When implementing CORS, should I check for a correct HOST header in my webapp? I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this.

The CORS spec directs you to not send the CORS headers if the origin isn't present or doesn't match your list of permitted origins, which I do.

But Section 6.3 adds that:

  In addition to checking the Origin header, resource authors are strongly encouraged to also check the Host header. That is, make sure that the host name provided by that header matches the host name of the server on which the resource resides. This will provide protection against DNS rebinding attacks.

Is this valuable to add to our API server? My understanding is that DNS rebinding is an attack that you'd perform to access something on a local system like a router, so I'm not sure if that applies to us.

If we should check the Host header, what action should we take? Just not sending back the CORS headers, or rejecting the request altogether? The first option makes more sense to me, since otherwise the recommendation wouldn't belong in a CORS spec, but the document is unclear.

My understanding is that DNS rebinding is an attack that you'd perform to access something on a local system like a router ...

A DNS rebinding attack is not restricted to a router or other local network devices. It is an attack which is used to bypass the same origin policy and thus not only submit data to a server like in CSRF but also read the response back.

While the typical use case is to read data from servers which can not be directly reached from outside (like the internal company wiki) it could for example also be used to get data from internet reachable systems which use IP-based authentication (i.e. some client given special rights based on there source IP address).

Given that CORS is about restricting cross-site read/write the recommendation to check the Host header in order to protect against DNS rebinding makes sense, since DNS rebinding is essentially the attempt to make a cross-site request behave like a same-site request.


Why does a (D)DoS attack slow down the CPU and crash a server? So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse.

As far as I know, the thing that is used to slow down a server is the TCP SYN handshake, but that takes trivial amount of CPU.

How does one crash a server using (D)DoS?

How does one crash a server using (D)DoS?

To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of attacks specifically attempt to use up as much of the target servers resources a possible and bring it down, rather than just hammer it with network traffic.
However, to put this into context alongside other types of DDoS attacks, lets explore their major categories and their uses.
This article covers the 3 major attack types for DDoS. From the article:

DDoS attacks can be broadly divided into three types:
Volume Based Attacks
Includes UDP floods, ICMP floods, and other spoofed-packet floods. The attack’s goal is to saturate the bandwidth of the attacked site, and magnitude is measured in bits per second [sic] "(Bps)" [sic].
Protocol Attacks
Includes SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS and more. This type of attack consumes actual server resources, or those of intermediate communication equipment, such as firewalls and load balancers, and is measured in Packets per second.
Application Layer Attacks
Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities and more. Comprised of seemingly legitimate and innocent requests, the goal of these attacks is to crash the web server, and the magnitude is measured in Requests per second.

TL;DR - there are multiple types of DDoS attacks depending on what the attacker wants to achieve. Sometimes an attacker will just want to take up all the available bandwidth, other times they will try overwhelm the CPU.
It's worth noting that DDoS is just a distributed type of the generic 'Denial of Service' - it does not imply crashing a server at all, only preventing the server from doing whatever it's intended for, whether thats preventing actual business from taking place by using all bandwidth or otherwise.


Do all hard drives support Device Configuration Overlay (DCO) and Host Protected Area (HPA) for data sanitization? In the absence of physical destruction of hard drives including flash and SSD (since they are often re-used in different parts of the business or re-purposed for donation), the hard drives are securely wiped.

There doesn't appear to be an authoritative answer to whether all drives support DCO and HPA. Based on an article from Aleratec, it suggests that not all drives support DCO and HPA.

If this is accurate, does a secure wipe remove the ability to recover data if using wipe standards such as NIST 800-88?

What tools can be used to assess if a drive supports DCO and HPA? Currently we use Active@ KillDisk.

I learned that often the best way to sanitize a drive is to use the software tools or guidance provided by the manufacturer. If such a tool is not available, then try hdparm.

sudo hdparm -N /dev/sdX to check whether HPA is enabled or disabled.
sudo hdparm -g /dev/sdX to check number of sectors.
sudo hdparm -Np<MAX SECTORS> /dev/sdX to disable HPA.
sudo hdparm --yes-i-know-what-i-am-doing --dco-identify /dev/sdX
sudo hdparm --yes-i-know-what-i-am-doing --dco-restore /dev/sdX

Make sure the drive is connected to a SATA port directly. (Don't use a SATA-to-USB adapter.)


What type of encryption does Windows 10 virtual WIFI hotspot use? Hi I am planning on using the WIFI hotspot feature provided by Windows 10 to connect to 4 robots, however I do not know what type of encryption this windows 10 hotspot uses.

WPA2-AES, according to Microsoft.

  To provide protection for the wireless communications between the computer hosting SoftAP and the devices connecting to the SoftAP, the wireless Hosted Network requires that all devices connected use the WPA2-PSK/AES cipher suite.


SQLite database iPhone data I opened a SQLite database file, and it seems to have many rows that aren't readable.
The data has got weird symbols including "question mark diamonds". Is it data that iPhone encrypts when it goes to the database and decrypts back? Is there a way to read the data?

What are my chances of decrypting it? Where do I start?

Apple encrypts data using a CommonCrypto library and I would guess what you are seeing is SQLCipher.   Details to be found in the manual.

http://developer.apple.com/library/ios/#documentation/Security/Reference/certifkeytrustservices/Reference/reference.html#//apple_ref/doc/uid/TP30000157

Also I recommend reading these:
http://mobileorchard.com/tutorial-iphone-sqlite-encryption-with-sqlcipher/
http://sokol8.blogspot.no/2011/05/iphone-sqlite-data-encryption-sqlcipher.html
https://stackoverflow.com/questions/929744/encrypting-sqlite-database-file-in-iphone-os


Is it sufficient to convert ',  to avoid XSS in JavaScript strings? Is it sufficient to convert ' to &#039; , > to &gt; and <  to &lt; to avoid XSS when inserting untrusted data into a JavaScript string as below?

<script>
param='payload';
</script>

Are there any examples of situations where the above conversion is not sufficient to avoid XSS?

Don't rely on using your own "conversion" rules, OWASP recommends using a security-focused encoding library to make sure the necessary rules are properly implemented:

Escape the following characters with HTML entity encoding to prevent switching into any execution context, such as script, style, or event handlers. In addition to the 5 characters significant in XML (&, <, >, ", '), the forward slash is included as it helps to end an HTML entity.
HTML entity encoding is okay for untrusted data that you put in the body of the HTML document, such as inside a <div> tag. However, it would not be sufficient in a number of cases, such as "nested contexts":
<script>...param used directly here...</script>
<!--...param used inside an HTML comment...-->
<div ...param used in an attribute name=test />
<param as a tag name href="/test" />
<style>...param used directly in CSS...</style>

In general, never use param inside any of these nested entities, even if HTML entity encoded.


Multiple instances with the same SSL certificate legalities? In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?.

But what about two instances from the same server. So on the same machine the site is hosted at port 443 and port 5000 for example(https://sitex.com and https://sitex.com:5000), would this be a legal problem? My certificate is from GoDaddy, but I am unsure which certificate type it is; I am not the one who bought it.

This is not legal advice, if in doubt consult the provider or seek professional advice.

In my conversations with CAs I have found they generally consider a discrete instance of a server as the unit of licensing. That is, if it is one kernel. Multiple instances of Apache, Nginx, LDAP services, SFTP services all count as one server. If they can all be addressed by the same name on that single server, it is legal to use the certificate for multiple services.

The other alternative is a single load balancer/TLS offload device in front of your servers. Even if there are five servers behind the TLS offload (ie non-encrypted communications behind it to the servers, encrypted to the outside world), each device is considered a single server. So a two-device load balance cluster that perform TLS offload, is two servers, even if they then serve five servers behind them.

While checking for compliance is difficult for CAs to perform, do not think that you can "get away with it" just because your service looks like a single server to the outside world. Contact the person who purchased it for a copy of the license/terms of use for the service to make sure.

In the end, like any IT procurement, there needs to be a business case that justifies the expenditure, and if less than $100 per server per year is not worth it to secure your services where multiple servers are not allowed in the license, free options like Let's Encrypt can be considered.


Why do websites force the user to use a long and complicated password when brute force isn't possible? if you have a phone with 4-digit pin and the phone does not get locked no matter how many times you put the wrong pin it makes sense to use 10 or 16 digits as it'll increase the time the attacker needs to crack the pin and make it sounds impossible to crack.

However these-days even simple websites stops the user from trying random passwords after 3 or 5 attempts, to my understanding this kill the entire concept of brute force.

There has to be something wrong with my way of thinking, what am I missing?

Nowadays, the scenario password policies need to defend against is the theft of the complete password database. This is something which happens with alarming frequency even to very reputed websites.

When the developers of the website follow common best practices, then password databases usually don't contain the plaintext passwords but instead store a hash of every password. An attacker which has access to this data can perform an offline brute-force attack by calculating the hash-values of common weak passwords and compare them to the hashes in the database. To defend against this kind of attack, users need to be motivated to use strong passwords.


Hack to change the webpage of a website? Recently, there is a website by Malaysia Airline got hacked and their main page has been defaced, below is a link to that article

http://techcrunch.com/2015/01/25/malaysia-airlines-site-hacked-by-lizard-squad/

I want to know how did the hacker change the html file?

Do they attack in the DNS server, and reroute the request to that website to another server? How do they do all this?

The second question, I would like to ask is how do I protect my site from these kinds of attacks?

I want to know how they did it, so I could improve on my web security

Given the fact that the hackers had access to the servers and their data, then they had direct access to the HTML files.

Protection against such an attack is very broad in scope, because you have to protect yourself against all forms of intrusion into your network.


Can Symantec Trial Certificate be used for easy man in the middle attacks? Symantec SSL Trial Certificate issues certificates without validation that the domain is owned by the one requesting the certificate. Doesn't this make it easy to do a man in the middle attack against any websites?

For more information see [Symantec Trial Certificate Website][1]

The SSL certificate issued using this process is not trusted by default by any software and thus cannot do any harm as long as the software is doing proper validation of certificates. And if the software is not doing proper validation there is no hope for this software anyway, i.e. you don't need this trial certificate but can create your own.

From the documentation:

  In order to test the use of a Symantec SSL Trial certificate, you must install a special Symantec Trial Intermediate and Symantec Trial Root CA on the server. The Trial Root must also be installed in each browser that will be used during the testing phase. This is a special step that Symantec has implemented to prevent fraudulent use of trial certificates. When purchasing a production SSL certificate, these additional steps are not necessary.


How does authentication work without OAuth in mobile apps? I have a (Drupal) website that needs a companion mobile app for some stuff (quite customized, not just creating/viewing nodes). I know I can use OAuth for this, but I was wondering about alternatives (because OAuth is a bit complex, but then again security in general probably is).

When you use certain mobile apps (take Evernote for example), you don't get redirected to the website to grant permission to the app. Instead, you just log in with your username and password, straight inside the app.

So, I'm wondering how this works, and where to look to implement this. Is the password stored on the device, and sent to the website? Is this actually safe?

Peter: When you use certain mobile apps (take Evernote for example), you don't get redirected to the website to grant permission to the app. Instead, you just log in with your username and password, straight inside the app.

Actually Evernote uses OAuth. OAuth2 allows different authentication workflows. The Resource Owner Password Credentials Grant does not open a website.

  Peter: So, I'm wondering how this works, and where to look to implement this. Is the password stored on the device, and sent to the website?

An Android Authenticator is able to store an authentication token as well as a password on the device. The Authenticator will use the authentication token - if available - to access your web application. If no token is available, it will try to get one with the password, which will be retrieved through a login dialog. Therefore you could avoid storing the password, but as soon as the authentication token expires the login dialog will show up. Also Google recommends avoiding to ask for passwords when possible:

  In general, we recommend minimizing the frequency of asking for user credentials—to make phishing attacks more conspicuous, and less likely to be successful. Instead use an authorization token and refresh it.

  Peter: Is this actually safe?

You may assume passwords are stored securely. Put simply, Android works like a Linux system, where every app is run by another user, so that apps cannot access each other without public APIs. Note, that a rooted Android phone weakens that mechanism.

If you want to skip implementing OAuth, you could create a more simple login service, which returns an authentication token (for example a session id), but as always when rolling out your on security system, there are many pitfalls. Therefore I advice you to look for an OAuth framework (for example Apache Oltu) and implement an Android authenticator the standard way.


How to spoof IMEI/SIM location? Once you plug it into a phone and power it on, the IMEI number of the
phone and the SIM's serial number will be transmitted to the nearest
cell tower(s).
source

Is there a way to spoof the location of a SIM/IMEI that is connected to a smartphone?
I remember a few years ago I played with XPrivacy (XPosed) but I saw another post at Reddit that says that Magisk and Xposed are the opposite of security. source

You cannot spoof the location using the phone since the location is not determined by the phone itself. Instead the phone connects and authenticates against the cell tower(s) and any location is determined based on which cell towers it is connected to. Since one can only connect to nearby cell towers one cannot spoof the location by connecting to far away cell towers.


If my data is encrypted with a password, how does the website know me? Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website. Let's take Gmail as an example. What I would hope, is that without my password, nobody could view my emails. Not Gmail, and not the NSA. But if this is the case, how does Google know so much about me? How do they have access to the information stored in my email?

Edit:

The reason I was under this impression is for security rather than privacy; if a database is leaked, or an employee is not trustworthy, there goes all of my information...

Your password does not encrypt anything

The owners of the website can see everything*, including your plaintext password

*There are exceptions, but always assume that they can.

This is one of the reasons why you should not reuse passwords.

Your perception is a dangerous one to have. Maybe you can expand your question to what lead you to believe this?


Is decryption using Java+JSF safer than using JavaScript? First off, this is in addition to using SSL!  I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side.  I've read enough posts here to see that security implemented with JavaScript is hardly security at all, so I'm looking for an alternative to JavaScript based decryption.

I came across Java Server Faces, and I feel as though it may be a better solution than JavaScript.  I wrote a small app and couldn't find the "password" or key saved anywhere in the DOM (using firebug) which looks like a win to me.

Sorry if this is a silly question, but I was really struggling to find information about the security JSF decryption elsewhere.  Thanks in advance!

JSF works server side(it renders html/js).... so anything you decrypt in JSF is send out as html/js to the client's web browser (no additional security there).

If you want client side decryption use applets, or thick clients to do the work, and use TLS as transport layer. Any other js decryption thing will not work, and it's a waste of time and money. Of course applets and thick clients are not totally secure either but they can be more of a challenge than js.


Is there a combination program that will generate a dictionary from a predefined list of words and numbers in specific order? I'm sorry if this question has been asked, but I've already wasted 6 precious hours trying to find a program that will accomplish the task I'm requesting. (Perhaps I'm asking the wrong question?)

Specifically, I want to create a dictionary of predefined words and numbers (numbers being in a specific order) for use with a cracker.  For example, I want to use the words "cat" and "fcw", as well as the numbers with predefined order "515" and "23".

I need to either populate a dictionary (probably faster) with all of the possible combinations with the length between 6 to 20 characters, or run a program with these predefined combinations.

It's been a long time since I've coded, so writing has been troublesome.

Any help or walk-through would be greatly appreciated.

What you are trying to accomplish is called password mutations, or definition rule-sets. I would use John the Ripper for this (JTR), not because i hate crunch, but just because i've been using it a long time and i can give you specific examples for it.

let say you have a word list, containing the various different base strings you wish to test.

cat
fcw
cfd
etc...

and you wish to try different combinations of them, maybe some added anomalies for completeness sake. well we can do that with a configuration file. (john defines this as rules, but its all the same)

basic password cracking looks ike this:

john mypasswordsdump --wordlist=stringlist.txt

this will test each password in stringlist against the hashes in the dump. simple. now we add the extra element.

in /etc/john.conf (im not sure where it is in the windows version but im sure its not hard to find) you may or may not see something like this:

[List.Rules:<somenamehere>]

these are the declaration of rule sets. and you can add some pretty nifty functons here. a wide variety in fact.  is important because this is how you tell john in the command line what rules to use against your passwords.

so for the sake of example we will use [List.Rules:testrules]

now there are some great resources for building these rules:

http://www.openwall.com/john/doc/RULES.shtml
http://juggernaut.wikidot.com/jtr#toc15

just as examples. but lets try something easy.

[List.Rules:testrules]
cAz"515"

running this is john like this:

john mypassworddump --wordlist=stringlist.txt --rules=testrules

will result in the first letter being capitalized, the rest of the word printing noramlly, and then appending 515 to the end and then trying each of those passwords against your hashes:

Cat515
Fcw515
Cfd515
etc...

of course the more complex you make the rules, the more diverse the passwords get and the more tries JTR will have to do.

instead of straight "515" we write [0-9], this will append a single digit to the end of each word, from 0 to 9 and moving on to the next one.

in this way many sorts of mutation can be defined. its a lot of fun!


How to prevent the latest ImageMagick vulnerability? According to the CVE-2016–3714 there are a some vulnerabilities in the ImageMagick program (4 packages) :

  Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats

There are others programs and command lines dependent on the imagemagick package, ( an example here). By executing the ImageMagick program, an image file can receive malicious code.

What are the recommended steps to take in order to verify, secure and prevent the ImageMagick vulnerability until the patch will be available?

As per the page you linked, there's a workaround.

Add the following to your policy.xml:

<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="TEXT" />

This file can be found in /etc/ImageMagick/.

This prevents the ImageMagick coder modules from leveraging the access modules above, each of which are currently vulnerable to the command injection issue.

There are a number of documented PoCs for the bug over at the oss-security thread, which can be used as a check to validate whether the bug is still present after applying the workaround.

Here are a couple examples:

exploit.mvg

push graphic-context
viewbox 0 0 640 480
fill 'url(https://example.com/image.jpg"|ls "-la)'
pop graphic-context

exploit.svg

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="640px" height="480px" version="1.1"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink=
"http://www.w3.org/1999/xlink">
<image xlink:href="https://example.com/image.jpg&quot;|ls &quot;-la"
x="0" y="0" height="640px" width="480px"/>
</svg>

Simply running convert against these will cause ls -la to be executed, the output of which will be displayed in your console if the vulnerability is present.


Is OSCP qualification considered Junior or Mid? I have 7 years computer programming experience and i'm currently doing the pwk (oscp) and I just wanted to know whether it is considered as junior or mid level regarding penetration testing?

It is hard to answer this question since the answer is subjective, but I'll try.

OSCP is definitely a well-recognized and respected certification for penetration testing. Mainly because of the way the test is designed, it is meant to gauge creativity and skills required to be a successful penetration tester since it is not for everyone. For example, a good security management professional with a CISSP would not necessarily be a good penetration tester, since penetration testing is more about being creative and having a knack for breaking into things.

When it comes to penetration testing, I would rate OSCP as one of the best certifications you can get and it should score you a mid-level position in penetration testing but ultimately it's hard to say since job offers depend on a lot of things than just a certification.

Some references to gauge the quality of OSCP:

https://ch1kpee.com/2016/10/04/my-oscp-experience/
https://kaizensecurity.wordpress.com/2016/05/07/oscp-blog-post/

You can find more with Google. Goodluck!


Why did I never see those "spy signal jammers" for sale? I recently watched a 1980s computer television programme about the problems of spying. Basically, they showed how anyone could buy relatively cheap and common hardware and then be able to sit outside a house, or drive around in a car, and receive the signals going from the computers to the monitors, or even generated by the electronics inside the computer, which leak out everywhere like radio signals, and get a somewhat foggy but fully readable visual representation of the text and/or images displayed currently on the screen.

They even drove by the bank district and were able to read all sorts of private information.

This was in the 1980s.

I never heard of this until a few years ago. It seems to still be the case except for ultra-expensive, special "TEMPEST" computers which no normal person can afford or even buy even if they can and want to shell out all that money!

One of the guys said:

  Anyone who cares about their security has their computer inside a fully shielded building anyway.

Yeeeeeeeah... right. If I can't afford TEMPEST hardware, I most definitely cannot afford a "fully shielded building".

Later in the show, they finally showed some kind of mitigation technique. It was a cheap device which you flicked on and which would then generate garbage noise on the same frequencies, so that anyone listening nearby with their antenna pointed to my computer/apartment/house would just get garbage data. He also mentioned that it was specifically not illegal (as radio transmitters can be). But then nothing more was mentioned about it.

I wonder:

Did that jammer thing actually work?
Was it cheap/affordable?
Why have I never heard of this critical security problem? I would never have dared to do countless things "in private" if I knew about this!
Do all modern computers have such a jammer device built-in?
Do modern computers in some other way prevent this from happening, or am I still wide open for anyone to just remotely read my screen from outside?!
Where do I buy such a device today and is it necessary?

Hollywood did, and does, a lot of things divorced from reality.

There was a lot of mostly smoke involving Tempest and Van Eck stuff back in the day. However, it was primarily dependent upon the use of an old CRT in text mode only. Even then, it only worked under nearly pristine laboratory conditions and at short range.

If you find yourself working on an old green screen in text only and see a truck with an eight foot antenna parked outside your window, just turn on your handy Tesla Coil and go about your business.


Scope for information security in 2yrs down the lane? I'm a fresher. Very recently I started doing Java course because of the wide opportunities we get to enter into an IT industry.

Now, I've got an opportunity to work for a project that's related to information security. Now I'm in dilemma whether to complete my course which would take another 2months of time or grab this opportunity and launch my career through the project at HP.??

Getting a job in infosec working with a company like HP is a big opportunity. HP are about to split into two organisations, HP ink and Hewlett Packard Enterprise (HPE). HPE are making a massive push into security and want to be taking on the likes of Dell SecureWorks and Deloitte in the next few years, so as far as security goes they are a good company to be with right now.

Really you need to ask yourself is, will completing the course will help you get a better job? Another question you should ask is, are you able and competent do the job without any further education? I had a similar dilemma myself recently, I had to choose between a job in infosec and a PhD...I picked the job.


How can I securely and conveniently move keys, certs and other short data across an air gap? What options are available for transferring data between unix machines separated by an air gap?

USB flash drives
Optical media eg CDs and DVDs
Printed paper and Scanning+OCR
QR Code software, displays or printers, and cameras
Pen, paper and typing!
Smartcards / ISO 7816
Contactless / NFC / ISO 14443

Each of these have pros and cons, and I'm having a hard time identifying the smartest way to move things like certificates, private and public keys and other relatively short data, to and from an offline machine.

There is no "golden rule" on how to to move the data. The options you have listed give you a tradeoff between security and convenience. You should think of threat models and analyze your security needs.

When there is data on the machine I wanted to protect, I would use convenient means (like CD or throw-away usb sticks) to get data onto the machine, knowing that a malware could have been transported onto the machine, and very secure means (like QR code software or papers and typing) to get them back. Of course, if the data were really important, I'd ensure a good air-gap to defend against badbios-like (ultrasound) communication methods, or use very secure means for the other direction, to prevent malware to get onto the isolated machine.


Can you steal session cookie with BREACH attack? Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? Obviously there are some finer points of the BREACH attack which I don't understand :)

I'm specifically interested in Django. In all requests for which browser sends a csrftoken cookie, the browser also sends a sessionid cookie.

Edit:

If my newfound understanding is correct, then the answer is trivially NO. The BREACH paper says:

  To be vulnerable to this side-channel, a web app must:
  (1) Be served from a server that uses HTTP-level compression, AND
  (2) Reflect user-input in HTTP response bodies, AND
  (3) Reflect a secret (such as a CSRF token) in HTTP response bodies.

Do (2) and (3) refer to the same thing? That is, is the attack only possible if the user-input repeated in the HTTP response body is THE SAME THING as the secret you're trying to steal?

If this is correct, then it makes sense.

You can steal an CSRF token, because it's inputted by the user (generally either via a form POST param or cookie), AND it may be repeated again in the response (either as hidden input to a form, or as a cookie), AND it's the secret that you're trying to steal.

You can't steal a session token, because the user can't alter the output based on that input. I mean, sure, the user can submit an altered session cookie, but the server (hopefully) won't ever repeat that invalid session token in the response.

So BREACH is an attack specifically against response bodies, not headers.  Since cookies are sent as headers, they aren't susceptible to the technique described by BREACH, but have been vulnerable to other compression side-channel attacks such as CRIME.

What they mean by:

  (2) Reflect user-input in HTTP response bodies, AND (3) Reflect a secret (such as a CSRF token) in HTTP response bodies.

Is that (2) the attacker must be able to submit user input that he controls that is then added to the response body in such a way that he can submit guesses as to what the secret is, and (3) the application must also contain the secret he's guessing in the response body.

What this does is it creates an oracle.  Because it's attack on compression, he's submiting guesses for the first part of the secret, and when his guess is correct, it will cause the response body to be slightly shorter, because the duplication between his guess and the real secret will be eliminated by the commpression algorithm.  So, in simplictic terms, he keeps guessing a character at a time until he gets the correct next character, and the response body becomes a byte shorter.  Then, he moves to the next character and repeats the process until he knows the full secret.


Driftnet not picking any images from the target I'm trying to learn ethical hacking and I'm starting with ARP SPOOFING. I used driftnet but seems I can't get the images on my target. I'm running Kali Linux on VirtualBox and my target is my Windows machine. I'm connected to the same network. Can someone give me a clue why I can't get the images?

Details:

Router: 192.168.1.1
Target: 192.168.1.5
My IP:  192.168.1.7
VM Connection type: Bridged
Interface: eth0

Windows URL I am browsing on Google.

It's because you can only browse Google over https only and not http.Even if you force http, the response for that request will be a redirect to https.Along with the arpspoof, you will have to use a tool which will be a middle man doing the ssl handshake with the target's browser and Google. MITMproxy works great.There is still a catch though, the target's browser will flag the connection to be insecure, because MITMproxy will be using its own selfsigned certificate for handshake.Beacuse your other end  is Google, target won't be able to add an exception in the browser and continue browsing because HSTS is set.To force the browsing, you will have to add MITMproxy's cert to the trustable root certificates manually in the browser.

Mitmproxy

How to use MITMPROXY

Edit: If you are seeing this problem for 'only' http connection too, check the Network settings for your bridge adapter in VirtualBox.You should set Promiscuous Mode to Allow All.


Why is it even possible to forge sender header in e-mail? With so many popular e-mail providers forcing users to log on using their SMTP servers, why is it still possible to forge "From: " header in e-mails? What prevents users from simply discarding the e-mails in which the source domain of the sender doesn't match the domain of SMTP server?

tl;dr

It's very easy to spoof a domain even with SPF controls enabled.

The solution is to use DKIM + DMARC, or SPF + DMARC

The email client is responsible for telling you if the message passes DMARC Display From verification

The email protocol allows for legitimate spoofing using Resent-* headers and Sender headers.  The email client (MUA) should display this exception whenever it exists.

There are a few misconceptions about SPF, namely:

SPF does not prevent email spoofing.
SPF alone doesn't affect, influence or, control the RFC 2822 Display From.
By default, the usefulness of SPF is to prevent backscatter issues and very simple spoofing scenarios.

Microsoft attempted to solve this issue with SenderID, (making SPF apply to the Display From address) but it was too complicated and didn't really solve the whole problem.

Some background
First know that there are two "from" addresses and two "to" addresses in every SMTP message.  One is known as the RFC2821 Envelope, the other is the RFC2822 Message.  They serve different purposes
The Envelope:  (RFC2821)

The envelope is metadata that doesn't appear in the SMTP header.  It disappears when the message goes to the next MTA.

The RCPT From: is where the NDRs will go.  If a message is coming from Postmaster or a remailer service this is usually <> or someSystem@place.com.  It's interesting to see that salesforce uses this similar to constantContact as a key in a database like toUserContactID@salesforce.com to see if the message bounced.

The RCPT TO: is who the message is actually being sent to.  It is used for "to" and "bcc" users alike.  This doesn't usually affect the "display of addresses" in the mail client, but there are occasions where MTAs will display this field (if the RFC2822 headers are corrupt).

The Message (RFC2822)

The message portion begins when the data command is issued.

This information includes the SMTP headers you're familiar with, the message, and its attachments.  Imagine all this data being copied and pasted from each MTA to the next, in succession until the message reaches the inbox.

It is customary for each MTA to prefix the above mentioned copy and paste with information about the MTA (source IP, destination IP, etc).  It also pastes the SPF check details.

This is the Display From is placed. This is important.  Spoofers are able to modify this.

The Mail From: in the envelope is discarded and usually placed here as the return-path: address for NDRs

So how do we prevent people from modifying the Display From?  Well DMARC redefines a second meaning for the SPF record.  It recognizes that there is a difference between the Envelope From and the Display From, and that there are legitimate reasons for them to not match.  Since SPF was originally defined to only care about Envelope From, if the Display From is different, DMARC will require a second DNS check to see if the message is allowed from that IP address.
To allow for forwarding scenarios, DMARC also allows the Display From to be cryptographically signed by DKIM, and if any unauthorized spammer or phisher were to attempt to assume that identity, the encryption would fail.
What is DKIM?  DKIM is lightweight cryptographic technology that signs the data residing in the message.  If you ever received a message from Gmail, Yahoo, or AOL then your messages were DKIM signed.  Point being is that no one will ever know youre using DKIM encryption and signing unless you look in the headers.  It's transparent.
DKIM can usually survive being forwarded, and transfered to different MTAs.  Something that SPF can't do.  Email administrators can use this to our advantage to prevent spoofing.

The problem lies with the SPF only checking the RFC2821 envelope, and not the Display From.  Since most people care about the Display From shown in an email message, and not the return path NDR, we need a solution to protect and secure this piece.
This is where DMARC comes in. DMARC allows you to use a combination of a modified SPF check or DKIM to verify the Display From.    DKIM allows you to cryptographically sign the RFC2822 Display From whenever the SPF doesn't match the Display From (which happens frequently).

Your questions

Why is it still possible to forge "From: " header in e-mails?

Some server administrators haven't implemented the latest technologies to prevent this sort of thing from happening.  One of the major things preventing adoption of these technologies is "email forwarding services" such as a mailing list software, auto-forwarders, or school alumni remailer (.forwarder).  Namely:

Either SPF or DKIM isn't configured.

A DMARC policy isn't set up.

The email client isn't displaying the verification results of the Display From and the Resent-* or Sender field.

What prevents users from simply discarding the e-mails in which the source domain of the sender doesn't match the domain of SMTP server?

What doesn't match: the envelope or the body?  Well according to email standards the envelope shouldn't match if it's going through a remailer.  In that case we need to DKIM sign the Display From and make sure the MUA verifies this.
Finally, the MUA (email client) needs to show if the sender is DMARC verified, and if someone is trying to override that with a Sender or Resent-From header.


Second router setup for secure subnet I have a BT Smart Hub as my router which has no guest network functionality, I also have a Netgear Nighthawk D7000.

Initially I attempted to use only the D7000 and take advantage of the guest wifi feature but I couldn't get the setup right so that BT's YouView and Internet TV Channels worked as required (some are encrypted eg BT Sport so wonder if this was the problem).

I was considering a setup like this:

 Phone Line
     |
     |
 Main router, BT Smart Hub (has guest access)
     |      |        |                \
     |     TV     YouView etc      Guest wireless devices
     |
     |
 2nd / D7000 router (LAN on Main router -> Internet port on 2nd / D7000)

Is the setup destined to cause endless headaches setting up or is it quite straight forward?

The BT Smart Hub actually has an extra WAN port too, I wasn't certain if it was even a possibility to go from this WAN port to the Internet (WAN?) port on the D7000? Are there any extra benefits to this if it is possible? More secure? Any harder to setup?

Tackling the issue that the Guest wireless device (or LAN connected) could take over the Main router and effectively track all traffic to and from the Internet from the Private router (which has my laptop / pc / mac etc), would using a VPN like F-Secure Freedome on all devices on the 2nd Private router significantly mitigate or even stop any MITM there? Is there any risk of direct access to the devices on the 2nd router via the main router or will the firewall in the 2nd router block this?

This question is sort of a follow up to the one here as one of the answers suggested the setup here was backward but even if reversed would open the setup to Man In The Middle attacks and have all network out of the 2nd router potentially exposed.

This is a great question and as a hands on pentester who is constantly setting up layered networks... I can tell you that it's not a straight forward answer. In my experience it's going to be more about how well designed these routers/switches are than good set up practices.

1: try it. Just set it up, open wireshark, and go. If you run into issues, check wireshark. Be especially observant of ARP and DHCP calls. One major issue you might run into is confusion about having two arp tables. If the first router thinks an IP has changed (DHCP) but the 2nd router (functioning as a layer 3 switch basically) has not refreshed it's arp table... that device will be a ghost. Don't be afraid to unplug and plug the 2nd router to help issues like this.

2: How routers handle multiple "gateways" is not always great. If you plug D700 into the main router on the D700's WAN port, it can get confused. Some routers have features to mitigate this, some don't. If one of the routers can't handle the config you're setting up, I'd suggest making the IP range of the second router different from the first (10.0.0.0/24 and 192.168.0.0/24) to help with trouble shooting and confirmation of proper routing. It will force a route table on the 2nd router which might help with confusions (why is there multiple DHCP?!, says the router and devices).

3: MITM is confusing in the context used here. Most common MITM: fake SSID that imitates -either router- and when someone logs in it SSL strips and collects passwords and etc. This is a pretty specific and nasty type of attack. 2nd most common man in the middle happens if someone has already breached your network and I won't go into it because you're in serious trouble at that point no matter how you look at it. Your set up, in my opinion, doesn't really affect your exposure to MITM for a motivated attacker.

Hook it all up, and report back with errors? Happy to help troubleshoot. Good luck.


is it possible to create a WEP wifi that accepts any password? the same as evil twin fluxion but without captive portal so the victim connects to our fake Wep Wifi that accepts any password after getting disconnected from his Wpa 2 Wifi so we sniff data from the WEP Wifi to get the password that the victim has entered in clear text

Nope, it has to be an open network. The problem lies on the second message of the WEP authentication which is generated with the password, and later used for data encryption.

To achieve this somehow you need beforehand to know the password the user will use to send him the challenge encrypted, then he'll answer correctly the challenge in message 3 and that's it.

That's how WEP authentication works :(


What is the security value of this on-the-fly SRP user registration? I am currently implementing SRP on a game I am developing. However, I will be distributing this game server and client, so I would like registration to be allowable on-the-fly, without requiring the host to use some sort of forum or email communication to pre-register the account before the first login. I'll go over the basic flow of SRP, and then my registration changes.

SRP Documentation: Found Here

The User enters their username and password into the client.
The client sends the username and a randomly generated value to the server.
The server gets the salt and password verifier (which is the result of a function on the password, both stored externally) of the user and sends the salt and another randomly generated value to the client.
Each side now independently calculates a strong shared session key, and proves that key to each other.
If both proofs match, the user has successfully authenticated.

To add the registration functionality, here are my proposed changes.

The User enters their username and password into the client.
The client sends the username to the server.
The server checks to see if there currently exists a user with the username sent from the client.
If no user exists, the server sends the RSA Public key to the client, requesting the client to generate a salt, and verifier.
The client sends the salt, public ephemeral value, and verifier to the server, and encodes it with the public key.
The server decodes the salt and verifier with the private key.
Each side now independently calculates a strong shared session key, and proves that key to each other.
If both proofs match, the user has successfully authenticated.
If the user has authenticated sucessfully, the salt and verifier are saved to the database, or file for the user.

Would this be an acceptable, secure form of on-the-fly registration? Or are there some things that I haven't considered?

Edit: It seems that I haven't provided all of the information necessary. The way I'm modeling my game after is similar to Minecraft servers, where users can either download the client and connect to any number of user-hosted servers available, or they themselves can host the server. The difference however is that the Minecraft user accounts are created once, when they register for the account, and when they launch the client, the client authenticates with the official Minecraft servers. I want to leave the userbase management up to the people hosting the servers; that way the only user accounts they know about, are those that have registered with their server.

One thing to consider is bots.  You've made the registration very easy and convenient.  That also makes it very easy and convenient for griefers, cheaters, or other types of miscreants to create bots that swarm a server.

Depending on what your game is, that might be irrelevant.  But automated registration with no CAPTCHA is something you should consider.


can a token be used for sql injection I have a token that is restricted to read only access.
If someone obtains that token, can they use it to do a sql injection attack?

Given that the token is permissioned for read only, can someone embed a delete query in the request, have it read on the server side, and it actually does a delete?

First and foremost: If the token is concatenated into a SQL query (without sufficient escaping), then yes, it can be used for SQL injection. Don't build queries by concatenation!

Tokens, by themselves, have no permissions; they are just identifiers. The app's logic determines what permissions to give the bearer of the token, but it's up to the app to enforce that, and a (successful) SQL injection bypasses such checks. Databases also have permissions (at least, the better ones do), and the app will have certain permissions on the database that determines what a query the app sends to the DB can do (and all that a SQL injection is, from the perspective of the DB, is a query that the app sent over). A very security-conscious app will use the Principle of Least Privilege (which says you should never give anything more permissions than are needed to do its task), such that (for example) a DB query that is supposed to be read-only will be made using a connection with read-only permission on the DB, and in such a case an embedded DELETE subquery would indeed fail. However, in practice very few developers do this, and the app usually makes all queries using a connection with full permissions on the DB.

The permissions of the token-bearing identified entity (presumably a user of a web app or similar) have no bearing whatsoever on the permissions that the app has when talking to its database. In fact, since a SQL injection requires modifying the token, it's no longer actually the correct identifier for that user, so it definitely isn't going to be subject to user-specific access checks.


Terminology: What's the appropriate term for the digest output of various integrity hash and HMAC functions? I've heard conflicting statements from various CISSP instructors, so I'd like some "real world" perspective:

What is the appropriate terminology for the digest output of the following algorithms:

MD5
SHA-1, SHA-256, SHA-x

Some folks say that it's appropriate to refer to the digest output as a generic "hash value".  Others state that crypto folks will cringe at that as "hash" is specific to SHA (hence "Secure Hash Algorithm).

Additionally, what about output for:

HMAC-MD5
HMAC-SHA1
CBC-MAC

Can I get clarification?  Additionally, any perspective for the CISSP exam would be appreciated too (I understand that it may be different than practical real-world usage).

MD5, SHA-1, SHA-256, SHA-384, SHA-512 are examples of methods for message authentication using secure hash functions. When you apply the hash function on the message, you get a "Message Digest". [W. Stallings - Network Security Essentials, 5/e]


Why must new password must be different from old When changning my password ive come across this below message a few times:

  Your new password must be different from your previous password.

What is the rationale behind such implementation?

EDIT:
Sorry I was not clear that this message comes when I forgot my password and used the "forgot password". My question is: from a security point of view, why is it necessary to check that my new password is different from the old one and why can I not use the same.

The rationale is that they want you to change your password.   If you try to use the same password, you aren't changing your password.  You're re-entering your password.

So, perhaps the question then is why do they want you change your password?  They want you to change your password to limit the amount of time a compromised password is valid.  Whether this is a helpful mitigation or a case of the cure being worse than the disease is subject to much heated debate, but this is the reason none the less and a fairly standard policy today as it has been for many years.

The thinking is that if you lose your credentials to an attacker, the attacker can then authenticate into the system as you.  However, if you're required to change your password regularly, the attacker can only authenticate as you until your next password change, at which time he will no longer have your current credentials, and will once again be locked out of the system.   If the system were to let you continue to use the same password, the policy would obviously be useless as the same credentials would continue to work indefinitely.


Are passwords safe to send through POST, without SSL in a iOS app? Is it safe to post passwords to my web server in this manner?

NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"];

NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding allowLossyConversion:YES];

NSString *postLength = [NSString stringWithFormat:@"%lu", (unsigned long)[postData length]];

NSMutableURLRequest *request = [[NSMutableURLRequest alloc] init];
[request setURL:url];
[request setHTTPMethod:@"POST"];
[request setValue:postLength forHTTPHeaderField:@"Content-Length"];
[request setValue:@"application/json" forHTTPHeaderField:@"Accept"];
[request setValue:@"application/x-www-form-urlencoded" forHTTPHeaderField:@"Content-Type"];
[request setHTTPBody:postData];

NSError *error = [[NSError alloc] init];
NSHTTPURLResponse *response = nil;
NSData *urlData=[NSURLConnection sendSynchronousRequest:request returningResponse:&response error:&error];

if ([response statusCode] >= 200 && [response statusCode] < 300)
{
    NSString *responseData = [[NSString alloc]initWithData:urlData encoding:NSUTF8StringEncoding];
    NSLog(@"Response ==> %@", responseData);
}

My server doesn't have https or any certificates, so is it still safe using the method above?

No, because they are transported unencrypted over the internet. Even when your app or site is http best practice is to do at least the post containing the username/password using encryption/ssl.


Can someone decode this for me? I decoded some of the original traffic from hex and got the below output. I'm not sure how to decode it further. Any help? Thanks.

T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=22&X=6/A3eZDCME9jCLvH9D6cciMZAFUWx2xUayI+JAbr1hzuW0BNOuxYTlatYqKViHFk0RKP1lCag7gtlyUH9l1a+fDDMkI4W/+8t0zuNFEgGcMW/qlM5iGhhJKB38/186Uy2Q+vUGBpgSSk8iyQkFhf66FIsnYI/Q32N6s=
T=2020-04-10+13:27:30.758+PST&L=i&M=[g2tray]&N=23&X=fH6MMvw38rPIs/BF2YCulBUMBS94+qEM5lZWUQ0izn1WY+RWnBBiiuuqOHQ3omFirWOrq7Kc1ug9U/4p7tw4JsCQo+V2PChm+CdEpjMNQqehUW/yoiwBpKUfWVH3N2WATTaOsbDJcRk1sQ7qG21hXgnnAODuWe7QTwrgfg==
T=2020-04-10+13:27:30.789+PST&L=i&M=[g2tray]&N=24&X=w+qtxL4auaCbNaOQbt7Yll0pYT7JtmlvZQYddUrMpbiJbURPSHWrUN1klgvbqan0WlpLcx3CHgd4HcHr0NuWi9X45zsc8ilChkRFfUspKLQ5SbqJfclr0Equy1J6OF+/m1w8ZcfdzUGqyVB9LjtYKQj4BQmFXHywq5gG/xA=

Each line consists of a timestamp (T=) and four variables (L=, M=, N=, and X=) in HTML-encoded format (var=val separated by &).  Of these, only the variable X requires decoding, and it is base64 encoded.  However, the decoded value is binary data, and not much useful to humans:

$ echo -n fH6MMvw38rPIs/BF2YCulBUMBS94+qEM5lZWUQ0izn1WY+RWnBBiiuuqOHQ3omFirWOrq7Kc1ug9U/4p7tw4JsCQo+V2PChm+CdEpjMNQqehUW/yoiwBpKUfWVH3N2WATTaOsbDJcRk1sQ7qG21hXgnnAODuWe7QTwrgfg== | base64 -d | hexdump -C
00000000  7c 7e 8c 32 fc 37 f2 b3  c8 b3 f0 45 d9 80 ae 94  ||~.2.7.....E....|
00000010  15 0c 05 2f 78 fa a1 0c  e6 56 56 51 0d 22 ce 7d  |.../x....VVQ.".}|
00000020  56 63 e4 56 9c 10 62 8a  eb aa 38 74 37 a2 61 62  |Vc.V..b...8t7.ab|
00000030  ad 63 ab ab b2 9c d6 e8  3d 53 fe 29 ee dc 38 26  |.c......=S.)..8&|
00000040  c0 90 a3 e5 76 3c 28 66  f8 27 44 a6 33 0d 42 a7  |....v<(f.'D.3.B.|
00000050  a1 51 6f f2 a2 2c 01 a4  a5 1f 59 51 f7 37 65 80  |.Qo..,....YQ.7e.|
00000060  4d 36 8e b1 b0 c9 71 19  35 b1 0e ea 1b 6d 61 5e  |M6....q.5....ma^|
00000070  09 e7 00 e0 ee 59 ee d0  4f 0a e0 7e              |.....Y..O..~|
0000007c


I don't recognise my DNS server's address: does this mean I am compromised? I'm using the Ubuntu GNOME Linux distribution as my desktop. Recently, it became impossible for me to connect to the Internet with it. When I checked its network settings, I saw that the DNS address was 46.161.40.29.

When I searched this IP address on my other desktop (a Windows 7 machine), I found the article http://anti-hacker-alliance.com/index.php?details=46.161.40.29.

On my Linux machine, I set the DNS nameserver in /etc/resolv.conf to 8.8.8.8 and 8.8.4.4, and was able to access the Internet.

Note that every time I reboot my machine, I'm unable to connect to the Internet, and the DNS file (/etc/resolv.conf) is blank. My wired connection is also not showing in the network manager.

I still see 46.161.40.29 in my wired connection's settings:

Is my computer compromised? If so, what can an attacker do?

  Note: I'm using the D-Link DSL-2520u home modem, and the firmware version is v1.08. When I checked my DNS settings in the modem interface (192.168.1.1) it was pointing the primary DNS address to 188.42.254.137, and the secondary to 8.8.8.8.

Something in your environment has definitely been compromised. It seems more likely that your router has been compromised. You haven't provided much information, so I'm going to make some basic assumptions:

You're at home
You are behind a commercial router, provided by your ISP
You haven't done anything to secure your router
Your linux desktop is a DHCP client of the router.

These devices often have default passwords that users never change and critical firmware vulnerabilities that go unpatched. As a DHCP client of the router, your Linux desktop is going to pull DNS information as part of its DHCP request, and so will see the behavior you've described above. Configuring other DNS servers in resolv.conf is only a workaround. I strongly suggest that you try to log in to your router (probably @ 192.168.1.1, based on your screenshot). I bet you won't be able to. You'll probably have to reset it to factory defaults, then log in. You'll want to secure it better - update firmware, change default passwords, and hope that's enough.

For confirmation without logging into your router, check the DNS configuration on your Windows desktop. If it points to the same 46.161.40.29, then it's very likely the router.


What technologies to use for the "front end" server to safely validate requests? Imagine that I have a server made with technologies and programming language that are not secure for some reason, such as legacy versions with known vulnerabilities or anything else that may result in giving a hacker an opportunity to forge an invalid request to access more data or internals of the system.
Now to solve the security problem instead of rewriting the core I would like to place the 2nd server in front of it. It should have libraries to be able to accept simple HTTP requests with headers, parse/generate JSON, do the validation (to ensure it passes valid JSON to the 1st server, i.e. recursively check structure, sizes and encodings) and so be quick, simple and safe enough to make is possible to rarely update it and use any unsafe protocol for easier communication with the 1st server.
What technologies should I use for the 2nd server? What programming language?

From the security standpoint any common programming language will do as long as you are familiar enough with it to securely code in it. Some languages like make this harder but often run faster, others make it easier at the cost of being slower. But the main point here is your expertise.

If your goal is to handle well-formed JSON with a fixed schema Go might be a useful language since it makes it easy to map JSON to structures with clearly defined types. This allows you to unmarshal JSON to a structure and marshal it back to JSON and implicitly normalizing and sanitizing the data while doing this. Go has also integrated support for handling HTTP and scales well. But there are likely libraries for other languages which provide similar support and it might be better to use the language you are deeply familiar with instead of learning a new one.


Does PCI actually require card informations to be encrypted in memory? I saw in many places that card informations are kept encrypted even in memory, is that actually required by PCI? I don't see reason behind it, if attacked can get to the values, he can get to encryption key as well, right?

And if it is actually required, does each card require own encryption key? Or one common can be used just with separate IV for each?

TL;DR

Technically, PCI requires card holder data (CHD) to be encrypted both in transit and at rest. This may seem simple at first, but the reality is, it doesn't get very specific about delineating between rest on disk vs. volatile memory. If you want to be pedantic, volatile memory is still data at rest, but according to the FAQs, it's not explicitly required to be encrypted while in memory. Though it's good to point out that this is just the FAQs, not actually in the PCI DSS Standard itself. Here's a good article to read for more info.

Long Answer

The reason for in-memory encryption has to do with the memory-scraping attack vector.

  PCI DSS does a good job of making sure credit card data in persistent
  storage is secure, however, such data in non-persistent storage --
  such as files stored temporarily in memory -- can still be vulnerable
  to compromise, particularly via memory-scraping malware. Learn more
  about this threat. SOURCE

More info about what PCI requires can be found here. The TL;DR of the long answer is that if you do not encrypt the data at rest (on disk or in memory), make sure you have compensating controls to mitigate the risk of data loss.

  If stored cardholder data cannot be encrypted, consult PCI DSS
  Appendix B: Compensating Controls and Appendix C: Compensating
  Controls Worksheet.


Mitigate MS17-010 on Windows XP? (wannacry ransomware) On my network I have to run two XP VM, because of legacy programs.

How can I mitigate MS17-010 on Windows XP? The machines are not directly exposed to internet, but they must be connected to the LAN.

Is enough to disable SMB server for avoid having my VM infected? I don't need a SMB server on the machine, but I need to access SMB clients from it.

Microsoft released patches for all operating systems in custom support. Please see here.

For English language patches, direct links are Windows XP SP2 x64 and Windows XP SP3 x86. Localized version of the patch can be found here. Rest of the links can be found on the bottom of the blog post.


I have created secured server with PSK-NULL-SHA256 with no certificate but when try to connect with client provides handshake failure Server side :
I have created the secure SSL server using openssl command with no certificate to verify using cipher suite PSK-NULL-SHA256 with preshared key "AD" with dummy key and PSK identity as given below which results in server is created and waiting for client to connect with.
openssl.exe s_server -accept 4020 -cipher PSK-NULL-SHA256 -psk AD -psk_hint testing.domain.0106 -nocert tls1_2**
Using default temp DH parameters
ACCEPT

Client side :
Below command is given in client to connect with using same cipher and port mentioned in server but ends up with the error mentioned below .
openssl.exe s_client -connect 127.0.0.1:4020 -psk AD -psk_identity domain.0010 -tls1_2

Error in client side :
CONNECTED(00000004)

25769803792:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake
failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40

---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 246 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)

Secure Renegotiation IS NOT supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : 0000

    Session-ID:

    Session-ID-ctx:

    Master-Key:

    PSK identity: None

    PSK identity hint: None

    SRP username: None

    Start Time: 1592417575

    Timeout   : 7200 (sec)

    Verify return code: 0 (ok)

    Extended master secret: no

---

Error in server side:
ERROR
25769803792:error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher:ssl/statem/statem_srvr.c:2284:
shutting down SSL
CONNECTION CLOSED

Why is the connection being terminated with alert number 40? Can anyone please let me know the rationale behind it?

You can look up TLS magic numbers on the TLS parameter registry, including alerts. 40 is “handshake failure”, which doesn't tell you much.
The reason for the handshake failure is clearly indicated in the server output: “no shared cipher”.

Below command is given in client to connect with using same cipher and port mentioned in server

Well, no. You did not specify a cipher suite.
By default, OpenSSL does not allow insecure cipher suites such as cipher suites without encryption (…-NULL-…). See the ciphers man page (linked from the s_client and s_server man pages). You have to enable them explicitly with a -cipher option, e.g.
openssl.exe s_client -connect 127.0.0.1:4020 -psk AD -psk_identity domain.0010 -tls1_2 -cipher eNULL


Is it OK practice to use the same public and private keys for TLS and to generate JWTs? . . . Or is that discouraged, and it's better to use separate key pairs for TLS and JWT? (It would be slightly easier to manage one key pair only, but probably better security to use two separate key pairs).

No, don't do this. This is related to the "never roll your own crypto" rule: understanding all the math in the algorithms and all the implementation details is very hard, and there is a high chance you will miss something leading to vulnerabilities. Also just because you can't break your design, it doesn't mean no one else can.
There is a great question on crypto.SE about using the same RSA keypair to sign and encrypt, and the answerers conclude that even though theoretically it could be done securely, in practice it will very likely lead to vulnerabilities:

Therefore, it is technically safe, cryptographically speaking, to use the same RSA key pair for signature and encryption, provided that the key pair is used safely for signature and used safely for encryption. Here, I mean safe in a narrow sense, assuming a “perfect” world where everything that should stay secret, remains secret.
The thing is, the world is not perfect. Implementations of RSA can leak partial information through side channels. Keys get compromised. Protocols using RSA sometimes use it in ways that are very brittle.
Using the same key for both encryption and signature can exacerbates weaknesses. RSA has a history of weaknesses, not in the mathematical algorithm itself (once you use proper padding), but in the way it's implemented.

Your situation is slightly different (although TLS can use RSA keys for encrypting the session key, and JWT uses the key to sign the payload), but this shows that using the same key for multiple purposes can lead to unintended consequences.
Also as ewanm89 pointed out in the comments: the two use-cases have fundamentally different security requirements and different key management (e.g. how do you rotate your keys and how often do you do that, for how long would you accept JWTs signed with the old key etc.).


What malicious things can happen when clicking on links in email? I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it yet)?

The common reasons for links in spam email are:

verification that your email address is valid and that it is read which makes the email address more valuable for address brokers (the link needs to have some individual part, that can be a number, but it can also just be unique word from the dictionary). This kind of link may be labeld "unsubscribe".
the link may point to a phishing site, pretending to be from well-known-company such as eBay, but just wanting to trick you into entering your username and password for that side (e. g. "your account needs to be verified"). Please note two things: In HTML emails the displayed link text and the actual link target can be distinct. There are some special characters that look like normal ones
the link may point to a website which tries to exploit your browser or plugins to get access to your computer, or trick you to manually execute malicious code (e. g. "get this video codec", "you computer is infected, get anti virus for free").
the spammer might want to get people to visit his or her website to advertise his products or opinions, manipulate polls, etc.

Uncommon:

the spammer may try to flood the target with lots of visitors. This is not effective as a distributed denial of service attack because the email is a lot larger than the data send by the browser to the target server. Reflective DDoS usually use DNS where a small query with a faked sender address can result in a much larger reply to the target site. But it may be effective to exploit some pay per click advertisement programs.

More than one point may be true.


Explain the naming with the variety of cipher-methods as seen by `$ openssl enc --help` I am confused by this variety, perhaps outlined here. I am trying to understand the conventions.

Trend A: strength?

$2^8$, $2^7$ -- seems clear but why algo with 192 or 40? Referring to same issue? And it is?

Trend B: background?

aes? desx, des but with x? Is there some mother-algo? Major names: aes, des and rc, why?

Trend C: endings

.*cbf, .*ofb, .*cbc -- what do the common endings mean?

Trend D: odd single numbers

What do the number-endings such as 1 or 8 mean?

Trend E: odd bloat

Why bloat with bf and blowfish? Historical heritage?

$ openssl enc --help
-aes-128-cbc               -aes-128-cfb               -aes-128-cfb1
-aes-128-cfb8              -aes-128-ecb               -aes-128-ofb
-aes-192-cbc               -aes-192-cfb               -aes-192-cfb1
-aes-192-cfb8              -aes-192-ecb               -aes-192-ofb
-aes-256-cbc               -aes-256-cfb               -aes-256-cfb1
-aes-256-cfb8              -aes-256-ecb               -aes-256-ofb
-aes128                    -aes192                    -aes256
-bf                        -bf-cbc                    -bf-cfb
-bf-ecb                    -bf-ofb                    -blowfish
-cast                      -cast-cbc                  -cast5-cbc
-cast5-cfb                 -cast5-ecb                 -cast5-ofb
-des                       -des-cbc                   -des-cfb
-des-cfb1                  -des-cfb8                  -des-ecb
-des-ede                   -des-ede-cbc               -des-ede-cfb
-des-ede-ofb               -des-ede3                  -des-ede3-cbc
-des-ede3-cfb              -des-ede3-cfb1             -des-ede3-cfb8
-des-ede3-ofb              -des-ofb                   -des3
-desx                      -desx-cbc                  -rc2
-rc2-40-cbc                -rc2-64-cbc                -rc2-cbc
-rc2-cfb                   -rc2-ecb                   -rc2-ofb
-rc4                       -rc4-40

There's a list of what these mean in the OpenSSL documentation.
They seem to be shown as algorithm name-key size-encryption mode. When the key size is omitted, it seems to mean that there's only one valid key size for that algorithm, so there's no point in including it.
If you're actually trying to pick an algorithm, you probably want AES (the standard) with OpenSSL's default of CBC mode (more secure than ECB).
Algorithm Names
Some of the names have numbers in them to distinguish versions. For example, RC2 and RC4 were both made by Ron Rivest, and RC4 is newer. You see similar things in hash algorithms, where MD4 was replaced by MD5 (and MD6 is in progress).
They seem to prefer "bf" for blowfish, so I'd guess that -blowfish is probably for convenience or backwards compatibility.
DESX is apparently an algorithm based on DES but with a much larger key size.
Key Sizes
The key sizes are in bits, and generally a longer key is stronger, but encrypting with it will be slower. So, AES with a 128 bit key is faster but less secure than AES with a 256 bit key.
Most algorithms seem to use powers of two for key sizes, but nothing requires them to be. DES for example uses a 56 bit key.
Encryption Mode
The encryption mode is something I don't understand well enough to explain. You just should take a look at the Wikipedia article.
The 1 or 8 at the end of some of the encryption modes specifies the number of bits used in cipher feedback.


SSL/TLS Certificate Authority supply policy I would like to ask for recommendations regarding the following issue:
As a company with a number of customers worldwide we supply our product to many different sites. We need to shape our policy regarding self-signed CAs and the certificates for our products.

Is it common to supply self-signed CAs to customers and allow to them to sign/manage certificates by themselves or is it more acceptable to manage our own CA to sign & supply certificates for our customers?

If you need to manage a significant number of certificates then running your own (snake-oil) CA saves a lot of headaches - you can authenticate against a single signing authority, and you can revoke certificates. But if non-repudiation is ever likely to be a concern, I'd suggest you might want to provide a mechanism for the customers to generate their own CSRs for you to sign - that way you're not in the position of having access to their private keys.


PKCS#12 File - security impacts when imported in Web Browser or Windows Store? When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password.  How does the browser or operating system manage this password?  Is it secure?

The password you are prompted for is the one used to lock the PKCS#12 file itself. PKCS#12 files are really rather generic archives, extensible in many ways, but in practice they are password-protected containers for private keys and certificates. The "password protection" really is password-based encryption: the password is turned into an encryption key using a Key Derivation Function -- in that case, it is PBKDF2.

PBKDF2 attempts to protect the password against brute force attacks by being inherently slow -- by using many internal iterations. The number of iterations is configurable, and was chosen by the system that generated the PKCS#12 file; a higher number of iterations implies higher security (since it makes each password try more expensive) but also higher usage cost (since it makes each password try more expensive).

In any case, once the password has been asked from the user, and turned into an encryption key with PBKDF2, the PKCS#12 file contents are decrypted (in the RAM of the computer). What happens afterwards is completely unrelated to the PKCS#12 file: that file is merely a transport vessel; once your computer has the private key in its RAM, the PKCS#12 file (and its password) ceases to be of any use. Since you are doing an import, your browser or operating system is taking charge of the storage and protection of the private key, and does so using methods that are in no way impacted by the PKCS#12 file or its password. Windows (hence Internet Explorer) will try to store the private key encrypted with your session password, though you can add an extra password.

From a high-level point of view, if you are importing a private key in your machine, then this means that:

the key is morally yours;
and yet it was generated elsewhere.

In general, this kind of things is considered suboptimal. If the key is yours, then it should have been generated in your own computer, and the private key should never have left it. The recommended PKI usage scenario is that you generate your key pair on your computer, send the public key to the CA (as part of a certificate request), and receive back the newly issued certificate. In that scenario, only public information travels, and there is no PKCS#12 file at all.


Secure device pairing protocol I need to implement secure pairing between two devices based on a short shared PIN code with no trusted third party.  If you think about the way bluetooth devices pair you won't be far off -- my device displays a code, I tell you, "the code is 40YA," you type it in on your device and we've got a secure connection.

The protocol should protect against MITM and eavesdropping attacks, and the PIN needs to stay valid and secure for at least a few hours.  In other words, if an offline attack on the PIN is possible it should require at least a few hours to complete.

Does such a protocol exist?  Bonus points if a reasonably bright non-cryptographer can understand it.  :)

Update: Is Diffie-Hellman key exchange what I'm looking for?

David's answer and further research has led me to the EKE (Encrypted Key Exchange) protocol described by Bellovin & Merritt here:

https://www.cs.columbia.edu/~smb/papers/neke.pdf

and by Wikipedia here:

http://en.wikipedia.org/wiki/Encrypted_key_exchange

EKE is specifically designed for this sort of task -- amplifying a short shared password into a fully secure link.  The protocol was patented but the patent expired in 2011.  There is now an RFC for using EKE with EAP:

http://tools.ietf.org/html/rfc6124


How to store openssl CA private key securely We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the bast place to store the private keys?

We have a KeePass where we store the credentials for the systems in question but but it's already quit big. We were thinking about creating a second KeePass just for the private keys? What would be your recommendation ?

Storing SSL private keys on production server
As I understand your question, you have a web server serving a GUI over HTTPS (IIS, Apache, Tomcat, something) and you want to know how to securely store the private keys on disk for this server.
Typically, people put a lot of effort into protecting their CA private keys, but much less effort into protecting the web server private keys (because the web server needs access to them at all times).
Metaphor: this is similar to asking "best kind of garage for my sports car?". The short answer is: it doesn't really matter  if your car will spend 99% of its time on the highway.
I think this question covers what you're asking:
How should I store SSL keys on the server?
Basically, if you're ok with needing to manually start the web server every time, then the list I have below for CA keys applies, but if you want the server to restart automatically, then your options are either

Store the key on the server in plaintext (applying whatever file permissions you can).

If you're on Windows, use CAPI / DPAPI to add additional protections to the file beyond what you can do without OS help.

Buy an HSM to store the keys for your servers (expensive and you may compatibility / complex setup issues depending on which web server you're using).

Original Answer about storing CA keys
[I assume you mean storage of the CA private key, not of the SSL server keys. I'll update my answer if you clarify]
I'm glad you're putting thought into how to store the CA private key. The goal of protecting a CA private key is to ensure that it can't be copied. How much effort you want to put into protecting it depends on what it's worth, in dollars, if it's stolen.
I'm 95% sure that openssl already encrypts your private key with a password (technically: uses a password to derive an AES key, then encrypts the CA private key with AES). So arguably, putting this inside KeePass isn't gaining you much.
Here are three scenarios with increasing security:

Protect the CA private key with software encryption such as openssl's built-in password encryption, or KeePass.
Pros: Cheap, easy.
Cons: A hacker who breaks into your server can copy the entrypted file and brute-force the password. Then they have your private key.

Store the CA private key on an encrypted USB stick, such as an IronKey. Make sure you always delete the key file from the CA machine after each use.
Pros: When the key is not actively being used, there is nothing on the CA machine for an attacker to steal. There is only one copy of the private key on a physical USB stick. Hard to steal without somebody noticing.
Cons: Malware planted on the CA machine can steal the private key the next time you use it.

Air gap the CA. Run your openssl CA on a machine that has never been connected to the network. Transfer CSR's and signed certificates in and out via IronKey USB sticks.
Pros: Much harder (but not impossible) for an attacker to get malware onto the CA machine and extract the private key
Cons: Complex and inconvenient.

Use an HSM. This is the Cadillac solution: store the CA's private keys in a networked HSM, when the CA needs to sign something it sends the request to the HSM.
Pros: Highest security because the private keys never leave the HSM; if the CA machine never touches them then they can't be stolen.
Cons: Complex, expensive, may require dev time and expertise to configure.


How secure are passwords that are set via IRC's /nicksrv? I just registered a nickname on IRC and had to use a password to register it.  Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:

Is the password I registered with Nickserv hashed, and replicated to all other nodes in the IRC network?
Is there a salt for that password?  (what is it?)
Can anyone become a peer in IRC and see the hashed version of my password?
If none of the above applies, and Nickserv is centrally run, who runs it?
What other risks should I be aware of?

I can only speak for the UnrealIRCd that I helped run many years ago, but I'll give this a go:

NickServ is a service bot running on a single node. It connects to all nodes so you can communicate with it without the plaintext password going over replication. As such, your password is only actually on one server.
By default, NickServ passwords are hashed using MD5, no salt. We had a mod that used your email address as a salt, but don't expect much on most IRC servers.
An IRC network's peer servers are privately networked, requiring a password and common configuration to link them together. You can't just start your own server and become part of the network without the network admins configuring it.

As far as risks go:

Some servers use alternative nick registration (e.g. disable NickServ and make a bot that has the same name) so custom schemes are entirely possible. This might be a good thing, or a bad thing. It depends on the implementation, which is probably a black box.
IRC traffic isn't encrypted or authenticated by default. You can configure SSL on the IRCd and client, though. I highly recommend doing so. The network should be using SSL for server-to-server replication.
On older networks, you'll sometimes see bots like X for nick authentication. Some users do /nick NickServ to catch auth attempts. Make sure you read the MOTD and other docs before trying to authenticate.


sqlmap injection point in POST data I am currently doing a blackbox test on a web application for training purposes. It's a personal project.

In addition to my manual testing process, I used an automated scanner for detecting obvious vulnerabilities. While this tool only found some basic issues, it also detected a potential SQLi vulnerability which I did not notice before. I am able to reproduce the error using Burp, but I am still not able to extract database data manually. Because of that, I gave sqlmap a shot.

Before I come to my actual question, let me give you some details:

The vulnerability seems to exist in a login form. When the following sequence is POSTed to the form

password=letmein&username=1%c0%00xa7%c0%a2

a mysql error is returned:

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given

I have narrowed the sequence down to the byte %c0. This urlencoded value leads to the warning. So far, I am not sure why exactly this value leads to the warning.

The sqlmap setup looks like this:

 sqlmap -u http://thehost/include/login.php --method POST --data "password=letmein&username=1%c0%00xa7%c0%a2" -p "username" --dbms=mysql

Which generates requests/payloads in the following form:

 [PAYLOAD] 1%c0%00xa7%c0%a2)).("(,)'(
 [TRAFFIC OUT] HTTP request [#3]:
 POST /include/login.php HTTP/1.1
 Host: thehost
 Content-type: application/x-www-form-urlencoded; charset=utf-8
 Accept: */*
 Content-length: 70
 Connection: close

What I would like to do/try is change the injection point within the POST data. Is this possible? I know it is possible to specify an injection point within a GET request. Additionally, does anybody have an idea why the injected %c0 byte messes up the query?

thanks

SQLmap works in a heuristic way, firstly it learns about difference about good and bad response from the application, then you have to introduce a real value for username parameter to get a good response, SQLmap will analyze the responses after that it will inject sql commands to detect a possible SQL Injection. Your SQLmap command must be something like this:

sqlmap -u http://thehost/include/login.php --data "password=letmein&username=this_is_a_real_username" -p "username" --dbms=mysql

The option --method POST is not neccesary, SQLmap knows it's a request POST when you use the option --data.

I hope this information helps you.

Good Luck.


Can I blindly trust 127.0.0.1? On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:servicePort).

I have one server which is responsible for authenticating the user and generating access tokens. Basically it stores a 'auth token' cookie in the client browser which is shared to the other server (same subdomain). (let's call it the authenticator)

My other server should serve its service based on that refresh token. (let's call it the service)

What I imagined was to have that service connecting the authenticator with a simple TCP socket. The service would send the user's 'auth token' to the authenticator and it will respond 'yeah okay, this user is myUserName, it has permission to use your service').

Question 1: Is the simple fact that I (as the service) am connecting to 127.0.0.1 (the authenticator) enough to trust whatever its answer may be?

Question 2: Is there a simpler/safer method that TCP to communicate between the authenticator and the service? (they will stay on the same system, and should be different executables)

Communicating through 127.0.0.1 can be thought of as just another IPC mechanism, but one that re-uses existing protocols. Just like shared memory or UNIX domain sockets or pipes, it's one of countless ways that two processes can communicate on a single system. If you trust that the processes on your system have not been compromised, then you can "blindly" trust connections going through 127.0.0.1.


Is the certificate I receive back from the CA supposed to be private? I'm attempting to install a certificate on a web server. I understand there is nothing secretive about the CSR. Obviously, I wouldn't want to reveal the private key I used to generate the CSR.

How about the certificate I receive back from the CA? As far as I can tell that's the same certificate that I will provide to the end user, correct?

I guess I'm a little confused because I've received certificates with public/private keys that I've installed within Windows so I can do SSO, VPNs, etc...

The certificate you receive back from the certificate authority is the public certificate. You can consider it as public, and it will eventually be be published by the certificate authority in certificate transparency logs.

Moreover, if anyone had access to it, including your certificate authority, you must consider it as public.


What is the best option for setting up a several sites supporting SSL on the same IP? If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?

From what I've seen "Server Name Indication" is the main way to achieve this at the moment.

One of the downsides is that older browsers won't support this so depending on the site it may not be a possibility for it to be used.

Edit: Just to update following @D.W.'s and @Piskvor's comments looks like there's a list of supported and unsupported browsers on the linked Wikipedia page now.

All popular browsers support SNI, including all versions of Internet Explorer on Windows Vista and later. Internet Explorer 6, 7, and 8 on Windows XP were the main browsers that did not support SNI, but they no longer receive security updates since April 2014.


Help choosing the right virtualization for a CTF I am a High School cyber computer science teacher who also teaches
  courses on cyber security. I have been looking around for some good
  'beginner' CTFs that I could organize for my students, but many
  require outside knowledge beyond what they know early on. So I am
  actually wanting to build my own. However, I had two questions: one
  about choosing the best virtualization, and the second is about the
  hardware needed to run the event

For the above mentioned CTF I want to simulate a 'company network' where students will be given clues about getting into: a web server, an internal file server, and then three different employee machines. I figured that everything will be simple linux distros (like Ubuntu) and the students will SSH into each machine and only work from the terminal. (Like a mixture of Over The Wire's Bandit Labs plus the style/feel/clues of the game Hacknet)

For the actual hardware, I figured that I could implement virtualization on a single server to make things easier. My question is, what is the best free/open source hypervisor that would meet my needs in virtualizing these 5 different low-resource machines? Another factor is that there could be a total of 60-70 students who are attending the CTF.

What kind of specs on the server/network will I need to be running in order to support that many SSH connections? Ideally students would be accessing the virtualized servers via a wireless router/access point. Will a simple 'off the shelf' WAP do? Or will I need something commercial?

I am comfortable very with Linux, and new (but not totally ignorant) to virtualization. I work with host/gust virtualization often, but have never built anything to this scale before and am a little lost as to where to start. My Hope is that I could post this on GitHub once I am done and share it as a public CTF.

Thanks in advance!

The two top Linux based solutions in my opinion are Xen and KVM. Both offer is slightly different means to a final virtual solution.

If, however, you are looking for an easy, free solution that will VM Linux servers, I'd consider a Windows based "VirtualBox"  solution.  It comes Innately GUI based and offers a simple VM infrastructure without all of the bells and whistles of an expensive VMware setup.


does SSH key-based authentication work strictly in one direction? Is it correct to think that SSH key-based authentication works in one direction only? I mean user can authenticate only from machine which stores the private key to the machine which holds the public key in authorized_keys file. In addition, only the public key can be used in authorized_keys file.

Yes. You can't authenticate using public key. By definition.

From mathematical point of view, you can derive public key from the private one, so doing this the other way round would not give any security or anything what you can expect from "authentication".


Is it possible to force client use TCP instead UDP for DNS queries? Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?

You should read A Question of DNS Protocols by Geoff Huston, which is an actual investigation into this idea, with statistics and everything:

  If the DNS represents such a significant vulnerability for the
  Internet through these UDP-based reflection attacks, then does TCP
  represent a potential mitigation? Could we realistically contemplate
  moving away from the ubiquitous use of ENDS0 to support large DNS
  responses in UDP, and instead use DNS name servers that limit the
  maximal size of their UDP responses, and turn to TCP for larger
  responses?

I think the key points from that paper which address your question are:

If your server responds with partial UDP responses with the 'truncated' bit set, that will force clients to try TCP instead
Not all clients will be able to do so; 2% of clients and 17% of resolvers don't switch up to TCP (...as of 2013)

Personally, I think you'd be violating the spirit of RFC 1123:

  DNS resolvers and recursive servers MUST support UDP, and SHOULD
  support TCP, for sending (non-zone-transfer) queries.

I'm not sure faking UDP just to switch people up to TCP counts as supporting UDP.  That being said, there's always a gap between RFC and reality...


XSS vulnerability on chat I recently became the security administrator of a website. I'm not a security master, but I took it as a chance to actually understand how security works nowadays.

The website has a chat function, and I was wondering "Is this chat vulnerable to XSS?" So I tried to see which characters are escaped because since the chat is a prefab, nobody can tell me how it works. I found that the <> are escaped, however I can use the command:  [img]www.anywbsite.com/image.jpg[/img] and it will show a preview of the image on the chat.

This way it seems pretty safe, the problem is that I can put any url at all, even urls that do not exist, as long as it has a "www" and a ".com" at the end it will run the command.

I was wondering, is there any way I can form a url into a script? or something like that.

XSS

If the chat is vulnerable to XSS or not depends on what exactly the chat software does with the string you put in the [img] tag. Presumably it put it in the src attribute of an img HTML tag. As far as I know full control of the src attribute does not give you the ability to execute scripts, but there might still be some things you could try:

If the URL is not propertly filtered or encoded, try something like www.doesnotexist.com" onerror="alert('XSS');" .com.
If the URL is not quoted, you might be able to get around a filter by just not using any quotes.
If the image is wrapped in an a tag to make it clickable, so the URL ends up in a href attribute as well, you could try javascript:alert('XSS');. No image will be loaded, but if the reciever clicks on it the script will be executed. (Edit: I just noticed the www.*.com requierment. I don't think you could make this point work under that rule.)

There are probably more things you can try as well. Inspect the output HTML of the chat, and try different inputs to try to figure out what is going on behind the curtains.

Other issues

I will only briefly mention these, since your question is about XSS:

Privacy. This could be used to get the IP of the person you are chatting with. (Just send them an URL to an image on a server you control, then check the logs.)
CSRF. See Rápli András' answer. Not sure I would care about this though, since it is not an issue with your chat.
Password theaft. Send a URL for an image protected by basic auth, and the reciever will get a password pop up. It can be used to fool people into entering their credentials for the chat.


A website had a breach and isn't telling customers. What can I do? A website recently had a bug where users could effortlessly inadvertently access and operate other users accounts - payment information and all.

This website has an official community forum where they are responding to some inquiries with a copy-paste admitting it and that they are working on it. However, few users use this community forum; there have been no official announcements on this forum about it.

The company has not made any announcement on their website, they have not sent out an email notification, and there has been no official word anywhere. The website is large and housed in the USA, but operates internationally.

I feel that this is serious and their customers need to know their data was exposed.

What can I do?

Because they know about it and are open, when asked, about the problem, it is possible that there is nothing more they are required to do. Various jurisdictions require breach notification, but which jurisdiction applies to this company is beyond the scope of this site.

So, you can check to see if they need to report, and prompt them to do so or to report them to the relevant authority. Or you might find that there is no defined avenue for you to push the company to act.

As always, you could see if a journalist might be interested, but then you're scrambling for someone to take an interest in the problem.


Does "Armoring" an encrypted string always produce the same length output if plaintext was same length? I plan on encrypting numerous plain text strings which all have the same initial length. I plan on encrypting with AES-128 bit key using GPG. I plan on "armoring" the output into alphanumeric characters. The plain text will likely be less than or equal to 128 bits (will be a fixed number once it's set)

My use case is very sensitive to the number of characters which are created, and having the encrypted data always be the same length (or knowing the upper bound) is required.

Is it expected that all of my outputs will be the same length? Is there some way to know the maximum length, or force the output to always be the same length?

ASCII armoring produces the same length output for the same length input, where the input for ASCII armoring is the encrypted text. But, the encryption you do before the armoring does not necessarily produce the same length output for the same length input since symmetric encryption in GPG also involves compression.

Thus, the length of the encrypted data and thus the length of the armored data depends not only on the input length but also how good the input can be compressed. You can switch off compression with --compression-level 0.

But even if you have switched off compression the output length might be different of the input file name is different. Thus, you should read from stdin and write to stdout (i.e. use gpg as pipe) instead of specifying a file name as argument for encryption.