How to harden against credential stealing in EC2 via the http://169.254.169.254 API? AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls:

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

The feature itself is intentional, thus technically not a vulnerability. The risk is also stated in the documentation:

  If you use services that use instance metadata with IAM roles, ensure that you don't expose your credentials when the services make HTTP calls on your behalf. The types of services that could expose your credentials include HTTP proxies, HTML/CSS validator services, and XML processors that support XML inclusion.

As long as an application cannot be tricked by an attacker to make such a request and to output the response, it is certainly a convenient feature. Unfortunately, it is a common source of attacks.

Of course, a server should properly verify all URLs before, but in the spirit of defense in depth, I wonder if it is possible to disable it, or maybe allow it only during startup (before opening any ports).

Questions:

Is it technically possible to disable the feature? In other words, how can I ensure that requests to http://169.254.169.254/ are blocked?
If it is technically possible, are there any drawbacks in blocking it?
Is there a way to still have access to the safe parts of the API, but not to the critical ones? Maybe by whitelisting specific paths? For example, I see the point of allowing /meta-data/spot/instance-action, which tells you whether your EC2 spot instance has been scheduled for termination.

Since you're using Linux, you can do this using iptables. It's possible to block specific UIDs from making specific requests. See https://unix.stackexchange.com/questions/104830/block-specific-application-with-iptables, or https://www.cyberciti.biz/tips/block-outgoing-network-access-for-a-single-user-from-my-server-using-iptables.html (the latter is quite old, but I think still correct).

What I'd do for your case: add a rule that DROPs network OUTPUT from the UID that your server(s)/process(es) run as to that IP address. Assuming you don't run everything as the same user, that shouldn't break any other processes that want to access the metadata service, while preventing SSRFs or similar issues for that specific endpoint.

iptables -I OUTPUT -d 169.254.169.254 -m --uid-owner <UID or maybe username> -j DROP

This (I think; not tested):

Adds a rule to the beginning of the OUTPUT chain (used for outbound packets)
Filters to packets that are bound for 169.254.169.254
Matches only packets originating from a process with the specified owner (unsure whether this checks real or effective UID but you should drop any higher privileges as soon as possible anyhow)
Drops it on the floor.


Is TLS in Tor useless? I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification.

Actually there are no TLS certificates on any Tor nodes, so it seems to be useless; is it?

Can I turn it off to improve network speed?

When you are browsing TOR hidden services, the TOR system already provides end-to-end encryption, so another TLS layer is redundant. It is in fact counter-productive, because one of the goals of TLS is to de-anonymize the server. It makes no sense to go through the trouble to set up a hidden service and then get a certificate from a certificate authority which tells the whole world who you are. Well, you could use a self-signed certificate (some people seem to do this, otherwise Orchid wouldn't explicitly disable verification), but a certificate not signed by a certificate authority can be replaced by a man-in-the-middle so it only provides protection from a passive eavesdropper.

However, when you browse normal websites via TOR, TLS is even more important than usual, because the exit node can eavesdrop on your traffic in cleartext and even manipulate it. There were already exit nodes spotted in the wild which exploit this by inserting advertising or even malware into websites their users browse or to sniff logins for popular websites. Using TLS makes this impossible, but only when used correctly (which means with certificate validation. An unvalidated certificate could be from the malicious exit node).


Which web vulnerabilities should I test for when pentesting a static site? I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service that is managed entirely by them.

I have actually done web app pentesting before and found vulnerabilities such as XSS, CSRF, IDOR, and DoS. However, these were web apps where content was being reflected back to the page, and a user was "logged in."

Off the top of my head, I can think of:

Exposed/improperly protected admin panels
Directory traversal
Weak admin credentials on the host accounts/admin controls

Aside from those issues, I am having a difficult time coming up with other vulnerabilities to look for on a static site where user input is not collected or reflected, there is no notion of an "account", and etc... The site does use PHP 7 on Apache, but the site is rather basic compared to many of the modern "web app" sites which utilize OAuth, social media login, reflect content back to the page, and so on.

Note: I did see Which security measures make sense for a static web site? but that post is more from a "blue team" standpoint, whereas I am asking for pentesting advice, not advice for how to secure the site.

Regarding the third party payment service, there are many possible vulnerabilities. Off the top of my head, I'd try to intercept and modify a request made from the web page to the third party payment service (eg. lower the amount).

After, I would focus on the apache server that delivers the html page to the client. Try looking up apache vulnerabilities.

I'd fiddle around with the URL (I've heard about DoS by browsing to domain.com/shutdown) looking for direct request vulnerabilities, and test the request headers looking after OS injection, overflows, CRLF, etc.

Also, I'd check for inconsitencies like making requests with HTTP 0.9 vs HTTP 1.1 (this could provide a auth bypass)

  "I am having a difficult time coming up with other vulnerabilities to
  look for"

I suggest you browse reported vulnerabilities from MITRE as a habit and read the references when something makes you curious. (NVD imports the content from MITRE and I personally read if from here: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&search_type=all)
but for now you could take a look at all the CWEs and find some inspiration there (https://cwe.mitre.org/data/definitions/699.html)


Web server responding to an HTTP request from a spoofed IP address Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to the request? Would it send the file to the (fake) IP address? Would the outbound data be dropped somewhere along the way? Would my server get any feedback that the destination IP doesn't want the data or there never really was any open connection to the destination IP?

To extend this a little further, let's say the file is really large, say 5 or 50 mb. If my server reports (in the logs) that the number of bytes transferred to the requesting IP is indeed 5 or 50 mb, and that the transfer happened without error, then can I conclude that the requesting IP wasn't spoofed and it was legit?

I will note that some (or most) aspects of my question seem to have been addressed in this thread:

Is it possible to send HTTP packet via spoofed IP?

But there seems to be conflicting information in that thread.  Some people say no, you can't spoof an http request, while others say "If you can fit the request in a single TCP packet, you can."

The last comment in that thread says flat-out, "It's possible to spoof the destination IP, so when the server sends the TCP/IP payload, it goes to the SPOOF IP, and not your computer".

So it's not clear to me if the spoofed IP address would be exposed to any traffic (or at minimum a syn-ack response) as a result of the fake/spoofed http request to my server.  And again, if my server logs indicate that 100% of the requested file was transferred without error, even if were a large file - could that happen only if the requesting IP was legit (not spoofed)?

==============

The proposed answer (Is it possible to pass TCP handshake with spoofed IP address?) answers the question with both a yes and a no.  Specifically, here is the part of that answer that seems to say "yes it can be done, for a short transaction at least":

============

Unless source routing or access to a router in the network path is available, this is not a sustainable setup. The client may be able to guess the ISN, but later sequence numbers are incremented by the size of the packets being sent, which the attacker won't see and can't reliably predict. So they should be able to get at least one packet in after the three-way handshake, but not a conversation. And sometimes one packet is enough.

=============

I just want to know if it's possible that my server would answer the http request to a spoofed IP by sending the requested file and logging the request has having been performed with no errors.  Under the conditions that none of my network gear (modem, router, etc) is compromised and the requested file is small (under 10kb) and there are no further requests or transactions as part of the session.  If the answer is probabilistic (ie - it can happen but there is some chance element to it) then I will go further and ask if there is a way it can happen every time it is attempted (but with the spoofed IP changing between attempts).

It is usually very hard to spoof TCP, which is the underlying protocol of HTTP (when ignoring QUIC, which has its own spoofing protection). But it is not impossible and it might be easier in some setups: see this link about quick blind TCP connection spoofing provided by  ximaera for more information.

But, in case the attacker manages to successfully established a TCP connection with a spoofed source IP, the server will send its response to the claimed (spoofed) source of the connection. Since there is no matching association at the claimed target the packets sent by the server will either result in a RST from the spoofed target or will simply be lost. Since TCP relies on ACK from the peer (i.e. HTTP client in this case) to signal that it received some data and this ACK is not sent the server will realize that  the connection is broken. And while QUIC is a different protocol than TCP the results will be similar.


IKEv2 in remote access scenarios Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password on the user side and the same certificate on the gateway side?

There are a few reasons why EAP is preferred over PSK:

PSK requires the use of a (relatively) low-entropy password, which is (relatively) easy to bruteforce.
PSK requires the passphrase to be stored on the server, which may result in key theft.
EAP allows clients to authenticate using different credentials in each direction, so a server might authenticate itself to the client with a completely type of credential than the client uses to authenticate itself to the server.
EAP allows clients to authenticate using their own digital certificate, which is much more secure than a password. The user just has to unlock their certificate (or certificate store) using their password on the local device.
IKEv2 supports EAP-only authentication, which theoretically allows any form of add-on authentication mechanism to be used.


Is there a name for an anti-virus station / kiosk? I am not able to define the exact term for a station that is meant to scan whatever media coming from outside a company and that have the following specifications:

The station should never be on any network
The station must be used to check any device (USB key, hard disk, etc...) that should further be connected on a network
The station has to be manually updated (understand virus definitions)

Anyone know an exact term that refers to this? In French, the designation "station blanche" exists and is literally translated as "white station", but I'm not sure that the term applies.

A "sheep dip" station is one term - from the practice of dipping sheep in cleansing fluids before letting them near the rest of the flock.


Gmail Accessed by Remote Acess User in China, Computer, VNC number used Recently, we received an email from a foreign exchange student we hosted (from China) with a video from the family that required us to download an app for translation. I downloaded the app via my Iphone. The app gained access to my Gmail account (or said it now had access to it as a regular user). Perhaps that was the dumbest thing I could have done.

Checking my Gmail from work, a notice popped up that my Gmail was being accessed by computer in China and showed the VPN that were being used, home and work computer as well as some locations in Alabama and North Carolina. I changed my Gmail password that was required when I download the app.

Would these be enough to keep that app from accessing my account? or gaining the VPN numbers of computers I used Gmail on?

Thanks!

Is a password change sufficient?

I don't think a password change would remove its access. You should go to your account settings and remove its access there.

https://myaccount.google.com/intro/security?utm_source=OGB&utm_medium=act#connectedapps

This link should be the right place.


What are the steps of hashing and steps of verifying password using salt and key? What are the steps of hashing password during registration and login to an application using salt and key?

Are the following steps considered correct if applied to an application?:

1- During registration:

user insert password
hashing function generates unique salt
hashing function adds the salt to the password
hashing function generates a unique key
hashing function hashes the salted password with this key
the password and the salt are sent to the application database
the key is sent to another database

2- During login:

user insert password
the application returns the password of the inserted username with the salt and the key
hashing function adds the retrieved salt to the entered password
hashing function hashes the salted password with the retrieved key
the application compares the two hashed password for the user (the one registered in the application database and the one inserted)
if both password are the same then the login happens

Let me correct this. Notice the bold parts, and removed steps

1- During registration:

user insert password
hashing function generates unique salt
hashing function adds the salt to the password
hashing function generates a hash from password + salt
the hash and the salt are sent to the application database

2- During login:

user insert password
the application retrieves the salt and password hash for the username
hashing function adds the retrieved salt to the entered password
hashing function hashes the salted password
the application compares the two hashes for the user (the one registered in the application database and the one derived from the input)
if both hashes are the same then the login happens

This way you only ever store a hash and a salt, which makes it impossible to find the password from what's stored in the database, as long as the choice of hashing algorithm is secure and the password is hard to guess.


Nmap doesn't scan the whole range of IPs I have multiple machines on my home network with a range of private IPs from 10.0.0.0 to 10.255.255.255. When I scan the network, I use:

nmap -v 10.0.0.0/8

But the console shows this:

Starting Nmap 7.01 at ....
Initiating Ping Scan at ...
Scanning 512 hosts (4 ports/host)

I don't understand, it should scan 255^3 hosts, no?

When scanning a large range of IP addresses, NMAP will divide it into groups and scan each group and provide feedback after each one. This way the user can monitor it as it progresses:

Reference: NMAP https://nmap.org/book/man-performance.html


How to check/test security issues of freeware? My company is implementing software whitelisting processes. There are bunches of freeware needing security testing. Actually, it just requires a preliminary evaluation rather than a deep analysis.

How can we assess the security of freeware?

Almost the same thing as what can be done for paid softwares: examine the reputation of the vendor/software, and evaluate the risk in adding it to white list against the cost of forbidding it.

For example, Postfix, OpenBSD, Spring framework or LibreOffice are all freewares with an excellent reputation, even better that many commercial tools. The risk of using them is very low. But if your white list already contains concurrent softwares (equivalent features) adding them to the white list with no real reason will only add more work in maintaining the list of valid versions - said differently it would not be different than what you should do for IDEA, Windows or Microsoft Outlook.

On the other hand, you can find freewares with little reputation, simple because few people use them. The first question to ask is whether they are correctly maintained. If serious bugs have been pending for a long time it is a hint that you should avoid it... But it is the same for niche commercial softwares.

The last point that can be done is an audit of the code. I gave it last despite it being IMHO what can give the most information on the quality and security of the software. But it is very expensive in time or money, the reason why I would be reluctant to use it. But if you want touse a little known freeware for a mission critical operation, you should considere that.

For your last question, I would not trust tools nor any single website for assessing the security of a software. Of course if an anti-malware chokes on it you should keep away, but finding no viruses is not a sufficient condition. For websites, I try to find converging hints to establish a reputation. And I also try to use the reputation of the site or the author. For example when a high rep user from Information Security says something, I trust that much more that what I can find on my ISP forums :-) . But we are close to fuzzy logic at that point.


How to verify the signature in an iOS Passbook pass? The Passbook application in the new iOS6 keeps track of movie tickets, coupons, and other 'passes' for you, and the passes themselves are loaded onto the user's device via file packages with the .pkpass extension. I'm looking to write a script to verify the integrity of a pkpass file before it's installed on your mobile device, and I'm trying to verify the cryptographic signature that is included with each pkpass. Apple's documentation says the signature is a "PKCS #7 detached signature" signed with the developer's Apple-supplied security certificate. Apple doesn't go into any more detail, since they provide their own signpass application to do the signing, and the Passbook application by them does the verifying.

So, taking a look at some of the signature files created in pkpass files, it looks like they're a Abstract Syntax Notation One (ASN.1) data structure, in X.690 format. I can parse out the values of the file, but there's no context to it. So...

My question boils down to this; does anyone know of a listing of the ASN.1 data structure tree of the "signatures" Apple creates? Then I can hopefully figure out the formatting of the signature file and verify the detached signature on passes outside of Apple's proprietary app.

Looks like there's nothing Apple-proprietary about this, just had to find the right search term. a "PKCS #7 Detached Signature" file is a "SignedData type" of RFC 2315 "PKCS #7: Cryptographic Message Syntax".

SignedData ::= SEQUENCE {
     version Version,
     digestAlgorithms DigestAlgorithmIdentifiers,
     contentInfo ContentInfo,
     certificates
        [0] IMPLICIT ExtendedCertificatesAndCertificates
          OPTIONAL,
     crls
       [1] IMPLICIT CertificateRevocationLists OPTIONAL,
     signerInfos SignerInfos
}


Need help on 2FA QRcode security In reference to OTP 2FA Auth apps:

I'm trying to understand the concept of the QRcode being more secure in-transit than SMS?

Is it because the QRcode itself is not of any value to fraudulent entities since the Auth App doing the scanning is generating the actual code on the device itself?

The QR code contains the key used for HOTP or TOTP, so it must be kept secret. If someone gets a picture of your QR code when you're setting up your authenticator, they'll have the key and will be able to generate valid 2FA codes.

The reason this is more secure than SMS is because it's encrypted in-transit by TLS, whereas with SMS it's been publicized many times how it can be intercepted. This prevents remote attackers from getting the QR code, but you are still responsible for keeping it secret from anyone around you (ie you shouldn't set up your authenticator in a public area).

You can read a bit more about how HOTP/TOTP apps work here.


Is homebrew's change of usr/local/bin to r/w a security issue? I've been reading online that homebrew changing usr/local/bin to r/w could pose a serious security issue as usr/bin is the path after usr/local/bin.
Article found here: https://applehelpwriter.com/2018/03/21/how-homebrew-invites-users-to-get-pwned/
Is this legit and an actual safety concern? I'm new to linux paths and don't fully understand how they work. What other directories does homebrew modify? For reference I am using a Mac.

This is an interesting question, the article that you mention gives a great summary of the technical issues in this change.
Let's look at your question in more detail: "Is this legit and an actual safety concern?"

Is it legit?

Absolutely the article is technically accurate. In summary by allowing more users to write to a directory that is high up the path it allows for some interesting types of attacks.

Is it an actual safety concern?

If I may I think you are trying to ask "Should I be worried about this?". The reason I like to rephrase this is simple, there are plenty of issues out there that are legitimate security concerns that people choose not to do anything about. This can range from behaviour (connecting to public wifi) to bugs in software which the vendor has chosen not to fix.
Unfortunately, no-one can tell you whether a particular issue is worthy of taking action over without knowing much more about your environment and attitude to risk.
For example, I am ok (on my personal MacBook) to keep home-brew installed on the system with the default options. Why? Put simply the benefit I get on a system I use for development from having brew installed outweighs the risk.
Please note, this is my personal choice and not a recommendation for you!
If I was running a Mac based shared server I would be less comfortable with this, I would be trying to lock down as many accounts as I can and preventing most users from being able to impact global settings.
In summary, you need to consider your (or your organisations) attitude to risk and decide for yourself whether the changes that homebrew make during a default install are acceptable to you or not.


What attacks new Apache 2.0 vulnerable to? I am new to Security field and still learning how all the attacks works.

for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, where I have installed honeyd to create honeypots.

I have created another machine which supposedly is an attacker, where I have installed nmap to perform network scan, nessus and hping, while my apache webserver has nothing installed except Apache itself.

I am performing network scans in my network using nmap, and also performing tcp scans using hping , and DoS using hping. But without using any security on my Apache webserver machine, how would I know if my machine is vulnerable to any attack so i can install appropriate software ?

I searched on the internet and one website says to install mod_security, but I don't know why I should install it since I don't understand what attacks raw
Apache server is vulnerable to.

The goal of a web server is to provide a platform for applications to be made available. The attacks are usually directed towards applications and not the web server itself.

There have been numerous cases where the server was vulnerable and the fix to that it to apply patches to keep it up-to-date.

The really interesting part is to understand how applications hosted by said sever are attacked. One of the best ways is to install (in an otherwise secure environment) vulnerable applications and try to break them. You can find a good implementation for several vulnerabilities in WebGoat, part of OWASP. OWASP itself is very much worth going through.

You can then look further on how to protect these applications with mod_security, a system which sits in front of your application and hopefully stops known attacks. This is called a WAF (Web Application Firewall).

The next step are honeypots, these are systems which are designed to respond to attacks (not block them) so that you can alanyze what activities have been done on a given service. You have honeypots for various services, not only HTTP(S) based ones.

So in your case just having a generic Apache server will not help you much in understanding security.

First install WebGoat to understand how to attack applications (and protect from them),
then mod_security to see how a WAF can (or cannot) protect you
and finally a honeypot on selected services to check how you could study a live attack (this is not an easy task without a comprehensive knowledge of the service).


I know salt and hash(password + salt), how do I get hash(password)? ...If it's possible at all.

By hash I mean md5, sha1, sha256.

And how difficult is it? I mean, if it's possible mathematically, are there any tools around?

You cannot extract a substring from a hash, and that's what you are asking to do.

Take the terminology out of your question and it becomes: How do I get

hash("apple baker charlie") from hash("apple baker charlie delta")?

You cannot. Hashes are one-way processes. You would have to crack the entire hash, know what the salt was, then rehash the original string (the password, in your example).

Knowing the salt does one thing (potentially) for you: you know that you have cracked the hash because you can identify the salt in the result. But this does not technically make the process faster.


WPS vulnerability scanning for handshakes to detect the attack I was able to sniff the EAP packets from the attacker machine with a wireless card on p-mode, however i was not able to sniff this data off the user using the same card under windows.
Wireshark, did not detect the card because it is external/USB. Microsoft network monitor in p-mode only shows the probe request and response, however i don't see the handshake between the attacker and the AP. does the Reaver attack hide its foot print so it can not be detected by sniffers ? i don't think so, if a packet is going to live air, it should be detected with a sniffer, right?
is there specific things to account for?

You need low level access to the card/drivers in order to see that low level data. This is one of the reasons wireless tools have compatibility lists- do you can ensure you get a card which will provide you with the information you need.


HTTPS Proxy Everwhere? I am configuring a HTTPS proxy, which I want to use for my laptop wherever I go. The idea is that since its encrypted, I should be safe from eavesdroppers, even on open wireless networks. Think of it as a easy to configure VPN for web browsing.

My problem however, is that HTTP requests does not use my HTTPS proxy, but go directly to the internet.

Is there a "standard" way to force all requests over a https proxy, or maybe I am forced to install a local squid proxy, and forward all requests to a *cache_peer* with SSL enabled?

Note that installing software on the client machine is unwanted, as it would complicate the setup for various devices (smartphone, etc).

There are two distinct things:

Connecting to a HTTPS Web site through a non-SSL HTTP proxy.
Connecting to a HTTP Web site through an HTTPS proxy.

The former uses the CONNECT proxy verb, and it works well. You want to latter, which is ill-supported by browsers. For instance, when you configure proxies in Firefox through this popup:

then the entry field about "SSL proxy" is about a non-SSL proxy to use to connect to HTTPS Web site, and not the other one.

It seems that Firefox cannot yet use a proxy over HTTPS. Chrome can but requires some manual trickery.

For a practical secure proxy, I suggest that you use SSH and run it as a "SOCKS proxy". This works well with existing browsers; see this answer for some practical details. The screenshot above indeed illustrates the use of such a SOCKS proxy (when a SOCKS proxy is in force, all the browser communications will go through it, for all protocols, and that's what you want).


Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable? Today this article was published by the BBC: Talk Talk and Post Office routers hit by cyber-attack. It states:

  It involves the use of a modified form of the Mirai worm - a type of
  malware that is spread via hijacked computers, which causes damage to
  equipment powered by the Linux operating system.

Reading wikipedia on the Mirai worm it states it works as following:

  Mirai then identifies vulnerable IoT devices using a table of more
  than 60 common factory default usernames and passwords, and logs into
  them to infect them with the Mirai malware. Infected
  devices will continue to function normally, except for occasional
  sluggishness, and an increased use of bandwidth. A device remains
  infected until it is rebooted, which may involve simply turning the
  device off and after a short wait turning it back on. After a reboot,
  unless the login password is changed immediately, the device will be
  reinfected within minutes.

So my question is Can I protect my router from the Mirai Worm and How would I know if my router was vulnerable?

Like your quote says; change the password. It would be much harder to fix if Mirai used 'actual' vulnerabilities (software bugs i.e. memory corruption). Then you'd have to hope there's an update available and apply that. But it seems like it's only taking advantage of people who leave their devices with the proverbial 'changeme' as password.


How does Google know where I am? Whenever I open the Google Maps app on my Android mobile phone, Google always seems to know my location, and it is very accurate (usually it places me on the map even in the correct room). Also, this happens even if both WiFi adapter and GPS are off. I know WiFi adapter off doesn't really mean anything, and I have heard Google uses information about nearby routers to geolocate you. But doesn't this mean ISPs are providing Google all (or some) of their routers' location?

As far as I know, no private company aside from my ISP should know sensitive data like my location, name, etc ... So, how does Google locate me so precisely?

Google uses BSSID information from your WLAN Access Point to get an approximation of where you are located, even with GPS and WiFi turned off. Taken from “How does Google Maps estimate my location without GPS?”:

  Google and others like Apple and Skyhook build a Database which links WLAN BSSIDs to a geographic location. A BSSID is like the MAC address of a access point that gets broadcasted by that access point. It is therefore "public viewable" if the BSSID broadcast is enabled, which is the default for most access points. The BSSID operates on a lower layer as the IP stack, you don't even have to be connected to an access point to receive these broadcasts.

So, essentially, when you ARE using WiFi and GPS, Google's database of BSSIDs is updated with a geographic location associated with that BSSID, as you've assumed. In your case, your AP is sending beacons advertising its BSSID, and because it is already in Google's database, Google Maps knows where you are based on the location of that AP.

So it's not that the ISP is giving Google the location of their routers, it's that your phone has already helped to build a database of the Access Points around you, and Google uses this data for geolocation.

Sadly, even if you get a new router and keep any and all Android devices away from it, they will still be able to approximate your location based on the cell towers your phone connects with (or maybe even your neighbor's AP!), but it won't be nearly as accurate.

I saw in the comments questions about whether or not Android phones will receive location data even with WiFi turned OFF. The answer is, yes, absolutely they can. I'm sorry I didn't make that clearer. Better check your settings if you were unaware:

This "feature" has been included since Android 4.3, and prior versions of the Android OS do not include this feature. Thanks to martinstoeckli for this information.

Although turning off this "feature" on your phone seems like the best way to prevent your BSSID from being added to the database, this isn't necessarily the case.  You've got other people's phones, the phones of passers-by, and even Google's own Street View cars to contend with. Thanks to Bakuriu for pointing this out.

Though this may be the case, you can opt out of your involvement in this program by appending _nomap to the end of your SSID. Your SSID is the "name" of the network that you have chosen or have been given. For example, you connect to the SSID "Home" or "D-Link" for your WiFi at home. In order to opt out you would rename your network Home_nomap or D-Link_nomap. Thanks for the tip Andrea Gottardo. For more, refer to the Google Support article about opting out.


How to connect Tor to the web using a specific server? Some websites restrict access based on which country the accessing IP comes from. I'd like to use TOR to circumvent such restrictions. So I'd like to use an exit node that's located in a specific country.

How do I configure TOR to use an exit node that's located in a specific country? Or alternatively, how do I use a specific exit node?

It is possible. You have to edit your Tor config. Vidalia Control Canel > Settings > Advanced > Edit current torrc.

https://www.torproject.org/docs/faq.html.en#ChooseEntryExit

You have to add:

ExitNodes {ua}
StrictNodes 1

"ua" is Ukrainian 2 letter country code. Be advised that bandwidth and latency over Tor are very poor.


Do outdated Javascript libraries present a risk for my web application? I have a small web application and I just realized that some of my JavaScript libraries are outdated.

An example:

<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core-min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-utf16.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script>

I found a new version:

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.9-1/core.min.js

Can an outdated JavaScript library present a security risk for my app? And one more thing, what is the best way of keeping libraries up-to-date?

Using any out of date software is inherently a security risk; any flaws patched between the version you're running and the latest version can be exploited. For example, maybe there's a specific payload you can feed it to cause an infinite loop, potentially causing a Denial of Service (DOS) event, or maybe there's a bug that can somehow break the JavaScript sandbox and wreak havoc on the system.

I don't see any critical security issues mentioned on the Internet, but that doesn't mean that they don't exist or haven't been patched. Using the latest version is always recommended when possible, but this may also include testing your code with the new version to make sure that it doesn't break functionality-wise when you update (for example, major releases are often incompatible with prior major releases).

The best way to keep your libraries up to date is to use the package from a toolchain that provides one-click upgrades. For example, if you copy the library to your local server using npm install, you can then import them directly (cloudflare will will provide protection for your site if you use them). From there, updating your libraries is as easy as npm update from the command-line terminal.

It's strongly recommended that you use a TDD (Test Driven Development) suite, such as Mocha, to make sure that your scripts do not break when libraries are upgraded, as well as generally reducing the chance you'll break your code during development. Also, remember to use a repository (like git or subversion) so that you can roll back changes if the npm update causes stuff to break.


Is it possible to build a web-service which is immune to DOSes? I heard that a service I'm using on the web has some problems with denial of service -attacks. I was wondering if it is theoretically possible to build a web-services where user can send data and which is immune to DOSes?

DoS is exactly what "user can send data" means; how do you tell between a legitimate user and someone/something that emulates a legitimate user just to cause trouble ? Often you can't.

For bandwidth-exhaustion attacks the mitigation is simple, you need to have more bandwidth than the attacker; either by doing it yourself or relying on a provider that sits between the Internet and your servers and has more bandwidth than most (all ?) attackers can have. Cloudflare is an example.

For application-level attacks, the ones that try to crash/slow down your server by overloading is more difficult to mitigate; if it's a web application you could use caching to avoid processing the page on each request and instead returning a cached version; you could also limit the number of requests per second to what is reasonable for normal use of your service, another idea is to put resource-intensive pages behind authentication so that only your legitimate customers can access them but outside attackers would just get a 403 without causing the server to process whatever that page was supposed to display - of course the solution isn't perfect either, as a legitimate user may have his account compromised to perform the attack, or that you made that "legitimate" user sad and he's now angry at you and wants revenge (I've seen that happen on video game communities sadly full of script kiddies).


Is sniffing HTTPS data useful? Now I have some sniffed HTTPS traffic, What on earth can I do with it. More specifically, is there any way I can decrypt it or understand it, any tool on kali or something? I am a bit new to the subject so please go easy on me.

No, you can not decrypt it unless you know the private key of the server. If it wasn't so, HTTPS would be sort of pointless.

There are two things you can do, though:

You can see what domain the user has visited - these are not encrypted.
If a key exchange without perfect forward secuirty is used (such as RSA, but not Diffie-Hellman) you can store the data so it can be decrypted if you in the future should for some reason find yourself in possession of the servers private key.


Credential In Windows How can I view the Credentials stored in Windows?

Is there any possible way to view the stored password?

I can just export them..

Go to Control Panel\User Accounts\Credential Managerand you'll see a list of locally saved password for windows. From there you can make a backup as well as add, delete and change entries.


Is it possible to "fingerprint" the "patches" applied to a Windows system? Two situations with a similar goal:

1) You have access to a target network, and you a Windows host. Is it possible to remotely finger print which (operating system security) patches are applied to the system without attempting actual exploits?

2) If you have either partial or full access to a target (unprivileged login, or root access) is it possible to finger print the security patches that have been applied without attempting the exploits that the patches remedy?

I should state first, that this is from a red team perspective. The owner of the target computer cannot be asked questions, or be asked to take any actions. Furthermore, stealth is of the essence.

There is a world of difference between an unpatched system, and a patched system, but it is quite noisy, and risks downing the system to try too many actual exploits (and it seems like the dumb way to go about finding the patch level.) Is there any safe, and quiet way to fingerprint this?

It is possible to do an unauthenticated network fingerprint for certain patches, but only a few. Nessus is one tool, and it can find e.g. MS08-067, MS12-036, with no credentials. You can use Nessus for free under the home license. Nmap also has some scripts for this (e.g. MS08-067) although be aware that this is different to the fingerprinting Ramrod mentioned in his answer.

A lot of patches don't affect anything that's directly network-accessible, e.g. Internet Explorer patches. You can do a similar test by having the client visit a website that checks it. Qualys BrowserCheck is one example.

The usual way to do patch scanning to do scan using administrator credentials. There are lots of tools that do this (including Nessus). In theory I expect you can do pretty good patch scanning with non-admin credentials. However, I don't know of any tool that does this - and I doubt anyone would be particularly interested in creating one.


What is a Flash drive by download? I've seen many people saying how some sites can infect your computer without actually clicking anything. They said that it was a "Flash Drive By" and it would use flash to download a file of any kind. Does that really exist or could it be something else?

It's not called Flash Drive By, but Drive-By Download, and yes, it's basically downloading malware just by visiting an infected website. Usually drive-by downloads work by exploiting a browser vulnerability (or a vulnerability in plugin like Flash or Adobe Reader), which leads to remote code execution triggering the download of malware.

Unfortunately drive-by downloads are getting more and more popular, especially that many legitimate websites get infected by adding a malicious Javascript code to their pages. That in turn usually happens with SQL injection and/or XSS. So, basically, a web application vulnerability in a legitimate website may lead to system-level exploitation of clients that visit it.

You can learn more about Drive-By-Downloads, the mechanism of infections, the statistics etc. in the following OWASP presentation.


run sqlmap with http post request with encoding data I have a target that http post request from that encoded As follows:

data request post first url encoded and then base64 encoded.

example request post from mentioned target As follows:

POST /test/test-page.php HTTP/1.1
Host: target.com
bmFtZTElM0R2YWx1ZTElMjZuYW1lMiUzRHZhbHVlMg==

for decoding data request post first must base64 decode and then url decode. actualy after decoding Something like the following:

POST /test/test-page.php HTTP/1.1
Host: target.com
name1=value1&name2=value2

Now my question is: how to run sqlmap on this target while injected queries in parameter values from data request post and then encode Similar as mentioned and then send to server target

Sqlmap supports multiple ways to process parameters with custom code. You can use --eval to base64-encode a single parameter, like so:

--eval "import base64; paramname = base64.b64encode(paramname)"

Also, you can use the --tamper parameter to load a custom python script that modifies the payload.

Unfortunately it's not straightforward to tamper with the entire POST query string. But here is a suggestion for a workaround:

Specify an empty data string in your sqlmap command (use the asterisk (*) to indicate the injection point) and declare a --tamper script:

$ ./sqlmap.py -u "http://example.com/" --data "*" --method POST --tamper mytamper

The tamper script could look like this:

import base64
import urllib

def tamper(payload, **kwargs):
    params = 'name1=value1%s&name2=value2' % payload

    data = urllib.quote_plus(params)
    data = base64.b64encode(data)

    return data

This script inserts the payload into your query and performs the URL-encoding and base64 conversions. It currently tests for the name1 parameter. You would have to change the injection point manually if you want to check the other one.

For the sample payload ) AND 3825=3825 AND (7759=7759 you would end up with a request like this:

POST / HTTP/1.1
Host: example.com
User-agent: sqlmap/1.0-dev-6fef294 (http://sqlmap.org)
Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
[...]
Content-type: application/x-www-form-urlencoded; charset=utf-8
Content-length: 92
Connection: close

bmFtZTElM0R2YWx1ZTElMjkrQU5EKzM4MjUlM0QzODI1K0FORCslMjg3NzU5JTNENzc1OSUyNm5hbWUyJTNEdmFsdWUy

As you can see the POST body is URL- and base64-encoded.


Does U2F prevent phishing of passwords? U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating a unique keypair. If a phishing site pretends to be someone, they will fail that cryptographic check and the key fob won't activate

But as I understand it, the phishing site may still be able to steal the user password. Nothing prevents the user from inadvertently entering their password on a malicious site (even though the single password is not enough to crack the account). Is that correct?

No, and they are not saying that they can prevent the phishing of passwords. They are saying that phishing the password alone will not give the attacker access to your account.

You can enter your Gmail password in your question above and U2F will not prevent that. In the same way, a phishing site can gather credentials and U2F is not involved at any point.

The goal is that to successfully get into the account, one needs the password and the U2F device. The password is still compromised, but the account is protected against anyone who doesn't also have the physical key fob.


How Digital Certificate is bound to a particular identity? I'm trying to understand the following:

Let's say Alice wants to encrypt a message with Bob's public key. There can be a man-in-the-middle attack who impersonates Bob. So Alice uses digital certificates so she knows the public key is who Alice thinks the public key is from. But I don't really understand how this concept works.

Even if there is a digital certificate, you will still use the public key written in the certificate. How is the certificate bound to a specific identity (in this case to Bob)? Is this, for example, based on the IP address?

This is really an often overlooked mechanism.

The way a digital cert is bound to an identity is by digital signature from a certificate authority.

A certificate authority (CA), is an entity which is entitled to sign and 'vouch' for the identity of other entities.

They act as a trusted party.

Even more interesting is that for this whole system to work, all OS/browsers ship with a list of trusted 'root' certs, or certs of certificate authorities :D

Here's a list of all of the root certs Apple trusts.

Certs are thus bound to domains in the context of web/TLS.

Certs are not necessarily bound to domains, in other contexts certs may be bound to different identities. Its just common for TLS/SSL server certificates.

For example, Hardware Security Modules (HSMs) may create a secure channel and bind certs used for that to IP addresses or pin their fingerprint. In code-signing certificates are bound to legal entities e.g. Google Inc. –

Not very decentralised is it!


Why is it fine for certificates above the end-entity certificate to be SHA-1 based? I have heard about the phasing out of SHA-1 based certificates for end entity use, and the steps that are outlined for Google Chrome to display progressively more aggressive warnings for SHA-1 certificates not expiring before Jan 1 2016.

At the bottom of their blog bost, Gradually sunsetting SHA-1, about this, they mention, quote:

  Note: SHA-1-based signatures for trusted root certificates are not a problem because TLS clients trust them by their identity, rather than by the signature of their hash.

I don't understand the difference here.

Isn't identity proven by the advocate (higher authority) signing a hash of the certificate?

This is not for "certificates above the end-entity" but for "root certificates" only.

In pure X.509, there is no such thing as a "root certificate". There are certificates, and there are trust anchors. A certificate contains a public key, the name of the entity that owns that key, and is signed by another entity (an "upper certification authority"). This process of signing must start somewhere, and that somewhere is a "trust anchor". A trust anchor is a name and a public key.

X.509 does not specify how any entity should encode trust anchors, since trust anchors are something that is known a priori, not something meant to be exchanged over the network. However, a traditional method of storing trust anchors is to use the same format as certificates. A certificate contains, among other things, a non-optional field for a signature from some upper CA. Instead of defining a new format for a trust anchor, Tradition is to fill the "signature field" with a self-signature. Thus is born a root certificate: a trust anchor that is encoded as a self-signed certificate.

But that self-signature is meaningless ! It has no security value whatsoever. Correspondingly, nobody verifies it(*). Therefore, there is no problem related to its use of a hash function that is otherwise regarded with some suspicion.

(*) Some systems heuristically check that signature because self-signed certificates can only be used as a root, not as anything else. But this is not a security feature; this is for user interface convenience, with no reliance on the safety of that signature. Hence, no problem with SHA-1 or, come what may, MD5 or MD2.


Ways to authenticate client with a server I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to them through the Google Cloud Messaging service.

My problem is that I'm not sure what the best way is to prevent anyone from just forging messages to the server and writing any possible username into the sender field.

I was hoping that I could just use a secret key stored within the app's code which is the same as a key stored on the server corresponding to a specific user, but I've since found this key would be prone to being discovered through reverse engineering the app.

So now the only apparent solution to me is to implement a password based system that generates a limited time session key on the server that is fetched by the client after submitting the correct password, and then sent along with each subsequent message.

However, I would rather avoid this kind of system as I want to keep the app as simple as possible, and avoid having to implement forgotten password systems and such.

Are there any other ways in which I could ensure messages are authentic?

From the cryptographic point of view, if one user A must be able to do something that another user B cannot (e.g. sending a message with "A" as sender's name), then there must be some value that A knows but B does not. That kind of secret value is called a key, although there are other terminologies (e.g. "password" when the secret is stored in a human brain).

Hiding keys within application code has two major drawbacks:

They can be recovered through reverse-engineering.
They are not user-specific.

However, in your case, you want a user-specific secret value: each user has his own key, with which his messages are authenticated. Therefore, the user's key cannot be hard-coded in the compiled application code; however, it may be stored as a file on the user's device. Reverse-engineering is here a non-issue: by reverse-engineering his own app installation, the user may learn his own key, not the key of somebody else.

The important point here: such a key authenticates the user, not the device. Making sure that a given message comes from a specific device, and sent by "your unmodified app" and not other code, is nigh impossible, since the said device is physically in the hands of the user, and is not tamper-resistant. To get such kind of guarantee, you need a device which is able to fight back against its owner, e.g. a smart card. Mobile phone billing works, both practically and legally, because the user cannot break into his own SIM card. You cannot have this model with an app which is software-only on non-shielded hardware (the phone itself).

However, as long as you want to authenticate users, not devices, then a user-specific key is fine.

Then comes the tricky part: authentication is good, but who is doing it ?

If you just want your server to make sure of the identity of A, then a shared secret between A and the server S can be fine. The underlying cryptographic tool would be a MAC. However, in that case, when user A sends a message to user B through your server, the server is certain that it indeed talks to A, but B knows nothing. An evil user E, who wants to forge a fake message purportedly coming from A, may send the said message directly to B, without going through your server at all !

One solution, in that case, is to make the communication from S to B equally authenticated with the B key: this time, that's B who makes sure that what he receives from S is indeed from S. With MAC applied in both directions, for all communications between the server and any user, then you can have a reasonably secure messaging network. Of course, S is trusted: your server can betray everybody at will. But maybe this is not a problem for you.

(For end-to-end authentication, without trusting a central server, you would have to resort to asymmetric cryptography and digital signatures, and things become a good deal more complex.)

Storing a user-specific key in a file on the user device sure seems simple enough. However, sometimes, users switch devices (e.g. they buy a new phone, or they are Apple-addicts who have an iPhone and an iPad) and still want to retain their identity. This implies that the user-specific key somehow travels from one device to the user.

The scheme that you envision (storing the key on the server itself, with automatic download after password-based authentication) is valid. Be sure to do that over SSL, of course. You may combine it with a caching mechanism: the app downloads the key when it does not already has it, but then it stores it on the device.


Has scrypt been broken, finally? If I understand correctly, according to this: http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html, looks like the attacker can just create an optimimized version of scrypt that produce the same ouput with extremely high effiency (e.g. with N= 2^14, p = 8, r = 1, requires only 1KB instead of 16MB to run, while increase CPU work factor by only N/2).

The short answer is : no. That is not what I said, nor what I implied.

Using the tradeoff that I identified and talked about, you can trade memory for CPU time. So yes, you can reduce a particular derivation from 16MiB to 8KiB (approximately). However doing so will require several orders of magnitude more logic to be executed by the CPU. Some efficiency is gained by cache locality, but in general, it should be much slower. (on average, about 8,000 times slower than the 16MiB version, but as much as 16,000 times slower, depending on the exact random distributions of the algorithm).

There is a more interesting alternative though. My attack was an all-or-nothing bais. Basically, completely eliminate the V array, at the cost of increasing complexity. But you can make a more nuanced tradeoff. You can cut the array in half, and re-compute every-other value. Or cut it to every third value. Trading off storage space for CPU space. But at a varied degree. This is commonly referred to as a TMTO defeater (Time-Memory-TradeOff Defeater).

I did a more thorough analysis, including a proposed fix on this thread. It's worth noting that at least one of the proposals for the Password Hashing Competition uses my augmented algorithm.

So no, scrypt is still incredibly strong. And for its primary use case (as a KDF), it's quite a bit better than the alternatives.,

The point I was trying to make with my post, is that when not tuned optimally (used with improper settings) or with very fast settings, it can be significantly weaker than existing algorithms. Specifically for password storage. Where you know the result, and are looking for the source material (password).


OpenID Session Fixation with CSRF This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account.  It also highlights the fact that state-changing GET requests are just as bad a POST requests.

This is pretty simple to understand when dealing with a single forms based authentication.  But if we introduce an authentication system based on GETs and POSTs to different domains that we don't "own", I'm not sure how to prevent CSRF in that situation.

  If I were to extend this to OpenID, does this mean that a user could inject their OpenID credentials into my session?

What is the right way to address this problem?

I'll answer my own question since I haven't seen this practice be encouraged in various SDKs and code samples.  Here is my theory:

Upon clicking the "sign in" button on the Relying Party (RP), two things should happen:

Write a random value to a SECURE HTTPOnly domain cookie
Then have the IDP redirect back to https://www.host.com/account/signin?csrf=myrandom
 where "myrandom" equals the value within the cookie.
When the OpenID process signs you in, then it will POST to the above URL, you can then grab the CSRF string, and compare that to the cookie.

Let me know if you see any flaws in this approach


question about implicitly tags in ASN.1 From the X.509 RFC, in the "Implicitly Tagged Module" section:

CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

DistributionPoint ::= SEQUENCE {
     distributionPoint       [0]     DistributionPointName OPTIONAL,
     reasons                 [1]     ReasonFlags OPTIONAL,
     cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

GeneralName ::= CHOICE {
     otherName                 [0]  AnotherName,
     rfc822Name                [1]  IA5String,
     dNSName                   [2]  IA5String,
     x400Address               [3]  ORAddress,
     directoryName             [4]  Name,
     ediPartyName              [5]  EDIPartyName,
     uniformResourceIdentifier [6]  IA5String,
     iPAddress                 [7]  OCTET STRING,
     registeredID              [8]  OBJECT IDENTIFIER }

How would x400Address be encoded?  Like this?:

SEQUENCE {
  SEQUENCE {
    [0] {
      [3] {
        ...
        }
      }
    }
  }

The first [0] is from DistributionPoint (which is replacing DistributionPointName's [0] tag) and the [3] is from GeneralName.

If that's how it's supposed to work, though, then why does DistributionPoint even have context-specific tags?

You will get something like this:

SEQUENCE {
  SEQUENCE {
    [0] {
      [0] {
        [3] {
          ...
        }
      }
    }
  }
}

Explanations:

Even though the tags are supposed to be implicit (due to being in a module declared with IMPLICIT TAGS), implicit tags cannot be applied to a CHOICE (because otherwise the CHOICE would not work at all), so they are automatically converted to explicit tags in that situation. Here, the [0] tag on the distributionPoint field is in such a situation, so it wraps around, instead of replacing, the tag of the DistributionPointName field, which is also a [0].
Notice that fullName has type GeneralNames, not GeneralName. You do not quote GeneralNames in your message; it is a SEQUENCE OF GeneralName. The [0] implicit tag of the fullName field, being implicit, replaces that of the SEQUENCE.

For the first point, it is specified in X.680, clause 28.6 (from the 1994 version):

  The tagging construction specifies explicit tagging if any of the following holds:

  a) the "Tag EXPLICIT Type" alternative is used;

  b) the "Tag Type" alternative is used and the value of "TagDefault" for the module is either "EXPLICIT TAGS" or is empty;

  c) the "Tag Type" alternative is used and the value of "TagDefault" for the module is "IMPLICIT TAGS" or "AUTOMATIC TAGS", but the type defined by "Type" is a choice type, open type, or a "DummyReference" (see ITU-T Rec. X.683 | ISO/IEC 8824-4, clause 8.3).

The last clause (c) is what I explain above.


Is a SSH key required for SFTP? Since SFTP stands for SSH + FTP, I assume I always should create a SSH key pair for it, however, I see in my client configuration that that is optional.

That is applicable for both server-side and client-side SSH key pair.

A host key is mandatory for any ssh server. The server can have multiple host keys using different algorithms. If no key is present when the server is started a host key is generated for the server.

An ssh client can authenticate with a wide range of different methods. The two most common are password and publickey. As the name suggests only publickey requires a key. It is very often recommended to use publickey as it has multiple security benefits compared to password, and publickey is also better for the user experience.

The above applies both when using ssh to run commands on the remote machine as well as when using scp or sftp to transfer files. Once your keys have been created the same key files will be used for all three commands.


Keeping TrueCrypt keyfiles in plain sight If I create a TrueCrypt volume and secure it with a password and a keyfile, is there any way that someone who has access to my computer would be able to tell that the volume requires a keyfile to decrypt?

If not, then if I store the keyfile on my computer, along with thousands of other files, won't it be practically impossible to decrypt the volume using brute force, since even if they correctly guessed my password, they wouldn't know they had guessed it correctly, since they wouldn't have used it in combination with the keyfile, because they don't even know a keyfile exists for the volume?

According to the TrueCrypt manual, a keyfile can be any file, so they wouldn't even be able to search for keyfile signatures on my computer.

Not to mention using more than one keyfile per volume. Wouldn't this increase the security hugely, since out of the thousands of possible files on my computer, they would have to guess the exact combination of keyfiles, and they obviously wouldn't know how many keyfiles I'd used for the volume.

Please can someone clarify this for me? I'm sure I've got it wrong.

The KeePass documentation specifically recommends not to do this:

  ... The point of a key file is that you have something to
  authenticate with (in contrast to master passwords, where you know
  something), for example a file on a USB stick. The key file content
  (i.e. the key data contained within the key file) needs to be kept
  secret. The point is not to keep the location of the key file secret —
  selecting a file out of thousands existing on your hard disk basically
  doesn't increase security at all, because it's very easy for
  malware/attackers to find out the correct file (for example by
  observing the last access times of files, the recently used files list
  of Windows, malware scanner logs, etc.). Trying to keep the key file
  location secret is security by obscurity, i.e. not really effective.


Is it possible for a NFC-enabled device to emulate a Visa card with PayWave? If someone has access to the physical Visa card (and with that comes the number on the front, the expiry date, and three digits on the back) would it be possible for them to program a NFC-enabled device to emulate the physical card?

In reading "What prevents people getting charged over NFC in crowded places?" it seems that the reader authenticates the card, but does that make a difference?

It seems that both Google Wallet and SimplyTapp can do this, correct?

I talk about this in the answer to another question:

  Modern credit cards generally can't be copied, however this can depend
  on the country. In the USA I believe it's easier to clone cards as the
  banks there haven't all implemented what the UK calls Chip & PIN but
  is more generally known as EMV. EMV helps protects against cloning as
  each card has a cryptographic key that it uses to sign and then return
  some data that the ATM sends it. This key can't be (easily) extracted
  from the card meaning that you can't set up a fake card with the key.

As I mention the situation is a bit different in the USA which can use a slightly different system that doesn't require the card to sign any data sent to it by the reader, this makes them easier to clone. The banks are trying to push the USA towards using Chip & PIN and I believe some are going to make it mandatory for shops to have soon so hopefully this won't be an issue for too much longer.

In relation to some other points in your question:

As I comment on the top answer of the "What prevents people getting charged over NFC in crowded places?" the card doesn't authenticate the reader at all, the answer is incorrect. I'm not sure why it got so many up votes and no one got back to me on my comment.
SimplyTapp as far as I know doesn't try to emulate your credit card, you buy prepaid gift cards which can only be used at certain merchants. When I tried it they didn't even have any gift cards left so I couldn't use the app at all, from a couple of comments on news articles about it, it seems that other people have the same problem.
I think for Google Wallet they basically issue you their own card and they pay the merchant, then bill your bank. This is from the Wiki page you linked to although there's no source for the statement. "The latest security measurement implemented (July 2012) is based upon Google financially completing the transaction and subsequently billing the respective card issuer."


making an iPhone/Android app which sends a user password to my server, how to secure? I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login.

I don't have SSL on my website, but it's just a reviews website and no private data is transmitted, nevertheless, on a mobile phone it seems more dangerous to me as mobile phones are always using a wireless network.
and people sometimes use the same passwords for several websites.

What I want to do is:
The app hashes the password twice, with two hashing algos which are considered secure, and then transmits it so at least if someone sniffs the data he can only use use it for my website, or maybe other websites which use the same hashing technique. maybe even more then twice, according to what is appropriate.

Is this a good idea?

and also, are mobile networks vulnerable to this kind of sniffing attacks? is there commonly some kind of protection like an SSL-like relationship with the network provider when someone just sits in a restaurant and is provided with a connection?

Can people eavesdrop on mobile networks?  Most definitely.  Also your server is likely connected to the mobile network over the ordinary internet where people could eavesdrop.  Also, people frequently use wifi connection from their phones (versus 3g/4g data connection) which again will go over the ordinary internet and is subject to many potential eavsedroppers.

Why not SSL?  If you have your own domain, you can get an SSL certificate from a trusted signed CA (certificate authority) for free (https://startssl.com), which prevents eavesdropping/MitM attacks, etc.

There are problems with your scheme.  E.g., replay attacks (eavesdropper replays the hash), MitM altering messages after authentication (e.g., replacing legitimate review with spam or a XSS vulnerability), firesheep, etc.  You can improve on it marginally with nonces or timestamps, but again its far simpler just to use SSL than to try and reinvent the wheel.

You may think, I'm not dealing with credit cards why do I care if I'm unsafe.  Maybe you have reviews and some spammer decides to steal credentials for many accounts to positively review their products.  Or some script kiddie gets upset with a review and deletes all reviews they can from your site.  Or your idea of a strong hash is sha-1 without a salt (e.g., you worked for linkedin) and someone captures hashes sent over the network and soon captures a million sha-1 hashes and brute forces them in parallel in a embarassing incident.


How safe is it to connect to Internet through VPN? Sometimes I connect to the Internet using a VPN connection to be able to access the blocked websites. I've got a few questions regarding this:

Are my important data (like my credentials) vulnerable to be eavesdropped on the VPN server? What if the protocol of web site I am connecting to is HTTPS? (like gmail)
Is the owner of VPN server able to access anything on my computer (files and folders) via this connection?
If the answer to any of the above questions is Yes, is there any counter measures to prevent it?

Any advice would be appreciated!

You need to think of connecting to a VPN like walking over to a physical network and plugging your computer into a switch there.  So:

If you use HTTP, everything is sent in plain text.  The VPN server can read everything.  If you use HTTPS, only the domain of the server will be known by the VPN server.  The first step in a HTTPS session is to establish an SSL connection, everything is encrypted from there.
If you have open ports on your computer (sharing files, music, etc.) this will be visible to the VPN server. Other than this, nothing is revealed.  Again, it's as if you were connected to a physical network. The VPN server doesn't gain any other special privileges.

There is one exception to this, what VPN software are you using?  Do you verify the source?  If you received the VPN software from a questionable source, it could contain a trojan which allows outside attackers access to your computer.

Have you considered Tor or Freenode?  These can run by themselves, or in addition to a VPN to give you privacy when visiting standard HTTP websites.


How can one prevent HTTP-authentication Brute Force Attacks, on PHPmyadmin with CSF-LFD? I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban").

I don't want to protect PMA by limiting it to a certain IP or to remove and install it each time anew.

In contrast, I do secure PMA with basic HTTP-authentication and picked up a nice password for the root user but my question is where and what directives should one add to make sure CSF-LFD covers Brute Force Attacks for this one.

Add these lines to your Apache Config to log failed authentications

/etc/apache2/conf.d/phpmyadmin.conf:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:

/etc/fail2ban/filter.d/phpmyadmin.conf

[Definition]
denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload


Can I trust profile data a 3rd party auth provider send to me? This question may be related to this one, but I think we need to be sure.

My website implement login via OpenID (or Google, or Facebook, etc.).

On my website, authorization is based on user email adress. If user has email something@example.com, she gets access to the content linked to that email address. (Basically in my case, content sent by other users to her email address.)

I do not provide other ways to login than third party auth and single use token. User sometimes connect via OpenID sometimes via token.

I guess when new user login for the first time via OpenID, I should in fact verify that she really owns the email address ? Then only, I can store the provider as "trusted" for this email address.

Does anything prevent anyone to set up an OpenID provider, to make it provide someone else email address, and to get privileges linked to this email address on my website ? Can I make a list of "trusted" providers (like Launchpad.net, Facebook, Google) which are known to verify user email address ?

I am pretty sure about the answer, but I need a confirmation. I want to make my login system as light as possible especially for new users. So I would not like to add tasks for the user if it is not mandatory.

If you're allowing any OpenID provider like StackExchange appears to do:

then you should probably validate the email address separately by sending a confirmation email containing a verification link (like SE do) before allowing access.


A way to prevent non distributed, network-level DoS attacks? I have a DigitalOcean Ubuntu 16.04 machine with Bash as main shell, Nginx, PHP-FPM, and MySQL as server environment, Certbot for TLS and WordPress for web applications.

I protect from MITMs with TLS.
I protect from SSH and application BFAs with SSHGuard and WordFence.
I protect from Backdoors and DB injections (like SQL injections) with various policies like minimal usage of modules, simple and unified forms (and captchas and honeypots if needed), and automatic upgrades via unattended-upgrades and WP-CLI for WordPress.
If I'm not wrong, WordFence also protects from one or more types of application layer DoS attacks.

Currently I see no reason why the websites I host should be attacked in a Distributed DoS (for example, I hold no organization targeted by another organization).

And yet, I do fear of DoS in general; especially of a Network-Level DoS from a single machine.

My question

What will be the best way to monitor and repel any simple (say, single machine) attack of a network-level DoS?

I would prefer not to use external tools like CloudFlare as their policies can change and they can suddenly cost money or change pricing.

Ideally I would desire to install a Linux utility that works automatically, "as is", monitoring and repelling attackers from iptables (or nftables in the future) but I get the impression such tool isn't available with current technology. UPDATE FOR THIS PASSAGE: It seems that such tool, if existed, wouldn't be enough anyway because I need a network level tool outside the operating system (a tool that DigitalOcean or any similar hosting provider should provide, in my opinion, and that would be controllable from their interface/GUI).

A DoS is different from the other concerns you mention.

With MiTM, zero is the only acceptable number of successful attacks. Zero is the only acceptable number of successful SQL injections. Zero is the only acceptable number of brute forced passwords- and why even subject yourself to password brute forcing, disallow passwords altogether and whitelist IPs.

With DoS...if you are infrastructure supporting commercial customers, then, sure, transient request lossage directly costs money. That's a metric that one can care about.

If the service is best effort, there is probably a level of "successful" DoS that you can ignore. There is a gradation of acceptability for the risk.

To have some insurance, you can apply per-IP rate limits at the network level, e.g. https://making.pusher.com/per-ip-rate-limiting-with-iptables/, and you can apply per-IP rate limits at the application level in nginx, e.g. https://www.nginx.com/blog/rate-limiting-nginx/ or with any rate limit plugin for Wordpress.

But because it's amorphous, distill the concern into a metric that accurately expresses the distinction between caring and not caring for you. This measurement may just be a report from a web ping service giving you an availability score.


In an enterprise environment, should developers/maintainers be able to look at production logs by accessing the application servers? I came across this practice, from a big company handling personal customer data, of not allowing developers/maintainers to look straight at the application logs (e.g. good old tail | grep) by connecting to the application servers through SSH in the production environment. The logs do not contain any personal data.
Developers can still retrieve the logs, but they must do so through a web interface, which is exposed by the server through some kind of plugin. The interface exposes the logs as static files that the developer can download and then look up offline, for problem determination purposes. This is suboptimal from the maintainer point of view because

it is impossible to look at real-time logs
the download fails if the file gets bigger than a certain size, in which case you need to ask a sys admin to retrieve the logs manually (or set log rotation to smaller chunks, but then it's often harder to find the chunk you're looking for).

In the integration and/or UAT environments, maintainers are allowed to connect directly to the application servers through SSH, they are given personal users with read-only access to the machine, and can therefore read the logs straight e.g. from the /logs dir. In the production environment, the company policy is "Only sys admins can SSH to the application server".
The purpose of this question is to better understand the good reasons behind this rule, and the possible alternatives around it i.e. TL;DR

What could actually go wrong allowing maintainers to access production servers through SSH connection using a personal read-only user?
Is there any best practice for allowing real-time access to production logs without exposing the system to security risks?

In general, I think there is recognition that operations engineers and sometimes developers (either internal or with the 3rd party vendor whose products you are using) will need to see production logs in order to debug issues. The number of hoops you need to jump through -- like type of authentication, audit logs, redacting sensitive data, etc -- will depend on context: is there customer data in the logs (specifically "personally identifying information (PII)"?) in which case GDPR may apply depending on where you, your servers, and your customers are. Is there health data in the logs? In which case health regulations like HIPAA or PHIPAA may apply. Is there financial data? In which case PCI-DSS may apply.

For example, quoting from PCI-DSS v3.2.1:

Requirement 8: Identify and authenticate access to system components
8.1.1 Assign all users a unique ID before allowing them to access system components or cardholder data.
8.3 Secure all individual non-console administrative access and all remote access to the Cardholder Data Environment using multi-factor authentication.

So under PCI-DSS, they recognize that people will need to access raw data for various reasons, but they want clear audit trails of who accessed what and when.
Whether or not ssh keys count as strong authentication, I think will depend on what you're doing to ensure that ssh keys are uniquely tied to a single human; ie how do you know that people don't have access to each other's ssh keys?


Why ACK flood is effective? I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection.
What about ACK flood, what does it happen on the destination side that makes this attack effective (hypothetically) ?

what does it happen on the destination side that makes this attack effective (hypothetically) ?

A SYN flood is effective since each new SYN marks the beginning of a potential new connection and thus the system will allocate a new state (i.e. memory) and send a SYN+ACK back.
An ACK which does not match an existing connection and its state though will simply be discarded. No new memory need to be allocated for this, no data will be sent back. It still takes some time to process and it consumes bandwith, but that's it. This means an ACK attack is not very effective compared to a SYN attack.


Does Ransomware on one computer put entire network at risk? I was visiting an office recently where one computer had become infected with a ransomware variant and turned off until the 'network guy' could come take a look (I don't know which one as no one took an image of the screen or was at all knowledgeable about security issues).

If the infected computer is on an ethernet network with other computers all on the same subnet, are those computers likely to be infected also as a result of the first computer becoming infected? I realize that they might be infected independently due to lack of whitelisting, spearphishing, etc.

Short answer, without any supplementary information, one should at least consider the risk of network infection as important.

The main thing is at least to be able to put a name on the malware, and even better to detect how this first computer was infected.

Some worms indeed use network connection to propagate themselves: they scan the local network generally targeting some defined unpatched OS flaw and take advantage of this to propagate. However, this the worst scenario because:

The other system may be up-to-date and correctly patched,
Not all worms are acting like this,
You may even not be facing a worm at all, in such case the ransomware contamination was just the result of another way of infection not impacting for the rest of the network (phishing email, browser flaw exploited by some site visited by the user, etc.).

If possible, I would encourage you to take a look for suspicious network activity. A dozen of infected PCs scanning the network to find supplementary victims is usually quite noisy...


Windows / Sensitive Data / Prevent access by various process It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME

and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx

any process you run can also access that file - there is no easy way to "launch process without access to [insert entities here]".

So when DUDE.NAME runs, for a random example, a video conferencing software (that doesn't require admin, so they aren't admin), it's still running as their user account, and effectively could access network folders behind the scenes and steal data.

What is the industry best practice for this?  Do you simply run this risk?  I find executives want easy access to their secret files but want to be able to run programs they obtain from the web.  Maybe they download "Easy Tax Calculator!" which doesn't need admin, simply runs as their account, gives them a crappy interface long enough to run code in the background to steal data and send it off.

The best practice is exactly the same as for every privileged account (administrator, root, etc.): don't use it as a standard account.

All you need to do is NOT grant access to the DUDE.NAME account to the sensitive data and use HIGHSEC.DUDE.NAME instead.

You can effectively couple that with some form of isolation if necessary. For instance, you can require the user connect to a termnial services server using the HIGHSEC.DUDE.NAME account in order to access the sensitive data.


Received a call from +1 202-455-8888 but I did not attempt to log in to my Gmail I have enabled multi-factor authentication for my Gmail. When I need to log in to my mail, I should enter an OTP which is sent to my phone number.
I got a call from this number, even though I did not sign in to my mail, and it said "Your verification code is ******". Does this mean that my account is at risk? I have checked my mailbox, and there is no attempt to login.
I found this on the Google support forum:

Yes, this number is definitely Google's number used for various verification purposes. Just be aware of this: If you initiate the verification process, then it is perfectly safe. If, on the other hand, somebody else sends you a code from this # (it is possible) and then asks you to give them the code verbally or by text, they are trying to scam you! So to be safe, do not ever give the code to anybody, no matter how convincing their story is!

There are two possibilities:

Someone has your password and is trying to use it, but fails the 2FA. Change your password!

Someone is trying to register a new account or 2FA to an existing one, but has (possibly accidentally) added your phone number instead of their own.
It's possible that there's just a minor difference in your numbers and it's simply a typo, e.g. the Ghostbusters are trying to register +1-311-555-3268 instead of +1-311-555-2368.

It's safer this way, when there's just an automate that gives you information, but if someone calls from number +1 202-455-8888 and tells that they are from Google, it's probably still a scam, because Caller ID spoofing is relatively easy. You shouldn't tell them anything. If they really were Google, they would already know it anyway. :)


Why keep track of user password changes in web application? For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just reminding you that you "changed your password 10 months ago..." they go ahead and state "Was this you? Recover you account"

What is the reasoning behind this -- security-wise? If an attacker was able to change your password 10 months ago, is it logical for him to let you be able to recover your account afterwards? If they could change your password, it means they could change pretty much everything that the user can use to recover the account.

I think I am missing a point on why sites need to keep track of user password changes.

EDIT:
The said situation occurs when a user enters a wrong password that was once his password. For example, a site would have an example passwords table with the following contents:

user_id | password  | changed
---------------------------------
1       | blah      | never
---------------------------------
1       | blah blah | 12.07.2017
---------------------------------
1       | no blah   | 31.01.2017
---------------------------------
2       | blah      | never

When the user with user_id = 1 tries to login with the password no blah, he would be reminded that he changed his password on 31.01.2017. But when he logs in with his current password blah, he would be logged in with no problem.

I think I am missing a point on why sites need to keep track of user password changes.

No website HAS to keep tracks of user password changes. It's just that some do.
Keeping tracks of password changes allow several things :

Remind the user that he change his password.
This is usefull if the password has been changed by someone else. If it's not you then you know you have to change it again right away ! (You don't have to be hacked personnally to have your password compromised. All you need is password reuse and a hacked service.)
Remind the user that he already has used a password. This ensure that you are changing your password for a real new one and not using a password that you might have changed because it was compromised.
Remind the user that it might be time to change his password.


Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF? Initial situation:

A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the service side.

Problem / Security Threat:

The WebView element of the android and iOS plattforms allow to create a malicious web browser that unveils and modifies session cookies. webView.loadUrl("javascript:document.cookie=’’;");. If the attacker already figured out, how the double submitted cookie looks like, (In this case it's the AuthenticationToken) he is able to create a malicious RESTBrowser. Therefore he adds the already known CSRFToken to the document object model and thus bypasses the CSRF countermeasure. Is that right so far?

Possible Preventions:

So far I have no idea how I can prevent an attacker from creating und publishing such a malicious mobile application, as well to prevent the service from beeing accessed via malicious mobile applications. I know about the existence of the User-Agent header and that the service can use this information to reject requests from others than specific browsers. But I'm sure that also this header can be manipulated within the WebView.

What are effective countermeasures aginst CSRF in contex of malicious mobile applications?

It's an app. It can send your server any cookies it wants. It can save the password as the user types it. It's in complete control. You have no more "defense" against this than you do against Mozilla Firefox or Google Chrome.


Why don't digital signatures reveal the senders Private Key As I understand it, Digital Signatures involve the 'signage' of a message using the senders Private Key, and its validation by the recipient using the sender's mathematically-related Public Key.

Whilst this seems straight-forward enough, the whole point of Asymmetric encryption (as I understand it) is that the private key is hidden to the world and necessary for decryption, making the publicly available key of the sender therefore useless to the attacker.

If Digital Signatures use the private key of a sender to encrypt data, surely the private key becomes vulnerable, and the message can be attacked using the same decryption attacks commonly used against symmetrically encrypted data.

RSA wouldn't be held in such high regard if it were actually susceptible to the flaw I just outlined, which makes me suspect I have misunderstood something.

There seems to be some confusion here about the difference between digitally signing and directed message encryption. If I digitally sign something I indeed need a private key to do so. But you can take my public key and verify that the holder of this public key did indeed sign this .

Where decryption is concerned. Yes a private key is required to decrypt say a message of some sort. However what we do is, before hand, exchange public keys with one another, and I encrypt the message with your public key not mine (or both depending on the algorithm or purpose). That way only the holder of the private key associated with that public key can decrypt it (i.e. you).

To make this a bit more clear they are different ways of using RSA alltogether, basically at a high level:

Encrypt(plaintext, publicKey) = RSA(OAEP(plaintext), publicKey) = ciphertext
Decrypt(cipherText, privateKey) = OAEP(RSA(cipherText, privateKey)) = plaintext

While signing is slightly different:

Sign(plainText, privateKey) = RSA(Hash(plaintext), privateKey) = signature [s]
Verify(plainText; s; publicKey) = RSA(s,publicKey) = output
if output == Hash(plainText) the signature is verified

This is crude, but shows the high level difference between them. The private key is never known by either party. But they can still decrypt and verify using their own private keys, and each others public keys.


WAF SQL evasion using HPF technique I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discusses two techniques

HPP (HTTP parameter pollution)
HPF (HTTP parameter Fragmentation)

HPP was easy to understand but I am confused with HPF and what is the difference between HPF and SQL injection fragmentation and how it works.

It's pretty well explained in this blog post how it works. In essence, if you can construct such a URL query to split individual parts of a subsequent SQL query in more query parameters (thus the fragmentation part of it's name), the WAF (Web Application Firewall) might have problems determining it's supposed to drop the request, or whatever it's setup to do when such an attempt is detected.

One way of exploiting this is by a adding a begin comment /* at the end of one input parameter, and end comment */ at the beginning of the next one. WAF will consider the two parameters as acceptable, if it's not looking at the whole picture (what SQL syntax comes out as the product of all input parameters).

This might result in a part of SQL code between the two input parameters to be ignored by the RDBMS's SQL engine. If the ignored (commented out) part happens to be filtering SQL query results (say, ... WHERE user=$param1 and start_date>=$param2... can then result in ... WHERE user=$param1/* and start_date>=*/$param2..., providing for a vector to exploit possible $param1 values WAF will consider as acceptable, and also ignore other filters up till the point where $param2 value is used), the end product of such an exploit can disclose information the developers never intended to be disclosed.

HPP attacks, on the other hand, are trying to take advantage of differences between the interpretation of input parameters by WAF and the request handling web application, when a single parameter name is repeated many times. For example, let's consider this URL query to be parsed and analyzed by both: ?q=acceptable+request&q=not+acceptable+request. WAF might take the first input parameter as the one to analyze and ignore the next one, while web application might do exactly the opposite.

Note that I'm only using URLs as an example, and the input parameters can be requested at any other part of a HTTP request headers (cookies, POST or GET request fields,...), depending on where they're later parsed from by web application.


Dealing with a large number of bad chars I have recently discovered a Buffer Overflow vulnerability that leads to Remote Code Execution. However, due to the structure of the application assessed, a lot of so-called 'bad chars' came up. The list is as follows:

\x00\x0a\x1a\x0d\x22\x2f\x2a\x26\x2e\x3a\x5c\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a

It basically eliminated the whole uppercase alphabet A-Z, since the application turns these letters to lowercase.
The question is, is exploitation still possible in such a case? If so, what are the methods to achieve it?

It's impossible to tell whether this specific case is exploitable, but the answer is usually yes. Generating exploit code that avoids certain bad characters is a well-known problem with mature solutions. The exploit payload generator in Metasploit includes an encoding step which takes care of this: you tell it what characters to avoid and it builds a decoder that avoids these characters. You can try it out for yourself.

If you're new to this, keep in mind that just because you don't manage to build an exploit doesn't mean that there isn't one. A good black hatter can often find solutions even where Metasploit gives up.


What does key, key pair and signature mean here? I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with:

  X.509 certificates can be used for servers, clients, email, code signing and more
  applications.http://twitpic.com/6gdxaq indicates that a certificate...

The image refers specifically to an incident in 2011, where a rogue google.com certificate from Diginotar had code-signing capability. I wanted to remove dependence on external service Twitpic for the sake of URL persistence. In trying to do so, I noticed something I've seen often, and don't understand. In this context, it refers to cloudfront.net. I'm guessing that is because Twitpic uses Cloudfront as their content delivery network (CDN)?

I can't (easily) upload the image to IT SE, as Twitpic only offers a 150px square thumbnail http://twitpic.com/show/thumb/6gdxaq.jpg. I don't know if Twitpic does this for security, or for SEO purposes. If the latter, it would ensure that viewers visit the Twitpic site in order to see a larger version. To view the full sized image in my browser, there is a Cloudfront domain URL http://d3j5vwomefv46c.cloudfront.net/photos/large/390320594.jpg?with several portions appended. This is my question: What do key, Key-Pair-ID and Signature mean?

key=409511&Expires=1358170888&
Key-Pair-Id=APKAIYVGSUJFNRFZBBTA&
Signature=ZLwi3pS71nfx0MzKMdFMQZYwYtKjzxnoIgLxDa6X16o3K7pjtywH-Sqm7rvZqe3XH0ELZb4fQffF5lWG2h2PF4ONGCoCL6zQKfr~Ep9raiUPM1pO1LbrUDZEJBoYSURAecyNJsctRd9wJgKoFnEkHnSfvsNexYx-Y91cTVmYPQc_

Is there a standardized nomenclature, and is it analogous to what is used for certificates, such as X.509 (SSL) which contain a keys and a signature? That was why I included so much information about the prior question, in case there were any actual or conceptual similarities.

Or does this pertain to authentication, instead of authorization?

It seems that Amazon is using this mechanism for authenticating requests to the CloudFront Servers. Read more here and here.

You generate a key pair using your Amazon account and sign certain URLs that point to private resourcesa and you distribute this signed URLs to the people you want to access your site. The parameters help identify the key that signed the URL(your private key) and the time until the URL can be accessed using this link.

This is how Amazon checks that you authorize the connection at that specific time.