Subkey rotation and revocation If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I let my subkeys expire, does that have the same effect as if I revoked them?

Short answers:

Adding or revoking signing or encryption subkeys does not affect signatures on your public key.
Revoking a subkey or letting it expire will have the same effect of marking that subkey invalid for all users.

Longer answers:

Technically, your entire PGP key consists of subkeys, but the certification ("C") subkey is considered the backbone of your PGP identity and is often referred to as the "primary" key. When you give out your public key to others, it's the fingerprint of the "C" subkey that you pass around. The "C" subkey is used to cross-certify other keys -- either your own subkeys, or public keys belonging to others. If you add or revoke any signing ("S") or encryption ("E") subkeys, this will not affect the signatures on your "C" subkey, and therefore your cross-certification data is not impacted by subkey changes.

In general, PGP will only care whether a subkey is "valid" or "invalid". Expired or revoked keys will be equally treated as "invalid", and it's up to the UI to display the reason behind it ("expired" vs. "revoked"). Actively revoking subkeys requires that you republish your public key and convince your correspondents to apply the updates. There is no universally established mechanism for receiving timely key updates, so many users choose to create shorter-lived subkeys that will force their correspondents to refresh the entire key when the subkey expires ("passive nudge") instead of creating long-lived subkeys and then notifying everyone to fetch key updates in case of key revocation ("active nudge").


Can malicious communication be hidden reasonably well in encrypted network traffic? Given that a lot of websites now use TLS/https to encrypt all network traffic: If a client machine is compromised and does need to establish a back channel to a C&C-Server for additional instructions and data exfiltration, can it be successfully hidden in HTTPS traffic?

Network based intrusion detection systems have - unless utilizing a HTTPS proxy - little knowledge of what other resources are to be loaded after an initial page load. If the malware sends a heartbeat by using suspicious header data on an HTTPS request (and gets tasking back in form of maybe an image treated with steganography, can regular network based IDS pick that up if the DNS requests do not trigger anything and the IPs are not on a blacklist?

Additionally, as port 443 is usually allowed in firewalls (and established connections are usually allowed back), this seems to be a good spot to hide in plain sight.

How could this be determined to be malicious content when it's properly encrypted? Could this allow malware to hide it's communication from the sight of most analysis?

What are possible ways to pick up and detect malware that hides its communications in this way, i.e. sending a single request whenever it must and there is a lot of https traffic to different servers ongoing anyways, for example with an initial facebook loading?

While HTTPS makes it much harder to detect malware from traffic payload the communication can also be hidden with plain HTTP. This is done for example by encrypting the transferred messages with a shared secret or by using steganographic techniques.

Still, detection might still be possible by looking at the meta data of the traffic instead of the content. Such meta data are for example the traffic patterns: Even with TLS the direction and size of traffic is still visible, i.e. it can be seen when a request is sent and when a response is received. Visiting a HTML page with a regular browser will result in request+response bursts since the loading of the HTML page will cause a download of the embedded resources. Other meta data are features of the TLS handshake, like which ciphers are offered by the client and in which order, which TLS extensions are used, what kind of certificate is returned etc. Other meta data are target and timing of the request, relation to DNS traffic etc.

There was an interesting research by Cisco about this topic, see for example Detecting Encrypted Malware Traffic (Without Decryption). At the end of this link you will also find references to further research.


In Metasploit, how to use a custom exe as payload? Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to execute my payload.exe, how can I do that?

It is possible in SET, where you can just import a custom executable.

Is it possible in Metasploit?

You can execute any payload file or string you like using the msfconsole with these options:

PAYLOADFILE The file to read the payload from
PAYLOADSTR  The string to use as a payload
ARCH        The architecture that is being targeted
PLATFORM    The platform that is being targeted
VERBOSE     Enable detailed status messages
WORKSPACE   Specify the workspace for this module

http://www.metasploit.com/modules/payload/generic/custom


Finding how many filtered ports of a host that would be listed as “filtered” on Nmap I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this.

Using Nmap, find how many ports are filtered in testphp.vulnweb.com are displayed as "filtered."

From my understanding, it was asking me to find filtered ports that would be displayed as filtered. If i want to find how many filtered ports of a host that would be listed as “filtered”, would I use the -sA command for the firewall or is there a way to do that? I’ve tried -d2 but only found ALL filtered ports.

Please let me know if I'm overthinking it or the question should be interpreted differently. Thank you in advance!

Filtered ports can be differs according to your scan method. I think the purpose of the question is to understand this. so run it with all possible switches and compare the output to see which one is better to bypass firewall


Transparent Proxy with tight whitelist, permitting GET requests still prevents data egress? We have a network that currently has zero internet access. I want to provide a means for the users on the network to access certain productive sites for reference, such as the Stack Exchange Network, W3Schools, Perl Monk, etc. Also I want them to be able to download the latest updates for their applications, including Firefox, Chrome OS, IntelliJ, perhaps even Windows updates.

This is on a whitelist basis only. This way if one of them ends up with a virus, it would not have a way to call home, because 'home' is not on the whitelist. (I don't expect anyone with access to Perl Monk servers to be collecting sensitive files submitted by a virus. It would have to be some other arbitrary IP address.)

However, I then realized, that data could be posted in the form of an Email or Forum Question, without the whitelisted network's intentional cooperation.

One option is to adjust the proxy to only allow GET requests. For example, Stack Exchange can be navigated readily with only GET requests, but content cannot be submit without the use of a POST request. In this way the developers could still get answers to their questions without giving viruses a way to call home.

Is a whitelist of hosts reasonable?
(I'm thinking yes, since it makes 'call home' more difficult for a virus.)
Is permitting GET only, without POST considered impractical, or is this a technique used in the industry. Am I crazy or is this a good idea to set on the Transparent Proxy?

Sites should restrict any data submission functionality to POST requests, to protect themselves against CSRF. So following the assumption that the participation will be good in the whitelisted sites, it seems like allowing GET requests is a good idea. What is recommended?

I don't think your average virus is designed to circumvent whitelist blocks, and doing so via a forum question seems too low bandwidth to be worrisome (or interesting for the average virus writer).

I say 'average', because this kind of behaviour is more to be expected of a tailored virus designed to exfiltrate very selected information from your network.

But, at that point (i.e. a virus designed just for your systems), I wonder whether it wouldn't be possible to setup some sort of covert channel - haven0t tested it, but maybe reading a question via GET increments its view counter? In that case the virus and its CCC server could agree beforehand on a number of very old questions, that are unlikely to get views, and the combination in which to view them in order to encode a given sequence of bits.

I think that for the "average" scenario you're doing way too much (but, hey, better safe than sorry - belt and suspenders and all that). For the "they're looking for you" scenario, isolated (and expendable, maybe just through imaging and reformatting) workstations and physical compartmentalization of Stack Overflow queries and sensitive information seem preferable.


Long term trust anchor validation Let's say someone signs a document for long term validation using a certificate issued by a trusted CA. Throughout the following years, the document is timestamped again and again by multiple trusted TSA.

Now we project ourselves in a distant future, ie 40 years from now. The original CA is long gone, out of business. I can certainly validate the integrity of the original signature, by going through and validating the timestamps chain. But how can I be sure that the signer certificate was really issued by the same CA that was trusted many years ago, but has since disappeared ? Should I have kept a copy of the CA certificate from the time it was active, and trusted, and preserve its integrity using timestamps ? Would have this bring any more trust in the validation ?

Edited for clarification:

Lets have 2 docs D1 and D2. Both contains a valid signature S1 and S2, and both were timestamped with Trusted TSAs (could be the same TSAs!). The only difference is S1 certificate was issued from CA1 and S2 certificate was issued from CA2. From an integrity point of view, everything is valid. From an origin point of view, 40 years ago, when both documents were signed, we only trusted CA1. CA1 and CA2 now no longer exists. How can I make sure, without doubt, D1 is a document I trust (because it was signed a a time we trusted CA1), and D2 a document I don't trust.

Maybe this is solved only by timestamping, but I feel I would be trusting the process the document went through, rather than the document itself.

You don't need to validate every signature if each TSA, before adding its time stamp, validates the previous signature. So TSA 1 validates the initial document checking the validity of the initial CA. Then TSA 2 validates the signature of TSA 1. As this signature covers the entire document, we know that the document hasn't been changed. Then TSA 3 validates the the signature done by TSA 2. As this includes everything, including the signature of TSA 1, we know that there's been no tampering. This carries on all the way through TSA N. Each TSA only needs to validate the previous signature. When you eventually receive the document, all you need to do is validate the signature done by TSA N and you'll be guaranteed that nothing has been changed.

One interesting aspect of this data structure is that even if a TSA's private key becomes exposed, as long as that exposure occurs after the next signature is applied, the security of the document is not jeopardized. Specifically, if TSA I's key is exposed after TSA I+1 has signed the document, integrity is maintained.

As @jhash points out, this is a block chain that has become popularized by Bitcoin.


Locale detection & huge Accept-Language header, can this be considered an atack vulnerability? I was looking for some examples of automatic locale detection as I needed to do the same in my PHP app.
Most of the answers I found were similar, only differing in the parsing methods.
An example 'pseudo-code':

$supportedLocales = ['en, 'bg', 'pl'];
$locale = 'en'; // default fallback locale

$userLangs = preg_split('/,|;/', $_SERVER["HTTP_ACCEPT_LANGUAGE"]);
foreach($userLangs as $lang)
{
    if(in_array($lang, $supportedLocales))
    {
        $locale = $lang;
        break;
    }
}

But, after a while of experimenting with the Accept-Language header in my browser to see if everything works correctly, I noticed that I could actually make the header very long, causing the server to do a lot of looping because the code above loops through entire $supportedLocales array for every key in $userLangs array.
I could actually easily send an forged Accept-Language header with over 25000 fake languages that were not supported by the app, therefore generating over 100000 iterations in total. Not including the iterations used to compare the string values.

Even here on Stack websites, I could send over few thousand languages before getting a '400 Bad Request' error.
If this can be considered an attack, how can one protect his website from such forged headers? I know I could just limit the amount of languages, but still, what amount can be considered normal?

If this can be considered an attack, how can one protect his website from such forged headers?

Forging requests that take a long time to process on the server is a common technique for a Denial-Of-Service (DOS) attack. This is why you always sanitise your input. Not just POST and GET values, but also the headers if you use them.

For the HTTP_ACCEPT_LANGUAGE header, I'd say anything more than about 30 characters or 10 languages would not be a sane value for most applications. So sanitse the header. You can either limit the number of results in preg_split or limit the length of the HTTP_ACCEPT_LANGUAGE header

$userLangs = preg_split('/,|;/', $_SERVER["HTTP_ACCEPT_LANGUAGE"], 10);

or

$userLangs = preg_split('/,|;/', substr($_SERVER["HTTP_ACCEPT_LANGUAGE"], 0, 30))

edit: The answer by user 'Your common sense' was accepted, but please realise that optimising a loop is not the right way to protect yourself from any forged input. You're just reducing the impact, instead of solving the source of the problem.


Are there really functioning quantum computers? I saw this video on youtube on quantum computing. It says that a company called dwavesys has already made commercially available quantum computer. I checked on the website and it exists. I thought that this was still in theory and quantum computers are a distant future. If what the video says is true, then the whole Public Key Infrastructure will collapse, right?

Yes, a fully functional quantum computer could solve the hard problems that are at the root of Public Key cryptography. And yes, D-Wave Systems have indeed produced a machine that seems to have some characteristics of quantum computing. But D-Wave have yet to demonstrate that their computer meets all the criteria of quantum computing needed to solve problems like the RSA problem or the discrete logarithm problem.

In fact some experts doubt if the D-Wave computer should be considered a quantum computer at all. MIT Associate Professor Scott Aaronson wrote on his blog:

  For me, three crucial points to keep in mind are:

  (1) D-Wave still hasn’t demonstrated 2-qubit entanglement, which I see
  as one of the non-negotiable “sanity checks” for scalable quantum
  computing.  In other words: if you’re producing entanglement, then you
  might or might not be getting quantum speedups, but if you’re not
  producing entanglement, then our current understanding fails to
  explain how you could possibly be getting quantum speedups.

  (2) Unfortunately, the fact that D-Wave’s machine solves some
  particular problem in some amount of time, and a specific classical
  computer running (say) simulated annealing took more time, is not (by
  itself) good evidence that D-Wave was achieving the speedup because of
  quantum effects.  Keep in mind that D-Wave has now spent ~$100 million
  and ~10 years of effort on a highly-optimized, special-purpose
  computer for solving one specific optimization problem.  So, as I like
  to put it, quantum effects could be playing the role of “the stone in
  a stone soup”: attracting interest, investment, talented people, etc.
  to build a device that performs quite well at its specialized task,
  but not ultimately because of quantum coherence in that device.

  (3) The quantum algorithm on which D-Wave’s business model is based —
  namely, the quantum adiabatic algorithm — has the property that it
  “degrades gracefully” to classical simulated annealing when the
  decoherence rate goes up.  This, fundamentally, is the thing that
  makes it difficult to know what role, if any, quantum coherence is
  playing in the performance of their device.  If they were trying to
  use Shor’s algorithm to factor numbers, the situation would be much
  more clear-cut: a decoherent version of Shor’s algorithm just gives
  you random garbage.  But a decoherent version of the adiabatic
  algorithm still gives you a pretty good (but now essentially
  ”classical”) algorithm, and that’s what makes it hard to understand
  what’s going on here.

So at least for now there is no practical quantum computer in existence that would undermine Public Key cryptography nor is one expected in the near future. Some experts  believe that it's still a long way off.

BTW, for a great analysis of the impact of a future quantum computer on cryptography I would recommend Matthew Green's blog post on this subject.


What is an Origin Error Attack? Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one.

From The Forrester Wave™: DDoS Services Providers,
Q3 2015 report, em mine:

  Attack types defended

  CGI request, denial of capability,
  diluted low rate degrading, direct,
  DNS request attack via fast DNS,
  high-rate disruptive, hybrid attack,
  ICMP attack, isotropic attack traffic
  distribution, land attack, nonisotropic
  attack traffic distribution,
  ping of death, reflector, TCP reset,
  TCP SYN flooding, teardrop attack,
  UDP flooding, varied rate, highly
  volumetric AppSec, poison dart,
  slow POST, and origin error attacks

Well, frankly, in general your list looks like a made-up set of automatically generated marketing buzzwords, sometimes completely unclear or unrelated to cyberattacks ("direct" anyone?). However, the author of the said report claims to have taken the list from Akamai, which probably gives us a clue to what "origin error attack" means.

Akamai is a CDN provider. Though the paper is dedicated to DDoS attacks, and Akamai DDoS Mitigation is technically completely unrelated to Akamai CDN network1, it's still the same company, at least in terms of PR and marketing activities.

Here's a short summary of CDN terminology. A content delivery network consists of edge servers – devices which serve a content to clients (e.g. Web browsers). The content an edge server maintains is retrieved from an origin server and distributed to all edge servers, or a subset of them, in a way specific to the particular CDN. An origin server is the server (operated by a customer of the CDN) which is hosting the original content, the latter being then copied, cached and distributed by a content delivery network.

In case of a cache miss, i.e. when a request is received for a piece of content which is missing on an edge server, the latter requests the content from the origin server. An origin error is the message returned to a browser by an edge server in case there's no such content available both in the edge server cache and on the origin server, under most normal conditions2, together with a 404 "Not Found" HTTP status code.

A typical (botnet based) application layer DDoS attack towards an HTTP application may have little3 impact on the availability of the said application in case all the Web resources requested by a botnet are cached by a CDN, and the latter is powerful enough to handle all the requests from the botnet. However, an attacker may choose to request only those resources from the CDN which are guaranteed to be absent on the origin server (e.g. random resources from a non-existent directory). This way, all the requests from a botnet would result in cache misses, and would all be simply proxied to the origin server which hosts the HTTP application, rendering it unavailable for legitimate users due to heavy load.

It is more or less suitable to call this method an "origin error attack" if anyone wants to give it a name.

A modification of such an attack is requesting resources that do exist both on edge and origin servers, with a random query string, e.g. https://example.com/?jhd=370 instead of simply https://example.com/. Some CDNs treat such a request as a cache miss and forward it to the origin server, as HTTP specification suggests. Others can be configured to strip query strings when a static content is requested, or deny such requests at all. Thus such an attack method, while being rather efficient against a dynamic Web site, might impose little impact on a static one.

**

Update (26.03.2020): there's now a conference proceedings paper which describes the attack in more detail.

1 Akamai Technologies maintains its Internet presence as autonomous system 20940. Akamai DDoS Mitigation (formerly Prolexic) is AS 32787. Akamai Technologies has acquired Prolexic in February 2014, however, as of March 2020, former Prolexic network seems to be still only loosely related to the main Akamai network:

Peering policies and locations available for peering are completely different for CDN and DDoSM networks;
Routing policies for CDN and DDoSM are also completely different.

2 The 404 status code is returned in case the edge server is able to reach the origin server, but the origin server itself responds with the 404 status code. In case the origin server is unreachable or doesn't respond to requests, 502 Bad Gateway and 504 Gateway Timeout status codes are often returned, respectively.

3 In case all pages of an application are cached by a CDN, a DDoS attack may still have an impact on the application's availability, but the impact is limited to the infrastructure issues, for example, DNS server performance in case the botnet nodes resolve the name of the victim themselves, or OCSP server performance in case bots are built on top of headless browser instances, and so on.


OAuth2: Where should I store my refresh token in a stateless application? In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented.

I went to the hassle of implementing OpenID Connect (mainly thanks to authlib) to let the authenticated web applications being stateless. It also allows me to make requests between apps without reauthenticating users, by passing my JWT around. Thats very handy...

Now I am facing the following problem : If one of the said web application wanted to refresh their token instead of going through the whole code flow again, they would need to store a refresh token somewhere in the backend, where it is secured.

Sadly this would break the stateless authentication I was looking for, which forces me to mount some sort database on each one of my web applications that initially didn't need any.

Is there a way to refresh a JWT in a stateless way ? Or, to rephrase my question, where can I store my refresh token in a stateless application ?

Put is simply the answer is "Don't use the refresh token" because it's not how the system is supposed to work when you're having SPA, apis and an identity provider. The documentation is a little bit confusing on this point because it has been designed a long time ago, before SPA were dominant. The main issue is that, at first, you probably considered the api servers as the relying parties and the angular application as just "front". At least it was the problem that I had. And it's simply not the case.

The key point here are that:

Your SPA is the relying party, not the flask APIs server.
Your APIs only need to validate the JWT token, not to take part in the authentication flow or get access to refresh tokens etc.
Your SPA doesn't need to obtain/use refresh token as those are mainly use by more "controlled" type of services. Instead openid connect includes an iframe logic in its specs, allowing the RP to get new access and id tokens when the current access token is close to the validation end date time.

The next question is which authorisation grant flow you should use ? The answer is PKCE. You don't want to use implicit because there are known security breaches. You can't use classical code flow because you'll need to put the client secret in the angular app. Luckily that's exactly why PKCE has been created: https://tools.ietf.org/html/rfc7636

And to implement that you'll need 2 things:

Implement the PKCE logic in angular, but somebody already did most of the work: https://manfredsteyer.github.io/angular-oauth2-oidc/docs/additional-documentation/code-flow-+-pcke.html
A python lib that simply check the received token to authenticate the user at the api level. I don't know flask very well but for Django I use a small lib: https://github.com/ByteInternet/drf-oidc-auth. That lib is basically one file. You want stateless so you want to use a JWT instead of a Bearer.

Once you're there, the system will probably suit your needs:

Long run authentication is handled by the IP, and as long as the user is logged in at the ip level, the iframe will ensure that his access/id tokens are up-to-date.
API servers are stateless and don't require a database.


SSD is formatted twice and filled twice. Can i recover old deleted data? I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.

First the drive had a Windows 7 installed.

Then it was formatted twice with windows installer. After each format the space was filled with random video files.

Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.

The drive is an SSD.

Is there any possibility to find the old data?

Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say

No, you cannot recover any data from that disk.

This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.

If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?".
There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …).
But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.

Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.


Should passwords be automatically reset when the underlying method changes I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password hashing algorithm may not be up to cop (aka not BCrypt). (The terrible thing is not quite sure what it is and where it came from!).

This obviously has to change and the patch is being scheduled. We have to naturally update all our test users because their passwords will be using the old hashing method, not much of a problem, all our demo users are automated on build so it's updating the script. But the next question is what if this is a production system with active and stale users, of all amounts. What would be best practice.

Automatically force a password reset on every user? This will notify every user that their password has been changed and may cause question/confusion and may cause suspicion that there's been a security breach. More questions may be asked which may not necessarily be able to be answered by website stakeholders.
Update the DB to flag whether it's the new or old method, then once a user has been authenticated update their password in the DB using. Requires a bit of logic in the service and transition will be seemless to any existing user. The problem being if there was a breach then it may be evident that there are two methods going on here and if the less secure one is found to be that insecure it could obviously be broken.
Reset all passwords, using a BCrypted version of the existing hash. Flag it as the old style, so on successful authentication it just keeps a hash of the password rather than a hash of a hash.

Your option 1. is a bad idea: in addition to the User-Experience / Public-Relations reasons you state, you're also giving attackers a window to intercept the password reset tokens and compromise every account on your server. It also doesn't solve your problem if you have even one user who's too lazy to log in / update their password.

At first glance, both 2. and 3. seem fine to me. Your #2 is no less secure than what you're doing now, but 2. would mean you have to continue supporting the current weak login forever (or do something like "After X months we're wiping your password and forcing you to do a recovery" which breaks the nice user-transparency you want, so let's ignore that).

Let's consider the case where you have users in the DB who will never log in again. With both 2. and 3. you have to continue to support the current hashing alg in your code-base forever just in case they do log in, but at least 3. has the advantage that they (or rather, you) are protected against offline brute-force attacks if your DB is ever stolen.

Since you'll have to keep the "old style flag" column around forever, do yourself a favour and make it an int not a bool so that if you ever have to update your password hashing alg again, you can record which old style they are on.

UPDATE: A very similar question was asked here and built on the discussion from this thread.


Best way to store a password for web app I know how to store passwords for authentication of users (hash, salt, etc..), but in this case, I am developing a web app and I need to connect to other services and in order to this, I need to store username and password, so if I want to connect, I need to read the password that makes hashing useless, so I was thinking about encrypting it in the database or maybe in a protected file. Best way to store a password for web app?

The best way is to NOT store the password at all
Second way is to use a public and private secret to communicate with your service (things like oAuth and X.509 certificates)
Third is to encrypt the data on the phone itself

The problem is that anything that's outside of your control can be possibly subjected to tampering.

Facebook, Twitter, Google and some other tech giants created the oAuth standard of which oAuth-2 would do nicely for you.
You can store a not so secure secret on the phone to secure the authentication channel than set up a secret that is only known on the phone and server and it is specific for that communication only.

To the how to do this, without knowing what platform you are using, I cannot assist there.

Ask yourself why do you need to have access credentials that anyone can use. You should consider only credentials that can easily be revoked and are specific to that connection only (so a mobile token used on the desktop yields a lockout for example).


URL query string guessing I have recently identified a controller that handles query string parameters that are not obvious, by simply guessing query string parameters. E.g.

http://domain.com/controller.php?guessed_param=18

Is there a tool that takes a base URL and builds several variants from it with common query string parameters?

I'd recommend looking at something like Burp suite's intruder feature for this. that can easily create a variety of URLs from a base, and includes preset lists.

Another option would be to look at OWASP ZAP which is a similar application.


Logging someone else's google account on my Andoid device Earlier today I had to add someones's Google account to my Android phone, to help them with something. My phone is a Samsung Galaxy S7 with the latest Android version, not sure if this is important. Anyway, I helped them and then immediately removed the new account from my device, the whole thing took 4-5 minutes at most.

Now, I know that when adding a new account Google tries to download things like contacts from the new account to the phone, but does it also try to do the opposite? I mean, upload any information from other existing accounts on the phone to the new account?

The other person does not have my login details and I use two factor authentication.

Google products will not try to merge two separate accounts even if it is signed in on the same device. The only way to transfer data between two accounts is via exporting from one account and importing to the other.


How to encrypt a USB to be used with MAC & Win I would like to find out if it is possible to encrypt a USB flash drive (or only password protection) which could work with dual OS ( Mac & Windows ).

Is there a free software that i could use to do this or any different method ?

I am not sure if there is a free software for that, but there is a free trial for EasyLock, a cross-platform data encryption software for USB devices. Once you open the product page, select Resources Tab, USB Setup for Windows and Mac. You don't have to install both of them, you just choose the compatible one with the computer where you use it for the 1st time.
If you have any questions, I am here for you.


Storing encryption passphrases in memory in Dalvik? Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device.

In the native applications for Windows, OSX, and Linux, whenever the database is locked or exited, the password is erased from memory by filling its location with zeroes.

Since Java itself does garbage collection in a different manner, is there a real, tangible concern over storing passphrases in memory in the JVM? How about in Dalvik for Android?

Other than setting this.password = null;, what can be done to ensure that the passphrase has been securely erased from memory?

In Java the memory management is completely under the control of the VM. You can never be 100% sure what the VM does with its memory, because that's completely up to the implementation. However, there are things you can do to discourage the VM from caching.

Just null-ing a reference is not a good way to persuade the VM to remove something from memory. It will take at least until the next garbage collector sweep until the data is collected. With the class String you also have the problem that the Java specification mandates string pooling (multiple strings with identical content are mandated to use the same memory). This could be a reason for the VM to cache a string in memory even when there are no references to it.

What you could do instead is go the low-level C way and store your password in a char[]. There isn't much reason for the JVM to do much abstraction on arrays of primitives. When you overwrite each entry of a char-array with nul-characters, it is quite unlikely that the JVM will keep a copy of the original content.


Algorithm used in grid card authentication I have seen banks using grid card authentication after primary password based login. However, I am unable to find sufficient detail as to how it is being used. Is the challenge truly random or pseudo random or is it deterministic? Other implementation details also seem to be blurry.

Any clarity would be appreciated

Ref: ICICI grid authentication
(http://ishanbhalla.com/good-design-axis-bank-debit-card-based-authentication/)

LastPass Grid Authentication vs Google Authenticator which one is more secure?

Grid authentication isn't standardised in the same way that TOTP/HOTP is: you can find grids which contain anything from 9 spaces ("keypad" style) to 260+ spaces (Lastpass style), and which require anything from a single character to a whole string formed from some kind of pattern. As a result, it's impossible to give a general answer to the question.

However, the security of these systems doesn't come from the specific position of requested characters, but from the fact that the requested characters should be known only to the grid holder. From an attacker point of view, there is no difference between a system which asks for characters found in spaces A1, B1 and C1 and one which randomly selects from the whole grid, unless they only have part of the grid, or some way of verifying specific characters (whether individually, or as a set).

In all following, the attacker is assumed to know the account details other than the grid contents - remember that grids are usually a second factor, so the attacker first needs to get the password

To give an example, if you have a 5x5 grid containing 25 digits, which were generated randomly and independently (e.g. the presence of a specific digit in one space doesn't have any impact on the contents of other spaces), the chances of guessing the value of any single space is 1 in 10. If you prompt for a single value, request the same value if it's incorrect, and allow 10 guesses before locking an account out, an attacker will always be able to get into the system, unless they're daft enough to try the same digit multiple times. If you prompt for 2 values (again, asking for the same pair if either or both is incorrect, and giving no indication of which is incorrect), the attacker has a 1 in 100 chance of getting the right pair. They might get in given 10 attempts, and have a pretty good chance of getting in given 50 attempts (50%, clearly!).

This is the same no matter how you select the values to ask for, as long as you always pick distinct values - if you use a method where you can ask for "A1" and "A1", the security drops to whatever the security of asking for a single value is in those cases.

If the grid isn't random, though, you can end up with problems. For example, if you generated it by permuting the digits 0-9 into columns labelled A-J and then provide 5 rows, labelled 1-5, you'll have 50 values. If you ask for A1 and B2, you've got a 1 in 100 chance of getting them both right. If you ask for A1 and J1, though, you've reduced the search space. If A1 is 0, J1 isn't - there are only 9 possibilities. The attacker has a 1 in 90 chance of getting the right pair in this configuration. In this case, you'd actually be slightly better off with a less random selection for the requested grid positions...

If an attacker has partial knowledge, however, you clearly want to make it difficult for them to use that knowledge. A system which always requests A1 and B2 doesn't help an attacker with no knowledge much, but falls to an attacker who knows only the contents of A1 and B2, even if the grid is perfectly generated. Therefore, you ideally want to make the values requested for distinct login attempts different (e.g. when someone logs in successfully, the next login attempt should ask for different values). It doesn't matter much how they are different, if the grid is truly random: moving from A1, B2 to A2, B3 would stop an attacker who only knows A1 and B2, after all. However, you then need to think about whether you are providing information which might allow them to log in at some point in the future. For a 5x5 grid, the incremental approach, wrapping at line ends, will mean that the 1st and 26th logins will require the same values to be provided. If you just put all the possible grid positions in an array and randomly shuffled them, you've not got that problem, and you've avoided the same grid position coming up twice.

It would be preferable for any given combination of values to never be requested again. However, this puts an upper bound on the life of the grid - you can only have as many requests as there are combinations of grid coordinates. For one value, that's the number of values in the grid. For 2 values, that's the square of the number of values in the grid. For n values, it's (number of values in grid)^n. You can increase this even more if you care about order, as well as specific values. In order to prevent repetition, you'll need to monitor which combinations have been used already, in some way, and, ideally, avoid any link between requested combinations. If you want to protect against an attacker who has been monitoring data, it's bad if they can intercept A1,B2 and C1,D2, then they get B1,C1 as the next request, predictably. That combination might come up naturally (that's random for you), but that's always a potential flaw here - in theory, you could get two TOTP values in a row which are the same, but it's unlikely. Specific grid authentication methods take steps to avoid repetitions, but again, it's not a single method - it depends on the other properties of the grid system being used.

TLDR: there isn't a single method, but it doesn't really matter, since the selection process for the position shouldn't make as much difference to the security as the contents of the grid itself.


Allow read-only access to server-side pages for security review? This answer:

https://security.stackexchange.com/a/37319/10574

Mentions the issue of host-based security. To the end user, the web server is an untrustable black box.

Would it provide to needed transparency to make host-based security trustable if your users could read the live server-side code that runs the site?

So, for instance besides accessing example.com/default.aspx in your browser and getting the response, what if you opened up read-only FTP access and allowed the code in default.aspx to be read? Would that make your code open to review, and trustable? (kind of like how open source projects are considered more trustworthy because there's nowhere to hide back doors or badly written security code)

Is it feasible to do this?

This is feasible to set up. But it only superficially solves the problem.

It doesn't necessarily create extra trust. Why? It's not too hard to redirect FTP to another server (or to another folder). An untrusting user could claim that you have set up two servers; one with the live, malicious code and one with innocuous code. You direct FTP requests to the innocuous server, and let the web server run the malicious code. Remember, you get to choose what they see when they ask for an FTP connection. Spoofing it isn't too complicated.


If the encryption algorithm broken or analysed, can an attacker find my password? If the encryption algorithm broken or analysed, can the attacker know what my password was?

One of the rules upon which cryptography is based is that everything must be supposed known to the attacker. The only thing that is secret is the key. Some famous algorithms which follow this principle are DES, AES and RSA. So an attacker can't find your password only by studying the encryption algorithm.


PCI - Backend Applications and SQL Injection Currently pursuing PCI certification and our internal team is mandating that all inline SQL be moved to parameterized queries. No question this makes sense for web applications.

I'm wondering about opinions on the applicability of this for backend applications. We have a number of very old (VB6) applications used to integrate with various other organizations (think ETL jobs with batch file exchanges over SFTP). Updating all these is a tremendous task and I'm wondering how necessary it would actually be.

Thanks.

You have to consider insider threats, if these applications have sql injection vulnerabilities and access to sensitive data you could be opening yourself to unauthorised viewing and modification of your data by malicious internal actors.  The rule is is never trust input, even if it does come from someone that works for you.

Secondly, think defence in depth. What if an attacker breaches your perimiter and finds one of these tools. This could be an additional attack vector.

I would pen test these applications for sqli vulnerabilities and fix issues you discover rather than a blanket rewrite, that would be more efficient.


My Apache log is kind of freaking me out So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, registered to some dude in China, that redirected to my server. I looked around and found that it's pretty common to have folks requesting stuff to check for vulnerabilities in your site etc.

Then I saw a GET request with my FTP username in it, not made by me and that's when I started getting worried my server had been compromised. I promptly started taking measures, making sure everything was up to date, changing passwords, username of my FTP, hosting account and pretty much anything I could think of. Now I see the same type of requests, with my changed FTP username, still not by me.

This is kind of freaking me out.

There's nothing terribly serious on my webserver, it's just a couple of basic sites I've been (mostly) playing with. No client data or anything sensitive like that. I just use it to host my online webpage/resumé for the moment.

Still, I don't have any experience in how to deal with this & I'm somewhat uneasy about what's going on. My site is very simple, so I could quite easily rebuild it from scratch..
What's the best course of action here? Burn everything & start over?

A million thanks to anyone taking the time to reply, I could really used some advice on this.

Do you use any application to access your FTP account? The first thing I would do is to check the source of the FTP connection. Some application may save your credentials if you have selected to and would periodically connect. Don't freak out yet, check the source IP of the FTP connection. If it is from one of your IPs, it is probably a saved password in one of your application. If it is something from elsewhere (China), you might even have issues with your personal machine as you mentioned that you changed the username and it appeared in the logs when you did not use it.


Base Programming for vulnerabilities Hello, I am a beginner looking for some information.

My question is the following:  In order to understand certain security concepts is it essential that I understand the underlying languages?

For example, to understand XSS should I know Javascript?  To understand SQL Injection should I know SQL?  Or is it enough to have a background in programming and study vulnerabilities that use technologies that I am not particularly familiar with?

I think it would be very difficult to truly understand security concepts like XSS and SQLi without knowing at least a little about the underlying languages.  While you may be able to execute a XSS or SQLi attack without knowing javascript or SQL, it would make you more of a script kiddy than it would a true security expert.

It also truly limits your ability to find vulnerabilities that are a little off the beaten path.  The deeper your understanding of how a language works the easier it will be for you to exploit applications that use it.

That being said, knowing a little about a language will go a long way.  You don't need to be a SQL master to understand how SQLi works.  Just being familiar with the basics will help you familiarize yourself with concepts like SQLi.


SSH login without password I'm currently trying to get basic shell to an educational linux machine. I'm not an expert when it comes to ssh authentication and keys. I have done only basic ssh setup in the past and I have messed a little bit the public and private keys.

My questions is:
I have managed to obtain the public keys (ssh_host_rsa_key.pub, ssh_host_dsa_key.pub) and the authorized keys file. Is there any possible way to combine this info to login via ssh without providing a password?

In order to login, since you can't add a public key in the remote server, you need a private key. So some choices you have are:

enumerate more and maybe you get lucky by finding the corresponding private key
check if you can access sensitive files e.g. /etc/shadow etc... and if you can try to break a user's hash. Maybe the password revealed can get you ssh access.
Since, from your comment this is an old debian system, as you correctly pointed out, brute-forcing the corresponding private key is worth-trying.


Signing UIDs which do not belong to a RL person with full name Sometimes I am asked to sign pseudonymous UIDs or see PGP keys which belong to organizations rather than single persons. These, by nature, do not contain the name of a real life person; hence there is no obvious way of verifying such identities. (One method I was offered was proving ownership of a domain related to the UID by making a signed document available on that domain, but I couldn't decide if this was enough.)

There are, however, reasons to include such keys (at least those of organizations) in the web of trust, for example a software release signing key should rather have some signatures on it. What would be a decent way of validating such identities (or: under which conditions could such an ID be declared as "verified")?

First of all: what to sign or not to sign is completely up to you. There are no fixed rules on how to verify IDs, nor whether to sign nick names or not. From RFC 4880, Signature Types:

  [...] Please
     note that the vagueness of these meanings is not a flaw, but a
     feature of the system.  Because OpenPGP places final authority for
     validity upon the receiver of a signature, it may be that one
     signer's casual act might be more rigorous than some other
     authority's positive act. [...]

From experience, the usual expectation is probably to only sign verified real names. Can you reason signing pseudonyms, what is the semantics of such a certification? A pseudonym is a self-assigned identity, which cannot really be verified. There might well be use cases; consider a group of people only knowing each other under their pseudonyms, which do not want to reveal their real identity, like a group resisting governmental oppression.

In the end, it's up to you to decide what to sign or not to sign. It might be reasonable to provide a certification policy explaining how you sign other's keys. This will enable others to understand how you verify identities and what you sign, so they can take use of your certifications when searching for trust paths (given they trust you/your key).


Javascript/Ajax Hijacking I was wondering if below GET requests from a HTML file and a javascript file, are vulnerable to AJAX Hijacking/JavaScript Hijacking?

AJAX Hijacking: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/
JavaScript Hijacking: http://www.net-security.org/dl/articles/JavaScript_Hijacking.pdf

1)

                    var req = new XMLHttpRequest();
                    req.open("GET", queryUrl, false);
                    req.setRequestHeader("Accept", "application/json");
                    req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
                    req.onreadystatechange = function () {
                        if (this.readyState == 4) {
                            if (this.status == 200) {
                                //do something }
                                                  }
                                             }
                   req.send();

2)

                var req = new XMLHttpRequest();
    req.open("GET", encodeURI(ODataPath() + type + "Var1"+ Value1+"), true);
    req.setRequestHeader("Accept", "application/json");
    req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
    req.onreadystatechange = function () {
        if (this.readyState == 4 /* complete */) {
            req.onreadystatechange = null;
             // Do Something
    };
    req.send();
};

Your calls are fine as long as they don't send JSON arrays with sensitive information as referred to in your sources. Perhaps you could use normal HTTPS requests for that info instead.


Could an SE question that runs an SVG from a private website potentially be dangerous? This SE question (now deleted, so not easily viewed) contains an animated SVG that loads from a private website instead of the usual GIF's hosted by imgur. The line is:

![https://www.moonwards.com/img/animations/transfer_time.svg][1]

  [1]: https://www.moonwards.com/img/animations/transfer_time.svg

Can the website start collecting SE users' and viewers' IP addresses this way? Are there other potential problems?

I've looked at the answers to I received a suspicious SVG file via Facebook message. What does it do? but I'm not sure how that applies here.

Can the website start collecting SE users' and viewers' IP addresses this way?

Yes. Hotlinking embedded images is a feature on SE which has been criticized by users in the past. In your example, every visitor of the question page also involuntarily issues a request to the remote SVG image in the background. This way, everyone viewing the question reveals their IP address, user agent string, referrer and other browser details to the - potentially untrusted -  third-party host.

  Are there other potential problems?

Usually, SVG documents are capable of delivering active script content. So, allowing users of your website unrestricted upload of SVG images would potentially create a persistent XSS threat. However, when an SVG file is embedded as <img src=...>, as done on SE, the browser blocks it from executing any client-side code.  Therefore, SVGs effectively don't pose a bigger threat here than hotlinking GIF or JPEG images.
Another negative effect of hotlinking is that the third-party host could decide to silently replace the image with advertisement or other inappropriate content at any time. (You can find some real-life examples here.)
Specially-crafted SVG files can be used to exhaust your memory. This is known as the billion laughs attack. As a mild DoS attack, it's more of an annoyance than a serious threat, though.
In some browsers it's still possible to conduct advanced phishing attacks by presenting a HTTP Basic Auth dialog for hotlinked images.

I'm strongly in favor of SE enforcing that all embedded images are hosted on a trusted, reliable CDN (e.g. Imgur, as already done with direct uploads). The community rightfully requires text sources to be quoted in case a link becomes unavailable. So it would be only logical to also preserve images in case the image host goes offline. (However, there might be legal implications of automatically re-uploading copyrighted images in a CDN.)


Tools to help test the security of Android applications What are some decent frameworks to test the security of Android applications?

With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for webapps) to have a good basis to start scanning.

OWASP has a guide that includes best practices for webapps. Often these are applicable as well to Android apps, but it would be nice if there is a dedicated framework.

Wireshark is a good tool to see if the application is sending sensitive data in cleartext over the network.  Also, you can use ssh and adb to look at the data stored on the SD card and the file permissions, to see if sensitive data is being stored in cleartext.

Some free static analysis tools for Android applications:

Comdroid checks for vulnerabilities related to the use of Intents.  See this presentation for description of those vulnerabilities, and other pitfalls.
Stowaway checks for overprivilege: i.e., it checks to see if the application requests permissions that its code doesn't seem to use.

Keep in mind that these are research tools.  Moreover, they focus only on a very specific set of vulnerabilities.  They are not a general-purpose static analysis tool, and are not substitute for a general-purpose security static analysis tool for Android (like Fortify); they are better thought of as a supplement for other tools available to you.

Some security static analysis vendors have support for analyzing Android applications, e.g., Fortify.  Expect these to be expensive.

See also the following questions on this site:

Any useful tools for Android source code review? (but beware that many of the tools listed there are merely generic Java code scanners and do not have any knowledge of Android APIs, so are likely to be of limited use for assessing the security of an Android application)
iOS/Android Pen-Test
Android API/development security pitfalls
Android/iOS application security testing checklist


Client access to domain controller I'm working on a solution to identify if a machine is a member of the domain or not. We are using Checkpoint R75 Identity Awareness with two possible methods to retrieve machine identity.

AD Query to pull out machine authentication from logs.
Identity Agent (software) to log on to the Domain Controller via the firewall.

After some work with Identity Agent, which does not work to well with multiple domain controllers, I'm looking at the possibility to let clients log onto the AD to establish the identity.

Considering that the idea of this solution is to block unknown computers at the firewall, I am a bit reluctant to allow them access to the Domain Controller. Especially since the DC can be considered the "Crown Jewel" security-wise.

Now for the question,

What traffic should be allowed from clients to the Domain Controllers to allow them to login?

Well I guess first off, what port are they going through your firewall and getting to the domain controller? You just need to make sure they can get through port 389 for LDAP if they are authenticating against AD. I'm not sure what else you are asking in regards to what traffic should be allowed from the clients, that's up to you to set the rules for your environment.

Personally, I'd set up a security group in your firewall/vpn appliance (assuming you have a vpn appliance or function on your firewall). Generate some certs from your internal CA and create a web login (some vpn appliances will have one built in already). Only distribute those certs to the people you want to access your network from outside of your organization. This is now limiting access to only that PC you originally wanted to do, since the cert can only be installed to one PC.


How to improve security of a ISP-provided wifi router I have this concern that having my devices directly connect to the wifi router provided by my ISP could lead to security issues. For example if the router gets hacked and the DNS servers are modified to point to some hacked server somewhere.

Also the ISP-provided router does not have options such as guest mode which I would like to use for some things such as the smart TV.

Besides that what I would like to do is to separate some devices such as the network printer so that they are not directly accessible from the ISP-provided router (in the event it gets hacked).

So what I was thinking is to add one more wifi router (e.g. this Trendnet TEW-828DRU AC3200), which would have its own wifi network and would connect to the ISP-provided router using a LAN cable.

The questions I would like to ask about this are:

The ISP-provided router has NAT modes such as "Routed with NAT",
"Routed without NAT", and "Bridged". What difference (if any) would
each of these have on the security?
Would an additional router like this actually increase the security
or would it require anything else (such as a hardware firewall, a
switch, a separate VLAN for the devices I esp. want to protect, etc)?

The general advice is buy your own gear, always. Anything with the ISPs software on it likely can receive automatic firmware upgrades/config changes which can be from annoying (losing advanced configs, etc) to dangerous (some don't even have code signing!).

If you buy your own router + APs you'll want to use bridge mode. This essentially just opens the floodgates of the internet directly to your router (the new one), putting it in charge of firewall and port forwarding configs. You can technically plug your new one into the old one without changing anything but then you get into something called Double NAT which is not recommended because performance and various other weirdness. It's not less safe (maybe more secure through obscureness however). This isn't a security option in it of itself.
You don't need a second device to do VLANs if you buy a good enough router/one which supports DD/OpenWRT. Hardware firewalls aren't necessary either since the vast majority of the time when you have a pretty flat structured network with no special intercommunications rules you can just stick with the "isolate networks" option. You can, of course, get a hardware firewall however it'd be overkill for what you want because nearly every consumer AP+Router supports a guest network which is more or less what you need OOTB.


Having a JWT that doesn't expire I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject which is the user id. Then I look up this user in the database to get permissions/account status/etc. which I then use to determine whether or not the user has access to the data or action they are requesting.

I don't want the user to have to log in ever again after logging in once (in the same browser session). For example, on this site (stackexchange.com) I don't remember ever having to log in again in my current session.

Since I'm accessing the database for every relevant request, I feel like expiration time on JWT doesn't apply.

Where am I going wrong here?

Welcome to Security.SE. Let's take a step back and cover some higher-level topics first which will hopefully explain what you are looking for. The short answer is this: Long-lived tokens are dangerous.

Session Management

The standard session, getting a cookie with a token that is then stored in the database or caching server like Redis, is the way browsers handled keeping a user logged in, until recently. This cookie ideally would have no meaning other than being a token to information stored in the database, filesystems, or Redis. It acted as a key for lookup.

This property allowed applications to revoke sessions (e.g. "log out of all my devices") when needed. It also gives other properties, like identifying unique devices, but it rolls up in to that revocation.

JWT

I said until recently above, because with the advent of JWT, JSON Web Tokens, JWT usually acts as a stateless token. The server has no knowledge of that token other than what the token self-describes. This is also called an assertion. There are of course mitigations to keep people from asserting things such as signing the token. Assuming that is being done here, because most frameworks default to that now, it's less of an issue than what you can do with that token.

So what now?

In the interest of transparency: I cannot stand JWT. It is fraught with issues that are probably beyond the scope of this question, and I'm not aiming to derail. I tried to avoid bias in my answer, but in case anybody reading this sees a bias, that's why. :P

To answer the question now with some of this background: Should a token be stolen off a device (browser, mobile app, etc.), there's no normal method to revoke that JWT token. Because you kept it as a forever-token, even expiry of that token would not keep unintended audiences from accessing that account data. There's no server component, except for blacklisting that token, that can protect the user and the data stored.

To sum up: JWT's only real defense is expiry of the token. There's no revocation abilities that I'm aware of to protect the account. While long-lived sessions are a bad idea in general, it minimizes user friction. Who wants to log in every single time they come here? Sites like SE can revoke sessions on the server. You'll see this ability on Google and Facebook, for example.


MD5 Checksum and DLL injection I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent somebody or an internal threat from injecting malicious code or something into an external dll and using it with the original dll name. So an developer saying, can during development call an external malicious dll and use it as the same name as the original dll?

That way altering the application's behaviour. Making it difficult to find out. I have done some research but digital signatures may help fix but not sure if all.

Please if there is any solution to this I will be very grateful.

Merely checking the MD5 hash of a DLL might not be secure enough, since MD5 is not resistant to Hash Collisions and cannot be consideres safe anymore. An attacker could inject malicious code into an DLL and alter it in a way that the malicous DLL returns the same MD5 hash as the "real" DLL.

As @schroeder mentioned, you probably want to use a signature based approach where only DLLs which are signed with a trusted and known certificate (e.g. by the lead developer) are permitted to be used.

This however leads to a few new problems, e.g. certificate management, trust management, etc.


Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here.

I'm testing a Ubuntu 8.04 box, it's known as having a vulnerability of weak OpenSSL keys. The script provided by Debian confirmed that the server is vulnerable:

$ perl dowkd.pl host X.X.X.X
X.X.X.X: weak key (OpenSSH/dsa/1024)
X.X.X.X: weak key (OpenSSH/rsa/2048)
summary: keys found: 2, weak keys: 2

I then use another script provided by http://itsecurity.net/ called debian_ssh_scan_v4.py to find the fingerprint and corresponding public/private key.

$ python debian_ssh_scan_v4.py X.X.X.X
X.X.X.X:22 sshd fingerprint 4795d53ae413531f78f4d45bbd6eb929 VULNERABLE (RSA 2048 bit key, pid 26571)

$ find rsa/2048/4795d53ae413531f78f4d45bbd6eb929*
rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571
rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571.pub

The private key (under rsa/2048) is get from the list of possible keys:  http://www.exploit-db.com/sploits/debian_ssh_rsa_2048_x86.tar.bz2

However I was failed to login to the vuln box using that found key (note that ubuntu is a valid user on that box):

$ ssh -i rsa/2048/4795d53ae413531f78f4d45bbd6eb929-26571 -o PasswordAuthentication=no ubuntu@X.X.X.X
Public key 47:95:d5:3a:e4:13:53:1f:78:f4:d4:5b:bd:6e:b9:29 blacklisted (see ssh-vulnkey(1)); continuing anyway
Permission denied (publickey,password).

I also tried to bruteforce all the possible keys (which I extracted from the compressed file) using WarCat script and none of the key was able to authenticate.

With all those results, could I say that the box is safe, that said it's actually not vulnerable to the weak OpenSSL key bug ?

The "weak key" means that you can have a copy of the server's private key. This allows you to run a fake server and possibly do a Man-in-the-Middle attack on an authorized client, when he connects to the server. However, this does not allow you to log in "by yourself".

When using a public/private key pair with a client, you are sending that public key to the server and the server will authorize entry, or not, depending on whether that public key is in the $HOME/.ssh/authorized_keys of the target account. Here, you are sending as "client's key" a copy of the server's own public key, which is not authorized for client authentication, hence the result.

Not accepting his own key as correct authentication for a client is nothing special in SSH; client keys and server keys live in separate worlds. The server is not aware that you are trying to feed it with its own key; for the server, this is just "a public key which is not in the target authorized_keys file".

The box is still vulnerable; but there are other kinds of vulnerability than allowing connections out of the blue. MitM attacks are harder to put in action (you have to intercept an honest client's connection, usually with some variant on DNS poisoning) but are nonetheless very serious.


How to SERVICE_START_NAME value for processes without a Name Service? I would like to check SERVICE_START_NAME value for processes on my Windows 7 machine that does not have any name services (obtain with tasklist /SVC), but just a PID.

For services with a name I usually do: sc qc service_name

Note: there are no Windows Service in the process maybe, but still the process is running and I would like to know if it is auto loaded on boot and also which user starts the process.

When and by whom was a Windows process started

 CMD> wmic process {PID} get creationdate,parentprocessid

 Note: I'm sure this can be done with PowerShell as well, but it always
 takes me two or three times as long to use PowerShell so I rarely bother

If the parent process is still running, you can look at it with tasklist TaskManager etc. Note it is possible the original parent process exited and then a new process was assigned the same PID, so if the relationship doesn't make sense, look at the apparent parent's (!) creationdate also.

Or if you want to do this a lot, I recommend ProcessExplorer from https://technet.microsoft.com/en-us/sysinternals/default.aspx with View / Show Process Tree. This displays child processes sorted under their parents (if still existing) and indented, making the relationships easy to see. It can also show the UserName for each process, see View / Select Columns.

What processes are started at boot/login/etc

There are lots of places in Windows where things can be configured that start processes automatically at boot, login, or other events including scheduled times. There are quite a few tools that try to make sense of these. I like Autoruns from the same webpage above; I don't know if it includes absolutely everything but it has always included everything I needed to look for.

(FWIW as of today ProcessExplorer and Autoruns are the first two of the Top 10 Downloads.)


How do you limit javascript api to a domain? Ok, many of you now the scenario:
you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run".
The question is, from a api provider perspective if possible: HOW do you make a key useless on domains other than the one you please.

I have api available for secure consumption in server side scripting scenarios, and would love to offer a way to consume it securely on the client side from a static public html resource, but since is a paid usage api and the key is sitting in the public domain you want your key to work only on sites-domain-ip that you define.

I would check the origin header when the request comes in and confirm that the domain making the request matches the one you have associated with the key.

This means you would need to track the association between domains and keys of paying customers on your end so you could check this.

Keep in mind that the origin header can be spoofed if the request is made using something like curl, so while this would be a good defense against web pages using your API without permission, someone could get around your restriction for their own personal use.


Retrieve header from SMS on iPhone I received a lot of SMS-es from a guy where the phone number changed every time. I can answer to these SMS-es, so I think it's only a spoofing of the sender ID of the SMS header which will be displayed in the phone.

My question is:

how can I retrieve the header content of an SMS, to find the real phone number?

I have an iPhone.

The problem with this is that it's likely coming from an email server instead of an actual phone.

I had a similar situation, but they were benevolent circumstances. I had a difficult time working at home to know when to stop working at maybe eat. My friend set up a shell script that would run at 5pm EST that would SMS me to remind me to grab some dinner and maybe stop working if I was at a good stopping point. Each time the SMS arrived, it would be an incremented number. He had also previously set it up to remind me at lunch to eat lunch and to take cigarette breaks throughout the day. Those numbers were different even from each other and incremented on their own.

So say you find the header info and find out the email address of the sender. Great. Well, it's ridiculously easy to register a new email address, or even spoof one with an open mail relay. This can all be scripted and automated.


Multiple digital signatures I have the following case scenario:
One document that needs to be signed digitally (using an external signing service) by 4 different people. The 4 people must be present while signing the document at the same place.

How can I create a situation where "digitally speaking" is ensure that the 4 people were signing while being together?

I thought that if each one of them uses the same computer (each of them logging in the signing service) that would be a way since it is the same datamachine (same IP). Are there any others?

For a non-technical solution: How about taking a picture of the four of them in the same room together, possibly holding a newspaper to give a "no-earlier-than" date, and maybe a printout of the document, and add the picture to the document to be signed?

I'm fairly confident that this would convince most people that the four people in the picture came together in order to sign the document in question, especially if the signature service gave the same date for when the signatures were made as the date visible on the newspaper in the picture.

This is assuming that you can't have a trusted person present that can simply vouch for the four people all being there with his own signature on the document.

If it's just that you must each witness that the others have signed, you might do it like this:

A signs the document.

B signs A's signature.

C signs B's signature.

D signs C's signature.

A signs D's signature.

B signs A's 2nd signature.

C signs B's 2nd signature.

(You need B and C to sign again to prove that they know about D's signature, too. If you stop after A signs D's signature, you have no way to know whether B and C know that D signed).

I also have an idea that uses zero-knowledge proofs, but this is so convoluted that I don't think it would interest you.


Is there any problem using empty salts with PBDKF for this purpose? The aim is to generate a secure key for symmetric encryption.

I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea is to use PBDKF2 for the generation of that key.

This master password is pretty difficult to deduce, since I only store its sha256 hash. But the user provides it every time he logs in.

With the described scenario, I would say that I have a secure key for symmetric encryption, since it is not stored anywhere, and it can't be deduced with the information that it is stored.

So, my doubt is, is salting useful here? I cannot see it. I think that an empty salt would be ok.

Or maybe the scenario I'm considering has just any sense...

First, don't store the SHA256 of your master password! See this answer for how to store the hash of the master password.

Onto your question...

Salt is used to prevent the attacker precomputing the hashes for many/all possible inputs.
In the specific case of storing the hash of the master password, a sufficiently large and random salt will prevent an attack from using a single table that maps all inputs to their hashes. For such a precomputation task to work, the attacker would need to create a unique table for each unique salt. This becomes computationally unfeasible. So, if you've salted and used an appropriate hashing algorithm (see answer referenced earlier), even if an attacker steals your password database, they can't reverse the hashes back to their passwords.

In your case, the key is the output of the PBKDF2 algorithm and will not be stored in a database. So there is no way that an attacker can steal the hash to reverse it to get the master password. So salting the PBKDF2 algorithm to generate the key seems unnecessary. But, as per the answer linked to earlier, you must salt the hashed version that you will store in your database.


How to deal with security audit false positives? Security scan from certain company alerts about different non-existing issues.
And even worse - their results are not consistent.
How do you deal with such of things?
Just two examples:

alerts for Apache mod_lua module even when this module is not active
alerts for different things on two webservers with identical configuration

Just because an automated scan returns a result, that does not mean that it is an 'audit'. It's just a scan.

For any finding, it needs to be

verified that it exists
if exists, it needs to be justified
if justified, it needs to be placed in context with existing mitigations
its risks need to be assessed

For documentation purposes, it is a good idea to write down these 4 things so that future findings can be compared, and the justifications, mitigations, and risks can be reviewed in the future to make sure they remain relevant.

So, for your two findings, acknowledge that the module exists but that it poses no risk because it is not active, and confirm both findings on both servers as being true or not (there are all kinds of reasons why a scan will show different findings on the same config).


XSS Payloads:  vs javascript: Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for
javascript:alert(0)

The most basic payload for XSS makes sense, since the  tag is used for JavaScript in HTML.
<script>alert(0)</script>

But where does javascript:alert(0) come from? From my research colons are used for labeling anonymous functions and object literals but not sure if it's the same with this payload.

javascript: is the URI scheme (like http: or https: or ftp: or file:) for immediate-execution javascript. Javascript URIs can be set as the "URL" of a window, both the top-level window or an iframe/popup/etc. They execute in the context of the currently-loaded origin and page, so it's equivalent to injecting a script tag into the page.
Outside of malicious operations (such as excessively open redirects), javascript: URIs are usually used for "bookmarklets", where you create a bookmark in your browser that contains a little bit of script you might want to run on an arbitrary page. Then, when you're on the page, you can "go to" the bookmarklet, which just runs that script snippet on the page. An amusing example is featured on this page: http://kathack.com/
From a security perspective, javascript: URIs are usually not commonly used in attacks, but sometimes they're the most practical option. If you can control the location of a window, but nothing else, javascript: URIs are an option (along with data: URIs) for injecting arbitrary content into the page context. Most other times, it's easier to manipulate the actual HTML, though (by injecting a script tag, or an HTML element with event handlers, or changing the content of an existing JS block / invocation).


Changing Linux system files by malware from another OS. Is it possible? Is it possible to infect important Linux system files with a malware from another operating system? For example, you are using Windows, you have a disk with the Debian operating system connected. You "caught" (on Windows) a malware that aims to modify Linux system files. Will the Linux kernel notice the change in these files? Does it perform some sort of "integrity check" on system files? Or is it better to unmount the drive with Linux when using Windows or another "risky" OS?

Is it possible that Windows malware modifies an installed Linux partition?

Let me ask you the inverse: What would make you think that it is impossible? Indeed, when thinking about it that way, it makes it pretty clear that it's at least possible. Nothing really prevents malware from mounting the partition and manipulating the files on the partition, including the kernel.
Does that mean it's likely that malware would do that. Not really. If you think about it, the moment malware runs on your Windows OS, the attacker can already run code on your machine. There is little to gain from writing malware that would only target a fraction of the users (Windows users who have Linux installed on a secondary partition), when they already have an OS they can exploit.

Does the kernel notice these changes?

No, because that's pointless. If malware can directly write to the linux partition, it can simply install its own kernel, which removes this check - would it exist.

Is it better to unmount this drive?

Disconnecting is even better. If the computer has no way to write to a disk, then malware can't overwrite it.

Is Windows a "risky" OS?

Windows is just as secure as Linux is, depending on how you set it up. The fact that most malware targets Windows stems from the fact that 3 out of 4 desktop PCs run Windows.


Check if PXN is enabled? I am looking for a way to check on a mobile device if PXN(Privileged Execute-Never) Protection Mechanism is enabled.

you cannot check that because the processor registers are encrypted. The SP register is also encrypted from android 4.4.4 and on.


What is the risk, giving users email addresses on a domain name? Say I have a website at www.example.org

For the sake of painting a meaningful story, say I am going to give each user a web page at www.example.org/username and an email address at username@example.org

What are the risks of giving users that email address, aside from the possibility that they might send spam?

To clarify, in response to comment.  At first I wondered if maybe being able to accept email at that domain might risk domain hijacking somehow, and then I vaguely thought that perhaps there are other ways that people might pretend that are from the "Example Org" company, as proven by having an address at that domain.  On the other hand it can't be too risky I suppose because handing out email addresses is exactly what all email providers do.  It's a vague concern but I did not want to not fully understand potential risks before implementing it, thus the question to the security experts.

I see the risk that people can pretend that they are from the example.org company.

Rfc2142 describes internet mail addresses to be used when contacting personnel at an organization, for example abuse@example.org to report inappropriate public behavior of your server like sending spam. Other special mail addresses are postmaster or webmaster.

If someone can take one of these addresses there is the risk that someone can impersonate as an administrative user. The resulting risk depends on how much someone trust these users. Therefore I would ensure that it is impossible to use the usernames definend in Rfc2142.


Developing Home Automation Protocol, How to make messages secure? Let's say we have a hub called H and a door lock controller called D1

Now, we have a malicious electronic which imitates H called M

H sends D1 a command to open the door, D1 unlocks the door.

M captures the message (command), now I assume M can repeat an identical message at a later time and cause D1 to unlock.

How could I stop this?

My idea is to include a timestamp, which is validated by D1 and encrypt the message. If the timestamp is older than 30s then D1 will ignore the command. This still seems unsecure however.

Clarifications:

None so far

Read more

Replay Attacks

You are on the right path, but you would need 3 things:

Unlock Message
Timestamp
Unique Message ID

This way the Unlock Message couldn't be captured and replayed in the 30 second window.  You would just need to keep a log of used Unique IDs in D1 that have been used in the last 30s

As long as the private key in H is kept secure, and the public key in D1 is not tampered with ... this method should be secure.

It should also be noted that D1 should have a method of securely syncing its internal time system with H periodically to prevent time drift which could otherwise render D1 completely inoperative.

Another option would be to keep a public /  private key on both H and D1 ... this would allow you to create a shared secret which could be used as a Secret Key for something like AES256 communication between H and D1.  I am noting this because you put TLS as a tag in your question ... and this is in essence how TLS works.

TLS Handshake


Continued Use of Kerberos I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here.

I  was recently looking through the Mac OS X 10.10 source code and noticed that it has a Kerberos client, and in addition the bastion of all human knowledge that is Wikipedia notes that it is still a common component of most modern OSs. I was aware that the original MIT library was still under active development, but I was not aware that Kerberos' use was still so widespread.

Considering there are other SKDS that do not have its drawbacks (reliance on time synchronization and imperfect protection against replay-style attacks, unnecessary key confirmation, etc.), I was wondering why it is Kerberos has continued to be used in modern systems? Is it simply a matter of those drawbacks being sufficiently minor combined with the availability of a stable, well-tested and widely deployed library, or are there other reasons that make it more feasible and useful in practice than the other schemes that solve its issues on paper.

Kerberos has multiple mature, interoperable implementations on major platforms with active user communities and under continuous development (MIT Kerberos, Heimdal, Microsoft, Java), and through standard abstraction layers such as GSSAPI and SASL, it is easy to use Kerberos either directly or indirectly to secure many standard applications and protocols, including:

SSH (OpenSSH, ssh.com, VanDyke VShell/SecureCRT)
IMAP and SMTP (Cyrus, sendmail, postfix, Thunderbird, OS X Mail, Alpine)
Subversion
CIFS/SMB (Samba, Windows, Netapp)
Database (SQL Server, Postgres, jTDS, FreeTDS)
HTTP (Apache, nginx, all major web browsers, curl, client HTTP libraries
in Perl/Python/Java/C/...)
DNS (authentication for dynamic update, implemented by both Windows and BIND)
NFS

All these protocols and implementations have built-in Kerberos support ready to be used, if only you provide the infrastructure and know how to do it. This is not just theoretical; where I work, I am in charge of the Kerberos infrastructure for my firm, and we have all these applications and more. They all interoperate seamlessly across both Windows and Unix; our users log into their Windows or Unix desktop, type their password once, and then never type it again while accessing all these services, both directly and after using SSH to log into other hosts (where their Kerberos credentials are automatically forwarded and used). Credential delegation in different flavors is available to allow authorized servers to access further services on a user’s behalf via controlled use of the user’s identity. We do not have the nightmare of managing SSH hostkeys across various platforms and clients (OpenSSH known-hosts files, PuTTY registry keys, etc.); Kerberos authenticates our SSH servers as well as their clients.

If you have narrowly defined needs, then you can get away with other systems. If all you want is single-signon to web applications from full web browsers, for example, then you can use any one of several schemes — but if you also want to access that web app programmatically from a simple program that doesn’t have a Javascript engine and a user to type in a password, you’re pretty much stuck. With Kerberos, the same credentials work the same way in both scenarios.

None of this is to say that Kerberos doesn’t have its weaknesses, or things which should be improved. The use of Kerberos in HTTP (“HTTP Negotiate”) is a hack with problems; really, what we need is pervasive implementation of Kerberos ciphersuites in TLS. Using Kerberos to secure data traffic lacks forward secrecy, which is increasingly important these days; we need a GSSAPI mechanism which combines Kerberos authentication with a Diffie-Hellman exchange, as the SSH GSSAPI key exchanges do; once that exists, it can work transparently with any correctly written SASL client that uses a security layer (as do several of the cases mentioned above). This avoids the combination of Kerberos and TLS in separate layers, which has too many round trips and requires PKI when Kerberos by itself is sufficient.

Also, much of this usefulness is due to the wide adoption of GSSAPI and SASL in protocols through which Kerberos is used, rather than specific properties of Kerberos itself; other mechanisms made usable as GSSAPI mechanisms might enjoy similar usability, and there is current work on doing this for OAuth, for example. Kerberos has the advantage of still allowing for simple password-based authentication, while allowing for stronger methods as well (public-key certificates via PKINIT and OTP schemes are both supported), whereas PKI is tied to needing a second factor of some kind to hold the user’s private key and trusted CA certificates, which has limited its adoption for user authentication for quite some time.

In any event: if you want single-signon today, with existing systems out of the box, across a wide variety of applications and protocols particularly in an open-systems environment, Kerberos is pretty much the only game in town: nothing else matches its pervasive availability, usability and support in existing products and protocols, both commercial and open source.


What is the likelihood of a government organization having a copy of the major .COM private keys? This is a bit of a vague question, but it seems relevant these days with the information on all those "mass spying" programs getting leaked. I will describe the scenario and I just want to know if it is possible under current laws (specifically, US laws but I would be interested in laws of other countries also), and if so the likelihood of it already having come to pass:

  A major corporation with a major website (let's say Yahoo) receives a notice
  that one of their users is under investigation and they are asked to release
  all relevant info on said user. Not wanting to cause trouble, they politely
  comply and nobody except for the government organization and a few people at the company knows
  what took place. Some time goes by and they are contacted again, this time
  being told that the user under investigation has taken measures to obscure
  his/her identity and they are not able to pinpoint them to any one username.
  They are, however, able to tap the user's line and need the website's private
  key in order to decrypt that user's traffic. The company hesitantly agrees, the
  investigation finishes, and the government organization thanks them for their
  help. However, it's not over. The government organization has in their
  possession the private key that protects millions of users' data and could pass
  it around secretly to other entities. If it were given to another government
  organization that had set up the means to intercept data on a mass scale, they
  would be able to secretly decrypt all data to and from that website without any
  billion-dollar supercomputer.

A few incidents like this, and ALL the private keys for the world's top websites could be collected (and it doesn't seem like a very unlikely scenario to me...) What do you think?

Keep in mind that, even with the private key, if a site uses Perfect Forward Secrecy, it would take an active attack (MITM) to see traffic, and could only be seen after the key was acquired.  Merely capturing data and analyzing later would be insufficient.  Also, many of the large sites have multiple keys and rotate them frequently.  If you look at encrypted.google.com, for example, you'll notice that the expiration date is less than 3 months after the issue date for the certificate.

So, while what you describe is possible, there are technological measures that can be employed to make it more difficult for governments to conduct this kind of dragnet surveillance.


Is a lockscreen a deterrent to a USB Rubber Ducky style of attack? Lets say we are on the Linux platform and usb is authorized to work by default.

From what I understand USB Rubber Ducky acts as a keyboard and tries to type in bash commands right?

But what if the screen is locked, how does it bypass that? I mean if you plugin a physical keyboard you clearly need to type in the right passphrase to be able to do anything useful.

Perhaps I have the wrong concept of how a Rubber Ducky attack works?

Yes, you understand it correctly. USB Rubber Ducky cannot bypass the login screen or the lock screen (in a way other than providing the correct password).

It can contain payload brute-forcing the password for the user, but it cannot bypass it otherwise.


exploit document.write with unsanitized user input I'm trying to inject javascript into a js scriptfile but it's not working.

I have the following setup:

html file with javascript-file include (all inline js is blocked!)

Welcome, <script src="js/domxss.js" type="text/javascript"></script>

javascript source of js/domxss.js:

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
document.write(unescape(userInput));

Obviously I could just request

domain.com/index.html?user=<script>alert(1)</script>

and it would be executed, but all inline js is being blocked by my Content-Security-Policy. So what I'm trying to do is to break out of

document.write((userInput));

with something like this:

domain.com/index.html?user=bob); alert(1

so that I can get something like this:

document.write(bob);alert(1);

Anyone has an idea on how I could achieve that? I'm not bound on document.write, I'm just looking for a DOM-based XSS example where I can inject JS directly into the script file rather then printing it out as inline code.

Sorry if it seems a basic question but I'm not that familiar with JS.

Thanks for the help :)

To put it simply, you can't because your your payload bob); alert(1 is a string, and JavaScript knows its a string so it won't execute it. The parenthesis and semi-colon characters can be inside the string without being executed. This code could be vulnerable if, for example, you tried to concatenate the payload into an eval() statement. This is because eval will execute code inside the resulting string.

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
eval("document.write('" + decodeURI(userInput) + "');");

Then domain.com/index.html?user=bob');%20alert('1 will result in the following string being executed as JavaScript:

document.write('bob'); alert('1');

(This is why eval() is generally a bad idea)

However, a good Content-Security-Policy would probably block user input in eval() as well, so this method may not work. It depends upon the policy returned by the server, or the default controls the browser might load if one isn't specified.

Alternatives to eval()

Other dangerous ways in which a developer could accidentally evaluate user controllable data without sanitisation or validation (that might not be caught by a default CSP or client-side XSS filter).

The function constructor (can define function body as a string):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleFunction = new Function( "document.write('" + decodeURI(userInput) + "');" );
terribleFunction();

A Data URI:

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleScript = document.createElement('script');
terribleScript.src = 'data:text/javascript,' + encodeURIComponent("document.write('" + decodeURI(userInput) + "');");
document.body.appendChild( terribleScript );

setTimeout (although I think this method is essentially the same as eval()):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
setTimeout( "document.write('" + decodeURI(userInput) + "');" , 100 );