How exactly works this SQL injection example related to the DVWA application? I am a software developer converting do application security and I have some doubts about SQL injection example.

I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/

So I have the following doubt (probably pretty trivial).

I have this PHP code defining the query and the code to perform it:

<?php

if( isset( $_GET[ 'Submit' ] ) ) {
    // Get input
    $id = $_GET[ 'id' ];

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysqli_num_rows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        $html .= '
User ID exists in the database.
';
    }
    else {
        // User wasn't found, so the page wasn't!
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );

        // Feedback for end user
        $html .= '
User ID is MISSING from the database.
';
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

As you can see the query is definied as string concatenation:

$getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";

So I can inject what I want into the $id variable and perform extra SQL code as:

$id = 1 OR 1=1

that will be always true. Ok this is clear.

My doubt is different:

Inserting a valid value (such as 1) into the form) I obtain this URL:
http://localhost/DVWA-master/vulnerabilities/sqli_blind/?id=1&Submit=Submit#

The query is performed correctly and I am obtaining the following message result: User ID exists in the database.

If I try to insert a totally wrong ID in the form, for example "ABC" I am obtaining the following message error: User ID is MISSING from the database.. Ok, and this is ok

But if I try to insert a "wrong" value such as 1' in the form, the following URL is generated:
http://localhost/DVWA-master/vulnerabilities/sqli_blind/?id=1%27&Submit=Submit#

And I obtain a valid message: User ID is MISSING from the database.

So it seems that the query was correctly executed searching for the user with ID=1.

Why the ' char is not brocking the query? I was thinking that it have to search a user with ID=1' that is not existing in the database (as the case of ID=ABC).

Why? What am I missing? Probably it is a trivial question but I want to understand it in deep

So there are two things going on here.  I'll list and then explain:

In this case the value being injected is inside single quotes in the query, a fact which is easy to miss but is relevant for all your example payloads.
The application is suppressing errors.  As a result if a payload results in an SQL syntax error, you will get the "No results" message.

Let's run through your payloads keeping those two facts in mind:
1 OR 1=1
Here, the quotes around the value are important.  You actually end up with this query:
SELECT first_name, last_name FROM users WHERE user_id = '1 OR 1=1'
Which, contrary to what you said, doesn't actually match anything. Instead, it will only ever match the user with id=1.  If there is no such user it will return no matches.  The reason is because the whole thing is in single quotes, so the OR 1=1 is part of what it is searching for.  If anything therefore you would expect it to match nothing, since there is no user with an id 1 OR 1=1.  And yet it does match.  This is almost certainly because the user_id field is an integer, and MySQL will helpfully cast id='1 OR 1=1' into an integer, resulting in it throwing away the  OR 1=1 part and actually searching for id=1, which matches.
You can confirm that casting is giving you a false positive by trying out this query: ASDF OR 1=1 which you will find gives you no matches, showing that your current payload is not actually injecting anything.
To get the OR 1=1 out of the single quotes you first need to close the single quotes, so you would want something like: 1' OR 1=1.  Except that won't work either because the lone single quote at the end of the original query will cause an SQL injection error (which will result in no matches per #2), so you actually have to inject 1' OR 1=1--.  You should be able to test that this injection is working properly by using a payload like this: ASDF' OR 1=1--.  That results in this query:
SELECT first_name, last_name FROM users WHERE user_id = 'ASDF' OR 1=1--'
Which will match anything and therefore return results even though there are obviously no users with an id of ASDF.
1'
It's important to see the exact query this builds:
SELECT first_name, last_name FROM users WHERE user_id = '1''
You tried to close the quotes but the query itself already had an opening and closing quotes, so your quote injection caused an SQL syntax error (notice how it ends in two single quotes).  Per #2 above, an SQL syntax error will cause it to return no matches and not broadcast the SQL error.
Summary
All that to say: you are very close but there are some easy-to-miss details.  If it helps, take your injection payload, build the actual query yourself, and run that in SQL to see what happens.  In cases like this where you have code access it is even easier to figure out what is happening, because you can adjust the application to print out the query is running.  This makes it very easy to run it in MySQL and see exactly what is happening, especially in cases like this where the application suppresses errors.  Getting used to these sorts of things helps in cases in the future where you don't have such control.


The maximum size of a file that I can encrypt with a specific key size a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command.

we extract the public key from the private key using the command

openSSl rsa -in privatekey.pem -pubout -out publickey.pem

I want to know the size of my private key and my public key?

I want to know the maximum size of a file that I want to encrypt with my public key?

and the maximum size that I want to decrypt with my private key?

First of all, a 1024-bit RSA key is much too small for comfort. Current recommendations for RSA are a debate between 3072 or 4096 (better security margin) vs. 2048 (better performance). See:

https://crypto.stackexchange.com/questions/19655/what-is-the-history-of-recommended-rsa-key-sizes
https://paragonie.com/blog/2019/03/definitive-2019-guide-cryptographic-key-sizes-and-algorithm-recommendations

  I want to know the maximum size of a file that I want to encrypt with my public key? and the maximum size that I want to decrypt with my private key?

The limit here really comes down not to RSA itself, because practical public-key cryptography is almost always hybrid cryptography where RSA is used to encapsulate symmetric encryption keys (usually for some AES-based algorithm) and the actual data is encrypted with those.  So what in practice limits the size of the file you can encrypt is the design of the file or message format. For example with AES-GCM you cannot encrypt individual messages bigger than 64 GiB, and you should not encrypt more than 232 messages with one key, but that really means that to encrypt a larger volume of data the software should split it into smaller chunks and encrypt each one as a separate message, rotating keys after some number of chunks is exceeded.

(Side note: even for smaller files it's best to encrypt them in modest-sized chunks so that the software can reject forgeries without having to decrypt the whole file before producing any output. For example, one of the causes of the EFail vulnerability is that GnuPG outputs the decryptions of forged files before it performs an optional anti-forgery check.)

This is just one example; the general answer is that your question cannot be answered concretely with just the information that you give, and concrete answers require looking at your specific cryptographic software to see how it's designed and implemented.  For example, the documentation for GnuPG tells you for some of its symmetric algorithms you should not encrypt files bigger than 4 GiB:

  Due to its 1970s-era 64-bit block size, [3DES] should not be used to encrypt more than about 4Gb of data. Beyond that, though, it is solid as a rock, and very few GnuPG users will ever notice a problem with it. Provided you’re not encrypting more than 4Gb of data you may use 3DES with confidence.

I could not quickly find what's the failure mode if you violate this rule, and I cannot warrant whether it gives you an error saying you did something bad (as it should) or just silently produces a potentially insecure output file (which would be terrible). Caveat emptor.


How to pentest DTLS-SRTP? I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark.

Yes, it's protected by SRTP, but:

What's DTLS actually doing/working on the media channel?
What are other attack methods (apart from the eavesdropping) that can be tested on such a secured channel (to prove it works, or alternatively to prove it still has flaws)?

Specifically I'm doing it in WebRTC communications, and I'm ignoring other location's security aspects, except in the media transfer channel.

What kind of attack methods are you looking for?
I remember it has a memory leak in the DTLS-SRTP extension parsing code. Which makes OpenSSL vulnerable to DoS attacks (for more read CVE-2014-3513).

But I suggest reading RFC 5764 and see if that answers any of your questions.

Can also recommend "Prateek Gupta, Vitaly Shmatikov (2006) Security Analysis of Voice-over-IP Protocols"


Could someone recommend me a citable definition of honest but curious/semi-trusted? As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone know a citable definition of this concept? Ideally one that I can look up online.

While looking for a source, I found many papers refer to Yao, but could not find a definition by him ("How to generate and exchange secrets" sadly is not available online)

I found a citable definition in "Modelling and Automatically Analysing Privacy
Properties for Honest-but-Curious Adversaries by Pavert" et al.

  The honest-but-curious (HBC) adversary is a legitimate participant in
  a communication protocol who will not deviate from the defined
  protocol but will attempt to learn all possible information from
  legitimately received messages.


Is there any downside to having a VeraCrypt file container that is almost as big as the drive it's on? I am setting up an external hard drive to backup several computers to, and I want to keep its contents private by using VeraCrypt. I don't want to encrypt the entire drive because then when it's inserted, Windows shows a popup asking if I want to format it, which I find annoying. Instead I have formatted it as a regular exFAT drive, and am currently creating a VeraCrypt file container on it that is almost as large as the drive: the drive is 3.63 TB and the file container is 3.61 TB, leaving 25.8 GB free.

Doing it this way also allows me to have a small amount of unencrypted space on the drive where, for example, I can store install files for VeraCrypt.

I know that normally it's not good to keep a drive almost full because then there isn't space for pagefiles and the data can get fragmented. However this is an external, so there are no pagefiles, and once the VeraCrypt file container is initially created, I don't see how it could ever get fragmented.

So, will I be OK? Or are there issues with this setup?

There should be no issues either with the cryptography or with the integrity or performance of the exFAT filesystem. The only thing you should keep in mind is that you are losing plausible deniability. When you encrypt the entire drive, it is computationally indistinguishable from a drive that has merely been wiped and has no data on it. If the drive is formatted and has a large VeraCrypt container on it, it is much harder to claim that it is anything but a large tomb of secrets. If that is outside of your threat model, then what you suggest is completely fine. The only real issue I can think of is that filesystem corruption would do more damage than it otherwise would, as it could render the entire VeraCrypt container inaccessible.


How dangerous is it to use CSS styles from an untrusted source? I'm a moderator at a forum. We want to have a new style for the forum.
We're thinking about announcing a competition to the users to come up with the best CSS design; we would adopt the best submission.

How dangerous would this be?  How dangerous is it to use CSS styles from someone we don't trust?  Is it possible for a CSS designer to add a malicious code or function to the CSS style itself?

It is not advisable to use CSS styles from a source you don't trust, without some sort of review.
There are some risks, particularly on older browsers.  Some older browsers provide a way to embed JavaScript inside of CSS, so that the JavaScript will be automatically executed as soon as the browser loads the CSS.  Browsers with this problem include IE6, IE7, as well as later versions of IE in IE7 compatibility mode; also IE Mobile 8.  (In those older browsers, this is supported through CSS constructs like url, expression(...), behavior, -moz-binding, -o-link, and probably more.) This weakness of older browsers allows an attacker who supplies malicious CSS to do anything an XSS attack can do.  Using CSS styles from an attacker is basically a self-inflicted XSS vulnerability.
Fortunately, modern browsers have closed all of these JavaScript pathways.  Unfortunately, some users still use older browsers, so if you use CSS from an untrusted source, you'll be putting those users at risk.
That said, I would recommend taking a risk management perspective.  How great is the risk?  How great is the benefit?  In this case, I suspect the benefits are probably worth taking a slight risk, particularly if you adopt some mitigations to protect yourself.  I would recommend:

Review all of the proposed CSS before loading it into your site.  Make sure you understand it, and it isn't obfuscated.  Make sure it looks clean and well-organized and readable.  Make sure it doesn't load external CSS or other external resources.  See whether it looks reasonable to you.  If you spot it doing stuff you don't understand, maybe don't use it.

Check the source.  Are they a trusted user of your community, who have been spending time on your site for a long time?  Or are they a new user who you have little history of?  There's probably less risk from a trusted member of the site, and more risk from an unknown.

If it were a site I was running, I'd probably do it.  Yes, I'd use the above mitigations to protect myself -- but I wouldn't let security get in the way of having fun things.
Other resources: CSS security, from ha.ckers, Ending expressions, from MSDN


Why fear hardware brought to China, when most of it comes from China? A lot of people will bring disposable hardware (laptops, phones) to business trips to China, eg. Employee laptops in China.

Considering that most of that hardware was manufactured there, what is the added risk? I.e. why do we trust a computer that was born in China but not the one that went there later?

Because they had to be subtle when they bugged all the hardware in the world, the same as we had to be subtle when we bugged all the operating systems in the world, for fear of being caught.

But when they have physical control of a specific targeted machine, then they can be much less subtle.


How can I convert a Windows certificate into a PEM format, that includes the chain + root? I need to import a certificate into a Cisco Ironport for Web SSL inspection.  The only input format supported is PEM.

Based on my research the PEM format does support all certificates in the chain, however I'm unsure how to convert a DER/CER/P7b into PEM that includes the chain.

I've been using the following OpenSSL commands to do the conversion, however I don't seem to be getting the full chain.  Am I missing a switch?

  Extracting the Public key (certificate)

  You will need access to a
  computer running OpenSSL. Copy your PFX file over to this computer and
  run the following command:

  openssl pkcs12 -in <filename.pfx> -clcerts -nokeys -out
  certificate.cer

  This creates the public key file named "certificate.cer" Note: These
  instructions have been verified using OpenSSL on Linux. Some syntax
  may vary on the Win32 version.

  Extracting and decrypting the Private key

  The WSA requires that the private key be unencrypted. Use the
  following OpenSSL commands:

  openssl pkcs12 -in <filename.pfx> -nocerts -out
  privatekey-encrypted.key

  You will be prompted for "Enter Import Password". This is the password
  created in step 11 above. You will also be prompted for "Enter PEM
  pass phrase". The is the encryption password (used below).

  This will create the encrypted private key file named
  "privatekey-encrypted.key"

  To create a decrypted version of this key, use the following command:

  openssl rsa -in privatekey-encrypted.key -out private.key

Specifying openssl pkcs12 -nokeys -clcerts says to NOT output any chain certs. If the chain certs are present in the PKCS12, omit -clcerts to include them in the PEM output. They will be present in the PKCS12 if you create it with Windows Export Wizard and check Include all certificates in the certification path if possible, which is not the default (on my systems at least). This will (normally? always?) include the root, although something impersonating this subject in SSL/TLS -- which I presume is what your Ironport does -- doesn't actually need the root, only the chain below the root. (Technically it might need even less, depending on caching and presence of, support for, and success of AIA, but that gets too complicated.)

Note that PEM-format certs output from pkcs12 -nokeys includes a few lines of info before each ----BEGIN/blob/-----END block. This is a minor extension to PEM implemented by OpenSSL but not everybody else. If the Ironport is actually calling OpenSSL, and many programs that require PEM do so because they are calling OpenSSL, that's okay. If not, and Ironport is doing its own or some other strict PEM implementation, edit the file to delete the comments.

Also, there is no need to create the privatekey encrypted and then decrypt it. It is generally best to encrypt the privatekey, but apparently you need it unencrypted, so you can just use openssl pkcs12 -nocerts -nodes with suitable in and out. Unless whatever instructions you are quoting actually mean but don't say it needs unencrypted "traditional" format (raw PKCS1 rather than PKCS8). For that you must either use OpenSSL 0.9.8* (which is way old, but still supported as of now) where pkcs12 (import) writes the privatekey in traditional format, or with newer OpenSSL let pkcs12 (import) write PKCS8 and then convert to traditional with rsa but even then you can have the PKCS8 and the traditional both unencrypted.

Finally for clarity, P7B contains only certs not privatekey and so is not sufficient to impersonate the subject. The other choices in the Export Wizard are not simply DER and Base-64, which have many other options and uses, but DER or Base-64 (actually PEM) encoding of X.509 cert specifically; those don't contain either the chain or the privatekey and are even more insufficient.


If I host a web form which submits CC details to a provider, are there PCI implications form host? I'm wondering if anyone has any thoughts on a specific question I have.  I read a lot about systems that 'store, process, submit' CC data requiring compliance.

If I host a form on my website which takes CC details and posts them to a CC provider, are there PCI implications on my system (even though the CC details do not reach my server?).
The data itself is not stored on my system.
It's transmitted between the customer's browser and provider, my system does not participate.
My system only sends the form to the customers browser and provides the posting code.

I'd be interested to hear any thoughts or experiences on this if you have any.

Thanks in advance.

How are you handling the cc details? I'm afraid that PCI compliance is a lot more than https,

We used to host a form directly and pass on the information to the processing company within a script, not even storing them as session variables. That was reason enough for our bank to bump up our PCI requirements as we handled the cc details directly. If you imagine somebody put some dodgy code on our server, it could do anything it liked with the credit card details.

We now use an embedded iframe from our card processing company within the webpage. It doesn't look quite as good, but we never see the cc details, so our PCI compliance burden is greatly reduced. It wouldn't matter what code is on our server now, the credit card details can't be accessed.

A good starting point would be https://www.pcisecuritystandards.org/index.php, pick your self see where you put yourself and then go from there.


Using Nmap to Scan Port Forwarding? I have enabled port forwarding on my router to do some testing with Nmap. The internal IP address 10.0.0.10 on port 4245 is being sent to my public IP address on port 4245. I can access this with x.x.x.x:4245

However, Nmap is reporting port 4245 to be closed. To be sure, I have specified the port number and disabled host discovery. I have tried this both over TCP and UDP. The commands I have tried are sudo nmap -sS -Pn -p 4245 x.x.x.x and sudo nmap -sU -Pn -p 4245 x.x.x.x

Both of these  results show port 4245 as closed.

Note: x.x.x.x being my public IP address.

Long answer, see TL;DR below!

I don't think it's an Nmap problem, but rather a port-forwarding problem. I imagine you are scanning from the local network (if that's not the case, please ignore this).

Port forwarding often don't work from the local network, for a very simple reason. Suppose this is your network:

(A)--+
     |                    (           )
     |---(Rpr--R--Rpu)---(  Internet   )---(X)
     |                    (           )
(B)--+

A and B are two computers in your local network, both with private IP addresses, R is your router (which does the NAT and port forwarding), with one public address (Rpu) and one private (Rpr) on your LAN. X is a computer on the Internet, with a public address.

You have configured port forwarding on R so that packets arriving on Rpu:4245 (this means IP address Rpu, port 4245) are forwarded to A:4245.

When X sends a packet to Rpu:4245, it arrives to R, which translates the destination address to A:4245 and routes the packet to A. When A answers, it sends a packet from A:4245 to X. This packet is sent to R as its destination is outside the LAN and R is the gateway. R changes the source from A:4245 to Rpu:4245, and route the packet, which arrives to X as a packet from Rpu:4245 to X, everything is OK.

Now when B sends a packet to Rpu:4245, it sends it to R (because Rpu is outside the LAN and R is the router). Suppose R does the port-forwarding anyway, it sets the destination to A:4245 and routes the packet (from B to A:4245) to A. When A answers, it sends a packet from A:4245 to B. And this time it won't send the packet to R but directly to B, since B is on the LAN. The packet arrives to B as a packet from A:4245 to B, and hence cannot be seen as the answer to the packet from B to Rpu:4245, the source address does not match.

This could work if R also changed the source address to Rpr (or Rpu, or any address outside the LAN), because in that case, A would send the answers to R and R could reverse-translate the addresses, but that's probably not the case.

TL;DR. Run your tests from a computer outside your LAN with: nmap -sP4245 -p 4245 x.x.x.x (-sP4245 instructs Nmap to use a SYN packet to port 4245 during the ping scan). From your LAN, you can only check that the port is open by scanning (with the same options) your private address, but that leaves the port forwarding setting untested.


WireGuard VPN: how safe is it for production in its current state? In our project we had to build a VPN to get through to computers residing behind NAT. I never did it before. While looking for suitable software I came across WireGuard which claimed to be very simple.
After some reading I indeed was able to setup a server with 8 lines long config file and a client (that was behind NAT) with 9 lines long config.
The link worked perfectly in both directions. After that for obvious reasons I don't want to touch any alternatives. WG is on its way to the mainstream Linux kernel, but it is not there yet.
The protocol was formally verified and technical whitepaper exists as well. However the website claims WireGuard shouldn't be "relied on".
How risky is it, from information security point of view, to use WG in production in its current state? What are potential troubles?
Update: As of 2020 WireGuard is inside mainstream Linux kernel, so quite production ready.

Well, I'm actually excited about WireGuard too. There is already Android, macOS, Windows(third party - closed source) and OpenBSD clients, showing that the project have a solid future ahead. Tight integration with ip-link also seems a bonus and configuration is a no-brainer.
But if you take a look at the homepage, specially the "About Project" section, you will see a warning about using it on production:

About The Project
Work in Progress
WireGuard is not yet complete. You should not rely on this code. It
has not undergone proper degrees of security auditing and the protocol
is still subject to change. We're working toward a stable 1.0 release,
but that time has not yet come. There are experimental snapshots
tagged with "0.0.YYYYMMDD", but these should not be considered real
releases and they may contain security vulnerabilities (which would
not be eligible for CVEs, since this is pre-release snapshot
software). If you are packaging WireGuard, you must keep up to date
with the snapshots.
However, if you're interested in helping out, we could really use your
help and we readily welcome any form of feedback and review. There's
currently quite a bit of work to do on the project todo list, and the
more folks testing this out, the better.

Basically this project could have CVEs and it is under heavy development and constant change. Maybe it's not suitable to your organization. Also, no opensource Windows client, and a client that relies on tun/tap devices kludge.


The risk of RSA encryption. Would individually encrypted characters be risky? Is it possible to decrypt a RSA message if the characters of the message are individually encrypted?
The info you have is the message, the public key and the n which is too big to be factorizable.

I'm assuming you mean that each character is individually encrypted, and you get the ciphertexts and public key(s) used to encrypt the characters.
The main consideration would be whether the encryptions were performed with padding, such as OAEP. The importance of padding is well established for most cases. In particular, for this scenario, the critical weakness is the determinism of the output - unpadded RSA produces a deterministic output for a given input and key - which can be used to trivially brute-force small messages. The algorithm is simple:

Attacker takes the supplied public key and uses it to encrypt every possible (or even just every likely) character, individually.
Attacker compares each resulting ciphertext with the supplied ciphertext. If they match, the attacker knows what character produced that ciphertext and thus has "decrypted" the message.
Repeat for each (ciphertext, public key) pair that you have until you've "decrypted" everything.

If the messages are padded correctly, this attack is not possible. In that case, there is not (AFAIK) any reason this scheme wouldn't work.
Of course, RSA with secure key sizes is painfully slow, and using it for a large number of tiny messages is absurdly wasteful. In any realistic scenario, you would either encrypt the full message with the key (if it's short enough to do so in one "block"), or use a hybrid cryptosystem where the message is encrypted using a symmetric cipher, and the symmetric cipher's key is encrypted using an asymmetric cipher such as RSA.


fwsnort - How safe compared with Snort/Suricata? How safe is 'fwsnort' compared to a real Snort / Suricata instance?

What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is that realistic, today?
Is it really just the rules or does Snort / Suricata provide an extra security margin, which is significant?

I'm considering using fwsnort, instead of a Suricata instance, mainly because of the very easy setup. I'm no security expert, that's why I am asking here - am I bad off with only using fwsnort?

Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic.

Thus if you care mostly about attacks at the lower layers it might be enough, but it will not be able to detect attacks at the application layer except the most trivial.


Heartbleed and heap management - Why user data and passwords are kept in memory? If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how comes the OpenSSL process keeps in memory what it has encrypted/decrypted previously ?

It seems obvious that given the sensitivity of the OpenSSL process, there should not be any data kept in memory for longer that what's strictly needed, something like a "need to know" principle to ensure that the impact is kept at a reasonable level if the process is compromised.

I understand this sensitive data has to be put in memory to be communicated to the above layer/service (e.g. http server in most cases), but once it has been transmited it should be immediately removed, right ?

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own buffer/memory structures (e.g. OpenSSL's BUF_MEM) which depending on their implementation may or may not zero-out memory after use.

You are correct that sensitive data should only live in memory for as long as a need to know exists. It is best practice to zero out sensitive memory in these cases.

I can't say for sure in the case of OpenSSL since I haven't had an in-depth look at the code, but it could have been reading from memory that was still required, or memory that was no longer required but not zero'd-out, or a combination of the two.

More reading:

Optimizing compilers can remove calls to zero memory
Memory Deallocation issues in C
Zero and forget -- caveats of zeroing memory in C


How long to crack an 8 character WPA2 hash if first char is known I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?

If the passphrase is exactly 8 characters long and the first character is known, then only 7 need to be brute forced. Assuming characters are 0‒9 and A‒Z, the maximum number of combinations is 367.

An AMD Radeon RX480 GPU can go through approximately 170,000 candidate WPA2 passwords per second. This means it will take around 367 / 170000 seconds at most to exhaust all possible 7 character upper alphanumeric passwords, and half that on average. This equates to an average of 2.5 days.

Note that higher-end GPUs and clusters of GPUs can crack such a password, and stronger ones, much more quickly. From Twitter, 8x 2080Ti GPUs can crack any 8 character password in ~2.5 hours!


How to perform encryption/decryption in a RESTful system? I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard?
I'm trying to perform encryption/decryption in RESTful api where client sends encrypted payload and server decrypts it and does some processing. The server then sends encrypted response which the client decrypts and does some processing.
The architecture I've decided is:

One of the server periodically(once in 24hrs) generates a RSA keypair and uploads encrypted private key to redis so that other servers  can get it and use decrypted private key from a master key.
create an api to share current active public key.

client:

get current active public key from server as raw text
generate new symmetric key
encrypt request with symmetric key
encrypt symmetric key with public key
encrypt iV with public key
send request

server:

decrypt iV with private key
decrypt symmetric key with private key
decrypt payload with symmetric key
encrypt response with symmetric
send response

client:

decrypt response with symmetric key

I'm using java.security and javax.crypto for all the key generation, cipher encryption/decryption.
The transformations I'll be doing is

RSA transformation RSA/ECB/OAEPWithSHA-256AndMGF1Padding
AES transformation AES/GCM/PKCS5Padding

Is this architecture okay to use? The reason for creating an api to get public key is so that we can do key rotation periodically. Also, I'll create an admin only api to force change the RSA key pair incase private key leak.
My major concern is the api that shares naked public key. Is this a valid approach and what are its problems? What are my options otherwise? Any help would be greatly appreciated because this is a very new topic for me and I am finding it very interesting!
Update

I'm using TLS/SSL for communication and want to add additional level of encryption

As others have mentioned, you already have TLS, so this won't add any security, it'll just slow things down.
You mention sharing a private key between servers. Don't do that. Ever. Generate individual key pairs for every server, and have your central server sign them (the usual certificate generation process, with your central server as the CA).
The method you've proposed is otherwise OK but slow. Why not try libsodium boxes? Then it's a matter of calling crypto_box_easy() on the sender side, and crypto_box_open_easy() on the receiver side (obviously after key/nonce generation and exchange of public key from receiver to sender). There are bindings for Java.


How does my browser detect my location, even via proxy? How does my browser detect my location even via proxy?

I have tried this code via VPN and got the same result as without it. According to the specification my browser should detect it from:

  Common sources of location information include Global Positioning
  System (GPS) and location inferred from network signals such as IP
  address, RFID, WiFi and Bluetooth MAC addresses, and GSM/CDMA cell
  IDs, as well as user input.

So, I proxied my IP. I have no GPS on my PC and do not use WiFi or GSM either. How did this happen? Note that it is accurate to the street.

Several proxies add extra headers to a session which leaks info such as the X-Forwarded-For header which includes the origin IP address.

Since OP question states there is no GPS/GSM network involved, then one can assume this is running on a desktop, laptop, or WiFi tablet, therefore the location data is likely being acquired by geoip data related to the IP address in the X-Forwarded-For header.

Testing headers

- login to a remote shell outside the proxy
- exec netcat -l -p 8080
- on local browse to remote:8080 with proxy enabled then read the stdout on remote

This also tests for additional data that may be sent. tcpdump can also be run on the remote server.


3G Femtocell at home: can anybody connect, and is all traffic encrypted? At our office we have bad reception for 3G. We bought a Femtocell device that provides a 3G connection for one specific mobile provider. This device is connected to our network via ethernet. I cannot use this device at our office, because I use another provider.

Thinking about this - it could be that I use connections like this without knowing it. Take imaginary John, living in an area where connection is bad. He has bought and installed his own Femtocell at home. Not only he connects to this device, but everybody in range of this device - not?

When my direct connection to my provider fails, and I'm in range of John's home femtocell, my SMS, phone conversations and internet data are transferred over his home network.

Is this traffic encrypted and safe?
Is it true that anybody can connect to this device and use bandwidth?
When a phone connects to this femtocell, does it have access to the local LAN?

Whether the traffic is encrypted it's up to the femtocell manufacturer. You haven't provided much details, so I can only suggest you pull out wireshark and see what happens. Most likely traffic should go through via SSL, although I won't be surprised if there was no mechanism for updating CRLs and/or maintenance and open ports on the cell itself.

If I were to implement it, a low-cost solution would be to put a self-signed certificate on the box. The chances of somebody breaking into the hardware, stealing the certificate and using it for impersonating MitM attacks are small and if somebody is so well intentioned there are better devices such as stingrays which are less apparent. I've mentioned the need to stay low-cost as these devices are produced with tiny margins and often subsidised by the mobile operator.

Regarding your second question - whether anybody can connect to the device - the answer is both yes and no. When I asked my provider to set me up with a femtocell they asked for my mobile number and I suppose they set up the cell to recognise my IMEI - and since the device has no 'control panel' and it's behind my home router as NAT I assume there is some kind of ACL the device pulls remotely to see who is allowed to connect and who is not. Therefore, anyone authorized can connect, and this is probably defined server-side. Unfortunately I do not know enough about GSM standards to be sure how this is done in detail.

Lastly, regarding whether a phone has access to the local LAN, in the device I use this is not the case. In fact, I can "go online with 3G" through the femtocell and my phone's IP is of the mobile provider, not of my ISP. Therefore all traffic (data and voice) must be simply sent over the SSL tunnel to the mobile operator, which then takes care of routing it accordingly. I'm again assuming that, given the low cost of the device, a mobile operator has no interest in setting up complex routing policies to let data traffic go through a customer's LAN. This would also reduce helpdesk costs, as dealing with a home network might be very complex.


Using MD5 for file integrity checks? General

  Always check the MD5 hashes of the .NET Framework assemblies to prevent the possibility of rootkits in the framework. Altered assemblies are possible and simple to produce. Checking the MD5 hashes will prevent using altered assemblies on a server or client machine.

Source: https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet

Isn't MD5 completely broken for this purpose?

The MD5 hash algorithm has been demonstrated to be weak to collision attacks. This means that an attacker can generate two files which will produce the same hash value. This has no bearing on file integrity checks.

To create a file that matches a previously known hash, the algorithm has to be weak against second preimage attacks. While MD5 has some theoretical weaknesses in this aspect, the current attacks are still not computationally feasible.

Of course, new attacks might surface in the future. MD5 has been demonstrated to have several glaring weaknesses. Try to use a hash function like SHA256 instead.


private key passphrase protected, symmetric key location If I protect my private key with a passphrase, then it  will be encrypted

Where is the symmetric key stored for it ? Is it somehow in the certificate itself? What if I have specified that it's not exportable and passphrase protected, if someone gains access to my OS and uses mimikatz to export it will she/he be able to decrypt it (assuming the passphrase was as easy as Test123) or will it fail because the symmetric key is tied to the OS and not the certificate itself?

Your question is answered here.

Specifically, the key is encrypted using AES-128 in CBC mode with the DS4228D85838E32589695E83A22595C7 (hex) initialization vector. The passphrase you provided is used for generating the AES key.

How is the key derived from the password? According to this, it is done this way:

  1) Append the first 8 bytes of the IV to the passphrase, without a separator (serves as a salt).

  2) Take the MD5 hash of the resulting string (once).

Not exactly state-of-the-art.


How long do ISPs retain data? I recently came across an article informing people about how long major ISP’s store user data such as IP assignments and other user data. On average, companies supposedly stored this data for 6 months (180 days). Is this true? and wouldn’t this cause problems with the people who deem this as a safety concern considering 6 months is a short amount of time? I know that retaining data is pricey, but still?

Data retention is limited by country law (and GDPR in EU).

In my country, the law says 6 months so it's 6 months., but it may differ depending on your location and implicit legislation.


Creating a Private Key using Human Intervention In a hypothetical system, lets say that a design requirement is that people who snoop around the database of a web application (sysadmin gone rogue, or what have you), do not have access to the plain text of private messages between users. An encrypted version of the text is stored instead.

The easy way to do this is to use a public-key/private-key encryption scheme. However it's (really) ineffective to store the private key in the system, or in the users browser given a strong-willed attacker. This leaves human intervention for generation.

Short of using a java-applet (or fancy HTML5/Javascript), it's hard to provide an instance for a human to provide random input to generate the private key, and there's still the issue of storing it. There's also a problem requiring humans to remember a 16 character random password using case sensitive alphanumerics and symbols. Private key dongles that companies tend to use are also out of the question.

So, the question is: How do I take a potentially insecure password and morph it into a secure private key? Is this even possible?

My ideas tend to float towards that it's not really possible until a user uses a decidedly secure passphrase (16+ characters, case sensitive with numbers), due to ease of brute-forcing these days. Also a problem would be the lack of a secure-enough cipher that uses it's own input to generate a key for it to use. Again, stemming from the problem with storing the key that is used in the generation.

Also, let's assume that proper techniques are being used in all other places of the system (SSL, up-to-date encryption algos, etc.)

Trying to write password resistance to brute force attacks as an equation: complexity * transformation cost = resistance. Your limiting bound on transformation cost is how long you want to work to verify (or generate a key from) a password each time it is valid. Poor passwords are hard to brute force if the derivation function takes a year to run, but that's also hard to work with as a legitimate case.

The "new traditional" method of generating a key from a password is to run it through PBKDF2. Bcrypt and scrypt are two "stronger" options. When choosing the number of iterations, benchmark and crank that thing up as high as you feel comfortable with based on predicted load. Too low and it's easy to crack. Too high and you'll denial-of-service yourself to death with legitimate operations. The basic litmus is "how many login attempts must I be able to handle per second?" Remember that unlike with password hashing, you cannot increase iterations at a later point in time (unless you re-encrypt everything -- you probably don't want to do that).

Store a random salt with your encrypted data (one for each password / key used) and use that corresponding salt with the password. That will ensure that each password must be individually attacked instead of the whole group at once.


Is it possible to build in future support for TLS 1.3 into a client using .NET TLS? My (human) client has asked if a client service we are developing for them can somehow support TLS 1.3 for when TLS 1.3 officially rolls out. The issue is, the client service will be installed once, and probably never updated (I know this seems odd). It will be using the .NET implementation of TLS, so they want the service to somehow default to using 1.3 if and when the .NET framework on the client has it. Is this at all possible?

I have a feeling this is a big fat no, especially as the implementation of TLS 1.3 looks significantly different, i.e. with the new handshake, but my current knowledge in this domain is limited. Sorry if this is a really daft question, I have a feeling it is.

This is probably a more appropriate question for stackoverflow.

That said:

It's impossible to know what MS will do. At one end of the spectrum, they could limit TLS 1.3 support to a specific release of .NET (in which case you'll be unable to support it without retargetting your application to that new version). At the other end, they might add support directly in schannel and indirectly to all libraries that relies on it and make it the negociated default in which case your application will support it automatically as long as it doesn't supply its own default (or force some other setting that makes it impossible to use TLS 1.3).
It's also hard to give you an answer without knowing how you're using the .NET framework. If you're using only the highest-level interfaces and always using the default options then you're not going to have extra compatibility issue (although you'll be relying on the OS to be configured in a secure way).

Beyond that, I have a hard time understanding how you can reasonably expect the OS to be kept up to date but not your application. Or rather, if that is really a situation you are expecting then i would strongly suggest you invest in improving your auto-update system instead: that will solve way more issues than hoping for MS to add an implementation that is 100% compatible with your design without any change.


What kind of answer is this textbook question looking for in access control model? I'm going over a practice question and I have trouble understanding what it's asking.

  Draw an access control matrix for the following Linux file system.
  Group A1 contains S1 and S3, group A2 contains S3. Only show users as
  subjects.

So is the answer to the question supposed to look like

What is the answer to the question?

So to summarize:

Group 1 contains S1 and S3
Group 2 contains S3

Then it is pretty simple, if you know that in Linux, the 9-character permission scheme can be divided as follows:

First three characters are the owner's permissions
Next three characters are the group's permissions
Last three characters are the permissions of all of the other users

Then, following the assumption I made, you know the following:

Permissions    a     b    c
S1             rwx   -    rwx (S1 is member of group 1: group 1 has rwx permission)
S2             rwx   rwx  - (due to explicit owner deny on the last row of the table)
S3             rwx   -    rwx (due to group inherited allow permission of group 1)


Does the main OS run "virtualised" under the ring -1 hypervisor? After reading this answer which explains that modern CPUs have a ring -1 that is running a hypervisor on the CPU and handles vmenter & stuff, I am wondering:

The main operating system, like the one installed directly on the hard disk (and not one that would be inside a program like VMWare Player), must run on top of this hypervisor too. Since ring -1 has complete control over it and is actually hidden from it. Does that mean that the main OS kernel is "virtualized" too from that perspective? So does the e.g. Windows code run inside a vmenter on this ring -1 hypervisor? Or how does it work exactly?

Hardware virtualization
If an operating system is not a host virtualizing a guest, it is not running as "ring -1". If a hypervisor is not active, ring -1 effectively does not exist and does not matter. As such, unless you are purposefully running a virtual machine, you don't have to even think about hypervisors. The short answer is that ring -1 is not a real protection ring. It is a term made up to illustrate the relative privilege difference between a virtualized guest and its host.
Current Privilege Level
In CPU parlance, ring 0 is called CPL0 (Current Privilege Level 0) whereas ring 3 is CPL3. The purpose of this is simply to allow various instructions to check the amount of privilege before executing. A task stores its current privilege in the TSS, and instructions are able to have checks to ensure that only a certain level is allowed to continue. For example, the RDTSC instruction is defined as:
if(CR4.TSD == 0 || CPL == 0 || CR0.PE == 0) EDX:EAX = TimeStampCounter;
else Exception(GP(0));

This includes a check to see if the current privilege level is 0. If it is, then it will save the value of the timestamp counter to the EDX and EAX registers, otherwise it may result in a general protection fault due to insufficient privilege.
Privileged instructions and VM exits
Hypervisor context is not a real protection ring, and CPL < 0 will never evaluate true. When a privileged instruction is to be executed in a guest, it is automatically trapped and the guest exits in a process called vmexit, and the hypervisor is allowed to determine whether or not the instruction should be allowed, and can safely emulate it if it so wishes. After it has made its decision, it gives control back to the guest using vmenter, and the guest continues along like nothing happened until it runs into another privileged instruction that forces it to give control back to the hypervisor.
Certain non-privileged instructions can also be conditionally trapped in a hypervisor, for example CPUID, which gives information about the processor. While this is not privileged (normally, at least), it is quite useful for hypervisors to trap it so they can modify the values it returns. A guest running under KVM or Xen calling this instruction with EAX set to 0 will return the vendor ID string KVMKVMKVM or XenVMMXenVMM, respectively, in three other registers. If the instruction were not trapped, the bare metal result would be something along the lines of GenuineIntel or AuthenticAMD. It is not necessary to trap this instruction for security reasons like it is for instructions that poke hardware ports, but it is quite useful in the context of managing the guest's view of what it is running on. It is possible to disable trapping for some of these instructions. Section 2.7 of the technical documentation for Intel VT-x explains the different events that can be made to conditionally trigger a vmexit. Instructions that are sensitive are trapped unconditionally.
For securely managing a guest, rather than simply checking privilege level, the system checks if the instruction is running in virtualization context. The effect is the same (a more privileged context can overrule the decision of a less privileged one), but it is implemented using hardware virtualization technology rather than x86 protection rings in the TSS. This is why the hypervisor is said to be more privileged than ring 0, because even in ring 0, a guest can have its decision overruled by the hypervisor. Since lower rings mean more privilege, and ring 0 is the most privileged level, naturally this has lead to a context with even more privilege being nicknamed ring -1. The only purpose in that naming is to help people remember that ring 0 is not necessarily the most privileged context a task can run as.
Ring -2 and -3
There is also ring -2, for System Management Mode, or SMM (a special, highly privileged context which the CPU enters when a type of interrupt called an SMI occurs), and ring -3, for coprocessors that have a high level of control over the system (such as the Intel ME or AMD PSP). None of these are actually implemented as protection rings, and a ring -3 task isn't even running on the main CPU.


Why use a passphrase for RSA key? Today I generated my first key pair, so my knowledge here is - so to speak  - very limited.

On client side I am using Windows and to log in I use PuTTY and I used PuTTYGen to create the keys.

Here (https://winscp.net/eng/docs/ui_puttygen) they say:

  If you leave the passphrase fields blank, the key will be saved
  unencrypted. You should not do this without good reason; if you do,
  your private key file on disk will be all an attacker needs to gain
  access to any machine configured to accept that key. If you want to be
  able to passwordless log in without having to type a passphrase every
  time, you should consider using Pageant so that your decrypted key is
  only held in memory rather than on disk.

But here I am failing to see why I should even use RSA rather than regular password authentication when I need to use the passphrase. If I do a passphrase I still need to type in a password when logging in.

On a side I would ask a question about this part:

  Pageant so that your decrypted key is only held in memory rather than on disk

Does it really protect anything? I don't know how to read things from memory but isn't it a fairly common thing to do for hackers? To read/replace bits in memory?

You do not need a passphrase for your RSA key. But if your key gets compromised (for example, because you carry the key on a thumb drive and you lose it), an attacker could immediately access the assets the key is protecting.

Using a strong password will give you more time to change keys in case of a key compromise.

Related question on Superuser:

Do I need to have a passphrase for my SSH RSA key?


Event: ET SCAN Nmap NSE Heartbleed Request Last night I got this incident on my siem tool:

  Event: ET SCAN Nmap NSE Heartbleed Request.

Incident triggered from blacklisted IP to our open VPN server.

Clicking on the signature content it displayed:

  alert tcp any any -> $HOME_NET any (msg:"ET SCAN Nmap NSE Heartbleed
  Request"; flow:established,to_server; content:"|18 03|"; depth:2;
  byte_test:1,<,4,2; content:"|01|"; offset:5; depth:1;
  byte_test:2,>,2,3; byte_test:2,>,200,6; content:"|40 00|Nmap
  ssl-heartbleed"; fast_pattern:2,19; classtype:attempted-recon;
  sid:2021023; tag:session,5,packets; rev:1;)

Could someone help me on this signature? Is it really nmap scan or the heartbleed issue.

It is both.

NMAP contains a scripting engine that allows custom scripts, such as those that are used to detect vulnerabilities.

In your case, someone used the ssl-heartbleed script to see if an http server was vulnerable on port 443, and it was blocked.


Signatures for an antivirus When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against?

[ORIGINAL QUESTION]
MD5 has been used to detect malware for a long time. I know it is quiet outdated now due to several advanced techniques like polymorphism, changing of bits etc.,

But when one one use MD5 will it execute the malware to generate hash value?? it seems to me like it is executing the application on generating the hash value?

Recently, I found "finding a specific string" is the replacement for MD5 but with the knowledge in programming how to get the strigs in an executable or something?? Do antivirus has its own decompiler or something?

I am well aware of Heuristic and Sandbox technologies....

NOTE: This forum contains a 100's of question like this(e.g How to write AV signatures) but I find no answer for this ...

No. Unless there's a vulnerability in the File Stream reader (unlikely), you'll never be executing the malware in order to validate the hash. You are simply reading the contents of the executable to verify whether or not the MD5 hash is a match.

Reading is not the same as execution, and neither is writing.

Note that it's quite possible to fake the MD5 hash value because of collisions. This also doesn't help against an attacker that adds/renames methods in a virus program's source code, and who then recompiles the executable, thus producing an entirely different hash output.


Is the SSH last login message reliable or rather something easy to get tampered with? My client's Linux server recently got compromised by unknown means (highly likely because of a weak password). When I first logged into the compromised server I discovered the following:

The Log files were wiped
SSH last login IP still had my IP and date and not the intruder's
Following malicious code in a cron was found:

#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin
for i in `cat /proc/net/dev|grep:|awk -F {'print $1'}`; do ifconfig $i up& done
cp /lib/libudev.so /lib/libudev.so.6
/lib/libudev.so.6

I am doing a forensic investigation to find out what exploit was used and how the server was hacked. Current presumption is SSH password Bruteforce, but I have no evidence to prove it.

My questions would be:

Where is the SSH last login stored? Was it tampered with?
Why does the DDoS Virus maliciously deal with the libudev library?
Do you know exactly which virus this is? I've seen a couple of other questions containing this kind of code, but no answer which kind of DDoS virus exactly it is.
What does this code line do? for i in `cat /proc/net/dev|grep:|awk -F {'print $1'}`; do ifconfig $i up& done

Thank you for your time.

The last login information is stored in a log file. If the attacker has wiped or expurged other log files, it's likely that they've wiped this one as well.

Specifically the last login information comes from the wtmp file, typically located at /var/log/wtmp.

The crontab entry enumerates the available network interfaces and brings them up. It's a crude way of making it harder to disconnect the machine from the network.

The last two lines of the crontab script copy /lib/libudev.so to /lib/libudev.so.6
and then executes /lib/libudev.so.6. The current version of libudev is 1, so this file wouldn't interfere with the normal working of the system, but I guess it wouldn't immediately jump out as suspicious if you happened to notice it in a directory listing.

Understanding how the malware works is interesting, but it's unlikely to help you find how it got there.

What you've found is pretty crude and obvious, but there's probably other less obvious stuff as well. As usual, the only way to get a clean system is to nuke this one and start from scratch.


Implemented DMARC, getting reports of canonical.com sending spam - has Ubuntuone been hacked? I have implemented DMARC on my mailserver and for the first time I'm getting reports of an IP address trying to fake me as the email sender:

>record>
>row>
>source_ip>91.189.90.7>/source_ip>
>count>14>/count>
>policy_evaluated>
>disposition>reject>/disposition>
>dkim>fail>/dkim>
>spf>fail>/spf>
>/policy_evaluated>
>/row>
>identifiers>
>header_from>MYDOMAIN.EU>/header_from>
>/identifiers>
>auth_results>
>spf>
>domain>canonical.com>/domain>
>result>none>/result>
>/spf>
>dkim>
>domain>MYDOMAIN.EU>/domain>
>result>none>/result>
>/dkim>
>/auth_results>
>/record>

Now the odd thing is that this IP address belongs to canonical.com. And this has begun one day after I registered an account at Ubuntu One!

If I understand this correctly then the guys at Canonical have a client that has been hacked and that is trying to send spam. And it could even be that the hacked client has access to the database of newly registered users - else this wouldn't have happened one day after registering an Ubuntu One account.

If this is true then apparently Ubuntu One has been hacked, right?

Canonical is the parent company of Ubuntu, so yes there is likely a relationship between you registering your account there and getting this alert.

I doubt a hack is what is happening, but more likely a misconfigured email client that doesn't have your DKIM key (since you never gave it to them) and they are sending from an MFROM address that doesn't match your SPF record.

They probably invented some validation or mailing list software that doesn't play well with DMARC.


Does it make sense to log accepted traffic on firewall? Assuming a firewall is properly setup, only allowing determined traffic and dropping everything else, what relevant information (if any) could I get from the log of the accepted rules?

From the dropped packets log I can identify non-legitimate traffic, but don't know whether is there any use of the accepted packets log.

Logging accepted connections can be used for traceability. This is often used when an intrusion has been detected to check if the offending host has connected to other hosts within your network. This is actually more useful in larger network environment where there are multiple entry points into a network.


What servers or clients are immune to related-domain cookie attacks? (*.example.com) In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).

Lacking any tangible solution, could this mitigated by software that tracks and verifies each cookie's "type" and persists that.

Update:

The answer is that no current browser or technology is protected from these attacks.  Learn more here: https://stackoverflow.com/q/9636857/328397

I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).

That is simple: there are none. It's a basic part of the design of cookies that a.example.com gets to write cookies scoped to example.com, that will be picked up by b.example.com.

There are browser differences in what cookies ‘wins’ when the same name is defined at multiple levels, and there is a difference in IE vs the other browsers in that IE will scope a cookie set at a.example.com to *.a.example.com if it has no domain, whereas other browsers scope it to only the exact domain.

  Lacking any tangible solution, could this mitigated by software that tracks and verifies each cookie's "type" and persists that.

Not directly. There is no way to read the domain/path/etc options from a cookie.

All you can do is attempt to guess at what level the cookie was set, and try to verify that by deleting the cookie at that level (by settings expires in the past). If the cookie disappears, you guessed right; if it's still there, try a different domain/path combination.


Persistent exploits on "baremetal" cloud hosting services There are several cloud providers that offer "baremetal" hosting where tenants are allowed root-level access to the OS running directly on the hardware. What is the risk that a previous malicious tenant installed a firmware-based compromise that would grant them root-level access past reinstall when one of the kernel modules attempts to interact with that malicious hardware/firmware?

It is unlikely, but not impossible.

As previously mentioned, cloud hosting services use hypervisors to isolate VMs from each other (if there is more than one) and to isolate the VMs from the underlying OS and hardware.

Hypervisors, however, are not immune to vulnerabilities. Here is an example of vulnerabilities affecting Xen (a popular hypervisor). Not all vulnerabilities allows an attacker to break out from the hypervisor, but it happens.

Let us consider an attacker that successfully escalated its privileges to hypervisor level. In addition, the attacker needs to find vulnerabilities to insert a backdoor/implant in the firmware itself. Again, this is unlikely, but not impossible. It is possible that the firmware integrity is not verified at boot time or during an update. It is also possible that the firmware vendor did not respect the specification or that there is a vulnerability.

The combination of successfully finding and exploiting vulnerabilities in a hypervisor and firmware is low, but not impossible.

Knowing if such risk is worth considering depends on your threat model.
For example, it is worth considering in the case of a highly motivated and resourceful attacker.

One would still argue that it would be simpler for the attacker to use another vector. For example, a phishing campaign targeting the cloud provider employees?


XSS: Code payload gets displayed on the screen as a string I am new to security and trying to improve.
Sometimes when I try to find XSS vulnerabilities on a website my payload just get displayed on the screen but nothing happens.
The whole payload just gets displayed as a string.
What does this mean?

I saw that just below that the form often there is a hidden input field with some token. Does the payload just get displayed because it's first encrypted to that token and not sent? Or am I completely wrong?

This is an example, why are the italic tags just considered as a string and not as real HTML tags?

The Inputs are escaped.

In php there is a function for this:

htmlentities($str, ENT_QUOTES);

source: http://php.net/manual/de/function.htmlentities.php


Affected by Marlboro Ransomware (".oops" extension) - Which decryptor to use to decrypt the files? My friend got infected by "Marlboro" Ransomware (description of the nasty thing: http://sensorstechforum.com/marlboro-ransomware-remove-restore-oops-files/).

I have researched online, and a way to clean the ransomware is to have a thorough scan with any Anti Malware software (I am currently doing that with Malware Bytes) and restore / decrypt the files. Since there were no restore points, hence no history, I have to use the decryptor.

I have found that Kaspersky has a list of usable programs, but I couldn't find the one matching the "Marlboro" ransomware: https://noransom.kaspersky.com/

Would any of these decryptors help me recover my files?

This one has this kind of encryption: RSA-2048 combined with AES-128.

You can use the decrypter available here:

https://decrypter.emsisoft.com/marlboro

I am the author of said tool. Yes, I did see the answer above. However, I can't comment because of lack of reputation. To address what has been said:

The decrypter doesn't need an internet connection or the infected machine. So feel free to run it in a VM with no internet access or disconnect the network cable. If for some reason it doesn't work, please let me know.

Also due to a bug inside the malware, it will truncate up to 7 bytes from the files. There is no way for me to restore those. So some files may not work, depending on how sensitive the file format is to having some bytes missing at the end.

Regarding our reputation:

The decrypter is EV signed. Meaning, we went through the extended verification of the CA so the identity of the company has been thoroughly verified. Whether you want to trust that, is up to you. We have released a tonne of decrypters (as can be seen on https://decrypter.emsisoft.com), cooperate with law enforcement agencies in the No More Ransom project, take part in various reputable AV comparison tests (AV Test, AV Comparatives) and are a Microsoft anti-virus partner.

If you run into any issues, feel free to let me know or shoot me a message :)


How to prevent email discovery in forms? Being on the company security email list, I get emails with some regularity complaining about email discovery on various forms on my employers website. The reporters are complaining about things like our login form returning a specific message like "You password is incorrect." rather than "The email/password provided are incorrect." This lets possible attackers know that a certain email address is in use for an account.

I understand the issue here, and it's easy to change the messaging for a login or account recovery form. However, what can I do about a signup form. We only want one account for any given email address. I've looked at some other popular online services and their signup forms specifically tell you that the email address is in use.

Is there just no way around this? If that's the case, should I really pay any heed to the people complaining about email discovery on the login form?

This can be solved by implementing an out of band message.

To solve this issue I would have a form which can be used for two purposes:

Account recovery.
New user sign up.

The single field on this form is Email address. Of course you can use different text depending on whether the user wanted to recover their account or sign up, but the way it works will be the same.

Once the user has entered their email address and clicked Next, the same response will be shown for any address entered. Something similar to Thank you, please check your email account for the provided address.

The "out of band" message sent their email address will either say Please follow the link to recover your account or Please follow the link to sign up to our service and will contain the appropriate links which will include a time-limited token to allow the user to recover their account or sign up as necessary. The only thing that determines the text of this message is whether an account exists for their email address within the system, it does not matter if the user followed the account recovery or new user sign up links. As they should be the only user that can read their email, this should prevent username enumeration.  The token will be associated to the provided email which will stop the user then attempting to sign up using a different address, or to reset the password of any other account. This also has the effect of validating the email account for new sign ups.


Password managers, how do they get the credentials when you press enter? I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site.
I mean I am not first putting them into the password manager's (PM) interface, but as soon as you enter the credentials and press enter in any website somehow they are already sent to the PM and ready to be saved when you accept. Can javascript have that much access? How?

Well it's simple, in web whenever a page is created for login or for signup there  are few things that kept in mind.

1-The user input is taken in forms. <form>...<form>

2-Variables are created to take your input,that depends on what are the rules for inputs.

3-In web a tag <input type="password" class="inputtext" name="pass" id="pass" data-testid="royal_pass"> in this snippet the  type = "password"
tells you are going to enter password

So whenever you are going to fill a login page the browser detects and asks you to save the password.Then Browser checks for username, the tag is also used for user name. Basically you can say that input works as a variable, whose name is "pass" to take your input and proceed.


Is it safe to accept a file upload without any file extension? Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and server side to only accept common data suffixes like .txt and .csv and so on.

We have now discovered that some data files which we get sent don't have any file extension at all.

These files are not executed by the processes after upload: they are parsed for text patterns. So having unverified files up on the server does not - theoretically - present a big security risk. The data being processed, however, is personal data covered by data protection law, so a breach would be catastrophic.

Is it safe to allow users to upload files without extensions is this instance? And, as a wider question, is it ever good practice to allow a site to permit these files?

The extension itself should not matter. It would be good to figure out the MIME type to know about the content instead.

In terms of security risks in terms of file uploads, please see also https://www.owasp.org/index.php/Unrestricted_File_Upload


How do hackers intercept packets I understand that if you are typing in sensitive info on a non SSL site, you can view that info in plain text, or at best hashed when those packets are captured.

In fact, I've gone as far as to brute force the md5 hash of a password I entered into a non encrypted page and was able to retrieve the string of that hash. So, I can understand most of that.

What I cannot find information on, is how do hackers gain access to these packets in the first place? I know that in an insecure wifi, it behaves like a hub and so with the right tools, you may capture ALL packets in range. But on a wired network, it seems the attacker would have to have control over the router, put a bump on the line, or perform arp poisoning, dns exploits etc... But is there a go-to method? How would a hacker intercept your data from outside of your lan?

Can someone explain the most common methodologies? thanks

You are correct about listening to all broadcasts on a wireless network.  In a wired network (modern network with packet switching without hubs), the big threat is Man in the Middle (MitM).  This can be done on the local network using Layer 2 MitM attacks like ARP Poisoning, and Layer 3 MitM attacks like HSRP or STP hijacking.  The former involves spoofing MAC addresses to inject a malicious computer between your computer and the default gateway, and the latter involves exploiting weakly configured routing/switching protocols to force all network traffic through a hacker's device.  On a grand scale, MitM can also be done by hijacking entire WAN segments by broadcasting a more specific BGP segment to neighboring BGP routers, or more covertly by nation states (think NSA) placing sniffers in telecom hubs.  The key overall is MitM.

In addition, there are more targeted attacks against a particular network by physically splicing into a network connection using a device like the Throwing Star LAN Tap.


Wireshark Gratuitous ARP I'm playing around with scapy and wireshark and I have sent a packet to a destination that does not exist (10.0.2.14). Wireshark shows an ARP attempt to resolve the address but as its not there the ICMP packet sends to 10.0.2.14 anyway (what happens here? is it forwarded to the gateway and left for the gateway to discard after the TTL runs out?) The final packet has a description of Gratuitous ARP for 10.0.2.2 (source IP). I do not understand what gratuitous ARP is trying to do.

A gratuitous ARP is basically an ARP response that never had a request for it and is how most ARP spoofing programs work.

Normally you send an ARP request and wait for the ARP response. A gratuitous ARP is when you just send your details even though there was no request. These can happen legitimately when say your IP or MAC address change so you can update the ARP tables of other hosts.

When you send an ARP request to 10.0.2.14 and receive no response you're basically saying "oh well I didn't get a response so here are my details for you to get in touch with me" and sending the gratuitous ARP.


Content Security Policy I'm trying to implement CSP on my site and after some research I saw that most of the sites don't implement it or the implementation is very weak.
I also see that the implementation of the CSP is similar to HSTS and you need to insert some CSP tags for its implementation.
So my questions are :

Is CSP a minimal requirement for security on web poages?
What is the impact of CSP on SEO?

It is of course possible to run a secure website without having a Content-Security-Policy.  There are, however, some reasons it makes sense:

First, if you configure it reasonably strictly, it's possible to make certain security problems, like cross-site scripting attacks, harder or nearly impossible.  This does typically require eliminating inline scripts and restricting external scripts to load only from trusted domains.
If you host user-generated content, such as user-generated SVGs, you may want to avoid that content from being used as a source of scripts or a generalized attack platform.  Since documents (including SVGs) loaded from a domain with a suitable CSP won't be able to use JavaScript, you may feel more comfortable hosting them.
You can also, more generally, require your pages to only function over HTTPS, since a robust CSP header will reject non-secure origins for loading external resources.  Thus, a page accidentally loaded over HTTP would be devoid of images, scripts, and functional forms.  While this would be a bad user experience, you'd at least avoid a lot of security problems in such a case.

I would say that now, in 2021, adding one is a best practice.  Many sites do not, but because CSP headers do provide defense in depth for a wide variety of problems, it would be prudent to add one.  I have no knowledge or interest in SEO and so couldn't speak to it, even it were on topic.


JWT authentication or cookies? I am currently creating a login system for my website. To secure the login service, should I use JSON Web Tokens and HTML5 storage, or should I use use the older way of using cookies? Are any of theses options secure or is there a better way of securing my system?

Also, if I do use JWT or cookies, what would be the most secure way of authenticating users?

Please note: This site is only going to have a small number of users as it is a personal site.

Reasons to pick JWT:

Does not require the server to keep a state, i.e. no need for costy lookup on every request.
Easier to share authorisation across different domains.

Reasons to pick session cookies:

Easier to implement in many languages and frameworks (e.g. PHP).
Instant revocation of authorisation, e.g. logging a user out, is possible. Even with a more complex two token system revocation is not instant if you use JWT.

When doing something simpe for a few users in PHP, you do not need the benefits of the JWT. Given that PHP comes with an existing implementation of sessions, I would just use that to avoid unnecesarry complexity. But for a different project with different needs the answer can be different.


How to test DOS attacks through Router? One of my clients has been told by their ISP that a DoS attack has happened and they have provided the logs of Juniper router. What is the criteria in routers on which we can confirm DoS attack is happening/occurred?

Any article or data to show some light on finding attacks through routers?
Log basically says:

Nov  5 12:24:42 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset:
 209.95.32.62/20443->xx.xx.xx.xx/50544 None
 209.95.32.62/20443->xx.xx.xx.xx/50544 None
 None 17 1000 Trust Trust 336106 0(0) 0(0) 1 UNKNOWN UNKNOWN N/A(N/A) ge-2/0/21.0

You probably mean to include DDoS attacks (Distributed Denial of Service) rather than DoS attacks which could technically be a single packet (think Ping of Death).

None the less the criteria you are asking about is slightly different from provider to provider but a few things which are easily tracked by these devices are the following:

1.) Seeing systems suddenly generate large bursts of traffic, above 10,000 packet per second is a good rule of thumb.

2.) Seeing large numbers of packets leaving a customers network with falsified source IP addresses. In theory this would be blocked by egress rules but it does happen.

3.) Large amounts of intentionally malicious traffic. SYN Flood attacks, UDP Flood attacks, DNS Amplification attacks, Bulk SNMP requests sent from a "target" host.

4.) Large amounts of intentionally fragmented packets.

Cisco, a large commercial routing manufacturer, has a document which may also give you more insight into what can be detected.

http://www.cisco.com/web/about/security/intelligence/guide_ddos_defense.html

Wikipedia has a really useful entry on Denial of Service Attacks that also mentions a lot of the network traffic you will want to look for.

https://en.wikipedia.org/wiki/Denial-of-service_attack

Finally the following paper may also be useful

http://mallikarjunainfosys.com/IEEE-PAPERS-2013-14/Bandwidth%20Distributed%20Denial%20of%20Service/Bandwidth%20Distributed%20Denial%20of%20Service.pdf


Is it a good idea to sign into your Android TV using your regular google account? So just got an Android TV box and I realized that I have to sign in. Was just wondering if it's a good idea to sign in using my regular google account which contains all my files in Google Drive, my emails in Gmail, my location history in Maps and basically all my online data.

My main concern is that a TV isn't like a phone. It's supposed to be used by not just me. There's no passcode or security.

I know there's no Gmail or Google Drive app. Does that mean that this data is not available on Android TV? Is it possible for someone to create an email client app that can connect to the gmail of the currently logged in user?

The Google Slides app is compatible with my Android TV -
https://play.google.com/store/apps/details?id=com.google.android.apps.docs.editors.slides&hl=en_GB

From memory I believe I can install apps without a password. I believe even changing Google Play to require authentication for purchases will not enforce this for free applications.

So yes - it is possible to access google data via applications.

If this is not desirable then you either need to use a different Google account or use something like AppLock to restrict access to Google Play and any other applications with permissions you aren't happy sharing with other TV users.


What vulnerabilities other than directory traversal come under IDOR? The most common vulnerability in the OWASP category Insecure direct object reference is directory traversal.  What are the other vulnerabilities which fall into this category?

It's important to understand why OWASP classifies directory traversal as IDOR: The parameter that is accepted by the application is a direct reference to a file (instead of an indirect reference which for example points to a database entry, which in turn points to a file). By passing a different direct reference, an attacker can read arbitrary files.

CWE - which is more fine-grained than the OWASP Top 10 - for example uses a different classification:

  The "Insecure Direct Object Reference" term, as described in the OWASP Top Ten, is broader than this CWE because it also covers path traversal (CWE-22). Within the context of vulnerability theory, there is a similarity between the OWASP concept and CWE-706: Use of Incorrectly-Resolved Name or Reference.

Some would classify open redirects as IDOR (although OWASP doesn't as it's covered under Unvalidated Redirects and Forwards)

IODR is basically an authorization problem.

The most common other example is a direct reference to database indices. For example, you have a functionality which shows private message:

id = [userinput];
message = getMessage(id);
showMessage(message);

function getMessage(id) {
    return query("SELECT message FROM messages WHERE id = ?", id);
}

The idea is that each user can only read their own messages. But because the ids are direct references to the message, and because there is no authorization check, an attacker can read messages of all users. Note that proper authorization alone would fix the problem, but so would using indirect references (ie each user has messages with id 1 to x, so there is no possibility of accessing other messages).


How to prove some server sent some file over HTTPS I want to prove that some file I retrieved using HTTPS was indeed sent
by the server.  I tried searching online, but I didn't find what I
want.

How to easily prove that some HTTPS server sent some file?  It should
not require special permissions and preferably be done with only
well-known free software.  The proof should be valid as long as the
server's certificate is valid.  The proof should be able to be
validated without internet access.

An example is that the contents of a web page depends on the
geographical location of the client.  It's something funny when
requested from my IP address such as this
one.  I want to show it to someone else.  If I
give him the link, he won't get the same page.  If I give him the page
retrieved from my computer, he'll think I have changed the page.
Fortunately, the page is retrieved from the server using HTTPS.  If
the connection uses a key exchange algorithm in which the server signs
the random bytes in ClientHello and ServerHello, I can show him the
traffic between the server and my computer.  Then he'll believe it's
indeed that server which has sent me the page, because only a server
that has the private key to the certificate can sign the random bytes.

Or how to easily prove the authenticity of an SSL server to someone
else?

I assume you want cryptographic proof that the server really sent this exact response. If the server signed the TLS response with the private key, for example, this would give proof that the server really sent this response.

Unfortunately, this is not what happens with TLS. The server signs something (the ServerKeyExchange message) or the client encrypts something (the premaster secret) to proof that the server knows the private key. After that, the master secret is determined by both client and server and they use symmetric encryption for the communication. You could store this to show to someone else later, but you can just as well decrypt it and change it, so it wouldn't be much evidence that it is really what you received from the server.


If a website filters out XSS-related terms, is it still potentially vulnerable? For example, say there is a website where the user input is not properly sanitized, but these filters are still active. Anything typed is inserted into between two div tags.

If the input is "hello", it shows up in the source as "
hello
"

Tags also work. If the input is "

So, my question is, would this website still be vulnerable to cross-site scripting, or is it safe due to the filter it uses?

It's not safe. You didn't fully describe your filtering mechanism, but a blacklist-based XSS filter is guaranteed to leave some loopholes.

Examples

Do you consider the href attribute of link tags? A click on this link would trigger:

Click me

If you filter out javascript:, are your checks case-insensitive?

Click me

And do you consider different ways of encoding? E.g.:

Click me

Do you consider frames? It's certainly not enough to filter out javascript: since an attacker could also use other schemes, e.g.:

If you're thinking that the ">

Again, there are many ways to encode this, e.g.:

The list goes on. (What about SVGs, forms, meta tags, obscure vendor-specific protocols, embedded flash applets, CSS, ... ?)

The correct approach is to use a whitelist of allowed tags and attributes, and parsing the resulting DOM tree instead of regex-based string replacements.


Query on IPS reports In the IPS reports i see multiple counts of the same exploit from the same source ip. I wonder why would someone continue to attempt exploiting a vulnerability when he must have realized in the first attempt only that the exploit was blocked?

I would guess that this is an automated attack which does not have too much intelligence built-in. A sign of an automated script would be other (possibly unrelated) attempts from the same IP.


How does a CA send a digital certificate? I would like to know after approving the Certificate signing request, does the Certificate Authority send the Digital certificate to the applicant by converting the digital certificate to PEM format and sending it as a .crt file via email or does it send the digital certificate in some other way?

There is a standard for exchanging messages with CA, but it is rarely implemented in practice. Existing commercial CA that deal with many remote customers tend to organize the certificate issuance process through some custom interface (often Web-based) and the certificate-sending is part of that process. Various methods are used in practice, possibly combined:

Sending the certificate over email.
Make the certificate available to the user over HTTP (the URL being displayed in some Web page, or even sent by email).
A custom protocol between the CA and a CA-controlled component that runs on the user machine (Applet, ActiveX control, full-blown "management console" application...).
Any "manual transfer" protocol in some specific situations (e.g. when an offline root CA issues a certificate for an intermediate CA, the transfer must involve something like a USB key, since the root CA is offline).

The certificate itself is commonly encoded "as is" (X.509 DER, or PEM), or wrapped into a so-called PKCS#7 (CMS) object. CMS was never meant to convey certificates (it is an encryption and signature format) but it is traditional to use it to send a certificate and a set of "helper certificates" (intermediate CA for its validation).

Some CA generate the private key themselves (on the CA side), and, in that case, the private key must be sent to the requester; usually, a PKCS#12 (aka PFX) archive is used to contain both the certificate and the private key, with password protection (password-based encryption).

Since a certificate is signed and contains only public data, its integrity is readily verified upon reception, and it how it travels is unimportant for security. This is the main good thing about certificates.


Can the numbers on RSA SecurID tokens be predicted? My workplace uses these SecurID tokens which provide you with a temporary password, the code will expire after a short time.  I have always been fascinated by the things, because it seems as though all the logic to calculate the next number must be physically located inside the device.

Given physical access to the token, is it possible to predict the numbers? How?
Without physical access, is it theoretically possible to predict future numbers from previous numbers, with or without knowledge of the seed?

*I'm not attempting to crack it, just interested out of mathematical curiousity!

What SecurID tokens do is not completely public knowledge; RSA (the company) is quite wont on releasing details. What can be inferred is the following:

Each device embeds a seed. Each seed is specific to a device.
The seed of a device can be deterministically computed from a master seed and the device serial number. The serial number is printed on the device. This computation uses cryptographic one-way functions so you cannot guess the master seed from a device seed.
From the device seed and an internal clock, the number is computed, yet again with a cryptographic one-way function.
The derivation algorithms have been leaked, if only because the verification servers must also run the same algorithm, so these algorithms exist as concrete software in various places; leaking and reverse-engineering are mostly unavoidable in these conditions.

Under these assumptions, then:

If you know the device seed, then you can compute future numbers at will.
If you know the master seed and the device serial number, you can compute the device seed.
Knowing seeds from other devices should gain you nothing into guessing the seed for a given device, unless the cryptographic one-way function which turns the master seed into device seeds has been botched up somehow.
Knowing past numbers from a token should gain you nothing into guessing the future numbers from the same device, unless the cryptographic one-way function which turns the device seed into numbers has been botched up somehow.
Extracting the device seed from the physical device itself is theoretically feasible but expensive, because the device is tamper-resistant: it is armored and full of sensors, and will commit electronic suicide if it detects any breach. If we take the example of smartcards, extraction of the device seed is likely to cost several thousands of dollars, and be destructive to the device (so you cannot do it discreetly).

On March 2011, some systems have been compromised in RSA, and it seems probable that the attackers manage to steal one or a few master seeds (it is plausible that the devices are built in "families" so there are several master seeds). RSA has stated that 40 millions SecurID tokens must be replaced. If you know the serial number of a token (it may be printed on the outside of the token), you can use the Cain & Abel tool that @dls points to; presumably, that tool implements the leaked algorithm and master seed(s), and can thus produce the future token outputs (I have not tried it). This would work only with servers which still accept the tokens from the 40-million batch which is to be replaced. I do not know how far RSA and its customers have gone in this process, so it may be that this attack will not work anymore. It really depends on the reactivity of the people who manage server you attack.

(If these system administrators have not replaced the compromised devices after nine months, then chances are that they are quite lax on security issues, and the server may have quite a few other remotely exploitable security holes.)


Prevent an application from making any network access on macOS I want to run an application on macOS, but preventing it from making any type of network access, or any type of internet access.

I have seen the following possibilities:

Use the built-in firewall. Unfortunately, this blocks only inbound connections, not outbound.
I have seen Little Snitch. However, it feels uncomfortable from a security standpoint to install a closed-source software on my system that has so deep an access to everything I do.

Ideally, I would like to do that myself. Is it possible to restrict an app's access to network ressources on macOS ? Maybe start it in a sandbox mode somehow?

Thanks!

You can use sandbox-exec

Usage: sandbox-exec -n no-network someProgram


API Design Model - Client Side Encryption I'm currently designing a API Model to use. A user will have a 'secret_api_key' and a 'public_api_key'. They will send a request to my server with the public key, the form data, and then a hash. The hash is the form data encrypted with the 'secret_api_key'.

This is so that the server will recreate this hash since it knows the 'secret_api_key' and if the hashes are the same then accept the request, else deny it.

My problem is, if someone were to do this using JavaScript then they would have to encrypt this 'on the go' in the browser meaning they will need the 'secret_api_key' to hash it all. But the 'secret_api_key' is meant to be kept away from public eyes, so anyone would be able to look at the script and see the secret key.

Is this a wrong way of doing it? I honestly can't think of a way that you would be able to use my API within a browser using JavaScript (Which would be the main method in which people would use my API)

I know with OAuth you get a 'access_token' which you just send with a request, surely someone could use a traffic sniffer and resend requests with the same access token? Or does OAuth working differently?

Any help or suggestions would be much appreciated.

Thank you.

You would need a session level key that could be given to the non-trusted javascript.  Basically a site running the API would need to have the ability to request an individual session for each of the users from their API key and then the user's session would have to use that key.  This allows the trust to be maintained between you and the server hosting content while also allowing the user to perform operations based on the server's key without divulging it.


Detection for corruption in HTTP and FTP How is data downloaded via HTTP or FTP checked for corruption?

I know that TCP provides a 16-bit checksum field in its header, which is used for checking. Also torrents use a more powerful checksum method, MD5 or (not sure) CRC32.

At first I thought HTTP implemented CRC, because as far as I know it is low cost and 'great' for networking (detecting accidental changes), but I couldn't find anything on this topic.

So how do FTP and HTTP ensure that data is not corrupt?

I am aware that data corruption can happen during saving of the file.

How is data downloaded from HTTP or FTP get checked for corruption?

By itself, not  at all.

HTTP and FTP as protocols don't offer integrity¹.

However, HTTP and FTP are usually used atop of TCP/IP, which both have checksums in their transports – if a TCP checksum fails, your operating system will just discard the TCP packet and ask for it again. So there's no need for HTTP to even implement integrity checking.

When tunneling anything (including HTTP and FTP) over TLS, you get an additional layer of integrity checks.

  So how does FTP and HTTP ensure that data is not corrupt?

They don't. It's usually the transport's job to guarantee integrity, not the job of the application protocol.

 ¹ there is an optional header in HTTP1.1 that allows the server to specify a checksum, but since that is practically impossible for resources generated on the fly and comes at high cost for large files, and has little advantage over  the much more fine-granular TCP-checksuming, it's rarely used. I don't even know whether browsers commonly support it.

I'd like to add here that it's of course harder to cause a collision within MD5 (which is used in these headers) than to forge TCP packes, if you'd want to intentionally modify the transfer. But if that is your attacking scenario, TLS is the answer, not HTTP checksums.