Should security policy acknowledgements in a company be customized for IT vs non IT users? I currently work in the Information Security team at my company. I have been requested by company management to assist in reviewing and revising our current IT security policies. I am a trusted, respected member of the IT Security team, and previously management has requested me in assisting them to review the content of annual security training

Our current suite of policies are very comprehensive,covering topics from personnel security, Cloud security, physical security, logical access security...etc. However, only the IT security team and IT function in general is affected by a good portion of these policies. Examples:

Portions that talk about access administration is probably not relevant to a customer service representative working in a call center.
If you are not in IT, requirements for degaussing of backup media is probably not of use / concern.

My concern with everyone, regardless of their job role, having to acknowledge all policies is that they may pay less attention to the policies that actually pertain to them - e.g: storage of sensitive data for HR or social engineering safeguards for a CSR in the call center. Simply put, the amount of reading may turn people off, or they may just click through the policies simple to complete the tedious task, and not recognize the importance of what they are reading to the IT security mission of the company. We are an insurance company and work with sensitive customer credit card and private health information. We must also comply with PCI DSS, SOX 404, and state DOI regulations.

Based on feedback in my linked question, I am thinking of discussing with my management to leave common education requirements such as incident reporting, and acceptable use as untouched in the changes going forward. In this way, all users get a common foundation of the security requirements. Certain processes such as incident response can only work effectively with end user cooperation via timely reporting, so this seems like a no brainer.

Question

Is customizing corporate security policy acknowledgments based on what is actually relevant to a particular employee's job role a good idea?
If yes, what can be used to measure the applicability of security policies as they pertain any given job role?

Yes, the security policy should be based on what is actually relevant to a particular employee's job role. I did write GDPR and security policies including for some very large companies and this was always a case to debate. Now-days most serious companies want data access on need-to-know basis so customizing security policy is important. In many cases I find that 3 levels/cases of policy are sufficient: one for general users, one for IT staff and one for IT Security staff. In today's context it becomes more and more important that IT staff respect various policies (specially regarding accounts and passwords) so making a special policy for them is mandatory. Also, the security level of IT must have additional rules because they are the ones with most privileges.

A lot of things can be used to measure the applicability of security policies. but everything start and ends with the users. There must be a system in place to be able to measure their compliance with the policies. If there is not, you must at least be able to make random polls/tests of their compliance. Without such things everything will eventually become very chaotic and uncontrollable and the overall IT infrastructure will be very exposed.


Snort Inline Mode(IPS) Routing Packet Forwarding I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've used is here -> Snort 3.0.1 on Ubuntu 18 & 20
I've built a local network which to simulate a real use case. For simplicity I'd like to focus on IPS protection and simple routing. The network I'm trying is below:

Now that I can perfectly configure the iptables to forward the outside(192.168.1.0/24) network to inside network (192.168.50.0/24) with such commands:
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.50.100:80
sudo iptables -t nat -A POSTROUTING -o enp0s1 -j MASQUERADE

Seperately, I can redirect the outside(192.168.1.0/24) network to Snort's NFQUEUE
sudo iptables -I FORWARD -j NFQUEUE --queue-num=4
sudo snort -c /usr/local/etc/snort/snort.lua -L dump --daq afpacket --daq-var queue=4 -i enp0s1:enp0s2

Unfortunately I'm having a hard time to understand to combine these both commands to use Snort as complete IPS tool. So in short how I can make Snort to forward inspected 'secure' client packet to the webserver then back(of course).
Much appreciated

IPS seems not to work without a bridge, right? Here is a docker setup that may work.
This is my iptables entry:
111  5788 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0  tcp dpt:8081 to:172.20.238.3:8080


Difference between white-box testing and secure code review As far as I know, penetration testing can be divided into black-box, gray-box, and white-box testing. But then what about secure code review? Is it part of white-box testing or is it separate?

Security code review is the process of auditing the source code for an application to verify that the proper security controls are present, that they work as intended, and that they have been invoked in all the right places. OWASP

With this in mind consider Grey-box testing:

  A black-box tester is unaware of the internal structure of the application to be tested, while a white-box tester has access to the internal structure of the application. A grey-box tester partially knows the internal structure, which includes access to the documentation of internal data structures as well as the algorithms used. Wikipedia

Pentesters will identify vulnerabilities by reverse engineering software into assembly code and working from there to identify attack vectors, such as a buffer overflow. But, by the definition above secure code review must be white-box testing.

To answer your question, secure code review is performed by white-box testing, exclusively. There may be some instances where individuals could skew this definition to fit the example above, but as reverse engineering assembly code is not source code, I will not acknowledge this.


OAuth: client credentials vs tokens Wouldn't it be much simpler and virtually equally secure to replace tokens by pure client credentials?

Client credentials wouldn't expire and resource owners would always be able to modify their access control matrix to revoke any privilege any time.

In that case -

Client credentials would need to be sent with every request to every server-side app/system that can present resources.
There would be no expiry and no scope limitation on any specific session.
It would be just like legacy basic auth, with all its drawbacks and benefits (simplicity)

In the OAuth client credentials flow, 'client' refers to a client application and not necessarily the resource owner (end user).  In some cases, like mobile apps, both are almost the same, as there is usually a single user of the client.  Thus, for a simple application, replacing an access token by repeatedly sending client credentials may be a suitable substitute.  However, for any distributed application where APIs and resources are distributed across different domains/servers/applications, having a central token endpoint is more scalable and more secure just by virtue of being a single point.

While Facebook has two-legged OAuth for end users (resource owners) using Facebook apps (clients), Facebook provides access tokens to Facebook apps via OAuth client credentials workflow.


Cellular Mobile Network Vulnerabilities - Is VPN the solution? Do current mobile cellular networks like 3G offer enough security? The article from Info-Security states that

  3G encryption cracked in less than two hours.

Could a eavesdropper or man-in-the-middle attack be launched on a mobile device?  Should we be using a VPN such as Hotspot Shield?

Remember that a 3G data stream contains both voice and Internet data, and the VPN encrypts only the Internet data. Therefore, your phone conversations would remain unprotected unless you use a service like VOIP. VPNs generally have strong AES-128/256 or similar encryption that will take much more than two hours to breach, therefore greatly increasing your security.

If the encryption is cracked, eavesdropping is most likely possible (think of those hackers looking at open wifi connections to sniff for passwords) and probably is a MITM as well.

However, you should still realise that spending two hours to crack a 3G connection is still quite a long time. Unless there is a specific reason why a person would like access to your phone, it is very unlikely that they will spend the effort to break the signal.


Password reset question answer complexity I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell number for the account that I can use to communicate a reset link or code. This means the entire process will happen on the web page. I will have a known e-mail address for the user, but it's an address that was issued by the system in the first place, meaning the fact that someone is using this feature at all may imply they no longer have access to that account.

In this circumstance, it seems like the security answer effectively becomes an alternative password, in that knowing the Question (I plan on requiring you to select the correct question from a list, as well) and Answer for an account are the same as knowing the password.  This makes me think that you'd need to have the same kind of complexity requirements for the security answer that you do for a password. However, I can't recall ever seeing this implemented. If I've run into requirements at all, it's usually something simple, like at least 3 characters just to make sure you put something verifiable into the field. They're also relying on the fact that send the code to a registered location in place of the additional complexity.

I plan to mitigate this by also sending an e-mail on completion, or when the session expires on failure, and by limiting the number of attempts in a given time frame. The system administrator has the ability to do a reset manually, without knowing the question/answer or original password, so I can't lose control of the account. But it seems like I'm still missing something. How should I handle this?

In this circumstance, it seems like the security answer effectively becomes an alternative password

That's right. Which is also why this seems like a really bad idea. It will only work as a feature if the question is something simple, something the user will know without having to remember it, which means that an attacker can figure it out as well (by searching for info online, on facebook, asking the victim, etc).

Your current idea would weaken the security of your user accounts considerably, so I would look for an alternative. The best way would be to require an alternate email address or phone number (such as most email providers such as google do).

Another alternative (if you require real names for sign-up) would be to require something like the copy of an identifying document for password recovery. An attacker might still be able to get this (especially if they know their victim personally), but it would be a bit more complicated.

If you want to stick with your concept, at the very least I would perform password resets via phone instead of online, to deter some attackers.


Is it safe to use an Android Server Monitoring App, to login to a server with SSH? Lately I have seen some Android Apps, (CPU Monitoring and things like that) that need access to your root account, ask you for username and pass, my questions are:

Is it safe to give access to an External App to your root account?
Is it safe to give access to a non root account, is this the right thing to do?
If you use an external app to your server, are you opening new wounds for your server?
I want to monitor my server, from my mobile phone, when I'm not near to my PC, I need to have access to important server modifications, when I need them (reboot, CPU monitor, create an account, etc.). I don't want to login as a root user, i would like to do it as safe is possible, which is the best method you think I can do this, remotely?

To answer your questions:

No (cf. d1str0s comment)
Probably not. This could still be used to leverage exploits to gain root privileges locally - or otherwise make use of your machine without your knowing with regular user privileges (like sending spam).
Supposed it uses SSH to connect, apart from it sending away your credentials, probably not.
Two options here from the top of my head:

Write an app yourself, so you can trust it (or search for open source that a community approves)
Use an administrative web backend to your server to which you can login using your browser


Risks of ssh to an untrusted host? I use ssh a lot to connect to a variety of servers at my university.
The machines are administrated by students, so assume they can't really be trusted;-)

What are the risks in making a ssh connection to a host I have no control over?
What information can be gained about an ssh client from the server side?
Is there a chance they can open a shell from the server on my client machine?

There is another big risk: SSH agent forwarding. If you use agent forarding, anyone who is root at the server you SSH into, can use your ssh private key to establish new connections. See http://unixwiz.net/techtips/ssh-agent-forwarding.html for more info on agent forwarding.


Are powerline ethernet adapters inherently secure? I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or townhouse.

I've noticed the speed is much faster when i just plug and play, rather than going through the encryption process - it's a little difficult.

So my question is, on a closed loop system - electricity inside my house - do I really need to set up the encryption? Or is it secure by the nature of the system itself?? How much of it 'leaks out' without encryption?

  This question was IT Security Question of the Week.
  Read the Mar 15, 2012 blog entry for more details or submit your own Question of the Week.

You do get some security from the way your fuse box is connected to the mains.

In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases.

In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other phases, and you will almost definitely get leakage outside your 4 walls.

This is why encryption was put in place on these types of things - a neighbour may be able to sniff your traffic.

Things that help with security, because they hinder signal strength - surge protectors, UPS's etc. but those don't prevent an attacker.

tl;dr

Encrypt, because you will be leaking signal. Not so much wirelessly (it can be done but it is tricky) but just across the existing mains wiring.


Managing the public keys and certifications of S/MIME protocol I don’t have any experience in the security field, and I want your help. I want to ensure if the following suggestion is applicable and secure, if it’s not, please give me your suggestion to solve the problem.

A company wants to build a website to manage and monitor their employees, now each employee has a unique nick name, however, the official wants to use S/MIME protocol in order to allow the employees to transfer sensitive messages between each other. Those employees have a big problem in managing the public keys and certifications, can I use Keybase.io (its open source) and improved it to upload the employees’ certifications and public keys?

Do you think that it will be secure, where when john wants to send a message to Sara, he will put her nick name and the system will request her public key from the server and validate her certificate, is this way secure, if it’s not how I can improve it?

keybase.io simply allows for users of social media sites to access each others public key (if one exists for the targeted social media site).

It is not unlike GPG's 'keyserver' functionality for providing users a way to get to my public key.

The question(s) you are posing boils down to a PKI (public key infrastructure).

There are many solutions available as turn key options; however the tone and question direction indicates a possible need for a custom one-off solution (while I don't necessarily recommend it, not because you can't but because it is and can be a legal nightmare) you should do your due diligence.

First brush up on implementation for the high level functionality. Next research the nitty gritty details provided by experts in the field.

NIST PKI - A high level overview
NIST PKI Technical Specifications - Details on management of a PKI; design, implementation, configuration, recovery etc.
NIST 800-32 - The details of a PKI implementation; ciphers, key sizes, algorithms, physical, virtual security, escrow, data recovery, emergency plans for key compromise etc.

One thing about using an existing solution is the majority of the heavy lifting is already in place. However the majority of the PKI structures of old using a centralized method of PKI management has given way to the distributed methods that GPG employs which utilizes a 'circle of trust' vs. the traditional escrow type management solutions.


Does password-protecting a database living next to the application add any security? I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.

What are the benefits of such a setup over a simply unprotected database?

Apart of some obfuscation, having to configure both, database and application, to those credentials only seems to add complexity, but not real security. An attacker with access to the server could always just find the credentials in the application's config file.

Edit:
I'm talking about a database only visible within the same machine, and not exposed to the outside.

It makes sense to password protect the database if you secure access to the application's config file that holds the plaintext credentials. When you restrict read access to the application's account only, the attacker requires root access to see the password. In case he breached any other (less privileged) account, he will not be able to gain access to the database.


Triaging malicious URLs I'm quite new to the security field and learning my ways on how to triage certain events.

One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if that device is compromised, I'm not too sure what else to do to confirm if it was.

When I investigate the event, it gives me the URL which is http://vap1ord1.lijit.com/

To triage, I do the below:

Go to virustotal (or other sites) and verify if the URL is indeed malicious
Check the device (user laptop) in question and run a scan with the anti virus software
Verify that there are no active communication between the device and the phishing website

Aside from performing the above steps to triage, are there any other steps I can perform to ensure that the device is indeed not compromised?

There are 2 main things to look for:

known indications of compromise
anomalies that would be indicators of compromise

By going to VirusTotal and running antivirus scans, you are looking for known indications of compromise.

Looking for traffic back to the site is in the realm of looking for anomalies, but it is not very helpful. A phishing URL may exist for only a few hours. Phishers know that their URL get blocked pretty quickly, so they plan for it. when the device is compromised, they would direct the device to contact their more permanent command and control server. So, what you would want to look for is anomalous traffic from the device. Your ability to gather and classify data as anomalous will depend on your toolsets.

You also want to look for anomalies on the device itself, like new accounts, new running processes, changed binaries, opened ports, etc.


a chain of 3 federated IdPs My client has 5 different identity and access management solutions. Until now they have been asking each one of their suppliers to add 5 trusted parties to their IAM solution, implement different URLs that will trigger SSO etc. It is now proposed that a new component is introduced in between the company's IAM and the suppliers' so that there is a single point for managing logs and reducing the effort required from the suppliers.

Is it technically possible to implement it, for example using ADFS or Azure AD? Has anyone implemented a chain of 3 IdPs in the past?

I've seen implemented a similar pattern - where a number of "originating" IAM solutions that was where users "lived" where mapped to an external supplier (in this case, a Salesforce based app), by creating a single "externally visible" IDP.

The advantages of this approach are several:

The biggest one, the external suppliers are simpler to configure and maintain as they don't have to add "n" external IDPs (if they support having more than one IDP for a given customer/tenant!!!)
The security of the service offered by the supplier is enhanced, as there's a single point for configuration/validation (vs having 5 "peer" trust sources that open up 5x the potential attack surface)
The "source" IAM systems don't have to be exposed externally as only one "visible" IDP is created
The "bridge" IDP/IAM solution can apply transforms and enforce a consistent set of claims and attributes that are exposed to the external suppliers, without needing to re-configure the source systems. This makes easier to adopt to changes in the suppliers, or to different requirements in the suppliers federation config.
You can also do protocol transformation. In the case I'm familiar with, the left-hand internal IAM systems were using a mix of SAML and OIDC, while the outgoing federation was using OIDC
Specific to this implementation, but not strictly needed, the "New IAM" solution included a user repository and a unified/centralized identity per "real" user was created for the users in the "source" IAM systems; a given living user could have different accounts in the different source IAMs, and the objective was to ensure that the externally visible account was the same, regardless of how the user was logged-on internally...

The way this worked was, the "New IAM" solution was configured to act as an SP for the left hand "source" IAM systems, that were acting as IDPs. The "incoming" federation request was validated, the specific policies configured in the NewIAM stack for access and transformation are checked, and if all matches, the user is redirected to the external supplier. The external supplier is configured to query the "New IAM" solution, that in this case acts as IDP.

It sounds somewhat convoluted, but it's simpler in practice than it sounds... the system is working fine, and orchestrating ~5 M users and expecting bigger growth.

Hope this helps!!


How does the password Tr0ub4dor&3 have ~28 bits of entropy? I rencently seen this :

I can't figure out, how he computes 28 bits of entropy for a password like
"Tr0ub4dor&3" seems really few...

He's modeling the password as the output of a randomized algorithm similar to this one:

Pick one word uniformly at random out of a dictionary with 65,536 (= 16 bits) words.  (We assume the dictionary is known to the attacker.)
Flip a coin (= 1 bit); if heads, flip the capitalization of the first letter of the word.
For each vowel in the word, flip a coin; if it lands heads, substitute the vowel with its "common substitution".  Munroe is simplifying here by assuming that words in the dictionary typically have three vowels (so we get ~ 3 bits total).
Pick a numeral (~ 3 bits) and a punctuation symbol (~ 4 bits) at random.  Flip a coin (= 1 bit); if heads, append the numeral to the password first and the symbol second; if tails, append them in the other order.

The entropy is a function of the random choices made in the algorithm; you calculate it by identifying what random choices the algorithm makes, how many alternatives are available for each random choice, and the relative likelihood of the alternatives.  I've annotated the numbers in the steps above, and if you add them up you get about 28 bits total.

You can see that Munroe's procedure isn't hard science by any means, but it's not an unreasonable estimate either.  He's practicing the art of the quick-and-dirty estimate, which he very often demonstrates in his work—not necessarily getting the right number, but forming a quick idea of its approximate magnitude.


Schemes/ Mechanisms that could provide one time decryption? I am quite familiar with most of the common undergrad/grad security foundations; but I couldn't find anything related to this scenario:

  A scheme/system where a piece of data can only be 'decrypted' AND read only once (potentially in a computer program).

Is it even possible? I have heard such things are there in the 'hardware world' (?). If my question is imprecise/incomplete, I'm willing to update. But I am actually interested in a generic design/protocol at the same time.

There is no way to do this - this is a subset of what DRM schemes attempt to do.

If an end user can decrypt something once to see it, they can see it again. Any of the following may be possible:

first take a copy and decrypt that
copy the screen
edit the application

The only way you could get close would be to have total control over the hardware and software, so you could delete once it has been shown, but even then, someone could use a camera to take pictures of the screen etc.

So, I'd like instead to ask what you intend to use such a scheme for - as there are ways to have the same effect in many scenarios.


How is the routing of Skype? While packet sniffing with tcpdump, is it usual to have different IP's connected while normal chatting in Skype? While using Videochat a direct IP?

I have doubts about the logins.
E.g. if someone could steal my creds and login from somewhere else at the same time.

Skype started off as a P2P based software until Microsoft bought it. This also means they want a peek through all the traffic that there is.

If you resolve the IP addresses to the zones or hostname, I am pretty sure it will map to the Microsoft AS (Autonomous System)


Question - "D3 (js) allows you to bind arbitrary data to a DOM" I have a security-related question with regards to d3.js

D3.js essentially allows data to drive dynamic charts etc, among other features.

The "d3js.org" landing page mentions "D3 (js) allows you to bind arbitrary data to a DOM".

Functions such as d3.csv.parse can be used to read in "arbitrary" data. However, the chart in question would be expecting certain types of data etc.

Can such a library truly accept "arbitrary" data from anonymous users? Could a user potentially parse carefully crafted data to produce an unexpected result with D3? (ie, authorized JS execution).

What may be best practise here for wanting to parse arbitrary to D3?

EDIT:  I can't comment on the question since I got locked out of my old account and don't have enough reputation...  All the below applies to data too.  Nothing on the client side is under your control.  I'm confused as to why you wouldn't be worried about arbitrary code but only arbitrary data.  Generally speaking, the ability to modify code provides more power to produce "unexpected" results than the ability to modify data.  Maybe you should explain exactly what you are worried about.  Can you clarify what you mean by "authorized JS execution"?

If I understand your question I think you are asking whether a user can change your client-side javascript arbitrarily i.e. to change it however they please.  The answer is a resounding yes.  Have a look at Greasemonkey, for example.  In general, anything that is executing on the client is in their control.  There have been many attempts to create client-side systems that prevent this kind of thing but they really only work if the client opts to use them.  Any technically sophisticated user will be able to disable these options.

You should never put any sort of sensitive logic on the client-side.  All input coming from the client should be considered potentially malformed or otherwise manipulated for nefarious reasons.

There was a case decade or so back where a retail website took the price of an item as an input from the client's POST.  A user saw this and submitted a price of $0.01 and ordered a bunch of items.  The website duly executed the order as submitted.  It went to court and the case was ruled against the website.  That is, it wasn't even illegal.


What AES mode does SQL Server 2012 use? I looked at this link that shows how to encrypt a SQL column via a certificate (RSA??) and AES256.

I created a dummy table (script at GitHub) intentionally using identical plain text (Credit Card = 1) and then tries a few simple commands to actually encrypt the data.

I noticed that the resulting cipher text had an identical prefix of bytes. I usually see this in AES ECB but then ECB also results in every block being identical - not just the first. Here the latter portion turns out different despite the same plain test. It might be possible they are using CBC but instead reusing the IV for the entire table?

Edit: The screenshot turned out tiny: Here is the text dump

CardNumber, CardNumber_Encrypted

1, 0x0062513D35F0404A8C2B72A7C64FCDD1010000002887B22A1A1E238BD5658A42F30E0EE34458A4781C4FF7CFAEA91E704E5B9EAE

1, 0x0062513D35F0404A8C2B72A7C64FCDD101000000DFDD0277220EB5CC23D5820FCF763BBE0970072915946ED2E4CAC05D977F7D67

Question: What AES mode does SQL server 2012 use? Can it be changed?

This blog post (Microsoft has totally embraced the document-by-blog fashion, apparently) describes the encryption format used by SQL Server. That's for SQL Server 2008, but, for backward compatibility reasons, the same format must be supported by SQL Server 2012. Block cipher mode of operation is CBC, there is an IV, and it includes some provisions for integrity check (a SHA-1 hash included in the encrypted data: that's a homemade construction which cryptographers will frown upon, although there is no flagrant weakness in it -- but, in these matters, you never know...). The blog post does not tell what kind of padding is used.
There does not appear to be any documented way to specify any other mode, either during symmetric key generation or when doing the encryption itself.


Chrome does not show green bar with EV SSL but firefox and IE does I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green padlock and green https:// like you get when you have a standard SSL certificate.
IE and Firefox display the green bar and company name as they should.
Does any one know why I'm getting this issue with chrome?
I have no insecure content on my page, I have run a check with ssllabs.com and the results came back 'B' because

This server does not mitigate the BEAST attack. Grade capped to B
BEAST attack   Vulnerable   INSECURE (more info)
RC4    Yes   PROBLEMATIC (more info)

Does anyone know how I get around this problem? Does this mean that chrome makes more in-depth tests to check whether it's valid, more so than other browsers.
Thanks.

BEAST attack Vulnerable INSECURE (more info)

  RC4 Yes PROBLEMATIC (more info)

These warnings are not directly related to your certificate.  They're more about your SSL configuration.  When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data.

BEAST is a vulnerability with SSLv3 and TLSv1.  Basically there's a crypto flaw in SSLv3 and TLSv1 (fixed in TLSv1.1, which isn't widely implemented) that allows a hacker (man-in-the-middle) to attack long running sessions.  You can mitigate this issue by configuring your server to use ciphers that are immune to BEAST and to prefer those ciphers.

On nginx the configuration looks like this:

ssl_ciphers RC4:HIGH:!aNULL:!MD5:!ADH:!kEDH;

ssl_prefer_server_ciphers on;

This will use RC4 with clients that support it and fall back to AES.


How to turn of telnet and FTP on Thomson 789vn router? I have run a port scan against a Thomson 789vn router and have noticed to my surprise that its HTTP as well as telnet and FTP ports are open.

How can one turn off telnet (also FTP) using the router's management interface? Is there a good reason that speaks against doing that?

The product is by now several years old and I have not found the required information in the manual.

Have you tried to telnet onto it? I had a similar Thomson router which if you telnet onto has it's own command line interface. It wasn't very intuitve, but once you get the hang of it you can figure out how to remove services.


TrueCrypt Data Recovery I deleted a 2GB directory and sub-directories/data files from a TrueCrypt container mounted as a Drive Letter.  The directory and sub-directories/data files was larger than the recycle bin so it was deleted without the recycle bin.  The recycle bin was also deleted.

The container can still be mounted and I have not used the machine since.

Machine description - Win7 x64 Virtual Machine on a Mac Book Pro with Mountain Lion

It's possible to a software recover the deleted data?

Yes. Basically, your Truecrypt behaves like a real harddrive, in a harddrive. So your "container" can be seen as a disk platter in a real harddrive. When you delete a file, windows will write exactly the same thing (deleting the file index from the file table) to the TC disk driver, as it would write to a "real" harddrive. Truecrypt does not know whats stored in a container, all it does is act as a encryption/decryption filter between a "virtual" disk drive and the container file.

Thus, you can run normal file-recovery Tools on the VIRTUAL truecrypt disk drive. Note that some file recovery Tools will be "allergic" to non-physical drives, but then just try Another tool.


Proper way of archiving malicious files I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files?
Given that the files won´t be executed (this happens in a seperate environment) but are just stored and get opend in i.e. Notepad++, is a Virtual Machine really necessary?

Not using a VM will leave you totally dependent on the static analysis programs and any other program (hex editor, text editors and so on) you use. This is dangerous. In my opinion, too dangerous. Like Matthew said, any bug in, say notepad++, will put your archiving machine at risk of being attacked when all you think you are doing is analyzing the file.

Considering these files are known to be malicious, I wouldn't take the risk. Not to mention the human error factor - someone accidentally running a malicious script by double clicking on a Javascript .js file for example (which most people don't know is double-click-executable like that by default on Windows).

Furthermore, a VM will be much easier to repair in case of a malicious program wreaking havoc. With snapshots you can easily undo any damages.


Are there any free static analysis tools for C# / .NET code A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to carry out similar assignments.

So far I have come across the O2 Platform but the documentation is all over the place. Microsoft's FxCop is another tool I found but their reports are horrible and I'd like something that would give me a report which I could use to further carry out a manual inspection without having to pull out my hair trying to read output.

What recommendations do you have for carrying out a code review in terms of a quality scan, free / relatively low pricing for an independent contractor and good reporting?

Roslyn Security Guard is now available and is free. https://dotnet-security-guard.github.io/

Update: This project is no longer maintained and has been forked here and improved here: https://github.com/security-code-scan/security-code-scan.

By the way, be sure to enable it for the full codebase by choosing Tools > Options -> Text Editor -> C# -> Advanced -> "Enable full solution analysis".


How can information be recovered after it has been overwritten (single pass) by a secure deletion program? We know that information can be retreived after it has been deleted. There are several tools for file "undeletion" (Recuva, FTK, some tools contained in Caine, etc.)

I have heard as well, that data can be recovered, even after it has been rewritten. For this exact reason, the DoD used to approve methods which included (DoD 5220.22-M) to 7 (DoD 5220.22-ECE)  overwrite passes. This is still a low bar, considering there are algorithms which include 35 passes (Gurmann).

Why, though? What papers, articles, or use cases have been published that suggest successful data recovery after single or dual pass of overwritting data?

Which software, methods, or tools allow me to analyze a given HDD for "further layers" (?) of recovery or overwriting?

(I know there is a different approach and dynamic to SSD, so for the time being, let's not meddle into it)

The whole multipass overwrite is fundamentally an urban legend hold over from a disk technology that hasn't been in use for decades.

Overwritten data (even once) is not recoverable, there is no tool to do it.

That said, the real issue is being able to actually overwrite the data in the first place. It's fairly simple to accomplish if you're wiping the entire drive (with standard caveats on overlays, protected regions, etc.), but if you are trying to overwrite only selected files, it's harder than you might think. There are numerous reasons, I'm not going into, as to why the attempt to overwrite individual files on a file system may not actually overwrite.


Does OWASP's top 10 list cover the majority of potential web application vulnerabilities? I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are organizations implementing a minimal level of scan coverage?

From OWASP:

  "It represents a broad consensus about the most critical security
  risks to web applications."

So, yes, by definition, the goal of the Top 10 is to describe the "majority of potential web vulnerabilities".

But your next step is not logically supported by that fact.

  performing an "OWASP Top 10" scan provides enough coverage to consider
  it an "in-depth" scan

I can list the top ten most common human diseases, but that does not mean that any given diagnostic scan for those diseases is comprehensive, complete, or accurate.

An "OWASP Top 10 scan" cannot possibly be definitive for all possible instances of those vulnerabilities, and in fact, some items on the Top 10 list cannot be scanned for.

So, no, an "OWASP Top 10 scan" cannot be described as an "in-depth scan". Depth is defined by how the scan is performed, not by the broad categories of vulnerabilities it is inspired to look for.

The OWASP Top 10 is descriptive (backwards-looking), not prescriptive (forwards-looking). From examined web apps, the ten biggest problems found are those ten. That does not mean that there are only ten possible vulnerabilities classifications.

And that does not mean that knowing these ten exist makes it possible to find them in any given web app. When breaches occur, it may be possible to trace things back to these likely vulnerabilities, but that's easier when you have the breach to start from. It gets significantly more complex if you are starting from a well-running app.

However, if you can find them in the web app from a scan or some other automated or simple process, then that's an indication of a significant weakness in the web app since attackers will also use these methods.

An in-depth analysis (not scan) of a web app includes many different approaches and techniques to quickly provide coverage of possible vulnerabilities before release. But remember that attackers have all the time in the world to look for the one thing you couldn't find in time.


multiple authenticode signatures Is it possible to have multiple Authenticode signatures in an executable? The Digital Signatures tab suggests you can, so I was wondering if, for example, you can sign an executable with Verisign's signature (for Windows), and also a self signed one in the same executable.

I've searched the Internet and can find vague mentions of dual signing and people supposedly signing an executable with multiple certificates, but nothing concrete.

/as switch to signtool.exe does that:

/as - Appends this signature. If no primary signature is present, this
signature is made the primary signature.

See: https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool


Home environment for MacOS detection tools I was recently introduced to a variety of detection/hunting tools for MacOS. Listed below are some of the tools I am interested in learning to broaden my toolkit and better learn Mac security.

Google Santa
XNUmon
Little Snitch
OSQuery

These are just some tools and as you can see, most are detective. Coming from an offensive background, setting up a home lab is easy. You have an attack machine with your toolkit, and vulnerable machines to practice your "skillz" on.

To me, practising defensive tools seems harder and I don't have access to use these tools at work. How can I learn these tools at home? Does anybody have any experience with this problem and can share some insight into a solution?

A defensive lab is nothing other than an offensive lab with added defensive tools. A good methodology is to have lab systems with these defensive tools, use your offensive tools to attack the lab systems, move laterally etc, and then use the defensive tools to see whether you can detect and/or prevent your attacks. If you scale that approach up to multiple people in the enterprise, you have the essence of purple teaming. In case you run out of ideas, I find the MITRE's ATT&CK framework a very useful source of inspiration, it also includes many macOS TTPs.


On-site Whitelisting vs. Off-site Cisco VPN A company I’m applying to as web software tester is requiring me to be on-site so they could put me on their whitelist. However, I had a previous job which allowed me to work anywhere, using only Cisco VPN.

Is on-site whitelisting more secure than using off-site VPN? How so?

From a very basic perspective, yes, being onsite is safer.

The key reason being that there is a smaller attack surface.

If you are connecting in via a VPN, there are numerous additional items which could be attacked (yes, in a perfect world, you would have a secure VPN that couldn't be broken/hacked/misconfigured, but this world is definitely not perfect) so the number of potential exploits increases.

The difference may not be much in a well managed environment, but there are many organisations which still see the increase in risk as too far.


TOTP Resynchronisation Considering hardware tokens implementing OATH TOTP (c.f. RFC6238), it is common knowledge that the clock in such tokens drift. A token that is not used very often is likely to drift way beyond the synchronisation window that an authentication server is using, hence resynchronisation may be required.

A simple form of resynchronisation is simply to widen the search window, and this may probably work in most cases. But if the search window is too large, there is a small risk that the token is wrongly synchronised (assuming an OTP is repeated). I have not done the math, but this is probably rare.

I have heard about resynchronisation methods that take a sequence of OTPs to resynchronise. This would give an accurate resynchronisation of course, but at the expense of having the user wait for two or three OTPs.

I know some token and authentication service providers have implemented a method where the user can get partial information about the clock in the display, so that the time information + OTP is used as input to the resynchronisation process.

I have not seen any of the OATH RFCs giving a concrete recommendation for how to resynchronise. I wonder if anyone on this forum knows of commonly used methods in the industry; in particular what is your view on the last variant I describe?

Usually, the  TOTP server is configured with an NTP server for accurate time.  Each time the token authenticates to the server, the server adjusts for the drift of the token. As you have mentioned if a token is not used often, the amount of drift can surpass the synchronization window.

To solve this problem most of the time, TOTP servers provide a re-sync option. For example, using a software from the TOTP service provider installed on the user machine can allow the token to obtains the server time and re-sync its clock.

Here are some links to shows examples of the re-sync option

http://support.nordicedge.com/nsd1326-how-to-re-synchronize-oath-tokens-with-oathresyncwebapp/

https://kc.mcafee.com/corporate/index?page=content&id=KB76278

Some other TOTP service provider will do it manually through a help desk like http://www.mideye.com/support/users/token-card-users/

Of course, there are some other methods, but in general, all of them allow one way or another the token to know the server clock.


Is there a typical step-by-step A-Z process for testing a Web site for possible exploits? I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for instance, OWASP has the following testing guide:

https://www.owasp.org/index.php/OWASP_Testing_Guide_v3_Table_of_Contents

Do you have similar go-to guides, where you will move from A-Z though the list, testing for exploits, or do you consider a great deal of the process to be of a "non-disclosure" sort?

The OWASP guide is the closest thing to a defined methodology, most testers operate using gut feel and experience imho.  I like that OWASP methodology, but I do think it misses a big chunk of testing around application logic flaws.

If you are looking for a starting point to develop your own internal methodology, take the OWASP one, remove areas that are not relevant to your testing, and adapt it.

I believe that the Penetration Testing Execution Framework (PTES) will be one to watch.  It is still early days, but I look forward to seeing what the output of that project is.  This can be found at http://www.pentest-standard.org


Visible anti counterfeiting in a mobile app? Looking at New Haven Line Commuters Will Soon be able to Purchase Rail Tickets with Smartphone App:

  When a conductor walks through the train to ask for tickets, the commuter should have their activated digital ticket displayed and show their smartphone screen to the conductor. The conductor will visually inspect the mobile ticket, which incorporates digital anti-counterfeiting features.

how can you do this? I am surprised by the visual part, if it had a QR code or similar then it's trivial crypto but visual? Say, it shows an animation, well, just capture it as a movie. If it shows an animation over your photo, then take the original photo and substract it and add back another photo. I just can't even imagine how this could work. Where could I read more?

Edit: after reading the first answer, sorry, the motivation behind this question is the botched up launch of the Budapest online pass sales system so expect the financial motivation to definitely be there. We are talking of something with a value of like 10% of the average net monthly salary. I only used the New Haven tickets as an explanation of the problem, as the press release describes the system real nicely.

I'm not sure about this particular system but one thing I have seen is a simple code (could be a little more sophisticated, like a movie) which changes every few minutes. The conductor just hast to watch the most recent one and then compare.

Given

the low cost of a ticket for a single ride and
the hassle of taking a nice enough picture or video to not get caught combined with
fines for getting caught

this can be sufficient protection.

In practice at least codes are dubious. The conductors don't actually seem to check mine, ever.


Securing data passed between two sites via a browser I need to pass some data securely from one web site to another via a browser.

A user visits site A and clicks a link there which takes him to site B; this could be just a link which would produce GET request or a submit button of a form, which would produce POST, either is fine. The communication is other HTTPS.

Some data is sent with the request. Data is not long, up to 20 symbols. I need to make sure that nobody but site A and B can understand it, not even the user who is operating the browser.

I am also thinking that I might want to get site A to sign data, but I am not sure if I really need this. Technically for me it is not a problem to share the key between these 2 sites.

The value that I need to secure is just a user name. I am thinking just about encrypting it with AES algorithm using 256 bit key on site A and decrypting it on site B with the same key. I am not planning to use any kind of salt.

The questions is can the approach I am thinking about be considered somewhat secure or is it very vulnerable?

I need to pass some data securely

What do you mean exactly by "securely", do you mean that:

You do not want the user to be able to read the content of the protected data (ie. you want to ensure the data confidentiality),
You do not want the user to be able to tamper or forge the data (ie. you want to ensure the data integrity)?

By simply encrypting the data, you solely ensure the data confidentiality. Without knowing the key, a malicious user could still try to modify the encrypted data to try, for instance, to get access to another user's data.

If you want to ensure the data integrity, you do not need asymmetric signatures (it would work, but as you feel it would be overkill), what you need is to apply an HMAC to the data. Thanks to this, given a common secret, website B will be able to check that the data allegedly received from website A is indeed authentic.

From then the fact that you want to apply a cryptographic function on top of this to hide the data content is totally up to you. The data could perfectly stay in clear form without reducing the security of the HMAC as an integrity protection system.


Why does IE11 refuse to enable back navigation caching for HTTPS? On my website, I get this error message in the console:

  DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337

That link includes a list of conditions a web site must meet to enable the back navigation cache, which can restore a page from memory without reloading or reconstructing.

The first condition to enable this cache is:

  Served using the HTTP: protocol (HTTPS pages are not cached for security reasons)

This is according to the official documentation for the feature, which you can read for yourself by following the link.

What are the "security reasons" that makes IE11 choose to disable the back navigation cache for HTTPS pages?

The primary reason for not caching pages is if the page contains sensitive information, and that information might then be accessible to anyone using the computer.  Good examples include banking details, medical records, or passwords.  A public computer or a computer that falls into the wrong persons hands could then gain access to secret information through the cached pages.

Furthermore, there's specific requirements for things like HIPPA compliance in the US, where medical records can't be stored in unencrypted form.  This creates a problem when creating web applications if the web application caches pages.

Doing this for SSL is likely just a guess that the page contains sensitive information.  A better design would be to obey a header on the page that directs that the page not be cached.


Protect file in a web site How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?

As Steve and Avi have asked, you are either referring to passwords for users of a website/web application or passwords for the system. Typical protection for the two options:

Passwords for web application / web site:

Stored in a database which is separated from the web DMZ by a firewall, not on the web server (which is in the web DMZ.) Access control is both on the firewall, and in encrypting the database or hashing the passwords in the database

System passwords:

Passwords hashed in /etc/passwd or /etc/shadow or SAM file or equivalent, and password file has access controls limiting access to root or system accounts only.

There are other options, but these are by far the most common.


Why won't Firefox accept my certificate? I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is:

  127.0.0.1:5559 uses an invalid security certificate.
  The certificate is only valid for 127.0.0.1
  Error code: SSL_ERROR_BAD_CERT_DOMAIN

However, 127.0.0.1 is in alternative DNS names. Here is my OpenSSL config file:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = chacheserver.net
[v3_req]
keyUsage = digitalSignature, keyEncipherment, dataEncipherment, keyAgreement
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1

Try to mark your IPs with type IP. (instead of type DNS.).

Namely, make your section look like this:

[alt_names]
DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net
DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net
DNS.5 = 192.168.1.130
DNS.6 = 192.168.1.70
DNS.7 = 192.168.2.130
DNS.8 = 192.168.2.70
DNS.9 = 192.168.8.70
DNS.10 = 192.168.8.130
DNS.11 = 127.0.0.1
IP.1 = 192.168.1.130
IP.2 = 192.168.1.70
IP.3 = 192.168.2.130
IP.4 = 192.168.2.70
IP.5 = 192.168.8.70
IP.6 = 192.168.8.130
IP.7 = 127.0.0.1

Some broken browsers (older Internet Explorers, I think) actually expect IPs to be marked "DNS". So for backwards compatibility you can leave the IPs marked as they are and ALSO add them marked with type ID "IP".

Further reading

General SAN concept with OpenSSL: ApeTec, 2012-01-15, Multiple Names on One Certificate. (Archived here.)
Broken browsers:

MichaelM.Info: IP addresses in SubjectAltName in SSL website certificates #fail for some browsers. (Archived here.)
Microsoft Connect regarding this: ID869717

Sidenote: Multiple wildcards will probably not work.

I don't think many clients will accept more than a single wildcard.

So they will probably accept these:

DNS.1 = chacheserver.net
DNS.2 = *.chacheserver.net

But reject these:

DNS.3 = *.*.chacheserver.net
DNS.4 = *.*.*.chacheserver.net


What causes Windows security logs saying an attempt was made to reset an account's password? This falls under the category of eliminating what might be normal activity from my attention.

I'm looking at Windows 7 security event logs.  I don't have context to know if the following event is a normal occurrence.  It happens 10 times a day or more on my workstation.  What is causing it?

Same events in event viewer look like this:

I just audited the event logs of all workstations in my environment (about 2000 windows 10, 4000 windows 7).

None had that error message in the last 3 days.

It's definitely not a normal occurrence. Do you have any 3rd party password management or MFA/2FA login devices for AD?

I'd post a comment but for some reason you need more points to comment than to answer. Sorry :(


Are HTTPonly cookies secure enough for implementing "remember me" functionality? I have a website which have a "remember me" functionality. When someone clicks that functionality it sets the user password and username in a cookie to remember him/her. Okay, fine.

But, that cookie is a HTTPonly cookie (no worry for XSS) with the Secure flag set. Is it enough security in there?

Now that cookie cannot travel in the plain text (as per the secure flag), it cannot be read through javascript (document.cookie). So my opinion is that this implementation is secure enough. But I am curious to know of yours.

There are some problems with this scheme.

You should never store the actual password in the cookie. Store a temporary session token that is associated with the account (on the server) and then you can delete that token when the user logs out. If you're just storing the user's credentials, there's no way to end a session (on the server side) without ending all the sessions (by invalidating the creds).
Storing the password in the cookie means that anybody who gets access to the cookie (for example, another user on the same computer) will always be able to log in as the "remembered" user by looking at those credentials, memorizing them, and taking them to another computer. Session tokens should be long and random, and ideally short-lived.
HttpOnly does NOT provide protection against XSS. It's not even close. All it does is prevent script from reading the cookie. Somebody can still take over the session of the logged-in user's browser, and take any action the user could take, and send the attacker everything that the user can see. In fact, there's an entire exploit framework that explicitly does this, essentially letting the attacker remote-control the victim's browser session. You still need careful XSS protections.
HttpOnly won't protect at all if there's any page that reflects the cookie's values back from the server. An XSS could just read the server's response. In fairness, you didn't say there was any such page, but I just wanted to highlight how threadbare the "protection" of HttpOnly really is. Anything that you think "this wouldn't be secure, except for HttpOnly" is almost certainly not secure even with it.


How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user? There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=auth_code; I can easily get the auth code and then access token manually. When browser redirects me to bank auth page I just enter my credentials and then It redirects me to my predefined URL with auth_code.

But I need to write unit tests for my implementation of this API. And how can I perform this process with entering credentials and send request from the page programmatically to get auth code?

You can try to use Selenium WebDriver to automate the flow.

I recently did exactly that - automated integration tests calling bank API protected by OAuth and it took me only few hours to get it to work.

Basically You run a real browser and drive interaction with web page from Java code replicating manual interaction.


Security Architect as a career path. How do i do it? As it says, I want to become a Security Architect and I'm not sure of the career path to follow! I've already asked a few questions about certifications and got great help from this community. Deciding a career path is not easy, after all (at least for me).

I've looked at a lot of certifications list.. a few threads,
here here and here.
Looked at some career path threads, here and here. And even tailed a few people, Avid in this site, for example.. and one more nice site for a security architect.

At this point, I know for sure that I must amass extreme knowledge and good experience. But... where to start? Are there any certifications inline with this career? Is there a specific path that will get me there?

Currently, I am a Security Tester. I'm learning anything and everything that I come across. I might be able to connect the dots later, or maybe not. But there are people here, who are in great positions with knowledge who can help me out with what I want.

Help me with your opinion guys...

This is my experience working with security architects, so YMMV, and the role is evolving... maybe it's different for new architects.  "Security Architects" have lots of outdated detailed knowledge and lots of up-to-date high level knowledge.  Most seem to be promoted into the role and survive through sheer arrogance.

Pricing, scaling, project management and risk assessment can't be understated for their roles.  They can't be experts in everything though, so that detailed knowledge they might have had earlier in their career becomes less and less important.  An architect should not be getting their hands dirty outside of the lab.  The reason being separation of duties and the risk of taking on too much of the workload.

Management needs to have somebody they can talk to.  Security architects understand the policies, the risks, the business decisions, budget and costs and direct the practitioners' leadership to implement solutions or changes on time and on budget.

Eventually their in-depth knowledge fades into obsolescence.  Some can't seem to cope with this.

The ones I worked with had CISSPs with some business training, ITIL, project management experience and a lot of technical certs collected from previous roles.  They also sit in on all the free training and certs provided by vendors who are trying to sell them solutions.

But don't forget the arrogance.  It's important.  The job is really impossible.  You're asked to provide perfection, but you're given a limited budget and a creeping scope. You're only right 90% of the time, but you'll waste all your time worrying about the 10% and burn out if you're not arrogant.  Overspec and fight for budget improvements or get risk signoff, but do not admit you're uncertain.  You are the expert.  Nobody knows more than you do.

(don't mark this answer correct... let's see if the Security architects chime in)


How do SSH keys work? I'm just looking for a simplified explanation of the mechanics of SSH authorization.

Basically, what makes it better then a really long password? And how does the public key play into things?

I understand how to use it, but I want to know how/why it works.

Edit: As mentioned in the comment I made right after I posted this, that other question does not answer mine. Stop marking it as a duplicate please. Or if you insist, post an answer over there that also answers my question.

I'm not sure what you're comparing SSH with the "very long password".  SSH provides a secure means to send your user login and password to a remote server.  Or you can use a client's public key.  Asymmetric keys are generally harder to break because they're not subject to users creating bad passwords.  Public Key Based Authentication is preferred for that reason.  You can white-list specific public keys for your user (and IP) so that not just anyone can login with your username, and from any computer.  This white list is contained in /home/<user>/.ssh/authorized_keys.

Basics of SSH:

Server presents its RSA public key to the client.  The client
manually verifies that it trusts this key before continuing.
SSH uses Diffie Hellman to establish a shared secret value.
The shared secret along with lots of key exchange data is hashed
together and signed using the server's private key.
The client can verify this signature using the server's previously
trusted public key.
Both sides now have all the information needed to generate session
keys.

From section 7.2 of RFC4253

7.2.  Output from Key Exchange

   The key exchange produces two values: a shared secret K, and an
   exchange hash H.  Encryption and authentication keys are derived from
   these.  The exchange hash H from the first key exchange is
   additionally used as the session identifier, which is a unique
   identifier for this connection.  It is used by authentication methods
   as a part of the data that is signed as a proof of possession of a
   private key.  Once computed, the session identifier is not changed,
   even if keys are later re-exchanged.

   Each key exchange method specifies a hash function that is used in
   the key exchange.  The same hash algorithm MUST be used in key
   derivation.  Here, we'll call it HASH.

   Encryption keys MUST be computed as HASH, of a known value and K, as
   follows:

   o  Initial IV client to server: HASH(K || H || "A" || session_id)
      (Here K is encoded as mpint and "A" as byte and session_id as raw
      data.  "A" means the single character A, ASCII 65).

   o  Initial IV server to client: HASH(K || H || "B" || session_id)

   o  Encryption key client to server: HASH(K || H || "C" || session_id)

   o  Encryption key server to client: HASH(K || H || "D" || session_id)

   o  Integrity key client to server: HASH(K || H || "E" || session_id)

   o  Integrity key server to client: HASH(K || H || "F" || session_id)

   Key data MUST be taken from the beginning of the hash output.  As
   many bytes as needed are taken from the beginning of the hash value.
   If the key length needed is longer than the output of the HASH, the
   key is extended by computing HASH of the concatenation of K and H and
   the entire key so far, and appending the resulting bytes (as many as
   HASH generates) to the key.  This process is repeated until enough
   key material is available; the key is taken from the beginning of
   this value.  In other words:

      K1 = HASH(K || H || X || session_id)   (X is e.g., "A")
      K2 = HASH(K || H || K1)
      K3 = HASH(K || H || K1 || K2)
      ...
      key = K1 || K2 || K3 || ...

   This process will lose entropy if the amount of entropy in K is
   larger than the internal state size of HASH.

Once the encrypted channel is established the SSH protocol begins the client authentication based upon parameters you've given it.  All of this is performed securely through the encrypted channel.


Why no support for TCP Sockets in JavaScript I know there are now WebSockets, but what is the issue with providing a socket API to allow interacting with existing protocols?

I mean, after all, I can use a hidden flash object to do the same already. Is there an attack vector I am missing?

... but what is the issue with providing a socket API to allow interacting with existing protocols?

This is not a restriction of the language itself but of it's use inside the sandbox within the browser. Just imagine that a script somewhere on the internet gets loaded into the browser and could from inside the browser access every computer reachable by the browser with arbitrary protocols. You could easily misuse this to send spam through a companies internal mail server or attack/misuse other internal and external resources.

Which means there must be some restrictions in place and the different sandbox environments for the different language runtimes provide different kind of restrictions:

With flash the target host must explicitly allow access to by providing an appropriate socket policy file. This is similar to the mechanism within HTML5 CORS.
Untrusted Java applets are limited to communication with the host providing the applet.
And with JavaScript inside the browser you can talk to almost all sites, but you are limited by the protocol you can use, i.e. HTTP (restricted by CORS) and WebSockets.


Social security and bank account numbers in plain text in web app I am in an "argument" with my company about them showing each and every employees social security and full banking routing / account number in plain text on a leading hosted HR Management software application.  They have the ability to hide it, like every other application I have ever seen, but they refuse to for their convenience.  They cite things like it is hosted in the same server farm as the CIA.

I am not too concerned with security in the backend systems, just the fact that they present the data to a user logging into the system in the front end of the application in plain text (though encrypted).  I know it is bad practice to do this, but I can't get them to budge.

I believe that the application has 2 factor authentication set up for reports and more data vulnerable functions.  The application does use RSA 2048 / sha256RSA.

I have brought up the Sony, White House, Anthem, and OPM hacks, but they still shrugged it off.

Does anyone have any suggestions on how to convince them to turn on masking of these fields (XXX-XX-1234)?

Are there any laws, lawsuits or other kinds of guidance that I could cite to help push the securing of this information (like PCI DSS compliance)?

I guess the real question should be:
How do I elegantly explain this to "people who do not understand the actual risk"?  (this was run by the "risk manager" as well)

Asked for legal ramifications here

There are 2 things here, them storing the data in a readable format and them showing you. They do need the data to be in a readable (by the program) format because it is needed to send people money and for tax reasons or to put on wage slips.

They should however not show you sensitive information that you don't need to see. If you wanted to you could use all that information for malicious activities. It is their responsibility to reduce the attack vectors without reducing functionality, giving you this info is making an unnecessary attack vector for little or no functionality.

The fact that the server farm is the same as the CIA means nothing. Its like saying that you live next to a police station so you wont get robbed. Additionally they should not know that they are in the same farm as the CIA because that now tells you one place the CIA have servers and that is info the CIA dont want anyone to know due to possible attacks against them. Lastly I wouldn't trust any government bodies with my data, most of the data breaches from whistle blowers are of data that the whistle blower should not have access to (Edward Snowden, Chelsea Manning, Harold Martin)


How can I detect real location of the user through their IP address? There were many ways to detect the user's IP, for instance we could get it through a single click link or through any other medium of communication where we could get the user's IP.

But the tedious part is finding the real geo-location of the IP address.

Whenever I check I am able to only retrieve the information that is associated with where the ISP is located and not the exact location of the computer with that IP address.

Some options I looked over for detecting location were:

If it's a public IP, we could trace it, or further explore with maltego
Some IP's were publicly listed with Google map records with exact physical location

Is there any way to determine the real address through the IP other than the ISP's address?

Geo-ip location accuracy varies wildly from country to country and from provider to provider. Some smaller countries have very accurate internal mappings of IP's to postal addresses but this type of data is generally not available to the public.

Note: Different Geo-IP address databases may also have different location data for the same IP address so you may also want to double-check the quality of your source data.

Alternative ways to gain more accurate information:

Methods people/organizations use to get more accurate geo-ip information include the following:

1.) HTML5 Geolocation especially if the remote device is a mobile device with GPS or GPS like triangulation features this may give you much more accurate info than the Geo-IP address. If the device does not use GPS it may alternatively leverage the local wireless SSID information and compare that other datasets to determine it's physical location, Google and Skyhook wireless have large databases of end user SSID's mapped to physical locations. Note: If you can get the SSID there are other public databases of where SSID's have been seen mapped to physical locations.

http://www.w3schools.com/html/html5_geolocation.asp

http://locationdetection.mobi/

2.) Purchase information about the IP address from advertisers who can confirm the owners shipping location via aggregation based on other activity notably past sales & shipping information. Matching aggregate regular and hidden cookie information to the account owner to help identify the person or people who use a given IP is far more telling than GeoIP information.

3.) See if you can match the IPv4 address to an IPv6 address on the same host. In many cases the IPv4 geolocation may not be as accurate or up-to-date as the IPv6 geolocation information for the same host.

There are likely many other ways to do this.

It may also be helpful to read some of the FAQ's at commercial providers of GeoIP data such as Maxmind to give you an idea of how accurate the data may be.

https://support.maxmind.com/

Finally it should be noted that some elements of this information such as HTML5 geolocation and unique cookies may be sent to the web server allowing someone to identify a user that may otherwise be trying to disguise their address via a proxy or a service like Tor. This is one of the specific reasons Tor users need to be careful about their implementation and how they are using the service.


Security of LastPass' password generator I currently use LastPass for all of my password generation and management.  After reading Diceware, I realized that LastPass' password generator might be insecure, as somebody could potentially attempt to generate the same password I did.

I'm cautious about posting their code on this website, but from inspecting their code here, I've seen that for each character, they pick a character type (Upper, Lower, Number, Symbol, or All), and then pick a random character out of a predefined list.

I've attempted to look at their random number generation code, and it looks like they use the time as the seed.  I'm not entirely sure where rng_pool comes from, and how it works to generate the password.

What method of generation are they using, and is it secure?

(The important functions on the page are lpCreatePass and getRandom)

If appears to seed the RNG with window.crypto, which if not available window.msCrypto is used and finally falls back onto current time. The relevant code is:

var rng_state;
var rng_pool;
var rng_pptr;

// Mix in a 32-bit integer into the pool
function rng_seed_int(x) {
  rng_pool[rng_pptr++] ^= x & 255;
  rng_pool[rng_pptr++] ^= (x >> 8) & 255;
  rng_pool[rng_pptr++] ^= (x >> 16) & 255;
  rng_pool[rng_pptr++] ^= (x >> 24) & 255;
  if(rng_pptr >= rng_psize) rng_pptr -= rng_psize;
}

// Mix in the current time (w/milliseconds) into the pool
function rng_seed_time() {
  rng_seed_int(new Date().getTime());
}

// Initialize the pool with junk if needed.
if(rng_pool == null) {
  rng_pool = new Array();
  rng_pptr = 0;
  var t;
  if(typeof(navigator) != 'undefined' && navigator.appName == "Netscape" && navigator.appVersion < "5" && typeof(window) != 'undefined' && window.crypto) {
    // Extract entropy (256 bits) from NS4 RNG if available
    var z = window.crypto.random(32);
    for(t = 0; t < z.length; ++t)
      rng_pool[rng_pptr++] = z.charCodeAt(t) & 255;
  }

  //First try to use browser's PRNG over Math.random
  try{
    var crypt_obj = null;
    if (typeof(window) != "undefined" && typeof(window.crypto) != "undefined") {
      crypt_obj = window.crypto;
    } else if (typeof(window) != "undefined" && typeof(window.msCrypto) != "undefined") {
      crypt_obj = window.msCrypto;
    }

 if(typeof(crypt_obj) != 'undefined' && typeof(crypt_obj.getRandomValues) == 'function') {
      if(rng_pptr < rng_psize){
        var num = Math.floor((rng_psize - rng_pptr) / 2) + 1;
        var buf = new Uint16Array(num);
        crypt_obj.getRandomValues(buf);
        for(var i = 0; i < buf.length; i++){
          var t = buf[i];
          rng_pool[rng_pptr++] = t >>> 8;
          rng_pool[rng_pptr++] = t & 255;
        }
      }
    }
  }catch(e){}

  //Fall back to Math.random if needed
  while(rng_pptr < rng_psize) {  // extract some randomness from Math.random()
    t = Math.floor(65536 * Math.random());
    rng_pool[rng_pptr++] = t >>> 8;
    rng_pool[rng_pptr++] = t & 255;
  }
  rng_pptr = 0;
  rng_seed_time();
  //rng_seed_int(window.screenX);
  //rng_seed_int(window.screenY);
}

Window.crpto is part of the Web Cryptography API:

  [The Web Cryptography API] specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform these operations. Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications.

window.msCrypto is Microsoft's implementation of this.

If you are using a supported browser then this generation method appears secure (well it as secure as your browser's implementation of the Web Cryptography API). If not, then it appears to use Math.random seeded with current time which is not secure - it would be good if the web page warned you if this was the case.

This page shows the current status of browser support for the Web Cryptography API.


Could Google read Map Api InfoWindow html content? I used google map api.
I read some high protected data on the my HTML page. And write them into InfoWindow on google maps using javascript.

Could google read infowindow html content?

There are no answer for me, or i cant understand :(

  Map size and location for retrieving map tiles and copyrights
  Addresses for geocoding
  Direction and Elevation requests
  Locations around which to search for Places
  KML when using KmlLayer

If you include any third party script in your page, the authors could potentially read any data on the page. That applies to Google Maps, any third party library hosts, advertising providers...

If the data is sufficiently high risk to be worried about Google stealing it, don't use any third party scripts.


Ubuntu LVM Encryption I recently installed Kubuntu and I noticed the option for having an encrypted LVM. The behavior suggests it's full disk encryption since I need to put in a password before I can boot. This article and others I have read suggest it's full disk encryption. Is this actually full disk encryption? If so what type of encryption does it use? or is it just a password I have to put in before it hits grub or lilo but the disk itself is unencrypted.

The only reason I don't believe this is full disk encryption is because the only full disk encryption software I've used before was truecrypt which took hours to encrypt a hard drive and when I did something crazy like AES>Serpent>Blowfish the machine would be noticeably slower. Kubuntu's encryption didn't take 4 hours to setup and the machine doesn't seem slower at all.

LVM operates below the filesystem, so whatever it does, it does so at the disk level. So yes, indeed, when LVM implements encryption this is "full-disk encryption" (or, more accurately, "full-partition encryption").

Applying encryption is fast when it is done upon creation: since the initial contents of the partition are ignored, they are not encrypted; only new data will be encrypted as it is written. However, when applying encryption on an existing volume (as is typical of TrueCrypt) requires reading, encrypting and writing back all used data sectors; this includes sectors which were previously in use, even if they are not in use right now, because they may contain excerpts of some files which were later on copied around. So that kind of after-the-fact application of encryption requires reading and rewriting the whole volume. A mechanical harddisk will run at about 100 MB/s, so a 1 TB volume will need 6 hours (3 for reading, 3 for writing).

The encryption itself needs not be slow, at least if it has been properly implemented. A basic PC will be able to encrypt data at more than 100 MB/s, with AES, using a single core (my underpowered laptop achieves 120 MB/s); with recent x86 cores offering the AES-NI instructions, 1 GB/s is reachable. Thus, the CPU can keep pace with the disk, and, most of the time, the user will not notice any slowdown.

Of course, if you do "something crazy" like cascading algorithms, well, you've done something crazy and you will have to pay for it. Cascading three algorithms means having to compute all three whenever you read or write data. AES is fast; Serpent not so (about twice slower). In any case, cascading encryption algorithms is not a very rational idea. By default, "encrypted LVM volume" in Linux will rely on dm-crypt, which is configurable (several algorithms are supported) but does not indulge into voodooistic cascades, and that's a blessing.

(This does show one of the little paradoxes of security: if it is too transparent and efficient, then people get nervous. For the same reason, medicine pills must taste foul.)


Is it dangerous to allow customers to refer to fonts.googleapis.com in their scripts? We are hosting customer created scripts (xlst). I am wondering if it would affect the security of our application if we allow customers to refer to fonts hosted at e.g. fonts.googleapis.com? Since they would be refered by a link tag, it should never be able to run any JavaScript content?

Normally those external fonts would be allowed, but since I am developing a application for a industry sector which is very sensitive I have to take much more care.

In theory, you're fine loading stylesheets and fonts from a third party - as you say, they're included in link tags, which shouldn't allow script execution. There are a few things which might cause information leakage though, and a potential for a targeted attack resulting in data appearing to change.

In terms of information leakage, browsers by default send a referer header when loading a resource. This will be sent to the font provider, and, if your links are structured in a way where you're attempting to use length or unknown values in the URL as a protection method, the font provider would be able to bypass that. If you're performing session checks, though, as most websites with authenticated sections in do, the third party shouldn't get the authentication tokens (usually cookies). Given that you're working in a sensitive industry, I'd hope this wasn't the case.

In terms of data appearing to change, a malicious font provider could supply fonts which are mapped incorrectly. Imagine if they supplied icons in a font, and you're using either a tick or a cross to indicate, for example, whether a blood sample was found to have a specific disease. By mapping the "tick" symbol to the "cross" value, and vice versa, an end user might think they've got some disease due to seeing this in the output. This would be a very targeted attack, so would probably only apply in very specific cases. This is unlikely to happen with Google Fonts, but could apply if you allowed linking to arbitrary web fonts.

Note that it would be possible for any stylesheet to perform similar attacks - for sensitive data, it's generally worth keeping anything that can modify the behaviour or appearance of the application hosted locally, unless you have specific requirements making this impossible.

For sensitive data, I'd advise hosting the fonts (and any other stylesheets and scripts) yourself, if possible, just for peace of mind.


Should magnetic locks automatically release in the event of a fire alarm? Basically what the title says, you'll find many buildings have these types of door locks
 which can usually be opened by using a RFID token. While this example photo is glass, lets assume that the door is steel/unbreakable.

In the even of fire what does/should happen to them?

From a security standpoint, any condition that throws open all the doors is probably a bad one, but if they don't open/fail then there's the possibility for loss of life in the event of a real fire.

Is there any guidance around this?

This is a very interesting question, I've come across this when a client was designing a fire-code-compliant office space. The client's work was related to the defence industry and the office space had two rooms with highly classified contents.

Now, of course, if you're a 3-letter government agency, you can disregard whatever laws you want, but let's assume that we want to follow the legal procedure.

The laws are clear when it comes to building code and fire safety (in all countries it's pretty much the same, but I'll quote the one from the United States). The National Fire Protection Association Life Safety Code 101 says

  Locks, if provided, shall not require the use of a key, a tool, or
  special knowledge or effort for operation from the egress side.

So to comply with the laws, the client built the rooms on the side of the hallway, making them impossible to use in the path of egress, then installed a big red button that would mechanically open the door from the inside. Behind the door there's a turnstile gate (though a very different model) that would only allow egress but not entry.

The idea is simple. If your room provides a step on the egress path, then by law it must be opened in the direction of the egress path. So it all comes down to thinking about security when designing the building.

I've found this image online and I added the red arrows and text to illustrate the point (those aren't really exits and fire exits)

So, Should magnetic locks automatically release in the event of a fire alarm? The answer is, it depends.


Should HTTP Security headers be configured for all servers? I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers
(and other internet facing servers such as loadbalancers). But is this necessary for non internet facing servers?

Let's say you have an app running on app.example.com on your local network, and you make it accessible on the internet through a reverse proxy on web.example.com. I would set the headers on app for a number of reasons:

You want to keep application logic close to the app. The headers are not one size fits all. You need to understand what you are serving to know how to set them. Therefore it makes more sense to set them on app.example.com.
Users on your intranet might browse directly to app.example.com, either on purpose or by mistake. They should still get the proteciton.
If an attacker knows the URL to app.example.com, she could leverage it in an attack against users on your intranet. If she can't embed web.example.com in an iframe on evil.com for her attack, she can just embed app.example.com instead.

If you have some minimum level of protection you want everything to have (perhaps you always want XSS proteciton to be on), you can set it on web.example.com as well as an extra failsafe.


How do I know how a file got onto my computer? I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually created this file?

Are there any logs in Windows which could give me this information? Or any tools which could help me garner this info?

I am suspecting a breach and the webserver(IIS) logs do not provide much info.

Not reliably.

You can check FTP logs, IIS logs, and the event logs (for admin access at the time of file creation), but if it's malicious and the attacker wishes to cover their tracks then most of these files are easy to fake/corrupt etc.

The best way is to be preprepared and have an system that reacts to new files being create (usually in specific directories or with specific permissions). The system that detects this can then make a record of which services were running, incorruptible (possibly off-server) copies of logs, and which users/service-users were logged in at that time.

The only reliable way to check/monitor whether a file has been uploaded to your server is to make a record of the hashes of all files (of interest) on the server at a specific point in time, and then to compare the current files list, and their hashes, to see if a file has been uploaded (and is therefore a new file compared to the snapshot list) or if one has been changed (because the hash is different).

It's not enough to check file create/access/change times as applied by the operating system as these can be spoofed (faked) easily.

This is a lot of work, but there are file integrity tools out there - both open source and free, and commercial, that can help with the bookkeeping.

If you need to know today and you have no record of files and (for change detection) their hashes, then there is no reliable way to check for this. Checking for newly created files through a simple file search may work if it's not part of a sophisticated attack where the malicious attacker is trying to cover their tracks, but it's just not reliable.


How secure is XMPP with self-signed SSL certificates? I'm looking for an easy way to set up a simple IM infrastructure that protects messages in transit as well as avoids having logs in places that neither I nor someone I trust controls. I'm based in Germany and according to Mr. Snowden, my traffic actually gets sifted through and analyzed, and I'm not comfortable with that at all. IM is something that bugs me a lot in that regard.

I'm thinking about having an isolated XMPP server with accounts for everyone in the group of people who needs this, and to require SSL with self-signed certificates. I'm running an XMPP server on my raspberry pi anyway, so why not pimp it with some SSL security. It's configured to not write any logs except for errors and diagnostics, so the log issue is fixed there already. The people in question know how to use Pidgin, but anything overly annoying wouldn't fly with any of them. Mobile would be a requirement as well, Facebook's just too convenient. I think XMPP has that covered.

I'm not so fond of OTR, as the Pidgin plugin requires a decent bit of technical literacy, crashes Pidgin every once in a while and takes 10+ seconds to initiate a conversation (for me) during which Pidgin completely freezes. Also, as far as I know there's only IM+'s plugin for mobile platforms and is quite pricey. Relying on a self-hosted server and SSL certificates should work for all conceivable platforms (I guess?), be relatively easy to set up on the client side and provide a decent improvement in security.

The question is, would that be safe enough? At the very least I aim to keep my communication over this infrastructure out of the NSA databases. I'm not aiming to withstand any directed attack by trained experts or the like, I'd just like to have private conversations that actually are as private as a phone call once was, and not archived and analyzed somewhere else as a matter of routine.

If it is, another side question, any recommendations on how exactly to generate the certificates to make them secure? I read that some algorithms may have been compromised, I'd like to avoid those if possible. I've seen a few threads on here on that, but none (that I understoof) with that NSA-proofness spin.

Self-signed certificates are just as good as certificates signed by another entity. The only thing that they're not is in the Public Key Infrastructure. Every modern computer comes with a list of known, trusted root certificates. Any certificate signed by one of these trusted roots is automatically trusted by your computer. Your self-signed certificates are not part of this trust chain, so it's up to you to trust these certificates. Clients will typically prompt you when encountering a certificate which cannot be traced back to a known root, so it's up to you to confirm that prompt.

The problem in this is that if you confirm this prompt every time by hand, it's very easy to be compromised by a man in the middle, since human verification of a certificate is very error prone. So you will have to establish trust in your self-signed certificate once initially and then let your client handle it. How to do this depends on the client and platform, but most/all platforms have some way of adding arbitrary certificates to the trusted certificate store.


How do I protect password enteries in Xorg? I have been doing some reading about security issues with Xorg on Linux, and was surprised to find that you can keylog any GUI application using two shell commands...

xinput list
xinput test <id of keyboard>

While there are ways to protect your root account from such attacks (creating a separate user account that has root access but does not use X), and this would be reasonably easy to do, but that is not my concern, due to a variety of reasons. However, this does nothing to protect other password fields. For instance, accessing bank websites, my master password file, etc. I would like to know if there is a way to protect all password fields from xinput test.

Is it possible to completely disable the xinput test command for a certain user, or will doing so break keyboard input from every GUI application?
Can certain GUI applications (such as Firefox and Konsole) be sandboxed individually?
I would prefer not to use a dedicated X servers for every GUI application, as I would expect this to use far more system resources, and it is useful to take screenshots of individual windows.
I am using Arch Linux and KDE

Banning xinput test won't help, because it's only an interface to the vulnerability, and a malicious program could access the keypresses without it.
Some comments from the blog post you link discuss sandboxing; even if it is secure (see the debate in the blog post), a concern is that most implementations just create another instance of the X server for sandboxed applications, which as you've said, is not desirable for performance reasons. However, it seems to be the most secure way to enter your passwords.

Regardless, if you're running malicious code on your computer, you have other problems (reading personal files, changing user configuration files, exploiting possible system vulnerabilities, and bad things in general). But if window isolation is important to you (it is to me), you could get involved with Wayland; as other people has said, it's a promising successor to X11.