Does Real-time typing view in chats invades privacy? Are there any detection and prevention methods? When a customer talks with a representative of a company in a chat on a web-page, it is possible that they are actually sending every keystroke to their server before you hit the enter or click the send button.

You are bartering over a price and you wrote your first offer and start to evaluate your decision before sending. And, you decided to change your offer, re-write it and send. The real-time typing, however, let the representative see what you wrote before and after the send. This will definitely give an advantage to the representative.

Is this a privacy invasion?
How a customer can detect this real-time typing view exist in a chat window on a browser?
Are there any tools to prevent this?

Is this a privacy invasion?

I don't think that this is about privacy. You are voluntarily enter content into a message box provided by the other party.

  How a customer can detect this real-time typing view exist in a chat window on a browser?

Look at the traffic within the browsers developer console. If it sends data with every keystroke you do it likely transmits all the keys (but could do something else too, so this is not 100%). But that you don't see anything like this does not mean that the edit history is not collected. It could just collect it locally in the browser and then send it within a single request if you submit the message. To be really sure you probably need to have a closer look at the content of all requests exchanged and also at any Websockets communication. In other words: it is likely easy to find out if they do it for sure but harder to make sure that they definitely don't do it.

  Are there any tools to prevent this?

It is unlikely that one can simply prevent it at the clients end since the system is designed and controlled by the other party. If you fear that they might read what you type and delete simply don't type and delete but use an external editor to write and edit first and then cut+paste the final result.


Can TLS fallback work with server side support only? I have patched my server with OpenSSL 1.0.1j for the Poodle vulnerability. Been reading the spec on TLS_FALLBACK_SCSV. From what I can tell in order for TLS fallback prevention to work properly it requires the client to announce it in the client hello, and if not, even if the server supports fallback, it will not be used. What is the expected behavior if only one side, say the server side, only supports it?

That is correct: clients that do not support TLS_FALLBACK_SCSV cannot benefit from the server's implementation. However, understanding the intent of the feature may help put your mind at ease.

There are broadly 2 categories of TLS/SSL implementations: modern and legacy. Modern implementations use recent TLS versions (though they may be locked into older versions like TLS 1.1) and can be updated with support for additional extensions. The code required to add TLS_FALLBACK_SCSV support into a TLS library is vastly smaller and simpler than implementing a new TLS version.

Legacy implementations cannot be updated, but may need to be supported for various practical reasons. TLS_FALLBACK_SCSV allows modern implementations to support legacy protocols without being coerced into using them when both endpoints can support a better protocol.

So communication with a legacy implementation is never protected, presumably because it doesn't support newer TLS versions anyway. Obviously, the safest method would be to disable all but the very latest TLS version, but that would render a large portion of TLS services inaccessible. TLS_FALLBACK_SCSV is a good way (once it is widely-enough adopted) to allow legacy connectivity when necessary, while still preventing modern implementations from being downgraded by a man-in-the-middle who can drop selected packets.

To answer your question directly, the SCSV is sent only by the client. As a pseudo-ciphersuite, it can never be "chosen" by the server, and the server cannot choose a value that the client did not send. So a client that does not support TLS_FALLBACK_SCSV will not send it, even if the handshake is a fallback from a higher version, and the server will not behave any differently. A client that supports the SCSV and experiences a fallback will send it as one of the supported ciphersuite values; a non-conforming server will simply select one of the other ciphersuites that it supports, ignoring the unknown value.

P.S. TLS_FALLBACK_SCSV was previously called TLS_DOWNGRADE_SCSV in an earlier draft RFC, which indicates its purpose in preventing downgrade attacks. I presume that it was renamed to indicate the action that the client is actually taking: falling back to an older protocol version because of a handshake failure.


Differences in certificate verification between ssl libraries I've been playing with x509 certificates to better understand them and I've hit a strange issue which makes me think I have a misunderstanding. Initially I tested everything with libressl 2.8.3 and things work as expected, however when testing against openssl 1.1.1d things fall apart.

First I've created a root key and certificate with

libressl ecparam -out root.pem -name secp384r1 -genkey
libressl req -new -key root.pem -out root.csr
libressl x509 -in root.csr -out root.crt -req -signkey root.pem -days 30

then the intermediate

libressl ecparam -out inter.pem -name secp384r1 -genkey
libressl req -new -key inter.pem -out inter.csr
libressl x509 -in inter.csr -out inter.crt -req -signkey root.pem -days 30

and a leaf

libressl ecparam -out leaf.pem -name secp384r1 -genkey
libressl req -new -key leaf.pem -out leaf.csr
libressl x509 -in leaf.csr -out leaf.crt -req -signkey inter.pem -days 30

The issue I'm hitting is that libressl will verify the intermediate cert while openssl will not

>>> libressl verify -CAfile root.crt inter.crt
inter.crt: C = US, ST = CA, L = SF, O = Inter
error 18 at 0 depth lookup:self signed certificate
OK
>>> openssl verify -CAfile root.crt inter.crt
C = US, ST = CA, L = SF, O = Inter
error 18 at 0 depth lookup: self signed certificate
error inter.crt: verification failed

Am I missing something or is openssl exposing that I have a misunderstanding of x509 certs and libre/openssl? Similarly validating the leaf cert with a bundle of the root and intermediate succeeds with libressl and fails with openssl.

Edit:

Thanks to Mike Ounsworth pointing out the issue. My intermediate cert was being generated as a self signed cert using the

openssl x509 -req -signkey root.pem -days 30 -in inter.csr -out inter.crt

command. Which resulted in a certificate which read

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 14260606495133371304 (0xc5e7da0d280d8ba8)
    Signature Algorithm: ecdsa-with-SHA1
        Issuer: C=US, ST=CA, L=SF, O=Test, OU=Test, CN=Intermediate
        Validity
            Not Before: Jan 21 20:45:34 2020 GMT
            Not After : Feb 20 20:45:34 2020 GMT
        Subject: C=US, ST=CA, L=SF, O=Test, OU=Test, CN=Intermediate

Swapping the command above to

openssl x509 -req -days 30 -in inter.csr -CA root.crt -CAkey root.pem -CAcreateserial -out inter.crt

Resulted in a certificate with the issuer set to root.

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 14926915319265390371 (0xcf270e658d266f23)
    Signature Algorithm: ecdsa-with-SHA1
        Issuer: C=US, ST=CA, L=SF, O=Test, OU=Test, CN=Root
        Validity
            Not Before: Jan 21 20:51:07 2020 GMT
            Not After : Feb 20 20:51:07 2020 GMT
        Subject: C=US, ST=CA, L=SF, O=Test, OU=Test, CN=Intermediate

The intermediate cert now passes verification

However on verification the leaf certificate I get an error with

❯❯❯ libressl verify -verbose -CAfile root.crt -untrusted inter.crt leaf.crt
leaf.crt: C = CA, ST = CA, L = SF, O = Test, OU = Test, CN = Intermediate
error 24 at 1 depth lookup:invalid CA certificate
OK

To Answer my own question. I had to add the CA:true x509v3 extension to my intermediate certificate. This gave me the cert generation line

openssl x509 -req -sha256 -days 30 -in inter.csr -CA root.crt -CAkey root.pem -extfile extensions.txt -out inter.crt

With extensions.txt reading

 basicConstraints=critical,@bs_section

 [bs_section]

 CA=true
 pathlen=1

copied directly from
https://www.openssl.org/docs/manmaster/man5/x509v3_config.html

I'm unclear about what critical means as openssl simply states If critical is present then the extension will be critical. on their man page, but whatever.

Pending more info in the question, I would guess that when you invoke the req command, you are using the same Distinguished Name (DN) for all certs. If so, the error that you're seeing on both openssl and libressl

error 18 at 0 depth lookup:self signed certificate

is because the SubjectDN and IssuerDN are the same, so openssl expects the cert to be self-signed (ie signed with its own key). As suggested by this SO answer.

RFC 5280 (the X.509 spec) says:

  Name chaining is performed by matching the issuer
     distinguished name in one certificate with the subject name in a CA
     certificate.


Isn't this a broken certificate chain? My certificate provider responded to my CSR with four certificates, the first being "ours", and the remaining three presumably to build a chain of trust.

I've never had to investigate (and prove to my provider) a certificate chain at this level, so I'm open to being told I'm not looking at the proper information.

My certificate has

  Issuer: C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network,
  CN=USERTrust RSA Domain Validation Secure Server CA

with

  X509v3 Authority Key Identifier:
        keyid:A6:C1:E7:E1:F4:F6:47:63:D7:2F:7D:8D:90:F8:BA:23:4F:60:AC:9E

What they sent me to build the chain are:

  Subject: C=US, O=Register.com, CN=Register.com CA SSL Services (DV)

  Issuer: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network, OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

  X509v3 Subject Key Identifier:
  96:36:9B:F8:D6:E5:B3:68:4A:70:7A:7A:72:8D:D3:6E:2C:0B:B9:31

  X509v3 Authority Key Identifier:
         keyid:A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

  Subject: C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network,
  OU=http://www.usertrust.com, CN=UTN-USERFirst-Hardware

  Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

  X509v3 Subject Key Identifier:
         A1:72:5F:26:1B:28:98:43:95:5D:07:37:D5:85:96:9D:4B:D2:C3:45

  X509v3 Authority Key Identifier:
         keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

  Subject: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network,
  CN=AddTrust External CA Root

  Issuer: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

  X509v3 Subject Key Identifier:
         AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

  X509v3 Authority Key Identifier:
         keyid:AD:BD:98:7A:34:B4:26:F7:FA:C4:26:54:EF:03:BD:E0:24:CB:54:1A

Since the AKID in my certificate is not an SKID in the chain they provided, my certificate fails to authenticate right away.... right?

Key identifiers are extensions meant to help with certificate path building, but a mismatch does not imply a validation failure (at least as far as X.509 / RFC 5280 is concerned -- what implementations do is another matter).

However, the subject/issuer DN must match in a valid chain, and a mismatch implies immediate rejection. If you have a certificate whose "issuer DN" is "C=US, ST=New Jersey,...", then the immediately preceding certificate in the chain (the certificate for that CA that issued your certificate) must have that exact name in its "subject DN". From what you tell, none of the certificates they sent you fulfils this property.


How to limit the need to type a long master passphrase to only once per login session? I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1.

I'd like to make the master password, or rather, passphrase, to the password-managing application very long2.  In fact, I want to make it much longer than I'd want to have to type every single time I need access to the password database (which is usually several times per login session).

Is there some way to limit the number of times I need to type the long passphrase to just once per login session?

I'm thinking of an "agent" application analogous to ssh-agent, but one that talks to the password-managing application rather than to the ssh client.  IOW, I want to be able to delegate to this agent application the authentication requests from the password-managing app every time I need access to its database (i.e., not only when I'm required to respond to an authentication challenge from some remote sshd).

1I know of two such packages, keepassx and pass; please let me know of any others.

2As I understand it, all password-managing applications require typing a master password to gain access to the password store.  A risk inherent in such a scheme is that, if the master password gets cracked, then the attacker gains a stash of passwords with one blow.  Therefore, it is essential that the master password be as secure as possible, and hence the long passphrase business.

You've limited yourself quite a bit to only KeepassX and pass, but you can keep KeepassX open all day long and set it to not lock.  Then you only need to unlock it when you login, but won't need to unlock it again.  This is essentially what ssh-agent does for ssh keys (keeping credentials in-memory after unlocking once).


Beneficial to rename MySQL root user? Title sums it up. I'm setting up a dedicated server as opposed to using shared hosting, and am wondering if it's more secure to change the MySQL root username. I've gone for a long and complex password, and I've done my best to secure the server itself using key based SSH and disabling root logins etc. But I'm paranoid since it's totally my responsibility now and I figure that if root is renamed, it makes it harder for a hacker to try and brute force if they don't know the username. Disabling remote access is probably helpful as well, if an option.

I saw this question: https://serverfault.com/questions/148801/when-securing-mysql-is-it-better-to-create-a-user-with-root-like-priviliges-and and the accepted answer was to rename root, but there wasn't much discussion.

What do you do and why?

Anytime you deviate from a standard install, there's a cost: You need to adjust your mind and tools to deal with the deviation. Precious seconds or minutes may be wasted in critical situations because no one else in the world uses fiddledimdunk as their MySQL root user.

Debian and others rename their MySQL user and that works best if you're running an all-Debian platform.

I've seen people fiddle with their .ssh/config for an hour to get chained ssh connctions working between jump-hosts because they moved sshd to a different port.

If you have a tool that lets you manage everything you need to, and you never need to manually log into your MySQL instance, it might be worth it for you, but I very much doubt it.

Instead, use that strong password you talked about and throw your log analysers at MySQL to detect anything odd going on.


Is it OK to store the user's plain-text password in a claim? For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password)
In case the user changes his password or his account is closed etc., I will need to periodically (say every half hour) re-authenticate against the user database, but I obviously don't want to ask the user for his password every half hour.
I'm using ASP.NET core cookie authentication. Is it reasonably secure to store the plain-text password in a claim so that I can get it back when I want to re-authenticate? Of course the claims are signed and encrypted by asp.net and only ever transmitted over a secure channel.
It seems to me that compared to the risk of an attacker intercepting the original login request or interfering with the user's password manager, the additional risk associated with this approach is minimal.
The other approach I considered would be to generate a session Id to use in the claim and then store the mapping of session Id to plain-text password on the server. This would be even worse IMO.

it is NEVER ok to store a plain text password that is not yours. EVER!
the way to go about this is to validate the access you have and if the access check fails. ask the user for there changed password (e.a. re login)
you must assume that all data in any token transmitted between your server and a client is 'public'. use proper once tokens and try to go for a token authentication based approach (auth 2 / saml / etc).
basically treat the passwords of your users as secrets, you only store the salted hashed version. never the original!


Why is EC2 not vulnerable to VENOM? I saw the advisory stating that EC2 instances are not vulnerable to VENOM.

My understanding is that EC2 runs on Xen, and that VENOM affects XEN.

Can anyone explain why EC2 is not vulnerable?  Do they remove the floppy drive emulation? Or did they just patch, so they were vulnerable, but now they are not?

Amazon advisory links to the original XEN advisory on which one can read:

  Systems running only x86 PV guests are not vulnerable.

So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM).

Luckily enough, this vulnerability affects the storage emulation code. So most probable explanation is that this performance tweak actually also avoided VENOM vulnerability.


Arpwatch position in network topology I'm a little bit rusty with MITM attack and its preventions.

Where is the right network position where to install arpwatch? If you place it in the router you can only prevent host2gateway mitm. To prevent intra-netwrok MITM (host to host connection), you should place an instance of arpwatch on each node.

Am I right?

Arpwatch won't prevent MITM attacks but will just monitor ARP activity and concerning MITM, the ARP protocol isn't the only way to do a MITM (eg : ICMP redirect, DNS spoofing, port stealing, DHCP spoofing...).

But if your goal is to detect host to host ARP poisoning attempts of all your network, yes you have to place an instance on each host. But I think the most efficient way to avoid ARP spoofing attacks is to use static ARP entries.


What is hardware security? I guess hardware security refers to the security of it's firmware, but the firmware is just software, so why do we call it hardware security?

If I am wrong, can anyone explain what is hardware security? If there is no code, how could vulnerabilities exist?

Is finding bugs in a router's firmware or in computer's BIOS considered as hardware hack?

Is this Hacker News report about Intel server chips considered as hardware hack? Do those chips have firmware? Which computer hardware parts have firmware and which haven't?

It's not matter of firmware vs. software it is a matter of execution of authorized code. How does it happen? Read about Trustable Execution Environment (TEE). There can be different implementations with using same CPU or not. If you'll read about ARM Trust Zone it will give you top level explanation how CPU supports this mode. Basically security is started from signed boot loader, loading Secure OS, setting memory protection zones. Later under supervision of Secure OS only authorized Trusted Applications will be loaded by Secure OS, and executed in protected zone where Host OS has no access, except communication channels using a shared memory.

Those who want to know more about Trusted Executable Environment, at first I would recommend you read here.

https://www.op-tee.org/category/blog/
start with
https://www.op-tee.org/blog/hkg15-311-op-tee-beginners-porting-review/
another source to read
https://www.arm.com/products/security-on-arm/trustzone

May be I'll add more links later.


Are jailbroken iPhones an enterprise security risk? Background

My company is currently in the process of rolling out support for the iPhone.  As a part of this rollout, they are requiring employees to install an application on their phones that allows IT to push out profiles to the device in order to enforce things such as password locks, backup encryption, etc.  However, the application also uses the location services API to report the device's current approximate location (nearest cell tower) as well as general information about the device.  It reports back to their management console every time the phone connects to a new cell phone tower. The reason for this requirement is they say that otherwise they cannot always ensure that a device is not jailbroken and thereby potentially bypassing their security policies.

Question

Is the threat of users connecting with jailbroken iPhones a legitimate enterprise security concern? Is it worth the privacy implications of the IT department being able to track the approximate location of employee devices?

In terms of the second part of your question about the privacy trade-off, that's very dependent on the organisation in question and their priorities.

Unfortunately a lot of companies would place their security concerns much higher on an agenda than privacy concerns for their employees (unless regulatory requirements dictate otherwise).

On the first part, there's a couple of potential risks from jailbroken iPhones that I'm aware of.

First would be restrictions on applying updates.  There will likely be a delay in being able to apply Apple security updates as the jailbreak won't always be available instantly for that version.

Second would be the concern that the jailbreak or software installed afterwards could compromise the security of the iPhone (eg, the default password on the SSH daemon from jailbroken devices).  There can be an assumption of quality and security control for iOS apps installed from the official Apple store that isn't there for apps from other sources.

Also having a jailbroken device may allow the user to disable security software installed by the company, which I'd guess is another reason that they're not keen on it.


ISPs are now adding unique header identifiers to web traffic. Can this be avoided? If so, how? I'm a security-conscious Verizon user, and it has recently come to light that Verizon is now serving up my web traffic to ad partners while en route. I understand that once my data has left the device, it's impractical to try and control it/protect it, but is there anything I can do to protect my information from this technique, or at least make it worthless to advertisers as far as I am concerned (this may be worth asking as a separate question)?

Solutions I'm interested in can be as far-ranging as rooting my phone to install some kind of packet spoofer extension on a mobile browser (Okay, I said I was security-conscious, not security-adept) to using a VPN to route all my web traffic, but I'm obviously not so much interested in "change ISPs". If it can't be avoided, a brief, high-level explanation that details anything these articles left out on the method would be appreciated.

Pertinent quotes from the articles in case the links go down:

  Verizon Wireless has been subtly altering the web traffic of its
  wireless customers for the past two years, inserting a string of about
  50 letters, numbers, and characters into data flowing between these
  customers and the websites they visit.

  The company [...] calls this a
  Unique Identifier Header, or UIDH. It’s a kind of short-term serial
  number that advertisers can use to identify you on the web, and it’s
  the lynchpin of the company’s internet advertising program. But
  critics say that it’s also a reckless misuse of Verizon’s power as an
  internet service provider—something that could be used as a trump card
  to obviate established privacy tools such as private browsing sessions
  or “do not track” features.

And:

  Verizon's solution is called the PrecisionID. When consumers visit
  certain websites or mobile apps, a request is sent through a Verizon
  network. Precision packages the request, as a hashed, aggregated and
  anonymous unique identifier, and turns it into a lucrative chunk of
  data for advertisers.

  Verizon said it is not using or selling its first-party subscriber
  data, but rather deploying partnerships with third-party data
  providers to target Verizon's massive consumer base.

  It's a cookie alternative for a marketing space vexed by the absence
  of cookies.

UPDATE

While I've heard (but not read for myself) that AT&T has said it will allow opting out, Verizon has waited until just recently to announce that it, too, will allow opting out:

  Verizon says it will soon offer customers a way to opt out from having their smartphone and tablet browsing tracked via a hidden un-killable tracking identifier.

Source

The easiest way to avoid interception/modification of your web traffic is one that you mention in the question which is to use a VPN.  This will encrypt traffic between your device and the VPN endpoint and should prevent your ISP from being able to modify web headers or other aspects of your use.

There are VPN clients for most modern mobile operating systems (e.g. OpenVPN which has clients for android and iOS).

One thing to note though is that is using a VPN you are trusting the VPN provider to an extent so it's worth spending some time looking at VPN providers to find one that you're comfortable with.  In particular I'd be a bit suspicious of providers who are free as there is a question of how they make money from the service if it's not directly from their customers.


Detect spy software on Symbian I would like to check a Nokia N8 for possible software that might send any kind of data without my consent.

Is there a specific tool to achieve this? Are there specific techniques?

I would like to check a Nokia N8 for possible software that might send any kind of data without my consent.

Do you want to prevent the phone from sending data for billing issues or are you interested in protecting confidential information?

  Is there a specific tool to achieve this?

There are software and hardware tools to analyze the content on the phone from the free Symbian OS SDK to Device Seizure v4.5 which starts at $1,795.00 (US). The more sophisticated and specalized the tool the easier it will be to come to a clear conclusion regarding the software and data usage patterns.

  Are there specific techniques?

For billing issues the easiest technique is to monitor your own data usage and compare your recorded data usage to the ussage you are billed for. If the two are not highly similar then there may be a problem. Ask your carrier or retailer about expected background data transfers.

For confidential data the most secure technique is to not put confidential data on the phone. Beyond that it depends on the size of the data and the length you are willing to go to protect your data.


Finding Ip from an ether adress I am using cocoa packet analyser because I am suspecting some intrusion. I find one special packet corresponding to arp protocol with some special ether adress. How could I find the ip related to this (I am a newbie for all these stuffs, so maybe my answer will be quite evident from you)

May be I am wrong, but try to use wireshark

Also I think that this might be useful http://compnetworking.about.com/od/networkprotocolsip/f/convertipmacadd.htm


Fingerprinting Windows Architecture from a file on remote system This is a post following up with this one.

Similar situation as the above post - I'd like to know if there's a way to find out the architecture (x86 or x64) of a windows system from a file on a remote system. This is assuming I can only read files on a remote system and need to deduce from there.
I'd like to know for as many Windows versions as possible, but my specific use case is for Windows XP.

There are several hints, but the most obvious ones would be:

On the current Windows versions the existence of C:\Program Files (x86)\ tells it's a 64-bit system. Any 32-bit version doesn't have it.
You could download C:\Windows\System32\ntoskrnl.exe. On it's version X.Y.Z the X.Y reveals the Windows (NT) version and Z the build. (5.0 for 2000, 5.1 for XP, 5.2 for 2003/XP64, 6.0 for Vista, 6.1 for 7, 6.2 for 8, 6.3 for 8.1 and 10.0 for 10).
Such files as System32\license.rtf, system32\eula.txt or C:\Windows\inf\layout.inf might reveal the license version (Home, Pro etc.)


Can someone explain in layman terms how Spectre and Meltdown expose protected data I'm working on a document about them and I think I understand it general what happens -> by exploiting the CPUs memory caching and speculative execution but I'm a little lost of how protected data is actually exposed.

So if I understand speculative execution correctly in a case of:

if a == true {
    firstFunction()
} else {
    secondFunction()
}

the CPU will call both first and second function and run them before it knows the value of a? Is it storing the actual values within those functions or just their memory locations in its cache? And once a is resolved, does it discard anything it obtained from going down the wrong path?

Thanks

Suppose you're shopping, and you can't remember whether you need cereal, but you think you probably do. So, you send an SMS to your partner to check, but while you're waiting, you go to the cereal aisle and pick some. If it turns out that you don't need it, you'll just put it back.

When computers do something similar, that's "speculative execution".

Now, let's suppose that for privacy reasons, only one customer is allowed in the shop at a time, and then the shelves get restocked by a robot when they're done. So, it shouldn't be possible for the next customer to tell what you bought. But, when you put the cereal back, maybe you bumped the ones next to it, so they're not quite in exactly the same place. The restocking robot doesn't do anything about them, since the shelves are still stocked. But an obsessively keen-eyed shopper coming after you might now be able to tell your preferred cereal brand.


Is there a full-disk-encryption OR file-encryption solution where a trojan can NOT extract the secret key (e.g. from RAM)? Is there a full-disk-encryption OR single-file-encryption solution like an operating system or a combination of devices or services ... that make sure that the master-decryption-key can NOT be extracted or stolen by a trojan horse.

So basically a system where sensitive files are added, edited, stored and displayed ... but in case of a trojan infection still keeping the secret-key secure to prevent the decryption of all documents?

It is possible to have an encryption scheme where all the cryptographic routine run on a smartcard. The smartcard contains the encryption and decryption key and the cryptographic operations are run on the smart card, rather than the main OS.

All that the main OS are able to do is send commands to the smartcard and receive encrypted or decrypted data, but it never hold the keys itself. This is rarely used in practice for full disk encryption because of poor performance (all data to be read/written must pass through the smartcard interface twice). For file encryption, many OpenPGP smartcard have this functionality.

The reason this is rarely used is because it's of limited advantage. If an attacker gains full administrative access to the system, the attacker can still encrypt or decrypt anything, even without knowing the private key. In most cases, it's the data that you want to protect, not the key itself; so an attacker being able to encrypt/decrypt arbitrary data is just as bad as leakage of the keys.


False Positive of Cleartext Submission in (CWE-319) in Burp? In a recent execution of a spider, Burp reported cleartext submission of a password CWE-319, but the evidence in the report is merely the preceding GET request of a non-existant page, redirected via HTTPS to a login page containing the form, which contains a password type field.

The form itself has no "action" attribute and its submission is handled by a javascript which submits form content via HTTPS. Burp is erroneously assigning the url of the redirect (as HTTP no-less) containing the form to the form action (per the report, anyway.) I have no record of any form submission in my logs. Is this a false positive, or am I misinformed?

If it is a false-positive, why does Burp identify it as such. On the other hand, if its accurate, what am I missing?

False positives are quite possible, and it sounds like that is probably the case here.  However, I would like to point out one potential gotcha to take into consideration.  Consider this form, pretending that javascript takes over the form submission and sends data securely:

<form onsubmit="secure_submit()">
    <input type="text" name="username">
    <input type="submit">
</form>

(just ignore the fact that inline event handlers aren't actually a good choice - that's just for the sake of the example).  The page is served over HTTP but of course the secure_submit function sends your data over https, so you're good to go, right?

Well, not quite.  What if the user has noscript enabled, or a javascript bug on the page causes the javascript to break?  There is no action attribute, but that actually won't stop the form from submitting anyway.  Without an action it will simply submit to the page that hosted it, which in this case was served over http.  Further, as long as your inputs have names attached to them, the browser will helpfully include all form input in the submission.  Moreover, since I haven't specified the method to use, the browser will send a GET request and whatever I put inside the input fields will end up in URL parameters, therefore ending up in the logs of who-knows-how-many servers in between my computer and the application.

Which is just the long way of saying: even with the details you mentioned, a form served over an HTTP connection can still result in credentials being sent in the clear.  To completely avoid the risk of that you would have to do one (or more) of the following things:

Serve the page over HTTPS
Specify an action
Remove the name from the input elements (the browser will no longer include them in the form data)

As for whether or not this is a false positive, it is quite possible, but I'm having a hard time coming up with a comprehensive answer based on your description.  Hopefully though the above discussion will help you figure that out yourself.


Can browser cookies be "physically" stolen? Can someone with physical access to a target computer steal the web browser cookies in that and setup a rogue authenticated session later?

Yes, but the exact implications depend on the authentication techniques used by the website which set the cookies. For example, some websites may have particularly short expiry times for their cookies, or the website may do extra checks (for example IP address or browser user agent) before allowing authentication to continue. In general, session hijacking requires a few things:

The cookies must not have naturally reached their expiration date.
The cookies alone must be sufficient to authenticate the session (no TLS certs, etc).
The user must not have logged out (which would invalidate the cookies).

Some particularly badly-designed sites will not invalidate the cookies server-side when the user logs out or when the cookies reach their expiration date. These websites rely entirely on the browser, and are very easy to hijack once you have the cookies themselves. A well-designed website will keep track of the validity of the cookies independently of the expiration date set in the cookie, and should immediately refuse to accept any authentication cookies after the user logs out.


The point of PCI 1.3.1 through 1.3.3 In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.

I have four DMZs at my current job (using a sidearm setup), and this is smaller than my past implementations. These are always built in a top down security approach - a higher security box always reaches into the DMZ and pulls out the necessary bits of information it needs or pushes the bits which need to be publicly accessible.

I totally get the idea of stopping and analyzing the traffic before it goes on to an internal potentially squishy system. The language in use implies punching holes in the opposite direction. It also implies the use of an analysis engine within the DMZ.

Maybe what I don't get is how the term DMZ is being used. The functions outlined sound much more like what is done with an application level firewall:

Termination of IP connections at the DMZ provides opportunity for inspection and
restriction of source/destination, and/or inspection / blocking of content, thus
preventing unfiltered access between untrusted and trusted environments.

Termination of IP connections both inbound and outbound provides opportunity for
inspection and restriction of source/destination, and/or inspection / blocking of
content, thus preventing unfiltered access between untrusted and trusted
environments. This helps prevent, for example, malicious individuals from sending
data they've obtained from within your network out to an external untrusted server
in an untrusted network.

These descriptions sound exactly like what TMG does out of the box.

Taking this literally, I would have a second TMG box sitting inside the DMZ being provided by my first TMG box.. That just sounds nuts to me. It sounds like the standard was written for an older setup, something like having a PIX blocking all traffic and bouncing everything through a second server running something like ISA / Forefront that sits inside the DMZ.

As far as I can figure there would be no security benefit of having a separate box in the DMZ for this use my configuration, other than if I have an Apache box outside and IIS inside (or visa versa).

Please provide some insight as to how or why terminating these connections in a DMZ instead of within the firewall itself would be beneficial. I'm just not seeing it.

You are referring to the interpretation guide here in your question.  The interpretation guide is meant to give insight into the justification for the requirement as well as some additional guidance if necessary.  You are not evaluated against the Interpretation Guide, so if you see conflicting statements, it is always best to source from the Standard first and foremost.

Requirement (from the Standard)

1.3.1 Implement a DMZ to limit inbound traffic to only system components that
provide authorized publicly accessible services, protocols, and ports.

Testing Procedures:
1.3.1 Verify that a DMZ is implemented to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports.

Guidance statement (from the Interpetation Guide):

1.3.2 Limit inbound Internet traffic to IP addresses within the DMZ.

Termination of IP connections at the DMZ provides opportunity for inspection and restriction of source/destination, and/or inspection / blocking of content, thus preventing unfiltered access between untrusted and trusted environments.

So the standard doesn't say that you need to implement an analysis engine.  It just says in the guidance document that you have the opportunity to analyse.  Application firewalls are handled in section 6.6.


Why do some websites have their hashes on the same area as the download link? Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with.

Some sites may have their hashes on a different domain probably on a different server other than the one the download link is on, like the site for Ubuntu (This may prevent someone from hacking the site and then modifying both the download link and the hash to fool people.), but some sites like Kali Linux have the hashes on the same page as the downloads link.

Isn't this bad? What prevents someone form modifying the hash if they can already modify the download link?

When you hash a file, you do this to validate the integrity of the file. You need to have other security measurements to protect and validate the integrity of the web page, that is not what hashing a file is meant to do.

Although is it safer to have the hash published separately for the exact same reason you stated, which is to protect the hash and the download link from being changed, you should also know that being able to change a web page is a really big security flaw and this is should never be acceptable. There should be logging in place to notice immediately when a web page was changed without you doing it.

If you can replace something on a web page, you can probably replace everything (download link and hash, for example).


Hashed passwords for NTLM authentication I understood that Windows users' password hashes can be exported very easily. Right? So my question is:

If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't it good enough for me for impersonating other users?

For example, when a user tries to log into some web site using NTLM, only the HASH of the password is used for the challenge process. So if I already have this hash (as it is saved locally and can be exported easily), doesn't it mean that I can fake the challenge process? Why do I need to crack the password if the hash can be good enough for me?

You are absolutely correct. This is a very well known problem with NTLM authentication and the resulting attack is known as Pass the Hash. There is in fact a very handy tool called Pass-The-Hash toolkit that makes exploiting this really easy.


Password hashing algorithms suitable for IoT devices? What password hashing algorithms  and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home environment?

I am looking at a range from ultra-low power CPU devices (most embedded devices) to the devices that have processing power equivalent to a basic Raspberry Pi.
This includes the ARM Cortex M3/A8/A9 processors, and low cost chinese SoCs (such as HiSilicon that uses ARM 926).

No password hashing algorithm is suitable for resource-constrained devices. That's because password hashing must be inherently slow. It needs to be slow on the attacker's computer, and yet not unacceptably slow on yours. But if your computer is slow, such as a microcontroller, what takes a few minutes on your computer only takes a fraction of a second on the attacker's computer.

Do not store passwords on an IoT device. A typical IoT device doesn't have a keyboard input anyway, so why would it store a password? If you need to authenticate, use an authentication token which is not meant to be memorized by humans, and thus verifying it can be a simple hash or signature verification, and not a password hash. If you need the user to authenticate with a password, this should happen on a control server which is a full-blown PC (in the cloud or on premises), and the PC generates the authentication token for the IoT device.

When it comes to choosing cryptographic algorithms for constrained devices, don't overthink it. The benefits of fine-tuning nonstandard algorithms tend to be marginal in practice. Use standard algorithms such as:

SHA-256 or SHA-3 for hashing. (That's hashing data for integrity — not hashing passwords, which as I said before you cannot do.) SHA-3 has the best performance when implemented in hardware but the hardware isn't out there yet.
RSA or ECDSA (with P256r1) or EdDSA (with Curve2519) for signature verification. RSA verification is faster than ECDSA/EdDSA verification, but signature generation is a lot slower and RSA requires more RAM and has larger signatures.
AES-CCM or AES-GCM or ChaCha20-Poly1305 for encryption. ChaCha_Poly is faster in software, but Cortex-M systems with hardware acceleration for AES are getting more common.


How to build arbitrary Dockerfile Images Without Compromising Host I'm building a server that will build images directly from Dockerfile:

docker build -t arbitrarydocker .

This docker file will be built on the same server as other client Dockerfiles, which may have secrets. How can I lock down the process that does docker build -t arbitrarydocker . so that it doesn't do things like:

ADD /contents/of/host/secrets ./space/in/hacker/docker/container

The best way I can think is to fork the process and run it with a made up user that has limited directory access to only one folder where its own secrets are kept with limited capabilities. Also wondering if there's a way to totally wipe out memory after dockerfile is built so data is not leaked to next client build.

If the only way to do it securely is to have a dedicated build server per client, then I can do that, but I'd like to avoid it.

All builds are done on Centos.

I'm going to state the obvious here and just say, "don't include /contents/of/host/secrets in your builder VM." Presumably, though, you've got something going on that makes the obvious answer less obviously correct.

So let's circle back to the other obvious bit, and point out that "arbitrary Docker build" is literally "arbitrary code execution", since the Docker build process is imperative (not declarative), and having your dockerfile do things like downloading and executing arbitrary code off the internet is Totally A Thing™ in the Docker build world.

In other words, the whole Docker build process is potentially malicious, so you should be thinking about it in terms of sandboxing attacker-provided code. You need a strong security boundary between the builder's (attacker's) runtime environment, and virtually everything else. You've heard that docker containers aren't a security boundary, but attacker-controlled docker containers don't even pretend to be a security boundary. The builder needs to run in its own VM, and all the access between it and your own systems needs to be mediated by well-defined communication channels; no back-door access.

With that in mind, lets think back again to /contents/of/host/secrets. The docker build runs on the builder VM. The VM is isolated because you don't trust it, and it has no access to secrets which you haven't intentionally shared with the attacker. There's your sensible solution.

For cleanup: Just delete the VM. Restart it again from your "pristine" HD image.

Since the wheel you're inventing has been invented many times before, I'd recommend looking over the existing solutions for ideas about how they solved the problems that you come up against.


how to bypass windows xp firewall with nmap I'm scanning a Windows XP in a virtualized environment. I use all of needed arguments to bypass its firewall but it doesn't answer:

nmap -e eth0 -Pn --data-length 5 --badsum -g 80 -S 192.168.1.103 -f -T1 -D 192.168.1.200,192.168.1.30,192.168.1.45,192.168.1.90 192.168.1.102

This is the response:

all 1000 scanned ports are filtered

Firewall rules allow file and printer sharing plus some other ports. Is there any way to bypass?

The whole point about firewalls is that you cannot bypass them, if you could they wouldn't be doing their job very well.

That being said the scan you have set up is not optimal, you are spoofing your source address for one thing, so you won't be seeing return packets. Even if your packets get through you won't see a response (unless you are using -S with the correct IP address of your interface although that's almost never required). You are also using -D, which is probably useless in your case although I wouldn't expect it to hurt anything. Fragments and bad checksums aren't a bad idea, but what you are really missing is:

Make sure you are scanning the ports you want to reach. Nmap by default doesn't scan all ports, it scans 1-1024 and then anything in the services file. If the ports you want to reach aren't there you will need to specify them using -p. You can also limit the scan to less ports if you have a set list you want to reach, which will save time
If you want to circumvent firewalls you are unlikely to be able to do it in default scan mode, read this section on port scanning techniques


What is cross-site-scripting? Possible Duplicate:
  Can anybody explain XSS to an idiot?

First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different.

On SO one person says

  An XSS vulnerability exists whenever a string from outside your
  application can be interpreted as code.

This sounds similar to a SQL injection but it attacks the web server, not the user?

Another

  Cross Site Scripting basically is a security vulnerability of dynamic
  web pages where an attacker can create a malicious link to inject
  unwanted executable JavaScript into a Web site. The most usual case of
  this vulnerabilities occurs when GET variables are printed or echoed
  without filtering or checking their content.

Again it sounds like someone would mess with the URL to put malicious code into GET passed variables but wouldn't this be like attacking one's self?

This article was at the top of a Google search but it seems to beet around the bush and not define anything. It implies XSS is done usually with JavaScript, is this true?

First I ask is there an aboslute definition?

Is there an absolute definition of anything these days? You will find most definitions for XSS say the same thing in the end. XSS is essentially injecting malicious scripts through un-sanitized user input.

Have a look at these two animations:
XSS Animation 1 and
XSS Animation 2

This sounds similar to a SQL injection but it attacks the web server, not the user?

XSS scripts are generally executed in the clients browser and attacks the user (I'm not saying it cannot be detrimental to the server as well)

Again it sounds like someone would mess with the URL to put malicious code into GET passed variables but wouldn't this be like attacking one's self?

You could share the unsafe URL with others who use the website. Maybe it is as simple as a facebook link that results in the person sending all of their personal information to you.

It implies XSS is done usually with JavaScript, is this true?

Yes. For example: enter this into a sites form,
<script>alert('xss');</script>
. If you see an alert with xss, the site is vulnerable. From there you are limited by your imagination and expertise.

Myspace was a bloodbath in regards to XSS. Look up the Sammy worm. It will surprise you how many people/companies ignore XSS (and security in general). I worked for a company where you could easily write a simple XSS worm that would erase all of the users data (on the website), and subsequently delete all of their contacts data as well, thus eventually deleting everyones data. This involved calling the applications API on behalf of the user within JS.  General rule, never trust user input.


How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)

LivingSocial - 50 Million Users Exposed
Zappos - 24 Million accounts accessed
LinkedIn - Over six million passwords compromised
Evernote - 50 million compromised

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up, and I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

I ask this because I manage a large database with sensitive information (FirstName, Surname, Address and DOB) and wondering how safe this data is, and how it can be made safer.

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements,

Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues.

  I cannot see how changing any session state would effect the application as Unit Tests would have already picked this up

Have a look at OWASP Top Ten again... Poorly implemented session state management have always been a constant source of problems as well...

  I cannot imagine that hackers would easily be able to gain root access to the machines which be locked down with a SSH key.

Again, assumptions. There is a whole bunch of vulnerabilities out there that will allow privilege escalation into root. This is especially true if you are running old, unpatched or misconfigured systems. Have a look at exploit-db and take your pick...


Secure forgot password page: Is a server-stateless implementation viable? This is yet another "How is a forgot my password page done right" question. However, it explicitly addresses two implementation options that I have come across recently.

The common approaches [1,2] that I know are based on a random token that can only be used once and that has a limited validity:

User visits forgot password page
User provides email address (or similar)
If the email is associated with a valid user account

The app generates a random, unique token t. t is of sufficient entropy (say 128 Bit).
The app stores the random token t and the timestamp it was created on alongside the user in the database
The app sends an email containing a password reset link to the users' email address. The link looks something like this: https://foo.bar/resetPassword?token=t

User clicks on the link in the email
The app checks

if there is a token t inside the database for a given user
if yes, checks that it is still valid based on the stored timestamp
if yes, allows the user to access the resetPassword page

The user sets a new password
After that, the app invalidates the token t

You can add a little more security stuff like out of band channels or security questions. But for me, that is the common best practise that I am aware of.

Now consider a different approach. We will loose the single use property. However, the benefit is that the app does not have to keep track of the token states at all.

Instead of generating a random token, we will use an HMAC as follows:

token = HMAC_k(email, timestamp)

k is a secret that the app knows of sufficient entropy. The reset link which is emailed to the user then looks as follows:

https://foo.bar/resetPassword?token=t&email=foo@bar.com&timestamp=1424124534560

When the user accesses the link, the app verifies it as follows:

calculate HMAC based on URL parameters: token_calculated = HMAC_k(email, timestamp)
check if the token provided as URL parameter and the calculated HMAC match
if yes, check if token is still valid based on the timestamp
if yes, allow the user to access the resetPassword page

In my opinion, the property of not having to maintain a server-side state is more valueable than the single use property. This assumes that a reasonable, short validity of tokens is configured at the server-side - say 20 to 30 minutes.

I would really like to know what other people think of the second approach. Especially, if there are any drawbacks that I might have not noticed yet.

[1] https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet

[2] http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html

Your question is well written, and you clearly understand the issues well. There is nothing fundamentally wrong with the crypto token approach you describe. Some things to be aware of:

Most sites these days are database intensive, so storing a password reset token is little additional overhead.
You should throttle the number of password reset emails that can be generated (e.g. max of 2 per 30 mins, for each email address) - which requires writing to the database.
You are reliant on k remaining secret; this could be copied by a malicious administrator (or brute forced, if weak) - while database tokens avoid this single point of failure.
A common (albeit minor) weakness with password reset schemes is the leakage of the token to external sites in the referer header. Having the token be strictly single use can help with this - although you can fix this weakness with crypto tokens as well.

There is a similar choice with generating session cookies - using crypto or the database. In fact, the performance considerations are much more significant for session cookies, as this work is done for every request. Despite the overhead, most sites use database tokens, for the minor security advantages.


What does the bizarre text mean at VirusTotal? I downloaded Bitcoin Core from here: https://bitcoin.org/bin/bitcoin-core-0.20.0/bitcoin-0.20.0-win64-setup.exe
I then uploaded it to VirusTotal: https://www.virustotal.com/gui/file/0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0/detection
On that page, it confusingly says:

0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0
btcgenerator.exe

There is no btcgenerator.exe anywhere inside, and that file name is both very suspicious and seemingly malware. But has nothing to do with the installation file. Why does it show on that page? What does it mean by it? It doesn't have any context except just being there on the page with no comment/label, right underneath the equally confusing: "No engines detected this file"
Moving the mouse cursor over the "btcgenerator.exe" text makes it blue, as if it were a link, but nothing happens if I click on it and there is no kind of "title" or "tooltip" explaining what it means.
I've just about had it with VirusTotal and its endless nonsense, but AFAIK, there is no (real) alternative in existence.

I've just about had it with VirusTotal and its endless nonsense, but AFAIK, there is no (real) alternative in existence.

There is.  You can verify the integrity of the file that you downloaded cryptographically, instead of relying on VirusTotal.
Take the SHA256 hash of the file that you downloaded.  It should be 0f1ea61a9aa9aba383a43bcdb5755b072cfff016b9c6bb0afa772a8685bcf7b0 (it seems that this is what VirusTotal computed, but you might want to verify this to be sure).  If that's the case, then you can rest assured that this is a legitimate file, because this hash appears in https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc, and https://bitcoin.org/bin/bitcoin-core-0.20.0/SHA256SUMS.asc is signed with Bitcoin Core developers' private signing key (which you can verify using pgp and Bitcoin Core developers' public key at https://bitcoin.org/laanwj-releases.asc).  In light of all of the above, it's highly unlikely that this is a malicious file.


Is it safe to transfer Facebook access token via TCP? Is it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?

Depends on what you're trying to do and what kind of TCP connection you're using.

To keep it short, I'll give you some things to consider:

TCP is just another transfer protocol like HTTP. If it's unencrypted, stuff like eavesdropping and worse might happen. But since you're not launching the next version of WikiLeaks, you might just be safe when you transfer that access token unencrypted. Yet, I'm not saying I recommend it!
The Facebook access token itself is pretty safe to transfer if there's no connection to other data. Meaning: no one would know what a random string of characters would be for if you don't transfer data that shows more information next to the access token itself.
The access token is only part of a whole. Just having it won't kill anyone's Facebook account.

As said: TCP is just like FTP, HTTP and all the other protocols. If it's not encrypted, people can fetch and put to use intercepted info more quickly. As a quick answer to your generalized question, this should satisfy.

If you expect an in-deep risk analysis, we (the people trying to help by answering) would need to know a bit more about the "Why TCP and what for". But in the end, you'll end up with an encrypted connection (TCP or other) if you want to be 100% sure that you're SAFELY transmitting Facebook access tokens somewhere else but Facebook. Think of it like your MySQL database... you're not storing passwords unencrypted either, or are you? Same goes for transmitting sensitive data: keep it safe and encrypt what you can because you never know where the next script-kid might be lurking to ruin your day.

Hmmm...

Why do I get the feeling the shortest answer would have been a simple, two-letter "no"?

-

UPDATE

As some comments show that there is a big lack in understanding data security, I'll add a few lines.

Some argued HTTPS does in-stream encryption. It doesn't. HTTPS combines Hypertext Transfer Protocol (HTTP) with SSL/TLS protocol.

HTTPS transmissions might be encrypted, but from a SECURITY point of view, everything can be intercepted - encrypted or not.

Next, some seem to mix up HTTPS with the less used S-HTTP (Secure HTTP). There is a big difference!

look at the question

The question was:

  "Is it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?"

The answer is NO, you need to use secure protocols to avoid eavesdropping/man-in-the-middle attacks.

But let's assume the OP is smart and uses HTTPS as an crypto wrapper. With HTTPS you might avoid eavesdropping/man-in-the-middle attachs, but you can't ignore that a Chosen-ciphertext attack will still be successful! For a first read about this, check "LIMITATIONS of HTTPS" at http://en.wikipedia.org/wiki/HTTP_Secure and "CSS" attacks at http://en.wikipedia.org/wiki/Chosen-ciphertext_attack.

As the OP asked about "worst case", the answer is: "interception of the key, optional decryption of the intercepted data when a security layer like HTTPS is used and in the end it might lead to the abuse of the token".

Now, if the question would have been "how likely is it that this will happen", I would have answered: "pretty much unlikely, but that doesn't mean it can't happen".

But if you check the question again, you'll discover that that was not part of the question. So I won't go into statistics and probability calculations here. Besides, we're missing major parts of the "how and why" of the transmission, so no one can honestly give a definitive answer regarding the probability. That would be unprofessional, to say the least.

other forms of attacks

No matter how you do it - in the end, everything is unsecure and unbreakable crypto has yet to be invented.

Depending on the country, there can and will be a whole range of additional security problems involved... and I'm not talking about China! See how Tunesia kicked FaceBook security with something that's so simple, it should run shivers down your spine: http://www.cpj.org/internet/2011/01/tunisia-invades-censors-facebook-other-accounts.php

look at the question AGAIN

Don't take security questions lightly. You might comment against my answer and vote it down, but that won't make transmitting a Facebook token via TCP any safer!

Especially, as the OP does not indicate he is using any kind of security layer, we have to interpret it as if the FaceBook token is transmitted from IP "a" to IP "b" in an unsecure way!

A regular transmission of data using TCP is unsecure by definition for several reasons, of which I have merely scratched the surface of some.

I can only repeat: don't take security questions lightly.


Intrusion prevention in windows azure? When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can monitor traffic for security?

What are people doing now?

Thanks in advance.

There are a number of layers at which IDS/IPS can come into play when dealing with Azure IaaS.

First, without doing anything at all, you already have IDS/IPS in place, because it's a standard piece of the Azure network security infrastructure.  Every packet that enters their networks is going to be subject to inspection by the systems that are already in place. This, however, is just a baseline.  They're not going to be able to do a lot with traffic that is encrypted, for instance, as much of your traffic likely is until it gets to your machines, and they can't be too aggressive so they don't drop legitimate traffic.

So, if you want additional IDS/IPS beyond what they provide, you have a couple of additional options within your environment.  The first would be a network-based IDS/IPS appliance.  Given that Azure is a cloud, and you can't deploy actual hardware, this would need to be a virtual appliance, of course, but those are supported in Azure, you'll just need to look for vendors whose appliances are compatible with Azure.

The last, and least complicated option is host-based IDS/IPS.  This is going to work the same on VMs in Azure as it would on any other machine.   HIPS is software that you install on a machine that you want to protect that will inspect and deal with malicious traffic coming to that machine alone.  There are a number of HIDS/HIPS offerings available and they should generally work as well in Azure as the do outside of Azure.


Received a mail that my password for an app has been reset. Does this mean my GMail is compromised? Today morning I received a very troubling message in my inbox. I saw that there was a message that my account password for ZoHo has been successfully reset.

I don't remember making any such request that I had forgotten my password to the site, also there is no history of any mail that password reset link was sent to my registered email address.

I haven't used ZoHo in a long time and I went to check that what their password reset policy is via mail and I did manage to reset my password successfully through my mail.

Now this means only one thing, that someone had access to my email(Gmail) account.

Does this mean my account has been compromised? I use Gmail on my Windows desktop and my Android Phone. I also have 2FA enabled.

What can I do to find out if my email has been compromised and what can I do to protect against it?

Now this means only one thing, that someone had access to my email(Gmail) account.

I disagree with this statement. You are jumping to conclusions. I'd like to point out other possibilities.

They are taking pre-emptive actions to reset passwords. For example, if they know they have been breached, or they decided to look into the massive database of leaked password that has been circulating since December to see which of their user was affected.

For example in December Wordpress.com did that. They sent out emails with the title "Your Wordpress.com password has been reset". But they started their email with: "We recently discovered your login credentials in a list of compromised emails and passwords published by a group of security researchers.", and explained the situation.

Someone might have managed to convince Zoho to reset your password, pretending to be you and having lost access to your email account. In this case they could have bypassed the sending of the first email step altogether. Your Gmail account would not need to be compromised. This is highly speculative - someone would need a real good reason to go through all that trouble - but nevertheless a possibility.
It can be a mistake! A support tech miss-clicked and reset the wrong account's password. A developer wrote a buggy piece of code that found its way to production. Things like that happen...

Read carefully the content of the email, does it mention anything about why the password has been reset? Are you sure it comes from Zoho? Then contact them and ask what's going on.


Does my host machine stay completely safe if I'm browsing the dark web using virtual box or vmware on bridge network connection? I'm just asking if my host machine stays safe when browsing the dark web darknet using Tor on a virtual machine with bridge connection through the host machine ? Since the virtual machine will be using the same RAM with host machine, can a virus inside the VMware RAM affect the host machine? Like send the IP address of the host machine, open a port, open a backdoor etc? Will there be a difference in terms of the security to the host machine if it is either Linux or Windows ?

There have been attacks hosts with non-ECC ram through their virtual machine. The attackers were able to pass commands to the host computer by manipulating the VM memory.

http://www.darkreading.com/risk/hacking-tool-lets-a-vm-break-out-and-attack-its-host/d/d-id/1131254?

The same security rules that apply to your host, apply to your VM. Use VPNs and the like to help mask your public IP.


Why is whatsapp Inc. still caching user data even after introducing the end to end encryption? Last week Whatsapp introduced the end to end encryption to prevent man in the middle intercept/attack. The company claims that the data such as text, call, video, images and documents are stored nowhere in their server, only the concerned devices will be able to store or decrypt the data. But still the "Quick Image/Video upload" is working fine. The basic idea behind "Quick Image/Video upload" is to cache a copy of the uploaded images/videos in the server and when another user tries to upload the same content then the hashes are compared. If the hash matches then the server copy is used to avoid data usage. If the claim made by Whatsapp Inc. (regarding the end to end encryption without any server cache) is true then how is the "Quick Image/Video upload" still working?

Update

Thank you @TreyBlalock for sharing whatsapp security whitepaper: https://www.whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf

  Transmitting Media and Other Attachments:

  Large attachments of any type (video, audio, images, or files) are also end-to-end encrypted:

  The WhatsApp user sending a message (“sender”) generates an ephemeral 32 byte AES256 key, and an ephemeral 32 byte HMACSHA256 key.
  The sender encrypts the attachment with the AES256 key in CBC mode with a random IV, then appends a MAC of the ciphertext using HMAC-SHA256.
  The sender uploads the encrypted attachment to a blob store.
  The sender transmits a normal encrypted message to the recipient that contains the encryption key, the HMAC key, a SHA256 hash of the encrypted blob, and a pointer to the blob in the blob store.
  The recipient decrypts the message, retrieves the encrypted blob from the blob store, verifies the SHA256 hash of it, verifies the MAC, and decrypts the plaintext.

Pointer number 3 is interesting here. So basically they are caching the attachments in their blob, that means they are of course storing the encrypted data in a device which isn't a communicating device.

  Now the million dollar question: "Is your data safe? Is it out of
  reach from the authorities or the hackers?"

All speculation wether what's app really uses e2e whenever possible (or if it's turned off with a kill switch whenever they like) aside:

If what the white paper describes is true, your data is fine in the blob, as it's encrypted reasonably well.

The only thing that would no longer work is data deduplication, e.g.

  If a file with that hash is already present, do not upload it, signal the user success.

This creates a heavier load on the servers - and possibly phone data plans for people copying Videos instead of sending links.

Note that if you were to upload a file a second time, your device might cache the file and the corresponding keys and send a reference to the same blob-object, sharing the same keys as before, to multiple other users.

This would somehow at least lower the amount of data that has to go on the server for a single person sending the same file to multiple people.


Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any implementation of either RADIUS or TACACS+ that does not use the MD5 hashing algorithm. Please correct me if I'm wrong.

And MD5 is forbidden in the FIPS 140-2 standard.

However, I found this Cisco doc which mentions something called "RADIUS Keywrap," and it seems to imply that you will be able to use RADIUS if you enable the keywrapping, and you will still be FIPS-compliant.

So... what is RADIUS Keywrapping? Does it mean that the MD5 algorithm is no longer used at all? Or is it that FIPS compliance can still be maintained if you "wrap" an insecure algorithm inside of a secure one?

Edit: Found in the doc that mfinni linked:

  RADIUS Keywrap

  RADIUS keywrap support is an extension of the RADIUS protocol. It
  provides a FIPS-certifiable means for the Cisco Access Control Server
  (ACS) to authenticate RADIUS messages and distribute session keys.

  RADIUS keywrap increases RADIUS protocol security by using the
  Advanced Encryption Standard (AES) keywrap algorithm to transfer keys
  while an HMAC-SHA1 algorithm is used to protect packet integrity. It
  specifies that the key encryption key (KEK) and the hash key must be
  different from each other, should not be based on a password, and must
  be cryptographically independent of the RADIUS shared secret used in
  calculating the response authenticator.

OK... that answers that.

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?
RADIUS:
Microsoft has FIPS-certified crypto modules for their recent operating systems (search for "Microsoft").
Enabling FIPS mode via Group Policy will force use of that crypto module.  However, as one answer pointed out, most RADIUS protocols are not allowable under FIPS.  PAP, CHAP, MS-CHAP, MS-CHAPv2 all use no/limited encryption or some form of MD hash (not allowed under FIPS).  There are some protocols that use FIPS-level encryption: EAP methods (PEAP, EAP-TLS).
TACACS+:
Cisco has taken their AAA servers through FIPS.  However, from the doc linked in one of the answers, it is only for 802.11i (wireless security using RADIUS), not for the TACACS+ piece.
One issue with TACACS+ (which is hard to find) is that it apparently uses MD5 to protect TACACS+ traffic.  Search "TACACS+ MD5" and you should come up with a SANS Institute document that makes this statement.  Cisco does not say on its website what TACACS+ uses for encryption.
Bottom line: TACACS+ in FIPS mode?  No, unless someone can show that the TACACS+ traffic is using 3DES or higher encryption.  RADIUS in FIPS mode? Yes, as long as you are using an EAP-method.


I want to be web security consultant? If I want to be very good at security and especially web security, then must I learn languages? I mean things like PHP, C#, java, etc? If not then what should I learn exactly? and do you know any good book for a beginner?

Security is a complex topic. It involves being able to understand complex systems, work with people, and solve problems with technical, social, and business solutions.

For books, I liked "CISSP All-in-One Exam Guide" by by Shon Harris. It covers the basic theory of security and many sub topics. A great history of IT Security theory can be gleaned by reading Early Computer Security Papers.

I would prefer security experts to know a broad range of relevent topics, because failure to understand a relevent domain can lead to subtle vulnerabilities. However, I was taken to task by Graham Lee, who pointed out diminishing relevance in my list of topics.

First off the three essential components of security are availability, integrity, and confidentiality. Others would add in authenticity and non-repudiation, but I would focus on the first three for someone who is just getting started.

Web security covers all the components, actors, and processes involved in web applications. The major components are the web server, the web browser, and the network connecting web browsers to web servers. The major actors are the web browser user, the web site administrator, the network administrator, and the web application creator. Note that there are typically many people filling a specific role, and there are many more roles.

I'm trying to keep specifics short, so I won't include everything. Specifics are as of this posting (mid-2011).

Web browsers

the web browser application: popularity, features, vulnerrabilities, etc

Specifics: Internet Explorer, Firefox, Chrome

user's operating system (what the browse application runs on)

Specifics: Windows XP, Windows Vista, Windows 7, Ubuntu Linux, Mint Linux, Fedora Linux

browser layout engines

Specifics: Trident (Internet Explorer), Gecko (Firefox), WebKit (Chrome)

Javascript engines

Specifics: V8 JavaScript engine (Chrome), TraceMonkey (Firefox), Chakra (Internet Explorer 9), Jscript (Internet Explorer 8)

Java virtual machines
Operating system theory: execution environment, process control, memory management, filesystems, IPC
user's network stack: IPv4, IPv6, TCP, UDP, ARP, RARP, DNS, HTTP, HTTPS, FTP, WebDAV
user's network connection: ethernet (IEE 802.3), WiFi (IEE 802.11),
cryptography: symetric key cryptography, public key cryptography, certificates, certificate revocation lists, Certificate Authorities, and hashing.

miscellaneous: black lists, white lists, sandboxing, downloading, password management, caching, and updating.

Network

network hardware: router, switch, bridge, hub, firewall, proxy, Network Attacked Storage (NAS), Wireless Access Point, SIP servers, VPN servers
network protocols: ethernet (IEE 802.3), TCP, UDP, IPv4, IPv6, IPSec, IGMP, WiFi, ARP/RARP, ICMP, IGMP, BGP, RIP, SNMP, SMB, DNS, DHCP, FTP, HTTP, LDAP, MIME, NetBIOS, POP3, RADIUS, SSH, SIP, SMTP, SOAP, WebDAV)
network configuration and architecture

Web server

http servers

Specifics: Apache, Microsoft IIS Windows Web Server, nginx, Google Web Server, lighttpd

operating systems (what the http server runs on)

Specifics: Windows Server 2008, Windows Server 2003, Windows XP Professional, RedHat/CentOS, Ubuntu/Debian, SuSE/openSuSE

programming languages (used to write http servers, operating system, frameworks, etc)

Specifics: C (Apache), C++ (IIS), Java, JavaScript, PHP, C#, Python, Perl

business impacts (usability, updates, changes, software life cycle, user avoidance and circumvention, user education)
databases (relational, objet oriented, architecture, distributed, transactional, SQL, management, security)

Specifics: MySQL, Oracle, Microsoft SQL, PostgreSQL

cryptography (symetric encryption, public key encryption, hashing, random number generation, salts, digital signatures, HMAC, AES modes of operation, initialization vectors, key generation, key distribution, key revocation, certificates)
network (firewall rules, DMZ architecture, proxys, load balancing, Single Sign-On authentication passing)
server management (user accounts, patches, upgrades, logging, log review, Intrusion Detection Systems [IDS])

Communication

In my opinion a good consultant (of any kind) is an effective communicator.

Technical design presentations and reviews
Solution pitches
Business case reviews
Whitepapers
User education presentations

Other nice to have areas:

computer hardware architecture (CPU, RAM, Disk drives, video displays)
peripheral busses (USB, FireWire, RS-232, I^2C, PCI, SATA, SCSI, Bluetooth)
CPU architecture (operating states [protected mode], I/O bus, registers, MMU, TLB, pipelines, and interrupts)
operating systems theory (kernel types [Monolithic, Microkernel], drivers, memory management, file systems, process control, threads, scheduling)
programming language theory (interpreters, compilers, machine language, symbol tables, dynamic libraries, dynamic linking)
executable file formats (ELF, PE, COFF, a.out)
database theory (relational, objet oriented, architecture, distributed, transactional, SQL, management, security)
file systems (fat32, NTFS, ext2, ext3, linux swap)


Restrict request to Android and Iphone App only? I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?

HMAC is a cryptographic concept for assuring the integrity and source (authentication) of information.  This isn't really applicable for what you are trying to do.

Really, there's no way to ensure a request is coming from a specific platform, this is because the host receives this information from the client.  A client can send whatever information it wants by manipulating (spoofing) the HTTP Headers, specifically the User-Agent field.

Bottom line, you can not trust user (client) supplied information.


asp.net+bearer token: Tampering of claims possible? I am experimenting with an OAuth2 authentication in an asp.net web-service.

When accidentally generating a huge amount of claims I've discovered that the bearer token increases drastically in size. That leads me to the assumption that the claims and possible other authorization related information will get stored in the bearer token.

(Previously I was under the impression that the bearer token is just another type of session-ID and the claims/roles where stored server-side)

My assumptions:

The identity claims are stored in the bearer token and thereby accessible by the client.
I feel encouraged by the developer guidelines (MSDN, StackOverFlow) to store identity related informations in the claims (e.g. "ClientID"=xxxx, "CanViewSensitiveData"=true, etc.). I considered it "state of the art".

The combination of the two points seem to be not right. To send/receive authentication/authorization sensitive data to/from the client would offer a possibility of a rogue client tampering with the bearer token and changing the contained claims/roles. Prior, with the usage of the sessionId, that was mitigated by a random generation of the sessionID and the huge entropy.

I am certain that the inventors of this technology/protocol already prevented the tampering of the contained data but I am not sure how. Could somebody shed some light on this matter? Are my assumptions wrong or is there some kind of token signing involved?

Unless you use an insecure homebrew setup of OAuth2, or you explicitly disable token validations; your tokens are cryptographically signed by the issuer.  As written in the RFC:

  The JWT MUST be digitally signed or have a Message Authentication Code (MAC) applied by the issuer.  The authorization server MUST reject JWTs with an invalid signature or MAC.

The downside of putting a lot of claims in your JWT token is that it could be "chopped off" if it exceeds some HTTP Header maximum length.  Apache is 8kB, IIS is 16kB.

So generally, stick to the use of (new) tested libraries and don't disable any token validation calls and you shouldn't have much to worry about.  If an adversary can "impersonate" a token issuer, then that's a different story.


How much are security tools audited? Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual...

Specifically, I'm thinking about Kali Linux (ex-BackTrack).
There are a lot of different (awesome) tools that go into Kali, many of which are open source. Obviously, the people actually developing Kali can't fully audit everything that goes in.

Does anyone?
I know the 'many eyes' argument of open source. I've heard it many, many times. But there doesn't seem to be a great deal of organization.

So, people on here...

What are the well-organized projects for looking through open-source repositories?
Are any of the people on here involved with them?
Do they have enough momentum to realistically outpace people who might try to put malware into root-privilege utilities?

edit: I am aware of this question. Still, the fact that no one's been found to abuse something yet isn't compelling enough evidence it can't be abused. Also aware that packages get reviewed before they get put into the update repositories. Again, I'm curious about how much the developers can realistically review to both be up-to-date and safe.

The following anecdote does not have a general value:

In 1999, I took the source code for PGP (not GnuPG, still in its infancy), version 5.5, and compiled it on my machine (which was an Alpha running NetBSD, i.e. a rather "normal" Unix system). PGP's source code had been available for quite some years, and it was often touted as necessarily secure since it was open source.

Of course, I almost immediately encountered bugs. I looked at the source, and it turned out that:

The code was using the char type as if it was unsigned, and, as such, was completely incapable of correctly processing any character beyond the 7-bit ASCII set. It was so throughout the code.
The source code was several hundreds of source files, in more than 30 sub-directories (and sub-directories thereof).

So I came to the conclusion that despite being a high-profile target, with source code open for inspection for several years (the source code had even been printed as a book to work around the US export regulations of that time), nobody actually bothered to look at it (or those who did, did not possess enough knowledge in C to do it correctly).

The code did not make it easy to be audited; auditing code is already a quite boring endeavour that unpaid amateurs are unlikely to tackle on their own accord. It is much more interesting, for the amateur, to rewrite the whole thing from scratch, which is exactly what occurred (with GnuPG).

While I do not believe, generally speaking, in hordes of unnamed amateur reviewers who audit code simply because it is there, there are projects which gather a bit of review, mostly because of people who want to modify the project to suit their needs. Therefore, malicious alterations of security tools are a risky thing. What you will find in all projects, open source or not, security-related or not, are bugs, some of them being exploitable into behaving to the advantage of third parties (i.e. vulnerabilities).

The plausible way to inject a backdoor in open-source security tools is to make an honest-looking implementation or design error, in particular when dealing with PRNG (there have been some allegations, apparently unfounded, of such a backdoor in OpenBSD; see this answer; the backdoor was not there, but everybody took the thing seriously, because it is plausible).

On a pure theoretical basis, external audit can find out all backdoors exactly as much as it can find out all bugs in the audited code -- i.e. it cannot.


How do I store other people's ssh keys securely? This is not really a programming question, but please hear me out. I am building a deployment tool, So using my application others can deploy their own application to their own servers. (just like forge.laravel.com),

Following are the use cases for this particular question

I need to store each of my user's public ssh keys because I need to insert this key in each of the provisioned servers. so that users can log into their servers via ssh without any manual authorizations.
Also, I need to authorize my applications ssh key (ie: my servers public key) into customers servers so that I can execute commands on my user's server on their behalf.
I need to generate a new key on the newly provisioned customer server and authorize it in github/gitlab of the customer so that when I push/pull from the server I don't need to enter any username or password.

Coming to the question, Where/how do I store these keys (securely)? can I store them in a specific directory in my server? This makes me think that my server can be a big target for hackers since if they are able to hack, it opens doors to a multitude of servers.

What are the steps I can take to make this setup more secure?

Considering use case 2, does it make any difference if I generate separate keys for separate customers?

The only key here that seems reasonably sensitive is the priv/pub key pair that you generate for each server that needs Github access.

The rest of the keys you mentioned are public keys. I'm not saying you should publish them and make them public, but they are public keys and don't need to be stored particularly safely.

Also, since the private key that's generated is being stored on the server only, it's going to be as secure as that lone system. Here you have a few things to consider:

Keep each system as secure as possible.
Make sure that if a single key is compromised, its access is already restricted and easy to revoke.


How to get the output of a SQL injection? This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable.
In the input for the username: I put something like:

username'; SELECT * FROM users;

But how can I get the input of my injection query? I did some research, and found sp_makewebtask in Microsoft SQL server, which can output .html file to a sharing folder. How can I do it in MySQL? Or is there a better way? Thanks very much.

The problem with your approach is that PHP is not going to (Okay, as pointed out below in the comments, it is possible, but it is unlikely) execute more than one simultaneous query and as you are closing off the initial query with a semi-colon, then trying to create a new one at the start of the SELECT. You would have to UNION or UNION ALL them.

  username'; SELECT * FROM users;

Should be similar to:

  username='admin' UNION ALL SELECT CONCAT(username, 0x3A, password) AS details FROM users LIMIT 0,1;

Read this link for MySQL's UNION syntax http://dev.mysql.com/doc/refman/5.0/en/union.html

There are two main types of SQL Injection, they are Blind and Error-based.

Blind is where you will not get any output from the given query, you may just notice a piece of text or image or something else missing from the page, and you have to enumerate through various options to get the desired result.

Error-based is, as the name suggests, where the script will throw an error, and you can see exactly what you need to do. You will see the result of the injection somewhere on the page or in the source code of the page at least.

In all cases, you should be able to use MySQL's INTO OUTFILE syntax to output the query results into a file, assuming you have the right permissions to do so.

http://www.tech-recipes.com/rx/1475/save-mysql-query-results-into-a-text-or-csv-file/

This is for most cases of MySQL injection, however, there are more than two types of SQLi, but for purposes of this conversation, they are the main ones you need to know about.

This is a good tutorial on SQL injections: http://www.exploit-db.com/papers/13045/


Confidentiality and Integrity violation in database security I read some topics on database security. Now I have two questions about confidentiality and integrity violation, Thanks anyone who answers me:

If we consider knowing the availability of data as a type of
confidentiality disclosure, what is the referential integrity
problem in database security?
Can confidentiality violation lead to integrity violation?

1) If we consider knowing the availability of data is a type of
  confidentiality disclosure?

Yes, knowing the availability of data is a type of confidentiality violation. Example is error message revealing whether a username exists  or not in the database.

  2) What is the referential integrity problem in database security?

For database elements to be consistently synchronized, multiple tables which segregates data about a single attribute has to be linked properly. In otherwords, no rogue data set should exist.

Suppose I have an application with two database tables user_credentials & user_activity.

user_credentials has columns user_name and user_passwd.
user_activity has user_name & user_lastlogintime.

Referential integrity is the property by which both the tables have exactly all the same values in user_name field. This ensures consistency in accessing or removing the table elements.

  3) Can confidentiality violation lead to integrity violation?

It is possible. But both has to be considered separately. Consider a scenario where a broken hashing algorithm with a known collission is used. Knowledge about the broken algorithm can be used to bypass the integrity checks. But from an Information security perspective theintegrity violation happens because of the use of a broken algorithm, though it is a result of confidentiality compromise.


Extracting openssl pre-master secret from apache2 I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django.

I have seen this post:
Extract pre-master keys from an OpenSSL application

and I figured out I might be able to use https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslopensslconfcmd

to get apache to output those dh keys, but I can't figure out how to do it.

I know it is possible, because it is done by many security applications and vendors (IPS/IDS systems for example).

Any ideas?

Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export LD_PRELOAD=/path/to/libsslkeylog.so and SSLKEYLOGFILE=/tmp/your.keys.

How to do so is dependent on the application. For systemd you could try systemctl edit apache2 to create an override. If it is still a classic sysvinit init script like Apache, try modifying /etc/init.d/apache2 with the above two environment variables. Don't forget the export keyword. Apache no longer seems to use sysvinit scripts, so you must modify the systemd unit file.

This will result in the master secret being written to the file specified by the SSLKEYLOGFILE environment variable. It is not exactly the premaster secret, but you can use it to enable decryption in Wireshark. For more details about the latter, see also https://wiki.wireshark.org/TLS

Depending on your use case, it might be easier to skip modification of the server and tap keys on the client side instead. Firefox and Chromium have built-in support for the SSLKEYLOGFILE environment variable. Newer versions of curl do support that too, but older versions of curl or other applications using OpenSSL require something like the above sslkeylog.sh approach.

Walkthrough

The sslkeylog.so library is specific to the OpenSSL version. Version 1.0.2 (libssl1.0.2 in Debian Stretch) is not compatible with OpenSSL 1.1.0 (libssl1.1 in Debian Stretch). In order to build the library, you need corresponding development header files. These are available through the libssl1.0-dev or libssl-dev packages for respective versions.

Fetching the sources and building the library should be straightforward:

sudo apt install git make gcc libssl1.0-dev
git clone --depth=1 https://git.lekensteyn.nl/peter/wireshark-notes
cd wireshark-notes/src
make
# Optional: install to a specific location. Adjust paths below if you skip this.
sudo install libsslkeylog.so /usr/local/lib/

This produces a libsslkeylog.so file in your current directory. To test whether it works:

$ ./sslkeylog.sh curl https://example.com -sI
CLIENT_RANDOM ... ...    <-- expected for TLS 1.2
HTTP/2 200
...
$ ldd /usr/bin/curl | grep ssl
libssl.so.1.0.2 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 (0x00007fc5a088d000)

The last command shows which libssl version the program was linked against. We can do something similar for Apache. The primary program (apache2) loads TLS support through a different library though, so we have  to check that:

$ ldd /usr/lib/apache2/modules/mod_ssl.so | grep ssl
libssl.so.1.0.2 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.2 (0x00007f8dbb6ed000)

If this shows libssl.so.1.1 for whatever reason, then you would have to sudo apt install libssl-dev instead and rebuild with make -B.

The next step is to modify the systemd unit file for the apache2 service. Execute systemctl edit apache2, this opens an editor for /etc/systemd/system/apache2.service.d/override.conf where you should add:

[Service]
Environment=LD_PRELOAD=/usr/local/lib/libsslkeylog.so
Environment=SSLKEYLOGFILE=/tmp/your.keys

After restarting (sudo systemctl restart apache2) your keys will now be created somewhere in /tmp/systemd-private-*-apache2.service-*/tmp/your.keys. If you would like a shorter path, you could enter something like /home/user/your.keys, but make sure the file is writable by the www-data user.

Make sure to remove this once your testing has completed. I recommend temporarily modifying the client instead to perform this kind of testing. As shown above, sslkeylog.sh also works with clients.


Update URL over HTTP I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS!
Do you think there's a risk for a man-in-the-middle attack?

According to online reports (bug tracker, reddit) and tweets from the authors it appears that:

The updates are signed by PGP (good)
The version is checked to avoid downgrade attacks (good)
The signature use an old 1024 bit DSA key, never renewed (bad)

We can conclude:

This mechanism is not at the sate of the art because of a deprecated signing algorithm, but the overall design is sound.
Since DSA 1024 has not yet been broken, it is still safe, but it might not be in 10 years. The lifespan of a VLC installation without update is far shorter than that, so an exploitation of this weakness is very extremely unlikely.

In summary: VLC updates are safe for now, but the update mechanism should be upgraded to a state of the art algorithm, which does not necessitate HTTPS.