salt), and I (the username or identifier) to the server who stores these values. However, it is stated that:

[The salt] could be chosen by either side but is done by [the client] so
that [it] can register I, s and v in a single registration request.

If the salt can be chosen by either the server or the client, then we can just assume the server generates it.

When the client later tries to authenticate with the server, the client sends I and the server responds with s. Then the client uses s and other data to preform the proof of password.

My question is, why is s static? Why does it need to be stored at all?

The salt is sent out to whoever requests it, and because of this an attacker could attempt to build a targeted rainbow table by requesting the salt of a specific user. This is brought up in this question, at bullet point #2.

Wouldn't it provide more security for the server to randomly generate a salt upon a ClientHello message? On each separate request, a different salt would be sent, preventing the attacker from being able to compile a targeted rainbow table. Additionally, the salt wouldn't be stored on the server, which would make the information even less useful in the event of a data breach.

Notably, this method might open up an attack vector where the attacker continually initiates the authentication procedure until the server responds with a favorable salt. However, if the entropy of the salt s is sufficiently large this would be infeasible. Additionally, the server could throttle the number of authentication attempts per username I, so that an attacker couldn't run this attack in parallel with a botnet

For example: After initiating an authentication attempt for I, the server would not respond to subsequent attempts to authenticate as I within a time frame of say, half a second.

You are absolutely correct that making the salt publicly available brings with it some security risks (which I will return to), but first let me address why the salt does need to be static.

The client must be able to derive from the user provided password the x that corresponds to the verifier, v that the server stored. The client authenticates to the server by proving that it knows (or can compute) x while the server authenticates to the client by proving that it knows v.

This means that the client will need to derive the same x each time, as it is mathematically related to the v which the server stores. The client computes x from the password and a salt. To produce the same x it needs the same password and salt each time.

Making the salt opaque

As you (and others) have noted, the fact that the salt is fully public means that an attacker does not need to wait for a breach of the server to start cracking. The attacker can precompute a large number of candidate v and then in the event of a server breach, when the real v is discovered, the attacker can see if that is a v that they have a password guess for.

This issue is true of every prior (asymmetric) PAKE as was pointed on in a brilliant paper released earlier this year: OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-Computation Attacks. The authors propose a new construction that wraps a more traditional PAKE in a way that does not suffer from this problem.

Although I'm the primary contributor to an SRP implementation, I posted the following picture after learning about OPAQUE.


should I give the csrf token a descriptive name? Personally I want to call the element _DO_NOT_give_this_security_thingy_to_anybody_ever. An example scenario is some clever social engineers want the user to run a malicious "add a friend" and find the CSRF token stands in the way.

But is it  worth it?

Call it that if you want - it doesn't affect the security of your system in any way.

At the end of the day, you can't protect against everything. If social engineering is involved, then the scammer could simply devise a reason for the user to give them the account password directly.

There are also other attacks that are difficult to defend against where users are involved, such as Self-XSS. This is where a scammer convinces a user to enter some JavaScript code into the browser dev tools with the promise of hacking somebody else's account.

A better approach to both these issues is to educate your users.