Should I log wrong passwords? I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed.

When someone tries to overtake the account of someone else through guessing passwords I would like to know this. For that reason I would like to log all unsuccessful login attempts.

I think that it wouldn't be a problem to log time, IP address and attempted username. But would it be acceptable to also log the wrong password in clear-text so I can detect the patterns the attacker is trying, or would the risk of being able to deduce correct passwords from misspelled login attempts by legitimate users too big?

I appreciate where you're coming from, but this is actually very dangerous in a production system.  While it might be kosher if 100% of all failed password attempts were in fact random evil people trying to break into your system, the fact is that a lot of bad passwords are actually going to be legitimate users making simple typos.  And there's the rub: if someone managed to get a hold of your bad password cache, they'd likely have a bunch of barely typoed legitimate passwords that they'd otherwise have no way of knowing.  In effect, every user who mistyped their password would have dramatically weakened their account in the case of a breach—quite possibly fatally.

Logging which accounts get bad passwords, and how often, can be very useful in auditing.  So for that, go ahead.  Just don't log the failed passwords.

(In practice, the passwords you'd get from doing what you're proposing are likely the same ones available already to tools like John the Ripper, anyway.  If you're concerned about users' passwords being compromised, it's likely sufficient to use a tool like John and run known passwords against your user accounts.)


Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break? This is a question that personally as a security professional has bugged me for a long time.

So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-zero (0.0.0.0 for those that might be less familiar with the lingo) for what I'd imagine to be assistance with setup on a domain environment. A lot of these services, like Link-Local Name Resolution or NetBIOS, can be disabled, albeit with a little bit of work.

While I understand that the Windows RPC subsystem has a dependency of nearly every system-installed service, the RPC Endpoint Mapper will bind to the typical msrpc port (port 135) on all interfaces. In a high-security or home environment, listening RPC ports may be undesirable as it may invite potential exploits.

I've messed with some of these facts in a test environment, largely with trying to set the Windows RPC server to listen on the localhost. I've been using RPCCFG, disabling DCOM, the usual steps I find on some dated forums. I know it cannot be disabled entirely, so I've tried to make it at least visible in software under the impression that the functionality would largely remain the same: The mapper is there, just not listening on the hardware. From XP to 10, the only place I've gotten this to work is a Windows Server 2008 R2 Datacenter installation, and I haven't been able to replicate it since.

While I realize in a high-security environment it would be more desirable to just not use Windows with respect to the security concerns, the inability to configure this service and have it work without Windows throwing a CRITICAL_PROCESS_DIED. Call me an enthusiast, but it's always something I've found interesting.

So, can the Windows RPC subsystem listen on localhost without error? Or is it not configurable without breaking all functionality within Windows?

Have you considered simply blocking the relevant ports at the firewall? Deny access from all external hosts. Using the "Windows Firewall with Advanced Networking" window (wf.msc), edit a rule, go to the Scope tab, and either set it to only work on local IP address 127.0.0.1, or to nor accept connections from any remote computers (or both). You could also add a rule that explicitly blocks connections to 135 from remote machines. Best to block both inbound and outbound, if you're really paranoid, since an attacker might present a malicious RPC server and attack you via returned data or callbacks.

I'll admit, I haven't tried this myself. Interested to hear if it works. Windows obviously doesn't require network RPC be available - the OS works fine without a network interface at all - but I expect some network functionality will stop working if you block all remote RPC endpoint mapping.


What was the point of Implicit Grant Flow in OAuth 2.0? I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs were a recommended option.

Here is what I know so far:

Implicit Grant Flow is less secure than Authentication Code Grant Flow; and thus, Authentication Code Grant Flow should be preferred over Implicit Grant Flow unless some particular use case has no other option but Implicit Grant Flow.
A JavaScript single-page application that is downloaded from S3 would have no way to complete the last leg of the Authentication Code Grant Flow because (1) it can't create an API for handling this on the S3 server from which it was downloaded, (2) it wouldn't be able to make cross-origin requests, and (3) it can't store a client side secret in the app.

So, if a hypothetical JavaScript SPA that is downloaded from S3 wanted to authenticate a user via Gmail, then it would have to use the Implicit Grant Flow. But if this SPA has no real backend of its own, then why would it ever need to authenticate a user? Is it maybe because this hypothetical S3 SPA has a CORS policy that allows it to access cross-origin APIs? Is this possible in S3? This sounds like a reasonable use case, but one that I'm not personally familiar with - thus, is this something that people are using out in the wild? And are there any notable examples of this?

Finally, if you're SPA does have a backend of its own, then wouldn't the Authentication Code Grant Flow be the recommended grant flow because it is more secure and it can be feasibly implemented given that you own the backend?

P.S. I'm asking what was the point because my understanding is that any use cases that required Implicit Grant Flow should now use Authentication Code Grant Flow with PKCEs.

Fortunately, I work at Ping Identity where some of the people who wrote the OAuth 2.0 and OIDC spec work! I had a recent conversation about this very topic because we were chatting about the new RFC that is basically recommending people not use the implicit flow anymore.[1]

Your confusion is likely because it wasn't created for a different use case but for simplicity. This is from conversations and the original spec which states (with my emphasis):

  The implicit grant is a simplified authorization code flow optimized
     for clients implemented in a browser using a scripting language such
     as JavaScript.

It's a simplified flow of the one you should be using (authorization code) for simple apps.

This simplicity also helps a little for efficiency:

  Implicit grants improve the responsiveness and efficiency of some
     clients (such as a client implemented as an in-browser application),
     since it reduces the number of round trips required to obtain an
     access token.

The main purpose though was simplicity in design. With the announcement of a new security standard for identity, they wanted to provide a simple option for greater adoption. With a simpler method, it would be easier to implement and less time-consuming.

[https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#page-6][1]


2FA authentication with QR code Can someone confirm if the following solution is actually 2FA?
User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device with the account in the system.
On the web login screen, QR code is displayed. A user opens the previously installed mobile app, and scans the QR. Afterwards, the user's fingerprint is checked using the phone's biometrics.
I don't have technicals details on how it is implemented. I want to make sure if it can be considered 2FA.

There are several moving parts here and you, admittedly, do not have all the technical details, but it does appear to be 2FA on its face, with a caveat:

The app is associated with the account and the phone, making the phone a factor (but that depends on how the phone is associated with the account)
The login process requires a biometric scan of the fingerprint, making the finger a factor

This process is not unlike a 2FA app on a phone (Google Authenticator, LastPass Authenticator, Microsoft Authenticator, etc.) that requires biometric authentication to open and uses push notifications. In your case, the push notification appears to be done via QR code.
However, this is pretty weak, passwordless 2FA. Since all the relevant factors are contained within the phone, that makes this more of a "1.5 Factor Authentication". The phone's app is the primary factor for the account and the app has its own factor, the biometric function controlled by the phone's hardware. Chaining them like this is not true 2FA for the account. It's more like two "1FA" processes chained together on the same device. This matters because the loss of the device alone puts the whole protection scheme in jeopardy; you are relying on the security of the functions of the phone.
Could it be considered to be "effectively 2FA"? That could be argued. To be honest, I would hedge my opinion and stick with the "1.5 Factor" answer. I know that it is not a clear answer, but the line to be drawn will depend on why you need to know if this is 2FA or not.


SRUM (system resource usage monitor) forensics - Windows server? Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\sru. I suspect that the feature is disabled as servers might generate too much data to keep the DB a sensible size, or it may have a performance impact. Has anyone found a method of enabling this feature in server 2016?
SRUM forensics overview

The file you're looking for, %systemroot%\System32\sru\SRUDB.dat, is managed by the Diagnostic Policy Service. If the file isn't present, you may find that service isn't running.

Take a look in services.msc and check to see if the service is running. Diagnostic Policy Service should be able to create the missing file when run.


Does a WPA2-PSK authentication only succeed if both parties know the pre-shared key? Normally people think of WiFi authentication as the client proving to the AP that it knows the pre-shared key. But does the AP also prove to the client that it knows the pre-shared key?

Is it fundamentally impossible for a connection to be negotiated in WPA2-PSK if either of the parties doesn't know the pre-shared key, or is it up to each party to decide whether to connect regardless?

(I'm just wondering about the possibility of Wi-Fi-based Smart Unlock in Android, which is claimed by many people to be insecure because it's spoofable - but I was under the impression that it's impossible to spoof an authenticated connection unless you have the PSK)

In PSK mode, the Pairwise Master Key (PMK) is derived from the passphrase.
Both the supplicant and the authenticator prove that they have knowledge of the pre-shared key to one another:

[Supplication to authenticator Message B] contains a MIC value and thus proves that the supplicant knows the PMK
[Authenticator to supplicant Message C] verifies to the supplicant
that the authenticator knows the PMK and is thus a trusted party.

So therefore, Android Smart Unlock could use the fact that the phone has authenticated to a particular WPA2 network as an indicator that it is in a secure location. Of course this does not verify that the AP hasn't been stolen, cloned or otherwise compromised.


If i connect to a VPN server using cicso anyconnect or PPTP protocol which has invalid certificate, can they sniff my HTTPS data? Lets say i have connected to a VPN server using Linux with the help of Cisco anyconnect protocol or PPTP protocol.
now when i try to connect to it, it says :
The certificate may be invalid or untrusted!
Reason: signer not found

I kinda know the owner of the server but i do not fully trust them.
So if i connect to this and click connect anyway, will they be able to decrypt and read my HTTPS data? for example when i connect to a website that firefox says connection is secure, will they be able to read my login info like username/passwords?

In general, TLS MiTM can replace one self signed cert with another and then see all your traffic.
When you click through the error for a self-signed certificate and connect to the HTTPS server regardless, unless you have viewed the certificate hash (fingerprint) or the public key's hash (fingerprint) and verified it is the same value as last time (when you are reasonably sure you were not MiTM'd), the self-signed certificate can be replaced by another self-signed certificate and you wouldn't notice. Anyone in main-in-the-middle position can do that and then read (and modify!) all traffic.
Checking that the certificate (or public key) are the same as values you trust is called certificate pinning. Some apps do this in code, with the trusted hash baked into the code, and then it makes sense and means using self-signed certs (or certs issued by an untrusted corporate CA) is secure.
Performing the certificate pinning check manually is possible, but I would not trust a user to do it diligently.
But this only lets you know whether the certificate is different from last time. How do you know the certificate is good the first time? If you are MiTM'd the first time, verifying on subsequent connections that the cert is the same won't help. That is kinda the problem with self-signed certs and what CAs like Let's Encrypt solve. But if you have an out-of-band way to know the cert is legit on the first connection (e.g. site owner published hash of cert on twitter), relying on pinning for subsequent connections is ok.
Why not use a trusted Let's Encrypt certificate?
If you mean the certificate of the VPN itself is self-signed, then apply all of the above to a MiTM between yourself and the VPN. But HTTPS connections using legit certificates performed inside the VPN should be secure from the VPN operator. They will know which sites you connect to, but they will not see your passwords. Traffic analysis can let them guess the content you browse based on data sizes and timing. For example, popular netflix movies and wikipedia articles are recognizable in encrypted traffic just by the size of the download!


Why do I see 2FA but not see "two separate entities" being prioritized in website authentication? I've seen a number of 2 step website authentication methods out there. Some include two passwords, HOTP/TOTP, Yubikey, SMS to a phone number, etc. However, it seems like all of these systems rely on your computer or main device to not be compromised.

To be specific, let me refer specifically to TOTP. Here is a typical TOTP website flow for a site:

You type in your password into your computer
You open your 2FA app (e.g., FreeOTP auth, Google auth)
You type in the current TOTP token into your computer

If an attacker had a keylogger or CPU logger on your computer, can they not access your account? By step 3, assuming your computer is compromised, they have both your password and your current TOTP token. I do understand that the attacker can only access your account once because the TOTP token would expire after 30 seconds.

However, what if the typical TOTP website flow was the following:

You type in your password into your computer
You open your 2FA app (e.g., FreeOTP auth, Google auth)
You send the current TOTP token directly from your phone to the server of the site you were trying to log into from your computer

I don't see how it would be that much more effort on the side of the site's server. I assume it would just need an endpoint that listens for incoming TOTP tokens that get sent with a username to identify which login the incoming TOTP token is for. Now an attacker would have to install a keylogger on your computer (or main device) and your phone (or second device) to get access to your account.

In my view, with this proposed setup an ultimate security mechanism would be a computer + a specific hardware device that is capable of sending TOTP keys to a server (perhaps like a Bitcoin Trezor but instead of showing a bitcoin address, it would show a domain name or ip address for confirmation). But as far as I know, I do not see a push for using two separate entities to do website authentication. Is there a reason for this?

I do understand that the attacker can only access your account once because the TOTP token would expire after 30 seconds.

This is case for TOTP. But there are a lot of HOTP based on counter, which is really one-time password, which means that capturing it does not allow anyone else to log in if you already did (the virus on your computer would have to prevent sending the real one time password). This is also the case of most of hardware tokens and SMS tokens.

  You send the current TOTP token that directly from your phone to the server of the site you were trying to log into from your computer

There are such tools, but I am not aware about deployment for public websites. It is usually called port knocking or single packet authentication (SPA), usually used for opening Firewall port for example for SSH. It is good additional level of security, but overkill for everyday use. Nice implementation is fwknop and I believe you would be able to bind it to your application as an "second factor".


Best practices to implement HTTPS in embedded devices Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed certificates, etc.), which make connections insecure. So, I'm looking for best practices, how an embedded device can implement HTTPS in a secure way, which fulfills the following requirements:

The browser accessing the device via HTTPS (both remotely and from LAN) does not display any warning to the user. Thus the browser is able to validate the certificate sent by the device correctly.
If the private key of the device was compromised, an attacker should not be able to use this key to perform MitM attack against another device or another web page.
If it was possible, users should not have to install any certificate or accept any exception in their browsers.

Points 1 and 2 are addressed by buying a certificate from a trusted CA.

As for your second point -

  If the private key of the device was compromised, an attacker should not be able to use this key to perform MitM attack against another device

If you can find a way to do this, you'll be very rich.

  or another web page.

Eh? I don't understand.

While the devices of this type I have used in the past have shipped without a cert, they provide a means for deploying the cert (and private key) to the device. Certainly you can't trust a certificate supplied with the hardware unless you sent the certificate singing request to the supplier (and retained the private key).


Why are website (such as gmail.com) certificates issued by my company? At my company, I get a warning flag that the traffic to the website may not be secure (enough). For instance: outlook.com and gmail.com. When I open the certificate I see this "issued for" and "issued by".

I blackened out the name of my company. Here is the name of "My Company ABC" mentioned, not for instance Gmail or Outlook. This particular message is taken from the web browser warning (either Outlook or Chrome).

For instance, for Gmail, it says:

  "SHA-1 Certificate. The certificate for this site expires in 2017 or
  later, and the certificate chain contains a certificate signed using
  SHA-1. The connection to this site is encrypted and authenticated
  using a strong protocol (TLS 1.2), a strong key exchange (ECDHE_RSA
  with P-256), and a strong cipher (AES_128_GCM)".

It looks to me that the communication from my client to the router is secure and strong, but not stronger than the company has the power to decrypt when needed? While they promise to send it with full encryption from their router that route out to Inter-AS and the endpoint (gmail, outlook..).

Why is it like this and what is the impact? Is this some kind of security trend going around?

Some companies want to be able to inspect all traffic exiting their network (data loss prevention, etc.). To do this, they require that all encrypted traffic be decrypted before it exits.

To make this possible, the company then issues its own certificates for external domains. Normally, those certificates are issued by Certificate Authorities (CA) that act as neutral 3rd parties for this sort of thing. But in an SSL Interception scenario, the company itself issues the certificates. Your traffic flows from your client, to the company border, gets decrypted, inspected, re-encrypted, then passed on to the destination.

The potential issue here is that the company might not be as up-to-date or as secure in the way they issue certificates as a CA. But that might not be a huge issue because the only people you are being protected from are the other employees at the company.

So, to answer your question, the local, company-issued certificate is not as cryptographically strong as it could be, and your browser is issuing that warning.


Why do browsers not reliable block pop-ups? On both Chrome and Firefox I am unable to reliably block popups without extensions. Though both browsers come with such settings, there seems to be ways to circumvent this behavior.

Now why is that? How are sites able to open pop-ups anyway?

As a long-term webdev, I've seen this evolve from IE6. This is all by design and consideration actually. Legitimate user-desired actions are not to be blocked. Many corporate portals use popups, as do web-based email, messaging, media players, and more. To developers, "Popups" and "popunders" are unintended and unexpected sub-window openings to be exact. If a site launches a popup, it's because you did something.

The rules for FireFox, Chrome, and Safari are identical: if the popup happens as a result of a user action, like a click or keyboard press, it's allowed. If the popup happens on it's own, it's blocked.

How does the browser determine what caused the action? JavaScript has a way to trace the caller of event-handling function(s) and sub-functions all the way back to a physical user action, like a click. If it doesn't find such a caller on the call stack of the popup-launching code, the popup is blocked. Developers generally cannot extend the user-initiated action until later, you have to window.open() right away, or else it's blocked. Extensions can block whatever they want, regardless of the user intent, or lack thereof. Links/forms with target=_blank only fire as a result of user-action, so they need not even be audited.


Investigating header and cookie flag issues I am working on issues reported by Nessus. Most of the issue types are missing headers and cookie flags.

The tricky part here is these issues have been reported at different port numbers, for example 443, 8008 and 8080.

Can anyone please help on how to check the request and response on these port numbers or how to check whether the security headers and cookie flags are set on different port numbers?

There are web proxies and packet sniffers that allow you to inspect traffic. You send traffic to the ports then inspect the traffic.


What are possible security problems of enabling HTTP2? I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like:

HTTP2 implementations are maybe more error prone than mature HTTP1 implementations so for example a zero-day is more likely
The WAF might not work with HTTP2 because it doesn't support the protocol

Are these problems really relevant and what could be additional problems?

HTTP/2 is a way more complex and new protocol than HTTP/1.x and thus bugs are at least initially more likely. In fact a simple search shows several implementation problems and also some new or updated attack vectors due to the changed design of HTTP/2.

  The WAF might not work with HTTP2 because it doesn't support the protocol

This is probably less of a problem. A WAF is usually either integrated into the HTTP stack of the server or is an active component with its own HTTP stack. Due to the way HTTP/2 is designed an implicit downgrade to HTTP/1.x will happen if the server or WAF does not support HTTP/2. This is also true for proxies and other active components.

It will be a problem for purely passive inspection as done in some Intrusion Detection Systems or firewalls. But a purely passive inspection has problems with inspection of TLS traffic anyway and HTTP/2 is only used together with TLS. If instead the passive inspection is augmented with SSL interception then usually a downgrade to HTTP/1.x will happen again unless the SSL interception explicitly or unknowingly forwards the ALPN TLS extension to the HTTP/2 server during SSL interception.


Simplify usage of KeePass or equivalent password managers while preserving security Situation
I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. Since I'm working in a regular workplace with other people I have a quite short interval before KeePass locks itself after inactivity. It would also theoretically be simple for a colleague to covertly film me typing in the password. I'm not particularly afraid of attacks here and now, but I would like to have a stable long-term secure process established.
I also have Keepass-droid on my cellphone which is much easier to use since I can connect it with my fingerprint. If my fingerprints are temporarily messed up I can still open it by using the master password. This it the kind of convenience I'm looking for on a regular computer.
I'm searching for a solution that I can use together with a password manager on a regular computer that:

Simplifies the log-on process
Still allows the master password as a backup
Is not solely dependent on a physical artefact that easily could be stolen and accessed.
Reduces the vulnerability to key loggers as long as I don't need to enter my master password.

Thinking about a solution
I've looked at buying an external fingerprint reader that I could connect to my computer and integrate with KeePass* but it seems to be a mixed bag of contrived solutions and paid subscriptions.
I'm also thinking that a possible solution could be if the password manager would allow me to open the same database with either my stronger master password or at the same time with a key file together with a simpler password, a key file that I then could store on for example a IronKey* that is hardware encrypted and locks down after 10 invalid password attempts. Then my workflow would be:

Mount the IronKey* in the computer in the start of the work day and open it with the IronKey* password.
When I need to open my password database, I use a key file on the IronKey* together with a simpler password (so that the key file is in itself not enough if the key file somehow get wings).

That way I don't have to be afraid of losing my USB-stick as 1) It's difficult to get the key file out of it and it would still require the additional simpler password to open the password database and 2) I could still use my master password to access the database and to set it up with a new IronKey* with a different key file so that I'm not locked out if loosing the stick.
But unfortunately I can't find anything about password managers supporting password or different password + keyfile at the same time. I understand that something like that could be cryptographically non-trivial, but how about if other password + keyfile would just internally return my master password witch in turn would be used to open the real database?
Alternatives that I do not like
I know that it's possible to use a Ubikey together with KeePass in either static mode, one-time password mode or Challenge-Response mode but each of those options does not attract me since the static mode makes me very vulnerable to unauthorized access to the ubikey and the others two will leave me locked out from the password database it I lose the ubikey.
Is there some solution that would enable what I'm searching for and trying to describe above?
* Or equivalent

Disclosure: I work for 1Password, a competitor of KeePass. What I can tell you is that getting stuff like this to work is harder than you might think.
I will say that 1Password allows for a quick unlock (after an initial, rarer, unlock with the master password) with TouchID on Mac and Windows Hello on Windows. If KeePass doesn’t already do that, I would expect that it will soon. Linux is much trickier for a number of reasons, and honestly it has fallen behind what security mechanisms are available in the OS. So obviously I can’t speak for KeePass’s plans there.
Some of the things that you suggested (keyfile + quick code, etc) are things that we (1Password) have looked at or even experimented with. And I can say that while we rejected them, otters might choose otherwise. Instead of talking about the specific challenges to particular mechanisms, I will mention a couple of general things that need to be kept in mind.
What password manager designers need to consider

Complexity confuses users, and confused users behave less securely. This might not be as big an issue for KeePass, which tends to have highly sophisticated geeky users. But don’t under-estimate this impact. You can’t expect most users to know what a key file is or the security properties of using them.
Complexity leads to vulnerabilities. The actual inner workings of a good password manger are far more complex that it might initially appear. But complexity leads to more bugs, and it makes the security harder to properly analyze.
Forgetting master password. When we introduced various schemes to to something like this, we found that if we didn’t force people to use their full master password frequently enough that people would forget their master passwords.
No security theater. It is actually hard to design these things in a way that the short cut is fully as secure as it seems. A shorter password or PIN might seem secure enough, but an attacker who gets what is on your disk is going to crack the short ones easily. Remember that for decryption, the attacker is not rate limited by things you put in your software, as they will attack the data directly.
Be extremely wary of anything that gives people another way to get locked out of their own data.

Anyway, those are some of the things that the designers of password managers need to consider, but that is different than the question of what you can do for yourself.
Variations on IronKey
If Keepass is scriptable in unlocking (1Password is deliberately not, but Keepass may have made different decisions) then you can roll your own encrypted keyfile solution. Encrypt the master password with short password and have a script that prompts you for the short password and then unlocks Keepass with it. You still would want to keep that file on a removable device. So this is just a variant of your IronKey proposal.
In doing something like this, pay attention to the confidentiality and the authentication of the channel over which the decrypted master password is passed to Keepass. Consider whether it address the threats you face in your environment.


RSA key exchange is obsolete. Enable an ECDHE-based cipher suite If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is obsolete. Enable an ECDHE-based cipher suite", which makes me question if its legit..?

It means that the cryptography from the certificate is breakable - the ROBOT attack is a good write up on how.  ECDHE uses elliptic-curve cryptography, which is faster, uses less data for the same level of security, and relies on newer mathematical techniques (although it's not necessarily a good thing...but as a quick aside ECs were needed for solving Fermat's last theorem and that only happened in 1994).

So yes, it's a legit warning.  It's probably just popping up because the site hasn't used a ECDHE cipher.  Which is far from ideal, but if everybody followed best practices I'd be out of a job.


Course project that teaches secure design I'm looking for a class project that (1) is scalable to large classes, and (2) teaches secure design.  This is for an undergraduate course on computer security.  Hopefully, it would be educational and fun for the students.

The first requirement is that grading of the class project needs to be scalable.  The course has 300-400 undergraduate students.  There are some resources for grading course projects, but not a lot, so any course project has to be something that can be graded at scale.

The resources available for grading scale linearly with the number of students taking the course: roughly speaking, the budget for grading a course project is 10-15 minutes from a teaching assistant (per undergrad in the course), plus 20-30 minutes from a less-experienced grader (per undergrad in the course).  The teaching assistants are pretty knowledgeable about security (typically a Ph.D. student who is actively doing research in computer security); the graders, much less so (typically an undergraduate who has previously taken the course on computer security, but has no other experience or knowledge).

Of course, if the project is a group project with N students per group, then the resources available to grade each project are increased by a factor of N.  However, for practical reasons, N probably can't be larger than 3 or 4.

The scalability requirements rules out a lot of potential projects that would otherwise be very cool.  For instance, if grading the project requires an experienced teaching assistant to read a thousand lines of code per undergrad taking the course, then that's simply not feasible.  If it involves reading a 5-10-page design document and doing a threat analysis of the system architecture, that might be tough, too.
The second requirement is that the class project should teach secure design.  It is easy to come up with course projects where the students try to attack some system (e.g., find vulnerabilities in a web application, exploit a buffer overrun, etc.); I've got a bunch of awesome projects of that sort.  But I would also like students to get experience designing secure systems, e.g., where we start from some requirements and they have to think through the options, choose a system architecture or a design approach, and build it.

These two requirements are in tension.  Good design is hard to evaluate; it takes time to analyze a proposed design and determine whether it's good or not-so-good.  That makes it not-so-trivial to craft a course project that lets students practice secure design, and where it can be meaningfully graded at scale.  I've looked at course projects from a number of other undergraduate courses on computer security and found many projects that are either scalable or that teach secure design, but I haven't found any that do both at the same time.

What would be a course project that meets these requirements?

(Background: I'm lucky to have an outstanding group of students.  The students are sophisticated, smart, and not afraid to work hard.  They're typically computer science majors in their 3rd or 4th year of college.  They're all there because they want to be there; the course is an elective, not a required course.  It's fine for the project to involve designing and/or implementing something non-trivial.  If the project is relevant to industry or their future  career, so much the better!)

Like @David mentioned, an e-commerce website or anything that handles "sensitive" data will be a good start.

Let's talk about your second requirement. If you are talking about secure design for web applications, you obviously want to point them towards the OWASP Top Ten. While the list is no where near complete, it is a good start. Perhaps have your students read through the it and come up with a design document explaining how they will mitigate each item in the list.

Your first requirement is a little tricky. Code review is a tedious process after all. If your students have prior programming experience and you are not grading them on the quality of the code itself, I suggest taking an entirely black box approach to the grading. Have the students try to attack each others code. I stand by my answer that the best way to learn about secure coding is by having someone break it. Perhaps you can think about dividing the grading into three components. The first component will be the initial design document that details the student's analysis of the threat model as well as proposed countermeasures. The second component will be the report of the "penetration test" against the code of a peer. This can be either a black box attack or a code analysis. The third component will be a report detailing how the students fix the flaws found in the code.

This way, your students get to experience the entire secure development process, up to patching any bugs that occur.


SQL query sanitation (black list) I have a following problem/challenge:

Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be basically anything from underline DB, include complicated joints, unions and whatever you can think of. (Just selects, no Insert/delete/drop/update)

The easiest way to do it – allow to the system to execute SQL queries.
System admin will add custom queries to the system and “regular” users will be able to execute them.
If they need new query, they will ask Admin to create a query for them and then they will be able to run it by Query ID.

White List approach is not going to work here (at least I can’t see how).

What about black list?
I was thinking about something like that:

blackList={"--", ";", "/*", "*/", "@@", "@",
                  "char", "nchar", "varchar", "nvarchar",
                  "alter", "begin", "cast", "create", "cursor",
                  "declare", "delete", "drop", "end", "exec",
                  "execute", "fetch", "insert", "kill", "open",
                   "sys", "sysobjects", "syscolumns",
                  "table", "update"};

Once again – the only person that can create such Custom Query is admin (and he most likely has full control over DB in any case).

Any help would be welcome.

Thanks

A

You are providing a list to sanitize, which includes drop, create, exec,...

But if you only need "SELECT" access, it would be easier to just take away the rights the user who's executing the queries doesn't need. (least-privileged rather than all privileged )

If I were you I would define stored procedures because they are quite injection foolproof. Should this be too hard in your web application, then you can try Parameterized SQL where you use parameters.

Never go sanitizing yourself and then directly query on the database. Parameterized SQL is quite flexible and results in safer environment normally than you would have with Dynamic SQL.

Also bear in mind to not disclose any errors ! (I know it is security through obscurity, but that extra time you gain with it might enable you to detect it.)


How did this site prevent me from creating multiple accounts? Disclaimer: I just realized this question may read a little bit as if I'm trying to promote this site. I'm not. Now that I think about it, I'm unsure whether this site even has a proper license from content owners. I'm not in any way affiliated with the site in question.

I just bought a music album from http://www.soundike.com/.

When I created an account, I noticed that they said I would get two free songs simply by confirming my e-mail address. It was true, I clicked a link sent to my Gmail account, and I was then able to download two songs even before paying anything.

Out of curiosity, I then attempted to create a second account using my iCloud e-mail address. The only data the site asks for is my e-mail address and a password. I changed my passwords each time.

I did not receive any confirmation e-mail. (I also checked my spam folder.)

I figured they must be using cookies or my IP or something to prevent multiple accounts. So I activated a VPN and opened an Incognito window in Chrome. I then registered again, this time with an Outlook.com address. No registration e-mail came.

Puzzled by this, I launched Tor and tried to register again with a new Gmail address. No confirmation e-mail, even when accessing the site through Tor.

How could they achieve this? Could they be blocking connections that come from a VPN or Tor?

It is not based on IP address and I was able to create two accounts:

Create an account using your gmail account
Go to incognito mode and create an account using 10 minute mail. (There was a 10 minute delay between the two steps)

Mind you, you are gaming the system. It is ethically wrong.


Limiting number of combo attempts with Fail2ban and 128 bits of entropy Apps such as Fail2ban and DenyHosts enable unix administrators to limit username/password combo attempts to typically 3 attempts. But why 3? Some admins enable more, like 6 or 8 giving honest users a little more slack when making different attempts at a password they may not recall exactly. But why not 18? Or even 30?

If a sophisticated cracker wanted to brute force a combo with a scheme involving 128 bits of entropy, s/he would need to make trillions of attempts a second. So if an admin limited the total number of attempts to 100 using Fail2ban, wouldn’t the authentication system still be secure and robust, as long as the admin sets up their username/password scheme to require 128 bits of entropy?

You can set any value you want. See parameter maxretry in jail.conf.

You are right. Giving 100 attempts before blocking means that an attacker can try about 7 bits (log 100). Thus remaining will be 121 bits, which means very low probability to guess the password.

On the other hand, why would one want to give an attacker more chances to guess the password?

If you ban the attacker, he will need another IP to continue his attempts. If you ban the attacker after 5 attempts, it means he will need 20 times more different IPs than in the case with allowed 100 attempts. For the most of the single working attackers this is an essential increase of resources. They will stop the attempts.

One more aspect is your resources. Each login attempt means that your server needs resources (CPU, memory) to establish a connection, session, to check the password. In for a small number of attackers like 5-10 it will not affect other processes on your server. But if there are thousands of login requests from different IPs, this can require a lot of resources from your server. Thus the processes running on it can be slowed down. That's why it makes a difference, if you ban an attacker after 3-5 attempts or after 100 attempts.


Using LDAP for application authentication Some of my colleagues want to get rid of our current inhouse application authentication, and use LDAPS to handle all of the authentication (storing passwords etc.) instead. I disagree and say that we should be building a strong authentication model using hashing and salting like so, and authenticate within the app itself.

They want the application to pass everything onto LDAPS because it means less maintenance; so Microsoft (or whatever LDAP service) is responsible for keeping all of the hashing etc. up to date on their end.

Aside from the problem of needing a secure LDAPS server (which I say is a problem in and of itself), are there any security risks going down a route where the application forces LDAP to handle authentication?

There are always risks. The real question is which approach gives risks that are more acceptable to your situation.

The use of LDAP for this is a tried and trusted solution that is well used and well supported. So that is a definite positive. Your bespoke auth is potentially poorly tested and, well, bespoke! How do you prove the risks associated with it? That might be unknowable without spending money on getting it professionally tested.

I would say though that there is LDAP and then there is LDAP! If they really mean that you would be using Active Directory along with the Microsoft standard tools for authentication and authorisation, that makes a whole load more sense than if they are simply saying "let's just use LDAPS".

Vanilla LDAPS may be no better than your current solution. But it might still have advantages if the current solution has minimal support and maintenance.

Bottom line is that off-the-shelf solutions, especially when using well tried industry standards are almost always better than bespoke ones for standard tasks. And are likely to be better supported and tested. But adding a specialist toolset is likely to be even better. Use open standards wherever possible as it makes integration and maintenance a lot easier. So using OAuth for example.

Incidentally, LDAPs isn't difficult to set up. Active Directory can be difficult if you don't already have a Windows infrastructure. If you are already using AD in the same environment as your application and users, it is a bit of a no-brainer.

Assess the risks, impacts and benefits of each without the emotion of protected territories. This should be a documented risk assessment, probably with a benefits matrix.


Safe way to store credentials for an application I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into git with those details still accessible.

Note: I am new to Python and I want to understand what would be good practice.

Another question: Is there an easy way to help user replace my API credentials with his set of credentials?

A possible way to achieve this is to have an optional configuration file - that is not in the repository but handled separately from the source code - from which those values are read.

You may include a demo configuration with placeholders in the repo for release though.

Also, with such a way, it will be easy to modify for users for different deploy targets.


“Flow” between computers (Logitech mouse) DLP From a DLP perspective, does anyone know what DLP controls to block or monitor this Logitech Flow?

DLP generally works at the filesystem level, scanning files when opened and/or written to disk.  Files copied onto a system using Logitech Flow will trigger DLP at the same points as usual; DLP cares about filesystem operations and not about the method (network, Flow, carrier pigeon, ...) used to get the file in place for interaction with the filesystem.


Are there vunerabilities with this authentication mechanism? I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.

I was thinking of the following approach:

Step 1 - Client asks for request token from server and supplies a username.

Step 2 - Server returns user password salt & request timestamp.

Step 3 - Client then calculates password hash based on salt + actual password (captured via input)

Step 4 - Client then generates token by hashing password hash + request timestamp.

Step 5 - Client sends token & username & request timestamp to server

Step 6 - Server verifies authentication by re-generating same token with details provided.

From what I can tell nothing that isn't public already is going over the wire so packet sniffers would be out of luck. The token is hashed using the original password (essentially the secret key) so MitM are covered. Finally, the original timestamp from the initial request is sent back (and is part of the hash) therefore Replay attacks should be out of the question.

I have only started looking at security therefore pretty much a novice at this stuff so any help/advice would be appreciated!

Update

I should have been more clear with regards to the SSL.... it's not that I am trying my best to avoid using SSL, it's more catering for the scenario where it isn't an option. Also, please target your answers more to the reasons why this approach wouldn't work & if it could be tweaked to work rather than "use SSL".

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL.

Don't!

Use SSL (well, TLS actually).

  nothing that isn't public already is going over the wire

This is obviously not exact:

the user name is captured; TLS would hide user name (I am not saying it is a serious still, but it is an information which is disclosed);
a hash based on available information is captured and passwords can now be tried (dictionary attack).

  I have only started looking at security therefore pretty much a novice at this stuff so any help/advice would be appreciated!

Use the proper tools. Don't try make your own protocols. If you try to come up with your own security protocols, they will almost always be flawed.

There are many issues with your protocol:

discloses user name (might not be huge issue, but still)
discloses password hash: allows off-line attack on password
the server needs to know all passwords in clear-text (either by storing them in clear-text, or storing them encrypted with symmetric encryption, and storing the encryption key) (well not the user password, but the real user secret authenticator)
and the worst part: absolutely no protection against an active attacker

Replying to your update:

  I should have been more clear with regards to the SSL.... it's not that I am trying my best to avoid using SSL, it's more catering for the scenario where it isn't an option.

Why isn't it an option in this scenario?

  Also, please target your answers more to the reasons why this approach wouldn't work & if it could be tweaked to work rather than "use SSL".

TLS gives you transport level "security": secrecy and integrity (actually, secrecy is limited, as the size of message is leaked; the secrecy of fixed-size keys is protected).

It can be "tweaked" to work without actually using TLS, if you reimplement most of TLS to get transport security without TLS. The implementation cost would be great, and even if you can get all the details right, your implementation might not perform as well as a carefully optimised TLS implementation.

The important question is why you would not want to use TLS.


Securing docker containers on private LAN I am using docker to run a few server apps on a raspberryPi with ports exposed to the open internet. If an attacker were to successfully infiltrate my docker containers, I would like to be certain that they cannot access other devices on my network.
Therefore, I would like to know how to lock down my docker containers so that they can only send outbound traffic to each other (when necessary, and in some cases it is not) and to the internet, but not to other devices in my LAN.
If there is a better way to achieve my end goal, I am all ears for that, also.

Isn't this the default case?  There is a default bridge allowing containers to communicate with each other and you can create arbitrary numbers of bridges to constrain each docker container.
From the documentation:

In terms of Docker, a bridge network uses a software bridge which allows containers connected to the same bridge network to communicate, while providing isolation from containers which are not connected to that bridge network. The Docker bridge driver automatically installs rules in the host machine so that containers on different bridge networks cannot communicate directly with each other.

Also no upstream connectivity:

By default, traffic from containers connected to the default bridge network is not forwarded to the outside world. To enable forwarding, you need to change two settings. These are not Docker commands and they affect the Docker host’s kernel.

As for all security assertions, I would test to make sure it behaves as expected.


How does a user get authorized wihtout authentication I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers.

The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case is, the user uses it to access their data.

Generally the users will need the Application (Web of Mobile) to be able to do everything for them because the API just gives out low-level responses in JSON format.  So when a user requests that a front end be authorized, that gives that front-end full access to whatever the user can do.

The users register and authenticate by means of their Google/FB/Twitter etc accounts so that the API doesn't need to worry about passwords, and to make it easier for users to sign-up.

When the user views a resource, eg their messages or account history or profile on the back-end, they do this via a front-end.

The front-end then passes the request for the resource to the API (which is implemented in a REST-ish fashion).  My understanding is that for this to work oAuth would be used to Authorize the web site to request the user's private information.

Please correct my understanding:  After registration, the user logs in on the Front-end.  The Front end then retrieves information for the user from the back-end via "oAuth Authorized HTTP requests", (oAuth 2.0 to be specific)

The Back-end sees that the request is authorized but doesn't know who was (presumably still is) logged in during this process?  So how does the back-end know what mailbox or profile or transaction history to serve up?

The API will encode the specified mailbox or transaction history in the URI, but really the question is how does the backend know that the front-end is requesting the correct mailbox for the currently signed in user?

The oAuth sets a session token for every user. When the user is logged in to the front end the front ends send the token to the back end and not the username and password. Using this token the backend authenticates the user and show his profile. So using this token the back end recognizes the user and shows his profile on the front end.  more info


Permissions to set for Secure internet browsing in Windows 10 (Pro) In the recent past I have been a victim of virus/malware attacks on my home computer running Windows 10 (Home), since I used the same account with high access rights to also browse the internet. However, to mitigate the risks I have upgraded to Windows 10 (Professional) and have also created a standard-user specifically for internet browsing with the intention to secure internet access and shield against virus/malware attacks etc on my computer.
So, I intend to be cognizant about what permissions should I set for this new "standard"-user (e.g. file-security permissions, read/write/control file/resource access etc) to browse the internet safely and prevent virus/malware from modifying files, accessing resources or writing itself on my computer. (BTW, It should still allow the user to browse the internet).
Can anyone please point me in the right direction and provide steps/best practices for security on Windows? E.g. deny/allow access to files/resources specifically, other security settings that should be enabled, for safe internet browsing on my computer running Windows 10 (Professional)? Also, kindly let me know which antivirus or any other apps is better suited for home computers.
I understand that this question is very wide and open-ended, but, still if someone could provide some basic ideas like which files to restrict access to, general allow/deny permissions, common security settings etc that could protect my desktop.
Kindly let me know if additional information is required.

What you're asking is really a discussion chocked full of opinions, suggestions, positions, guesses, and what about gotchas. Despite the voice in my head chanting, "Don't Do It ... Don't Do it ..." I'm going to make some observations.
Yes I know, this doesn't answer the question.
As far as Internet Browsing is concerned, there is no effective difference between Windows Home and Pro. Perhaps you're thinking bitlocker encryption is a protection factor, it's not in this circumstance.
The Microsoft provided Malware/Virus protection is highly rated. It's easiest to stick with that.
Creating a non-admin User account and using that is highly recommended.
Most malware infections these days do not come from direct Browser interactions or exploits. Modern Browsers do an excellent job of living within operational security constraints. The classic click a link and get infected would be a rare 0-Day you are unlikely to ever encounter. Personally, I recommend using a non-Microsoft Browser because it is not tied so tightly with the operating system, but that is arguably a personal bias.
The fact that you've encountered malware compromises in the past suggests your usage habits need evaluating.
Malware infection onto you machine is almost always because you chose to execute a dubious program.
So how does that happen?

A pop-up - Malware detected from your machine. Run this cleaner.
No! Just No!

Your Browser cannot play this video. Allow this video player to install in order to play this video. No!

Your machine has been detected doing bad things. Allow repair access? No!

Girls waiting for you. Click and allow Hotgirls.Bikini.Huge.Waiting.jpg.exe . No!

"Dude, look at the awesome program on this thumb drive my bud gave
me." No!

If you feel you need to run dubious programs, do it on a disposable machine.


How can an expired SSL certificate make the server and/or client vulnerable to MITM attacks? When I see the warning on my browser about "Invalid Certificate" or "Untrusted Certificate" , I might have doubt about a MITM attack at my network. Should I have the same concern when I see that the certificate expired warning? As I know, it happens only when the server did not renew its certificate, and it only shows that the server might use old security standards. Should I worry about anything other than this?

If the certificate is expired (say, after two years), this means that a potential attacker had at least two years of time available to brute-force or otherwise attack the key. OK, this means more risk than when the cert is only a few months old, but with good keys there should still be virtually no sudden risk increase at the moment of expiry. Nevertheless, this aspect should not be discarded. (Also, old certs may have been produced in the good old days of less secure signatures)

But more importantly, when a key that is still active is compromised, this fact may be advertised by revocation (e.g., CRL or OSCP). If a key gets compromised after its expiry, this is not done (simply because it would be a waste of resources to track those cases when the certs are invalid anyway by expiry).

In fact, it may be the case that the owner did renew the certificate, but what you are looking at is a fake site created by a MITM.

So, yes, you should be sufficiently worried (and worried as hell if that is any site of importance such as a banking site or a shop) and maybe inform the owner.


Strange device in routers client list Due to a high number of clients connected to one of my routers I recently changed it's password and reboot it. I also disabled WPS. The router is a ZyXEL Prestige 660.

After the reboot the client list looked like this:

Status  Host Name   IP Address  MAC address Reserve Modify

DeepThought 192.168.1.10    08:3E:8E:*:*:*
Louises-iPhone  192.168.1.11    C0:9F:42:*:*:*
H-iPhone    192.168.1.12    E0:C9:7A:*:*:*

Of course the '..*' where actual numbers, but the problem is that I've only connected two devices. The first two ones. DeepThought is an Acer laptop, and Louises-iPhone is a 4S.

What is 'H-iPhone', and where does it come from? Due to my physical position (a retreatment area in the deep jungles of Thailand), I don't think anyone around here managed to hack it in less three minutes. I didn't however find any useful information about the hostname 'H-iPhone' on Google.

Is it possible that the iPhone I connected, for some reason, could retrieve two IPv4-adresses, with two different MAC adresses?

I assume all listed clients already are authed through my pre-shared WPA2-PSK key?

I'm thankful for any thoughts and/or explanations! Please feel free to update the tags of this question if not suitable.

Or maybe it is bluetooth? I found something like that: Bluetooth PAN and this, which says

  My Mac reports very similar IP addresses for both, starting with 172.20.10 and differing only in the last octet.

It seems like you could be able to get IP address for a bluetooth connection like that. Try to investigate more into it, because from what I saw, different MACs in iPads and iPhones are only for wifi and bluetooth.


How does the browser/app trust the Root CA when the installed Root CA certificate expired? Sorry for being noob, but I don't have confidence that I am understand this correctly and I could like someone to give me confirmation and help me understand.

This post helped me a lot in understanding how does the browser verify HTTPS certificate (SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?)

Here is my understanding, please correct me if I am wrong.

1) How does chain of trust works:
The answer in the post described the chain of trust and how each certificate can be validated by using higher level certificate public key to verify the identity certificate.

The identity Certificate can be trusted, because the Intermediate Certificate's public key can decrypted the Identity Certificate.
The Intermediate Certificate can be trusted, because the Intermediate Certificate's public key can be decrypted by the Root Certificate.

2) But then how does the browser trust the Root CA?

My understanding is that the Root CA certificate is shipped with the browser / app / OS System?
So when verifying the root CA, we compare the public key and digital signature of the Root CA certificate it has embedded into the browser or OS System?

3) The installed Root CA certificate also has an expired time, it's 20 years long. When it expired, how does the browser / OS System verify the Root CA certificate anymore?  We will just pray the browser will get new Root CA certificate installed into our system before it expires?

i.e.: Example of Root CA of *.google.com

The installed Root CA certificate also has an expired time, it's 20 years long. When it expired, how does the browser / OS System verify the Root CA certificate anymore?

You don't.

  We will just pray the browser will get new Root CA certificate installed into our system before it expires?

It will get updated as part of standard software updates, probably long before it expires.


VPN Shared IP and wrongful attribution of traffic correlation of the encrypted packets by Feds/LEA I use Pia, arguably one of the most popular paid VPN's on the market today. Imagine this HYPOTHETICAL scenario.
I stay on the East coast, and i use my virtual IP location as the VPN's Datacenter in New York.
My external virtual IP from where i go out onto the internet, is a "shared ip" meaning, the same Pia IP address is used by atleast 100 other VPN customers to send out requests along with me.
Suppose out of the 100 connected VPN customers,there are 20 users using the latest Chrome browser, and all 20 are logged into their respective gmail accounts.
One of the users WHO IS NOT LOGGED INTO GOOGLE, searches for something illegal, illegal enough to BE FLAGGED by google's A.I., and it automatically sends this tip forward to the LEA or multiple 3 letter agencies.
The LEA gets back to google, says we need to know the IP address of who searched for this term/combination of words, and give us information IF SOMEONE WAS LOGGED INTO YOUR SERVICE, while this flagged search term was entered into your search engine.
Google complies, but the google team is also suspicious and apprehensive, because they realize that there are 20 other users who have the SAME IP when they logged in. So, after some deliberation of whether to forward the requested info or hold back because they are unsure/of the request from LEA is too broad, they decide let LEA handle the attribution, we will just give them all we have and exit the situation.
Now, LEA thinks, "its one of these 20guys/girls who has searched for this information, lets try to narrow down by going after these accounts one by one. A very hard task indeed. HOWEVER, THE PROBLEM IS, THE USER WHO SEARCHED FOR THE FLAGGED INFO, IS NOT LOGGED INTO ANY SOCIAL MEDIA OR ANY PERSONAL ACCOUNT.
So, what if LEA does some parallel construction and frames the wrong innocent guy? Could this be possible, that just using a VPN, if some idiot user decides to threaten someone or kidnap someone or email in a bomb threat, then all the 99 other users will be under scrutiny?

There's a mistake in your reasoning. While you share IPs, you have a unique IP:port combo, and Google certainly records this. This can and has been used to identify individuals behind shared IPs. It's a myth that a shared IP provides better anonymity.

The source port is necessarily sent with the IP address in order for the target website to know how to respond. This is how the concept of NAT, a way to put multiple IP addresses behind a single IP address, works. Otherwise, how could the VPN possibly know which IP address to forward a reply from a website to?

Please remember that VPNs are not meant for anonymity. The internal IP address is what "private" refers to in VPN, so it has nothing to do with "right to privacy", despite what the ads say.


Is using default-src * safe? I have a website to do security testing. The CSP is as follows.

default-src * ;
style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
script-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://cdn.ckeditor.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/ ;
font-src 'self' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws.com/

As per my understanding, default-src * ; loads
everything such as script, html and so from any domain. Is it safe to do? The web app loads third party scripts, images and css from only the three domains as mentioned in the policy. In that case default-src 'self' would suffice?

Also, what threat usage of data: could create? Does it break the application if I remove that?

default-src *

This is now the default policy for all directives that are absent. This is not as secure as it could be.

Since there is no img-src directive, the value for default-src is used as img-src. This means that images can be loaded from any URL. This doesn't introduce a big security problem, since showing images is relatively benign.

There is also no object-src directive, so that also permits everything. This is a problem, since XSS can now load Flash application using an object tag.

  Also, what threat usage of data: could create?

Any plaintext script can be rewritten as a data: URL, so allowing data URI's is equivalent to allowing any inline script. So this does not properly prevent against XSS.

  Does it break the application if I remove that?

This depends whether the application uses the data URI for the normal functioning of the application. Some applications use this, although it is rare.

You can also check the CSP yourself using the CSP Evaluator tool.


Generate CSRF token in SPA I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React.

It looks like the convention is to have the server generate the CSRF token on log in, and embed the token on the login form.

However in single page applications, it's not so simple.

What is the best method for applications using React and Angular, to retrieve the CSRF token from the backend? Is retrieving the token from just calling an API endpoint safe?

To answer you question, you must first understand what CSRF is, what kind of vulnerability it counters. Wikipedia has a good enough explanation on it.

In a nutshell, CSRF is a server-side problem, which shouldn't concern you as the react/angular dev. By definition your application is a legit application, and any api call should you're making on the backend server should pass the CSRF check.

How the backend server will consider the api call as safe is another question, and the answer depends on multiple factors such as how the user is authenticated, which framework is used to develop the server, etc.

A main point is that CSRF is tightly related to cookie, as the whole logic is to push an innocent victim to unknowingly submit a maliciously crafted web request. This is possible because the server will consider that the request is valid because the cookie sent with the request is valid and no CSRF check is done.

For example, if your application uses an authentication schema based on bearer or JWT token sent in the authentication header (and stored in local storage) the CSRF attack simply isn't possible because those tokens aren't sent with every request to the server as cookies are. CSRF simply doesn't work in that case.

If you use a cookie based auth with your SPA you are vulnerable to CSRF. In that case they are multiple solutions. ALL are implemented server side.

For example, one method is based on the fact that your SPA will always do a call using a HEAD method before doing a post, so if the server can return a cookie with a valid CSRF token for the session, you should pass CSRF protection.

Another method is to retrieve the token from a previous api call and manually add it as a hidden field in any put/delete/post/patch method.

In the end, ask your backend dev what he wants you to do.


Disadvantages of Using a VPN? I've got a yearly subscription to a VPN service which is real quick and from the research I did at the time seems to be pretty legitimate, but are there any disadvantages or scenarios where you perhaps shouldn't use a VPN?

I'm from the UK and I usually just have the VPN setup to automatically route everything through a VPN server located in London.

If for example, say that I want to connect to my online bank account, am I putting my credentials and packets are risk by having them sent over the VPN server? - I'm assuming that the banks login page is pretty secure already so by routing through a VPN server am I creating extra risk by routing over this third party?

The question boils down to; are there any situations where you wouldn't want to use a VPN, or is it always beneficial to security?

(Ignore cost / decreased network performance)

Yes, it could be a disadvantage. What is boils down to is how much you trust the VPN provider.

For most secure protocols, using a VPN will be just as secure because your communications are encrypted by the protocol. If there was a MITM at the other end of the VPN connection they would not be able to do much (apart from a side channel attack, which are usually pretty useless in isolation). Of course, this is assuming the protocols and software are secure, and cannot be not affected by the FREAK attack or other downgrade attacks.

However, the web is different. The main issue is that the Same Origin Policy does not designate a different origin for plain vs encrypted where cookies are concerned. A cookie set on http://example.com can be read by https://example.com. If there are any cookie handling vulnerabilities on the site then the "secure" connection could be compromised. The Secure Flag does not help here - this only prevents a plain HTTP connection from reading a cookie set over HTTPS, not the other way round. An example could be cookie poisoning like session fixation, or if there's an XSS vulnerability based on a cookie value that was assumed to only have been set via HTTPS. These are really vulnerabilities on the sites themselves, however using an untrusted connection allows them to be exploited.

So if there is any doubt about the trust of your VPN provider, then disable plain HTTP from your browser and use the internet over HTTPS only. You can do this by setting an invalid proxy server for plain HTTP (e.g. 127.0.0.1:8).

Of course, you should make sure you are using a secure protocol for your VPN connection too (e.g. not MS PPTP). Also, make sure you use iptables/Windows Firewall properly to prevent any incoming connections to your machine whilst connected to the VPN.


Can someone find out what phone was used to send an email Can someone find out exactly what phone/phone number an email was sent from? Say Doug used sallys phone to sign in and check his gmail account but never signed out then sally opened his gmail and sent an email using his account.. is there a way to find out that that email did infact come from sallys phone and not Doug's?

You can get the IP address by looking at the RAW email. gmail has this option when you are in the mail you want to check, go into the little down arrow that says more and choose "show original" the IP information is in there. Take time to read it, as there is more than 1 IP involved in getting your mail there.


What's going on in this visual render of an attacker and defender in Information Security? I'm self taught programmer and therefore an info security enthusiast, and I saw this video but I dont quite understand what's going on.Can someone please explain what's happenning, step by step in this video, which claims to be a rendered simulation of a computer program fending off a hacker?

I suppose my question is first "Is this an accurate representation of automated defense?" and then if so "What is happening exactly?"

This is a DDoS attack.

The purple bubbles are infected computers. By having thousands of infected computers, an hacker can simply force them to attack a target. This kind of attack means that there will be so many requests to a single server that he cannot handle with them all, making the server crash or simple not responding for a while.

To understand what is the definition of a DDoS attack i just copy a simple definition from wikipedia

  In computing, a denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. A distributed denial-of-service (DDoS) is where the attack source is more than one–and often thousands of-unique IP addresses.

The green bubbles are honeypots. The honeypot is just a simple "system" on the network that will provide some distraction to the hacker.

This means that instead of attacking the correct target, for example an webserver, the hacker will be attacking an honeypot, meaning that the real server don't have to handle with all the requests and the attack will not have any real impact.

The red and grey bubles, i think, that are really server responses.


Apple iPhone Security How difficult it would be to install an application that could record users keystrokes on an Apple device, for example, an iPhone X, and send it online without the knowledge of the user.

This answer will only explore privilege escalation to install the keystroke logger at root level or above. Other options are offered as part of parental controls or custom keyboards, but I will not explore those.

For the most part, performing clandestine keylogging I believe to be effective must be installed and operated with "higher privileges". This would for the best part involve privilege escalation which involves "exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user".

The privilege elevation could be archived by iOS jailbreaking, a method of privilege elevation with the purpose of removing software restrictions imposed by Apple. Jailbreaking will allow root access to iOS which will allow us to install a keylogger within iOS's file system. Which will make the device seem like nothing has changed, and it's a stock version of iOS shipped by Apple. This is not the scenario, the kernel verifies the file system on startup against checksums. Hence, we must reverse engineer and rewrite the kernel with a "custom" kernel to allow for this privilege elevation and the keylogger at root level to be maintained.

If the kernel is not patched for the modified file system it will not boot. The difference can be explored further by reviewing the difference between tethered and untethered jailbreaking.

With this knowledge, software keylogging on the kernel or root level is possible. Despite the pedanticism that must be dealt with to get this level of "undetectable" access on Apple iOS, it's completely possible.

With the use of reverse proxy(s), VPN and/or a darknet service, the keylogger can "phone home" reporting the intercepted keystrokes, without risking their anonymity.


What criteria should be used for manually reviewing / prioritizing failed logins? I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application.

What thresholds, or formulas should be used to determine when a failed login should be reviewed in more detail?    (Assume that an alert could be triggered on a per-user basis, or a per-IP basis.)

Some formulas I tried, but had issues with consistently applying include:

Success / Failed Logins Per IP
Success / Failed Logins Per User
Has the user ever logged in successfully at this IP before?  (if not, be more conservative)

I ran a Proof of Concept audit against existing web applications and noticed that there were a few legitimate use cases for the app that skew the straightforward application of the above ratios:

The user is behind a shared NAT or Proxy (remote office).
The user is on a home device (or mobile) and the source IP is always changing.
The machine is shared among many users, and that has a constant IP but many users

Some things I'm trying to prevent (incomplete list) include:

Brute forcing usernames or passwords.  (the lockout period is 24 hours)
DoSing the application by intentionally locking out users
Any attack above from a BotNet or TOR
Internal attacks / suspicious activity from internal users.

The ideal solution would have a consideration for the scenario below, but any general approach, academic whitepaper, or research would be helpful.

Optional Scenario:: An attacker is using sock puppet accounts to add success logins to the failed account, making him appear as a NAT above.

At face value, this is easy, but as anyone can tell by reading your question (or for those of us who have implemented something along these lines) this quickly becomes a can of worms.

Lets look at a few potential metrics...

Failed attempts per username -- the standard metric by which an account gets locked out, keep it low and most attacks will be blocked.

invalid usernames per IP per x hours -- Seeing 100 login attemps for unique invalid usernames in an hour from the same IP is a good indicator of malicious activity.

locked out users per offending ip over last x hours -- If one IP has caused n number of users to get locked out in the last x hours, that's suspicious. You'd want to compare this to the number of successful unique users logged in from that IP. If there has been one good login and 40 locked out users, something fishy is going on and worth banning the IP until an investigation can confirm.

avg & max valid user logins per IP over x hours/days -- gives you a good baseline for what standard use might be from NAT'd networks.

The key is to build baselines and flag any anomalies either for manual review or automatic action. That automatic action could be locking out a user, banning or rate limiting an IP, flagging an IP or user as suspicious and requiring all logins from that source to go through additional bot prevention steps i.e. CAPTCHAs and or email verification.

Some sites require these additional verification steps from any user logging in from a new device, this too will greatly decrease the potential for a successful user based attack.

As for your optional scenario, lets say they are using sock puppet accounts to meet baselines to appear as a NAT environment. Lets say they have 100 accts logging in successfully. If they are trying to get into a specific account, that account will be locked out after 3-4 tries. Assuming you have a decent password policy, attack prevented. Lets say that they're trying to get into one of 10 accounts, would 10 accounts being locked out in an hour from a NAT environment be normal? Doubt it.... Flag the IP for suspicious activity requiring users to verify their humanity after one failed password attempt.

Ensuring that users get locked out in a reasonably quick time will prevent most brute force attacks. Adding IP based metrics for locked out users, invalid users, and other related metrics compared to baselines and tied in with standard bot prevention and user verification methods will further decrease your risk and ensure happy auditors, sysadmins and users.


Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox? How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on?

How much access can add-ons have? Can they access internet history or maybe even cookies and such and send them to a server? Do I need to worry about this?

I do have Kaspersky and Kaspersky add-ons but I still wonder should I still worry about add-ons? Considering there is nothing I can do to make sure some add-ons are malicious or not even if they still have an OK reputation.

EDIT: bonus question, if an addon says it can read the data on websites you visit, does it mean it can know which websites I visit and technically can send them to a server and basically record my history this way ? (considering many adblockers and such addons have this permission)

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon).

Regarding your specific questions:

The browser history can only be requested if the history permission is granted.
The cookies permission only works along with a host permission which will define which cookies can be accessed. Host permissions are required for all of the sensitive actions (such as injecting JavaScript into a page, reading the contents of a page, etc).

Malicious extensions can of course execute arbitrary JavaScript in an isolated context, so something like a malicious cryptominer is certainly feasible.

For access which doesn't require explicit permissions, see my related question: Danger of browser extension without any permissions?.


What's the safest virtualization tool for running unsafe software - VirtualBox vs Windows Sandbox vs Hyper-V I'd want to ask, what's the safest environment to run potentially unsafe software?

I'm aware that this question may be very tricky, because each of those may have its flaws, but generally speaking which of those 3 sounds like safest option?

Hyper V - Windows 10 as host & guest

Virtualbox - Windows 10 as host & guest

Windows Sandbox?

From these three I would pick Hyper-V. The reason for this is the number of CVE vulnerabilities currently disclosed for these products are lowest for Hyper-V. Additional factor for choosing Hyper-V over others - is that Hyper-V is an Enterprise product, and thus there are higher chances that vulnerabilities will be mitigated faster that for the other, freeware products.

Hyper-V uses traditional architecture, where in standard configuration Hypervisor stands between guest and host hardware. Hyper-V offers much more tools than the other too for forensics.

However, a thing to note, that most current malware have defense mechanisms that allow it to detect hardwareID and some other things to stay silent and safe if it was launched on on Virtual Machine.

As for me, I personally would choose VMWare, simply because I have more experience with it.


Tumblr app on while Android phone logged onto work wifi I used the Tumblr app on my smartphone to access some adult Tumblr feeds while on my home network. I also used my phone's internet browser to view some adult content. While all this is completely legal, the Tumblr feed and websites definitely would run afoul of any company's Acceptable Usage Policy.

Later, I went to work where my smartphone automatically connects to my company's WiFi network. It wasn't until an hour after I'd arrived at work that I realized Tumblr and the web browser may still be running in the background on my phone. I'm not sure if the Tumblr app was automatically refreshing in the background, and I definitely did not actually open the app or refresh the site in my browser. However, I'm still worried that the background tasks may have violated my company's use policy by downloading adult content on their WiFi network.

I'm really worried that this activity might be detected and traced back to me. Is this something my company can do, if my phone did access offending content while on the corporate network? Does the Tumblr app or web browser even do any automatic refreshing in the background?

How the Tumblr site and/or app, or your phone's web browser, function in particular is beyond my ability to address.

The same more or less goes for your company's policies with regards to usage of personally-owned devices on the company-hosted WiFi network. However, I will note that I'm aware of an incident in my organization where someone recently had their hand slapped for inadvertently surfing for porn on their home computer while they were still connected to the corporate VPN. They were at home, on their own computer, using their own WiFi network, but the system was sending all Internet traffic, including their porn requests, through the corporate VPN at the time. No actual punishment was issued, as it was a first-time offense, but the individual was clearly advised not to do it again.

As for how traceable or identifiable you are while on the company network, the short answer is very. Given the cleartext traffic the typical smartphone sends under normal personal use conditions, it's fairly trivial for a network administrator to identify the user of a device. Even if not, with the proper sensing infrastructure in place and some additional hand-held tools, it's still fairly easy for your IT Security (or other technical) personnel to walk down your area and physically identify which device was sending the offending traffic.

So, everything comes down to how lenient your company is with "slip-ups" like this and how well-equipped and determined they are to trace offenders. To best avoid accidental offenses against company policy, I'll re-state what has been said several times in other answers to other questions on this site:

Keep all personal activity and devices on your own network, and off the company's hardware.


Mitigation of Spectre and Meltdown affecting host OS from guest OS (Virtualbox) I don't know all the details of Spectre and Meltdown, but the way I understand it is that they allow reading from memory, not writing to it. Also, I read that at least Spectre can get out of the virtual machine and therefore also affect the host OS. Finally, the Whonix website says (summarized and emphasis added):

  Experimental spectre/meltdown defenses. Testers only! Possibly not worth it due to huge performance penalty and unclear security benefits. Despite: host microcode upgrade, host kernel upgrade, VM kernel upgrade, spectre-meltdown-checker on the host showing "not vulnerable", latest VirtualBox version, all spectre/meltdown related VirtualBox settings tuned for better security as documented below... VirtualBox is likely still vulnerable to spectre/meltdown. For reference see VirtualBox bug report / forum discussion. Users can only wait for VirtualBox developers to fix this.

So that said, what can be done to mitigate the impact of Spectre and Meltdown exploited from a guest OS and avoid them to affect the host OS?

What I think is that if Spectre and Meltdown only allow malware to read data (memory), then I guess a VM without a network connection could avoid the problem. The infected guest OS can read data from the host OS, but it won't be able to send it anywhere. However, if I wanted my guest OS to be able to connect to the internet, then there's going to be trouble and I wouldn't know what to do.

Most threats assume the presence of an internet connection. It is usually quite challenging to exfiltrate data without the internet.

Spectre and Meltdown vulnerabilities allow attackers to see data that is normally restricted. This may include cryptography keys, authentication tokens, or other highly sensitive data.

If your compromised VM has network connectivity, an attacker could steal any of that information from the underlying OS.

This is particularly dangerous in an enterprise environment, where hypervisor credentials could be stolen and used to compromise all of the guest VMs.


In what ways can you trust a third party server with your data? What can you do that will make it easier for you to trust a third-party server? For example, using Intel sgx enclaves.

This depends completely on your situation.
As a private person, there is little you can do. You can read-up on the provider. Is this a trustworthy party? Or is it a party that easily sells its data? Read the fine print of the EULA. If the provider has a history of data leaks, they should be in the news. Is the provider is in a jurisdiction that forces the handover of all data and has a gagging-order history? You might want to avoid that, unless you trust that government.
ISO norms may give you some more reason to trust a provider.
As a company, you may look at your contracts. A smaller provider will generally be more willing to accommodate you. As a company, we normally have a right to audit (which we actually do too), which gives us more trust. There is also the possibility of independent audits.


Password managers with U2F security risks After a lot of research about password manager and a lot of reference obtained from this discussion
How safe are password managers like LastPass?
I come to the conclusion that password managers have some really scary point of failure, if my machine or mobile device is compromised when I use my master password and the U2F key to unlock the password manager (I am thinking something like yubikey or nitrokey) then all of my password can be stolen, even the ones that I use the less (like amazon account with my Credit Card information saved).

Reading the discussion and other opinions I got the impression that everyone says "If you lose the security of your machine than you are already ******", but there are cases when that isn't really true, think about the password that I use only a few times per year, like from online stores but with my CC credentials, in the time from the begin of the infection and the time I use the password I could get rid of the malware (formatting, antivirus) or I could use the password on another machine and the malware never gets this information.
With a password manager every password saved can be stolen.

So, I was thinking that the best way to use a password manager is to:

-never save critical password like bank account

-never let the password manager "open" (logged in)

-never use the autocomplete, even if the clipboard is another place unsecure and in this discussion tylerl had a point for the risk of fake sites
Does the average user really need a password manager?
But I read about some attacks via browser that can access even to other password without a trace, so better safe than sorry.

So reading the functionality for some of the most famous password managers, like lastpass or keepass, I was searching for a chance to decrypt only the single password needed, so if the machine is compromised only this password can be stolen. But it looks like it is impossible.

It's possible to add another layer of security?

What if I use an external drive to save the offline archive, with a different file system and encryption in read-only mode, that could help?

I know, I am a little paranoid, but when I am going to use some new software o practice I want to use the most secure and correct way to do it. So now I am confused and worried, I want a relatively simple way to access to my passwords but really difficult for others to get their hands on my data.

Sorry for my English

I think the point of the saying "if attackers own your machine then you are already screwed" is showcased with your question.  You don't want your password manager to decrypt anything except the single password you're requesting.  But any malware on your system can intercept and change that request.  This theoretical malware can tell your password manager to provide it with all decrypted data while still giving you the impression that only one password was decrypted.

Once your machine is owned you shouldn't trust it to perform any function that can be compromised.  In reality this type of malware should be more difficult to create given its complexity, but you may not want to rely on that obstacle given your level of paranoia.

What you may prefer is a device separate from your computers or mobile devices to manage your passwords.  When you need a password you authenticate to the trusted device, read off that particular password, and enter it on the potentially compromised device.  Your password store is essentially air gapped, and you can focus more effort on preventing that device from being compromised.  That may not meet your other criteria of being simple.


Mitigating physical cookie theft Threat model:
Malicious user gaining physical access to browser cookies (e.g., 3rd party repair guy copying cookies to his own device or something like that). Let's say legit user did not clear cookies beforehand.
Possible mitigation:
Pre-authorize user device:

Get user's browser signature via JS and save it in a db for later use (dbCopy). This is done by an "admin" account physically present in the device before a "regular" user can use it.

Now in every HTTP request of the user, the web app will:

Get browser sig via JS (currentRequestSig)
Set cookie hash = hash('sha256', currentRequestSig + randomToken) in user's browser
Store copy of the hash and currentRequestSig in the app's db
Get the cookie hash
Make sure the associated currentRequestSig of the cookie hash is the same as dbCopy
Make sure hash is not yet used before
Mark hash as used in db
Delete hash cookie

✓ Browser is verified at this point, user can proceed with using the app
Threats mitigated

If malicious user copies the cookie hash to his device, it will not work because of browser sig mismatch. This assumes browser sig is hard to replicate.

If malicious user disables JS, effectively disabling steps 1-3 (an HTTP requests therefore begins in step 4 with a copied cookie), the cookie he copied will still not work because it's already used before (step 6 will invalidate it).

My question is, is this a viable solution to mitigate physical cookie theft, or is it overkill and I am missing something?

This is almost useless for preventing cookie theft. You are relying on a non-secret property of the browser (every site you visit knows your browser signature) to attempt to provide security. This will just not work. All this will do is force the person copying the cookies to carry out one more step1: Grab a copy of the browser fingerprint as well. Remember that JavaScript on client side can not only be disabled, it can be modified too. The attacker can now simply replace the currentRequestSig function with one that will always return the victim's browser signature.

1This assumes there is some rate-limiting implemented server side which prevents simply bruteforcing the browser signature.


Why would a phishing blacklist be hashed? I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question.

But then I found https://stackoverflow.com/questions/44663025/how-to-test-if-a-url-is-a-phishing-in-command-line-using-google-safe-browsing which says the blacklist is hashed, which makes it useless for the first question above. There's a link to https://developers.google.com/safe-browsing/v4/urls-hashing which explains the hashing, but doesn't explain why the list is hashed.

Why hashed? What security problem does that solve? It seems all hashing does is cripple the list's potential usefulness.

Why hashed? What security problem does that solve?

I could imagine several reasons for this decision:

Using the shorted hashes saves a lots of space.
While it is possible to easily lookup specific URL's it is impossible to find out the whole list and then maybe reverse engineer parts on how Google creates this list in the first place. This makes it harder to work around the blacklist in a generic way, i.e. create URL's which have the highest chance to not get accidentally detected.
It takes efforts to create this list and Google might just want to protect their intellectual property.

  It seems all hashing does is cripple the list's potential usefulness.

Usefulness for whom? Note that this blacklist is intellectual property by Google and is obviously not intended to be open source. If this would be Google's intention then
they could simply publish the whole list and provide the tools needed to build the hashed version from it. The same way you could ask why Cisco does let you query OpenDNS for free but does not offer the list of all domains considered malicious by OpenDNS for download.