What protection measures are required in Android in-app billing for non-consumable products? The application is an Android client for a remote service on which all users have accounts and can make purchases of non-consumable items. Each purchase is tied to the account they were purchased on. The current purchase scheme is as follows:

The client initiates the purchase with the Google Play in-app billing service. The purchase request contains the payload which uniquely identifies the account.
When the purchase is successfully completed, the client gets back the purchase data which contains the payload and the purchase token. Also it has a signature for the received data which is currently not checked though.
The client sends the purchase token to the server. At this point it has to be authenticated.
The server receives the purchase token. The server authenticates with the Google Play service using its service account key and receives the purchase data for the given token. The data contains the original payload and the information regarding the purchase.
The server validates the purchase data: it is verified that the payload matches the currently logged in user id, the purchase is not yet consumed, and has successfully been paid for.
If the verification is successful, it is marked that the client has purchased the product on the server and the client receives a confirmation, otherwise the client receives a rejection.

What could go wrong with this scheme? For instance, it worries me that the signature is not used anywhere. However, I don't see what use is in it if the server receives the data directly from Google Play. At worst, it can receive a wrong token, but the payload contains the user id, so the purchase will be rejected if it has been made for another account. Sending the same token twice is also useless since the product is non-consumable: it either has been purchased or hasn't. But maybe I'm missing something here or there is some other flaw I don't see?

You are right, I do not see any problem in this scheme either. If Google starts lying to your server about fictive purchases I doubt a signature would help, as at that point you'd need to completely switch payment providers.


Can I generate a random 32 bit key by using the Java hashCode and random English words? I want to generate and communicate a 32 bit key to Bob over a phone conversation.  I know he happens to have the same Java and OS installed as I have.

Suppose I have a dictionary of 100,000 (English) words.  Can I uniformly at random pick two words, concatenate them and thus run hashCode(word1 + word2) without loss of entropy so that he can easily generate the same code?

As a follow-up question, can I then, if I want a 64 bit key simply pick four words and concatenate the keys hashCode(word1 + word2) with hashCode(word3 + word4) etc.?

Edit: Ps: 100,0002 > 232 if my math is right.

In short words: it won't work well.

In longer words: Java's String.hashCode() method has biases; it works by repeatedly multiplying a running state by 31, then adding the numerical value of the next character. Letter usage in English is biased, groups of letters are biased, and these will show up. In other words, you lose some entropy.

Arguably, going through a list of words is a very weird thing to do. To choose a random word in a list of 100000 words, you must have a way to uniformly obtain a number in the 0 to 99999 range. Why, oh why, would you not use that value directly ? Why turn numbers into words, then hope that the hashCode() method will turn them back to numbers without losing too much entropy in the process, instead of just using the numbers directly ?

If you can generate a uniform integer in the 0..65535 range, then... that's it. You have a perfectly fine random 16-bit integer. Generate two of them, shift one of them by 16 bits, combine with bitwise OR (or with an addition), and you're done.

Also, a 32-bit key is atrociously weak, by nature, since it can have only 232 possible values, whose exhaustive enumeration is a piece of cake for a not-so-powerful PC. These beasts count time in gigahertz.


Could encryption become a security breach? So, I was skimming though this SANS research about skype
. Long story short, it says :

  Skype uses
  standard
  cryptographic primitives to achieve strong end-to-end encryption (Berson, 2005)........encrypting traffic prevents intrusion detection systems and firewalls from inspecting the contents of the traffic (Fawcett, 2012)........there is a significant risk of data exfiltration via Skype traffic or more importantly, traffic that simply mimics the characteristics of Skype communication.....

There goes my question : Lets say the attacker is not yet inside the target network but he knows that the target network is using encrypted traffic like skype does, or even HTTPS, SFTP, etc... Could he use the fact that technical control (IDS, Firewall...) won't block encrypted traffic as a vector to get inside the network ? i.e later he could leverage from that and harm the target system (since he got into a part of that system that needs encrytion....could he just then wander around the system...)

IMHO these are two separate things. IDS and FW protects on different layers and if you do not have layered security on your network or services this network is serving the attacker could harm it.

Short example: you have a network where you have an application server which serves a web application for checking the DNS information (nslookup). If this application is not designed in a secured way attacker can create such a content that will give access to i.e. /etc/passwd file.

Summarizing - it is possible.


Is the installed certificate used for school wifi able to track me at home? I've read similar questions being answered on the safety and privacy of school wifi certificates but my question on whether they can still track me at home stands. I'm using my own computer (not school's) but the certificate I installed in order to use wifi seems a bit fishy.

This is the BYOD programme we're using: https://cyberhound.com/byod/.

Is this a certificate to simply access my school's wifi or do they have full control outside of school on my home internet?

The certificate is one part of the whole system. The other part is the school router which should be CyberHound Appliance.

When your browser connects with a site with https, the flow goes roughly like this:

Browser initiates connection with the server
Server returns its own certificate and a chain of certificates reaching up to a well known Certificate Authority (CA)
You browser checks the server's certificate is valid, and the chain of certificates reach to a CA that it already trusts.
If the chain of certificates does not reach to a CA that your browser already trusts, it will show you a warning that your connection is not secure

When you install the Cyberhound certificate, you are adding to the list of trusted root Certificate Authorities.

This means Cyberhound appliance can now do following:

When your browser makes an https connection to any server, cyber hound will intercept the request and generate a certificate for that server signed by its own root CA
Your browser will receive a certificate from Cyberhound appliance instead of the actual server you were trying to use. As the browser on your computer already trusts the cyber hound root CA, it will trust the certificate
Now Cyberhound appliance will be able to decrypt the communication between your browser and target server. It may log your activity and enforce other school policies.

As you see the certificate and the router (appliance) work together to intercept your https communication. So unless your home network is also being intercepted by a router that has access to Cyberhound private keys, you home internet usage can not be monitored by your school or Cyberhound.

TL;DR: You home internet connection can not be monitored just because the certificate is installed on your computer. There must be a router on your network with access to Cyberhound private keys to generate the certificates in order to intercept the communication.

Note: I have left some details out to keep the answer easier to understand.


As a user, is using MD5-encrypted passwords on websites a good practice? Disclaimer: This is from a user standpoint. We'll thus assume the target website (say, Paypal or Netflix) already uses a strong hashing algorithm with salts (bcrypt of pbkdf2, for example) and accepts 32-char-long passwords.

Context: let's assume Bob is a user who knows a few things about computers, but isn't an expert. For example, he understands that using strong passwords is a good thing, but he can't remember a long list of complicated passwords. He thus uses only one strong password on all sites, a practice he considers to be risky.

But then it hit him: he doesn't have to remember strong passwords! Instead, he can just remember easy ones and hash them with a simple function to get strong passwords. That way, he doesn't have to worry about database breaches too much, as his stored password would require massive GPU clusters to get cracked in a reasonable amount of time.

This would work this way:

Go to target website.
Enter username
Hash his easy-to-remember password with a fast algorithm to generate a long password
Enter hashed password and get authenticated by the website.

Question: Would this be a good, or even acceptable practice? Is this something you could advise someone to do? Why/why not?

This relies a bit on a variant of security through obscurity perhaps: the hacker only has to know a simple password was MD5-encrypted to render this uneffective, or even harmful (because the user will tend to use weaker pre-encryption passwords). As such, this wouldn't work on a large scale, ie. you couldn't tell millions of people to do that.

Thanks in advance for your input!

There's no question that this extra MD5 layer is better than just using the original password.

The question is whether you'd be better off using a Password Manager which simply generates random passwords and stores them in encrypted form.

I do see the elegance of your solution over a Password Manager.

Since the final password is derived, not stored, then your solution is portable. There is no need to sync passwords over the internet for multiple devices.
The 'easy to remember' password unlocks the 'actual' password for just one site. This seems better than using a 'single' Master Password to unlock the 'actual' password for any site as a password manager would normally operate.

From a server-side breach perspective, this is such an unusual (Obscure) practice that the attackers will go to easier targets.

However, it is true that a truly random password (from a Password Manager) would be more secure than one from a simple MD5 hash.

I would suggest you extend your solution somewhat.

Use a stronger hash, not MD5. Probably you should use PBKDF2, but you could be using SHA-256 or SHA-1 if it is easier for you. Stronger also means slower. So if you use a fast hash, you should add repetition. (number of Rounds)
Add some Pepper, which is stored with your hashing program, and has about 72 bits of entropy.

Input this same Pepper, and number of Rounds for the hash algorithm on all your devices, so they all can generate the same passwords. Also keep it in a file somewhere so you can always re-produce your hashing scheme should you lose the electronic copy.

vs a Password Manager

You have no Master Password, so there is no 100% loss when that password is stolen along with your device data.
If your device data is stolen, the Pepper is immediately compromised because it is stored in plain form. However, they still have to guess your 'easy to remember' password.

There will be some obstacles regarding password strength requirements. A Password Manager could store a different style password to fit the particular requirement, but your hash program will operate the same for all sites.

Tweak your hashing program to produce an uppercase letter, lowercase letter, number and some special character. This will fit the needs of most password strength requirements out there.
It might be necessary to truncate the resulting hash as some sites have a max-length. This is not a big problem. If you only take the first 20 characters of the resulting hash, the strength is not diminished. Only when you get down to about 72 bits of entropy (18 hex chars or 12 Base64) does truncation become a notable weakness.


Is an encrypted .dmg file decrypted on the dropbox server? I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox.  To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox.

My understanding is that when I open (decrypt) this volume, it mounts at /Volumes and the decrypted information is never visible to the Dropbox server.  Is this true?

Yes, as long as you are mounting using diskutil and not decrypting to the current working directory.

This is because the decryption is happening on the fly based on the data in the image when a encrypted image is mounted.

Please note that modifying any data in the mounted, encrypted dmg will re-encrypt the dmg to contain the changes such that Dropbox will think it has changed. This might lead to a lot of re-uploading, since ~/Dropbox is usually watched for changes and any changes instantly uploaded by the Dropbox app.

Please also note that for Dropbox, this is just a big ball of data that changes - as the dmg is chunked into 8 MiBiBytes chunks, a small change thus may lead to 8 MiBiBytes reuploading. Which is basically a good thing, security-wise, but might be unexpected and/or undesired in terms of bandwidth use.

I am unsure as to how Dropbox identifies what has to be uploaded with dmg files. Using diff may work but seems unlikely as there would have to be a shadow copy of every file for diffing - and dmgs might get big :)


Is it possible to brute force all 8 character passwords in an offline attack? This article states:

  Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.

There are 6.63 quadrillion possible 8 character passwords that could be generated using the 94 numbers, letters, and symbols that can be typed on my keyboard.  I'm skeptical that that many password combinations could actually be tested.  Is it really possible to test that many possibilities in a less than a year in this day and age?

As per this link, with speed of 1,000,000,000 Passwords/sec, cracking a 8 character password composed using 96 characters takes 83.5 days. Research presented at Password^12 in Norway shows that 8 character NTLM passwords are no longer safe. They can be cracked in 6 hours on machine which cost ~$8000 in 2012.

One important thing to consider is which algorithm is used to create these hashes (assuming you are talking about hashed passwords). If some computationally intensive algorithm is used, then the rate of password cracking can be reduced significantly. In the link above, author highlights that "the new cluster, even with its four-fold increase in speed, can make only 71,000 guesses against Bcrypt and 364,000 guesses against SHA512crypt."


Is there a crypto system which detects decryption somewhere between sender and receiver? I was wondering if there exists (or if it could be created) a cryptographic system in which a message is encrypted and sent from A to B, and some nodes in the middle could intercept and decrypt the message (having been given a key for that) but in such a way that when B receives the message, he knows who has read it before it got to him.

In other words, I'm looking for a read (and even write, if possible) access log for the message. All cryptographic techniques (authentication, certificates, PKI, ...) and metadata are allowed.

No system currently exists that does what you need.  The reason is that detection of reading implies writing data somewhere.  All parties would need to adhere to this principle -- be it through goodwill or because they all use the same cryptographic program/protocol.

Think of this as read-receipts in Microsoft Outlook.  You can try to send an email from Outlook to a gmail account requesting a read receipt, but it will be completely ignored by the gmail receipient.1  However, depending on policies employed on the Exchange server/Outlook client, sending a read receipt request may or may not be guaranteed.  So the challenge that you require is to get everyone on the same platform.

Of course, Quantum Cryptography does have the effect you are looking for.  The effect here is that there is an unintentional information "write" operation occurring when you perform the read.  This characteristic is merely a physical way to capture read receipts without allowing someone to opt-out.

1The email header does, however, show the systems the email traversed before arriving at its destination. This is part of the protocol adherence though it doesn't actually need to be there.  That is, one hop in the network could opt to completely ignore this part of the protocol without any failure in later hops.


Security for home server, wiki I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, and other relevant information. Currently, access is limited to my LAN, essentially prohibiting outside access, but I'm considering allowing external access, if I can figure out how to meet a level of security. Specifically, I'm looking for a solution which:

Prevents read access of any web content without some kind of authentication.
The authentication should be passed in such a way to prevent packet sniffing to allow permanent access to the network.
Ideally, I don't want this to cost anything, or if it costs something, to be a small one time cost.
As one of the most common locations I will be accessing this will be work, I would prefer a solution which does not require any additional software on the client end.
Access to within the LAN must be unrestricted, ie, no password required.
I would like to be able to access the site occasionally from my Android phone, so any solution should not prevent that from working.
I would like to expand this someday to allow more than just wiki software, but if there's a clever way to do this with the wiki software, I'll consider it.

My current thought is leaning towards producing a self-signed SSL certificate, and using apache authentication, either basic or digest, but requiring it to be passed over HTTPS, but I'm opened to alternative solutions.

My full config:

Ubuntu 11.10
Apache 2.2
Media Wiki 1.18

Jeff's comment gets it right.  Producing an SSL certificate is necessary.  If you have a domain name registered, you could skip the self-signed and go with a free SSL certificate so every new web browser you try will not complain about the certificate being untrusted (reducing the likelihood of MITM attacks).  If you don't have a domain name, you can use openssl to create your own self signed certificate.

This allows you to login to your computer over HTTPS.

Next you'll probably want to add apache authentication along with exceptions for the local LAN block (192.168.0.0/16 or whatever).  This can be done with a simple set of rules defined at: http://httpd.apache.org/docs/2.0/howto/auth.html


Break the popularity contest crypto There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not cryptography, but I wonder how effectively a message could be hidden in such an image and then securely transferred and retrieved.

Consider Alice and Bob who have conspired beforehand to use one of the solutions to the puzzle for Alice to transmit to Bob images of text. The TLA* is tasked with breaking their ad hoc "encryption" (obfuscation), but do not know about Stack Exchange sites. The TLA does not have access to Alice, as she is outside their jurisdiction. Furthermore, being images of text, the whole image is in greyscale.

If the TLA were to intercept an image 'encoded' with one of the solutions to the Code Golf contest, what steps would they take to decrypt it?

* TLA: Hypothetical government agency with access to the network.

The Code Golf is essentially to create an unkeyed 1:1 function to transform images.  As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size.

Further, if the images being transmitted have predictable features (eg. an image of a newspaper clipping will always have a white border), statistical analysis can be used to build up a map without needing to know the details of the images.


How to properly deal with different user-facing login mechanisms? I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier.

For example, the user can have access using OpenId, OAuth or token. But how can we "help" the user to determine which mechanism they can use?

For the moment the rest of my team want to expose the auth mechanism after the user gives the username to help to choose the right authentication mechanism.

For me, this is a bad idea, because someone can guess the validity and get info about a user without entering the password. But maybe there is a way to do it?

One option is to use email as "gate". The user needs to click to a link in his email to get the proper login mechanism.

I'd listen to your developers.  The whole point of identity federation is that you delegate authentication to the underlying identity management system.  Perhaps one is a simple username/password sign in while another uses two factor auth.

Besides, what info do you really need to protect?  The fact that bob@gmail.com is a gmail account?

If you're determine not to give anything away, there's nothing to stop you forcing the user to be explicit about their domain before they provide their username.  That's a common enough approach.

E.g.

Sign in with Google
Sign in with Facebook
Etc.


What type of SSL certificate do I need for communications between an Android app and a web service? I am developing a game for Android.

The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database.

I would like to encrypt the data that the client will be transmitting from the app to the web service and I am just wondering what type of SSL certificate I will need for that.

You are not communicating directly with MySQL, you're communicating with REST server (presumably over HTTPS), and therefore need an SSL certificate, not for MySQL, but for your REST API.

If the REST service is your own, then you need to make it SSL-enabled by installing a certificate on the web server that runs it. If it's run by someone else, then they need to do so.

And if it's your service, and only used by your client, then you can (and probably should if you know how) create your own SSL CA to sign the associated certificate, and then code your application to only trust certificates that you sign. This would mean that you don't need to purchase certificates and also means that you can't fall victim to any sort of SSL MITM attack. Bear in mind that you should only go down this route if you really know what you're doing. Otherwise, just purchase a domain-validated certificate like everyone else does.


Using snort with cloudflare? How might Snort or another IDS system work with Cloudflare? Essentially, the originating IP would be CloudFlare's, therefore a proactive IPS might be difficult to install.

I understand that Cloudflare itself is a IPS to some degree and will actively detect some attack signatures, but is it feasible to install something else between Cloudflare and a web server?

CloudFlare probably injects a header called X-Forwarded-For or X-Client-IP that you could read. However, [a] this can be faked and [2] it won't stop any attacks at layers 3 or 4 because the traffic really comes from CloudFlare.


Can opening media (e.g. video, image, text, etc) typically leak data to disk and to memory? Are there relatively safe programs to open media? Let us, for example, take a typical video player program such as VLC. Let us suppose we have an encrypted view of all media.

Does opening a video file only write to memory and not to disk?
If it does write to memory, how easy is it for a relatively sophisticated attacker with hardware access to recover the media from memory?
Are there secure programs to open and play such a video file without leaving a recoverable memory footprint? Follow-up: can this be practically done without Tails?
Repeat 1, 2, 3 for images and text.

Does opening a video file only write to memory and not to disk?

That depends on the video player. There is no fundamental reason that a video player would need to write to the disk, but I cannot guarantee that there is not one somewhere that saves things to disk on its own. If you have swapping enabled, then some memory from the video player may be written to the disk in order to free up memory. You should either use encrypted swap space, or disable swap to avoid this issue.

  If it does write to memory, how easy is it for a relatively sophisticated attacker with hardware access to recover the media from memory?

Very easy. Forensic tools like Volatility can view the process tree from a memory snapshot and dump individual processes. Analysis of those processes will allow reading buffers containing video data out from the program. Getting the memory requires only being able to plug in a PCIe device and mounting a DMA attack. Most systems do not protect from this.

  Are there secure programs to open and play such a video file without leaving a recoverable memory footprint? Follow-up: can this be practically done without Tails?

How do you expect a video to be played without anything touching memory? If your worry is about residual memory after the program closes and the system is shut off, just make sure you have modern memory (anything newer than DDR2) and powering off the system will result in data in memory vanishing in seconds. Note that video data may also reside in VRAM on your graphics card for a short time as well, and cold boots on graphics cards are possible.

You can use encrypted swap along with full disk encryption and ensure your system is powered off before "they" get to it. That way, even if video contents are written to the disk, at least it is encrypted.

  Repeat 1, 2, 3 for images and text.

This all applies equally to images and text. Video has a larger memory footprint, but just being small does not make something immune from being written to disk or remain in memory.

I agree with @SteffenUllrich. You need to define your threat model. For each of his example threat models, the following should hold true:

  Is the media still playing if the hacker gets access to the device?

In this case, the attacker would be able to read anything from memory. There is no effective way to prevent this. Solutions that encrypt entire memory are often highly experimental, limited in scope, or extremely slow. Some newer AMD processors come with the ability to encrypt all memory, however, which would be ideal for these purposes if you expect the attacker to get their hands on the system but are unable to compromise it (e.g. limited to cold boot attacks, not DMA).

  It is done playing but the device is not rebooted?

If it's done playing then some data may still reside in RAM. This data would most likely include parts of the page cache which cache recently accessed files. This can stay in memory for a long time. Additionally, when a process exits, the kernel frees the memory it used but it does not initialize the memory to zeros until it is requested by another process. The PaX hardening patches allow it to initialize the memory immediately when pages are unmapped or the process exits, and there are new kernel configuration options which can "poison" memory on free, at some performance cost.

  Was the device shutdown or rebooted?

If the device was shut down completely, everything in both system RAM and video RAM will have been destroyed in a matter of seconds. DRAM works by storing each bit of information in a very small capacitor, and refreshing any charged capacitor every 64ms so it keeps its charge. Reading a bit involves checking the state of the capacitor, and setting a bit involves either charging or discharging the capacitor. When memory loses power, it is no longer refreshed, and every capacitor rapidly decays to the same state (with microscopic sizes of these capacitors, charge is leaked very fast).

But how does this apply to a reboot? The problem is, a reboot does not cut power to DRAM, it merely resets the CPU and some devices, which means the DRAM continues to refresh, keeping its old contents until overwritten. After all, RAM doesn't know what state your computer is in. It just knows that it has been configured and is receiving power. There are a few reasons that this memory may not be persistent across a simple reboot:

Memory was intentionally overwritten before a reboot, as it is in Tails.
Your BIOS is configured to test all memory during POST after a reboot.
You are using ECC RAM, which by design must be reset to a specific state after reboot.

In the end, you should probably be using Tails as it is designed with anti-forensics in mind. There are only a few things to remember in order to prevent an attacker from recovering video history:

Do not save any data to an unencrypted storage medium. Stick with Tails' encrypted persistence.
Make sure you never leave your computer unattended, especially while it is running.
Make sure your system is powered down before allowing anyone to get near your computer.
If someone has unrestricted physical access to your computer, it's not your computer anymore.


Email "privacy" when sending within same domain Scenario:

email is hosted third party (think Outlook, Gmail etc.)
I am sending email to another person with an email account on the same domain (think from user1@example.com to user2@example.com)

Is this more secure and "private" than sending en email to the same person, but with his/her email account on a different domain (as in above example, but now from user1@example.com to user2@anotherexample.com)?

Assumption for this scenario (to reduce scope):

separate domains are not owned by related entities (going by above example, the relationship between the owners of example.com and anotherexample.com is as disparate as Microsoft and Google).
both domains' email servers support STARTTLS, and implement typical security practices (IMAP, SMTP connections from clients use only TLS, both accounts use strong passwords and servers store passwords properly hashed, salted and iterated, patching and configuration is done properly etc.)

Your have about 50% less violation of your privacy in this case.

When you send an unencrypted email to another domain, both your mailserver and the mailserver of the receiver can read it.

When you send an unencrypted email to the same domain, only the mailserver of that domain can read it.

This assumes the ideal case where both sender and receiver connect to their respective mailservers with TLS and the mailservers also communicate with each other also via STARTTLS. When one of these assumptions is wrong, there is an additional attack vector which needs to be considered separately.

In case of GMail, Google will read your email, parse it automatically, and use the information in your emails to add information to your and your communication partners Google profiles which are shared between all Google services for targeting both search results and advertising. Google Inc. itself claims that user should not expect any privacy when using their email service. So when you value your privacy or that of the people you communicate with, do not send or receive email with GMail.


What kind of metadata does a file actually contain? What kind of metadata does a file actually contain? I realize that this varies by the type of format, but I am specifically talking about the metadata universal for all files on a UNIX filesystem. Hence I will use plaintext as an example, since I'm not aware of any file specific metadata that would be in a plaintext file.

If I have a plaintext file, and I transfer it to another computer via a flash drive, is the inode for the file copied? I know you can get things from the inode like the last modification time, permissions, etc. But are there any types of metadata separate from the inode? Is it possible to figure out anything about the computer it came from?

What about in the case of an image file?

I will use plaintext as an example...

A plain text file does not contain any meta data, i.e. it is only an octet stream without structure. The only thing meta on this octet stream is its size. But, if stored on a UNIX file system there are several meta data associated with this octet stream, like the file name, modification time, owner, group, permissions, maybe ACL's etc.

  ...  I transfer it to another computer via a flash drive, is the inode for the file copied?

The inode itself is specific to the instance of the underlying file system. It will not be copied over to the flash drive. But some of the information contained in the inode might be, like the modification time. But the details depend on the capabilities of the underlying file system of the target, i.e. different file systems support different kind of information in the inode (or similar data structures). For example a (V)FAT file system which is usually used of flash drives does not support UNIX file permissions. It also depends on the way the copying was done, i.e. simply calling cp will not copy over the modification time but set it to the current time in the target. And even if the target system supports UNIX file permissions and owner, the original owner cannot be copied over unless the user doing the copy has the permissions to set the owner (i.e. is root).

  ... But are there any types of metadata separate from the inode?

The file name itself and the directory are not contained in the inode. In UNIX you could even have different file names or some file names within different directories point to the same inode, which essentially means that some same data can be accessed from different path.

  What about in the case of an image file?

There are a variety of file formats for images with different capabilities. For example JPEG files can contain EXIF, IPTC or XMP blocks which are contains for a variety of meta data, like creation time of the photo, camera used, location where the photo was taken, copyright information and much much more. Since these information are contained in the octet stream of the image file these will be implicitly copied too when the file is copied.


Protection against IP attacks I wonder if an attacker sends a frame with an ACK flag to my boss' computer (for example) and then uses the broadcast IP to infect all the network, how could we protect against something like that?

I am the last voice on it department but I really wonder on how to protect computers against it.

..sends a frame with an ACK flag...

I assume that you mean a TCP packet with the ACK bit set in the TCP header.
As long as this packet does not belong to any existing connection it gets simply discarded. Belonging to the connection means that source and destination IP and port match and also the sequence numbers are within a small window of previously received packets.

  ... and then uses the broadcast IP to infect all the network

I'm assuming that you still talk about the same "frame". First, broadcast does not work for TCP at all, i.e. a TCP packet with a broadcast address inside will be discarded.

But even if you use UDP instead of TCP (which means no ACK flag since this does not exist for UDP) the attacker has to be in the same network already since broadcast will only work inside the local network. And, no sane system would reply to a packet which has a broadcast address as source, so it gets discarded and your idea of attacking all systems via broadcast will not work. Still, if the attacker in the local network anyway he can directly attack these systems.


How can I create a secure random key for AES? I need to generate a lot of shared keys for an AES method which uses in various condition, my concern is how can I generate unpredictable keys? I've had some research on Cryptographically secure pseudorandom number generator but I don't know how I should use them?

/dev/urandom in unix based systems and CryptGenRandom on Windows. Most programming languages should provide APIs to generate random bytes such as os.urandom in Python.


Intercept pinned SSL connection with private key Can I intercept https traffic that uses certificate pinning using fiddler if I have the private key of the cert?

I am trying to intercept traffic between our mobile apps and API, and the mobile apps are using certificate pinning.

If I have the certificate and the private key from the web server, can I install it locally and use it to decrypt the traffic?

Seems like I should be able to.

Yes, generally speaking.

The comments have linked you correctly to the mitm proxy documentation for that feature already.

If that however is a feature of fiddler I do not know. If it's not in the documentation, go for MITM proxy instead:)

This, by the way, is independent of you using certificate pinning; this would work fine without a pinned certificate as well.

Whenever you have the private key, you can MITM.


Python SSL - No Shared Ciphers I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL connection with a Python client and server.
Simplified client:
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_verify_locations('.../quantum-safe-chat/pqca/ca/dilithium2_CA.crt')
_socket = socket(AF_INET, SOCK_STREAM, 0)
_socket = context.wrap_socket(_socket, server_hostname=hostname)
_socket.connect(address)

Simplified server:
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
context.load_cert_chain(certfile='.../quantum-safe-chat/pqca/server/dilithium2_srv.crt',
                        keyfile='.../quantum-safe-chat/pqca/server/dilithium2_srv.key')
server = socket(AF_INET, SOCK_STREAM, 0)
server.bind(self.__address)
server = context.wrap_socket(self.__server, server_side=True)

Now when I try to run the server and the client, I get the client error ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1129) and the server error ssl.SSLError: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:1129).
I already tried printing out the ciphers with context.get_ciphers() on both ends, where they were identical. Also I tried manually setting it to the same cipher on both ends with context.set_ciphers('ECDHE-RSA-AES256-GCM-SHA384') which only gives me the same result.
Does anyone have an idea what the issue might be?

I'm not familiar with libqs-openssl, but

The documentation clearly says that the necessary cipher support is for TLS 1.3, while your code insists on using TLS 1.2
You are trying to use ciphers which require RSA certificate, even though you don't have a RSA certificate

This together means that there are no ciphers which could support the authentication method available with your certificate. In other words: no ciphers and therefore also no shared ciphers.


How can I prove that mail sent was NOT caused by the newly deployed DMARC policy? I understand that by publishing an initial p=none policy, you basically instruct recipients that participate in DMARC to NOT treat incoming mail any different than how they did before a DMARC policy was published.

Regardless of the DMARC alignment result, "do not drop mail" (at least not on the basis of DMARC non-alignment).

For recipients not taking part in DMARC, this is irrelevant since they will not lookup your policy in DNS and hence will not action their mail based on DMARC alignment resp. non-alignment.

Obviously mail might still be bounced or non-delivered on the recipient side due to whatever additional security mechanisms or local policy the receiving mail server chooses to apply.

Receiving mail servers might also decide to NOT follow your DMARC policy, but drop every inbound mail that has failed SPF and/or DKIM, regardless of the final DMARC alignement test result.

In short, I can tell them that I want them to apply my DMARC policy, but I cannot force them to. And I have no visibility on whether they apply the policy or not.

So say I publish my DMARC policy in DNS. Senders complain that mail is bounced. I have no way to check k's of receiving mail server logs for DMARC checks and subsequent actions. These are not my servers!

My question - is there a reliable way I can prove that mail sent from my mail servers was NOT caused by the newly deployed DMARC policy, but any other cause?

How can I have more visibility on the application of my DMARC policy on the receiving side, apart from hypothetical aggregate/forensic reports?

I run quite busy domains for a year on DMARC p=reject and, after initial pains, things run now more or less unattended.

DMARC aggregate reports (RUA) are not hypothetical, surprisingly many domains does send them, and I don't mean only Google/Microsoft/Yahoo.

I haven't seen any forensic report RUF sent to me yet when there was an error (and RUA indicated the cause was DMARC).

Don't worry too much about rejections where the recipient only checked SPF or only checked DKIM, I don't see this in practice.

You absolutely need DKIM, because many people forward their mail and this immediately fails SPF check (for example they publish x@example.com, but the mail lands at name.surname@gmail.com).

Also, DKIM header has its own diagnostics flag (something like RUF/forensics) and linux opendkim installations often do send useful diagnostic messages.


Virtual machines vs separate physical machines for testing potential malware If you have to run potentially insecure executables, would using a separate laptop have any security benefit compared to a virtual machine, or would it be worse in the sense that the machine's firmware could be forever overwritten by malicious software, or the machine could infect other PCs in the local network? What risks do both solutions carry from a realistic point of view?

If you think that the executable is potentially unsafe, It is always better to access it in a network isolated PC. Considering threats like the recent zero-day vulnerability in VirtualBox (read more). We can never be sure of what's out there already. You can run it inside a VM inside the isolated PC with proper firewall rules configured as a safety precaution and always use up-to-date software.


Is there any useful Android app for security assessments? I've been thinking for a while about whether or not ask this, as it may be a opinion-based question, but as I have seen a couple of non-closed questions about recommended books, so I think this is the same case.

Is there any app for Android which be useful during a security assessment?

dSploit is great and packs tons of features and has wrappers for nmap (and other tools like hydra) and can also search the national vulnerability database. It also has many MITM attacks and login crackers(hydra). But its not available on the Play Store though. But APK can be downloaded here

Another tool worth mentioning is Interceptor-ng. Which is basically like/is wireshark for your Android device. Its available on the Play Store

Network Discovery is also pretty good and light; and can scan for hosts and open ports. Its available on the Play Store.

G-Mon is a powerful wardriving scanner and GSM / CDMA / EVDO / UMTS and LTE Netmonitor. And is great for scoping out access points. Its available on the Play Store.

WiFiKill is a "wifi jammer"/DoS tool which can deauthenticate an entire network (you need to be connected to it; just in case your wondering) or a single device. Its not available on the Play Store but can be downloaded here.

Special Mention:
bcmon is a tool(experimental) which allows monitor mode on Android devices which has the Broadcom chipset. I've never used this tool and hence can't offer much of an opinion on it. More info can be found here.

Good Luck.


undetectable virtualization apps to spoof web browsers monitoring web pages for malicious iframes (root kits) without VM is not safe. when its possible to detect virtualization just by javascript, which software provide undetectable VMs ? QEMU is safe?

JavaScript runs within a tightly controlled browser.  There is no way of identifying detailed information about the environment that the browser is running on top of,  unless of course you exploit the browser and obtain remote code execution.   Even then it may be difficult to determine that you are running inside a virtual environment.


Decoy User Account on Windows Is there a way to have two passwords for a Windows account? One password unlocks the decoy version of the account and the other unlocks the "real" version of the account. I would use Truecrypt's hidden OS feature but don't want to reboot the computer.

Not natively, no. You would have to have some 3rd party authentication mechanism that loads up a second account when a different password is entered.


Can one sidestep Meltdown/Spectre vulnerabilities by not installing new software on a server? Is it possible to not install new programs on a server and sidestep any Meltdown/Spectre vulnerabilities because it is only a newly identified issue.

I have an SLES server that runs a fixed database load. It's an Intel Xeon on AWS (hvm) VPC in a private subnet. As I look back, no new program binaries nor processes have been added to this server since it was launched over a year ago. But we have applied recommended OS/DBMS patches regularly (which obviously brings in new code)

From what I have read so far, database type work loads will take a huge performance hit from the fixes. It is already running at about 60-80% cpu during peak hours, and growing, so I do expect to upgrade to a bigger server in 2-3 months time.

Under this, does it make sense to skip the fix? If yes, how far this be stretched?

I am not very familiar with kernels and VMs.

Thanks a lot.

No.
Meltdown and Spectre make any vulnerabilities ten times worse. If an existing program (which you'd stop updating if you tried this) had a known vulnerability which enabled any sort of remote code execution (even as nobody) then an attacker could use Meltdown to escalate to root permissions. Patch your systems.


Certificate SAN Disclosure. How harmful can it be? My daily job duties brought me (by mistake) to the following IP: 52.63.96.32

It appears the registrar has signed with a single certificate a "lot" of domain. https://www.shodan.io/host/52.63.96.32

Am am right to assume that:

This is information leakage, it discloses websites that aren't
advertised on search engines.
The virtual web-servers all share the
same VM The virtual web-servers all use the same certificate.
therefore if the private key can be leaked/disclosed by one web
server using an insecure SSL/TLS  protocol.
Each customer should be concerned as this is potentially vulnerable to Meldown/Spectre ?

Also, If one of this website was to be compromised (Injection or XSS). Does it compromise other websites ?

And finally, Should I have any concerns if my company was hosting a website on this server ?

First, it is perfectly normal for content delivery networks to have such certificates. And given the IP address this looks like Amazon AWS, possible their CloudFront service which serves as a TLS termination point and load balancer which then forwards the traffic to the appropriate system. This is actually typical behavior which you will also see at Cloudflare CDN. Therefore I don't think that this was a mistake.

  This is information leakage, it discloses websites that aren't advertised on search engines.

I think that these sites have explicitly configured HTTPS access so that they get included in the certificate.

  The virtual web-servers all share the same VM The virtual web-servers all use the same certificate. therefore if the private key can be leaked/disclosed by one web server using an insecure SSL/TLS protocol.

This certificate is probably used at a load balancer which then forwards the requests to different sites which in case of Amazon AWS are probably each in their own VM.

  Each customer should be concerned as this is potentially vulnerable to Meldown/Spectre ?

No. Sharing the same TLS termination endpoint should not cause such problems.

  Also, If one of this website was to be compromised (Injection or XSS). Does it compromise other websites ?

XSS is not an attack against the server. Other injections like SQL injection can be. But given that these are probably independent sites running in their own VM a compromise of one VM does not compromise the other one.

  And finally, Should I have any concerns if my company was hosting a website on this server ?

No.


Using the same base string for a password in several different logins It is clear to me that using the same password for different websites is a bad idea because if an attacker manages to get a hold of your password, then he can gain access to the other websites in which you are using the same password.

However, I was wondering if it would be safe to have the same base string in all passwords, then append more characters to the end which would make the password unique.
For example, if I have the base string "p@ssw0rd" then on one website I would use the password "p@ssw0rdstring1" and on a different website I would use the password "p@ssw0rdstring2".

Is this method safe? if not, why? and which attacks is this method vulnerable to?

The biggest issue is that, if two of your passwords leak, an attacker will be able to find a pattern within your passwords. This would allow him to generate a dictionary attack by applying the found logic to other recovered hashes to try and find your other passwords.

p@ssw0rdstring1 and p@ssw0rdstring2 only differ one character. This means that an attacker can easily guess you will probably also have used p@ssw0rdstring3 or p@ssw0rdstring4.  While you can use a password base to increase the length of your password it will not increase security if an attacker knows you are always using this prefix.

While you are not specifying how you will choose the rest of your password, I must insist not to use anything which is site specific. So what comes after your password base should be completely random. If it's random you should remember it per website, which means that per website you need to remember a password, so why not remember something random completely without using a base?

If you have difficulties remembering passwords you should try to use a password manager like KeePass or Passwordsafe.  Passwords managers allow you to choose different passwords per website. These passwords are protected by a single keyfile and/or password. Choosing a unique password, which you do not repeat, is of the essence here.


What are the columns in Firefox's SiteSecurityServiceState.txt? Firefox's SiteSecurityServiceState.txt file (located in the profile folder) records the HSTS times and HPKP expiry times and pins. There are multiple columns, and I don't know what they represent:

An example HSTS entry:

api.github.com:HSTS 74  17087   1507520108719,1,1

and example HPKP entry:

github.com:HPKP 78  17087   1481557619233,1,1,WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho=k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws=K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q=IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4=iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=LvRiGEjRqfzurezaWuj8Wie2gyHMrW5Q06LspMnox7A=

The last column there is clearly all the SHA-256 hashes (pins), but what are the other columns? Clearly, one of them is probably a TTL, but which?

1507520108719,1,1

The first number is the expiry timestamp in milliseconds. Divide by 1000 to get a normal unix timestamp.

The second one is the HSTS state, which can be "unset" (0), "set" (1) or "knockout" (2, overrides HSTS preload information as "no HSTS information available").

The third one indicates whether subdomains are included or not.

Source: https://dxr.mozilla.org/mozilla-central/source/security/manager/ssl/nsSiteSecurityService.cpp#50


encodeURIComponent in a unquoted HTML attribute My gut feeling is that the following should be attackable:

$("Download Here	");

In contrast to

$("Download Here	");

For a cross site scripting attack if the user has control over somevar, yet I can't seem to find the specific attack. Am I mistaken?

From MDN:

encodeURIComponent escapes all characters except the following: alphabetic, decimal digits,
- _ . ! ~ * ' ( )

You would normally require a space character to add another attribute (such as onclick), unfortunately this will be encoded as part of the URI.
However, from OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet:

Unquoted attributes can be broken out of with many characters, including
[space] % * + , - / ; < = > ^ and |

So you might want to try the - or * characters to attempt to create a new attribute.
e.g. set somevar to http://www.example.com-onclick=alert('xss')
or http://www.example.com*onclick=alert('xss')
Your mileage may vary between browsers and unfortunately the = will still be URL encoded so you will also have that hurdle to overcome. So even though the value is not quoted nor encoded properly, it may not be possible to turn this encoding flaw into an XSS exploit.
Your second example is more secure, although the value should really be HTML encoded:
$("Download Here	");

where htmlEscape is:-
function htmlEscape(str) {
    return String(str)
            .replace(/&/g, '&amp;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#39;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;');
}


Secure and fast communication between 2 VM's I'm posed with a situation where i am uncertain which way to go.
We have 2 Virtual Machines set up at a host that'll act as a webserver and a database server.
Obviously, both will have to communicate with eachother. Now currently the way that it's set up is that they both communicate over their ext. ip's. (so we query the ip of the database server from our webserver). However we feel like this isn't very secure.

So far what i came up with is to set up a OpenVPN server on the Database server and a OpenVPN client on the  webserver. Set OpenVPN up to use private IP adresses and reroute all traffic through the VPN tunnel.
I think it's fairly secure but quite honestly i don't really know. Also i don't really know how this would turn out in performance. We don't want to sacrifice too much performance on this.

Anyone have any ideas if this is a good set up ? Or anyone have any other ideas how to achieve a better result ?

Thank you.

If two machines (virtual or not) must be made to communicate with each other, then establishing a VPN between them cannot harm; by definition, the VPN aims at emulating an isolated set of wires between your two hosts (hence presumably free from hostile eavesdropping and interference) so that arbitrary traffic between the two machine becomes "secure". OpenVPN has good reputation and is free, so using it is not a bad idea. Alternatively, if the applications which must talk to each other can handle their own security (say, SSL), then that is also applicable; the VPN, though, is probably simpler to set up, and more comprehensive.

As others have said, if your machines are VM, then the cloud provider is God: if he wishes so, he can technically see all your secrets and alter them at will. The provider is thus trusted. So the provider cannot be an attacker, and must be assumed not to fall under hostile control. Under these conditions, if the provider can set up a "private link" between your two machines (a VLAN, indeed), then that's fine. The security of the VLAN is strong as long as the actual wires and routers of the provider's network are clean and honest, which is, as I just wrote, a core assumption of the Cloud model.

Now, of course, there can be a subtle difference between "the service provider is honest" and "the service provider is honest and competent". A small configuration mistake (the dreaded human error) can put third party systems onto your VLAN. There again, running your own VPN can add protection against the provider's vagaries (it would not stand against provider's malice, but incompetence is much more common than wickedness).

Edit: I forgot the classic argument about performance. It goes thus:

Performance issues do not exist.
Performance issues do not exist until duly measured.

So if you fear performance issues, then the only sane way is to try, and see if the fears were justified or not. One can make a priori estimates but this requires some intimate knowledge of both the behaviour of involved algorithms and of network protocols and latencies; you cannot realistically hope to get decently accurate estimates unless you are highly competent in cryptography, low-level programming and TCP/IP internals. Trying out and quantifying issues is a much better way; more often than not, alleged performance issues happen to be non-existent (but other, unpredicted performance issues may unexpectedly appear). If you want to make benchmarks on OpenVPN, you should first read what has already been done on the subject, namely this page.


What is actually happening in the background when using such things as airmon? Firstly: Apologies if this is not the relevant place to ask this, if not then some direction would be good (thank you).

I have been interested in Information Security for some years now, but have only really taken a proactive step on it recently using Kali Linux and learning the basics such as airmon. However I do not feel that I am truly learning anything, I feel that I am just calling in some commands to do all of the work for me... What I wanted to know is what is happening in the background of everything, on everything after I hit enter on a command. Are there any good extremely in-depth guides/tutorials/lessons that supply this knowledge? I am constantly asking how I am getting in to something, why I am doing it this way, what other ways are there to do this, am I able to do the same on my own with out these commands?

Interesting question. Airmon-ng is used to enable monitoring mode on wireless interfaces.

You could do that through the following commands too:

> sudo ifconfig wlan1 down
> iw dev wlan1 set type monitor

Now if you check with iwconfig, you'll notice the change.

If you are interesting in knowing how the other tools in the Aircrack-ng suite work, you might want to take a look at https://github.com/aircrack-ng/aircrack-ng. It's an interesting read, but does require some understanding of programming.

Hope this helps!


HMAC - Why not HMAC for password storage? Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.

Let's say Joe Programmer is tasked with securely storing end user passwords in a database for a web application; or storing passwords on disk for logins to a piece of software. He will most likely:

Obtain $password from the end user.
Create $nonce as a random value about 64 or 128 bits large.
Create $hash = SHA256($nonce$password) and store $nonce together with $hash in the database.

Question one:

Why isn't the following substantially better than the above?

Create $long_string once and only once. Store this as a constant in the application code. $long_string could f.x. be 2 kilobyte of random characters.
Obtain $password from the end user.
Create $mac = HMAC-SHA256($long_string)[$password] (i.e. create a MAC using the end user password as key) and store this $mac in the database.

I would imagine the HMAC has the following benefits?

Collisions are less frequent?
It is computationally somewhat more expensive than plain hashing? (But not anywhere near scrypt, of course.)
In order to succeed with a brute-force attack within a reasonable time, and attacker would need to gain access to two things: 1) the database, where $mac is stored, and 2) the application code, where the original $long_string is stored. That's one better than a hash function, where the attacker only needs access to the database?

But still, nobody seems to suggest using an HMAC, so I must be misunderstanding something?

Question two:

What would the implications of adding a salt value $nonce be?

Create $long_string once and only once. Store this as a constant in the application code.
Obtain $password from the end user.
Create $nonce as a random value about 128 bits large.
Create $mac = HMAC-SHA256($long_string)[$nonce$password] and store $nonce and $mac in the database.

The point of the salt is to prevent attack cost sharing: if an attacker wants to attack two passwords, then it should be twice as expensive than attacking one password.

With your proposal (your "question 1"), two users with the same password will end up using the same MAC. If an attacker has read access to your database, he can "try" passwords (by recomputing the MAC) and lookup the database for a match. He can then attack all the passwords in parallel, for the cost of attacking one. If your long_string is an hardcoded constant in the application source code, then all installed instances of the application share this constant, and it becomes worthwhile (for the attacker) to precompute a big dictionary of password-to-MAC pairs, also known as "a rainbow table".

With a nonce (your "question 2") you avoid the cost sharing. The nonce is usually known as a "salt". Your long_string and the use of HMAC does not buy you much here (and you are not using HMAC for what it was designed for, by the way, so you are on shaky foundations, cryptographically speaking). Using a salt is a very good idea (well, not using a salt is a very bad idea, at least) but it does only half of the job. You must also have a slow hashing procedure. The point here is that the salt prevents cost sharing, but does not prevent attacking a single password. Attacking a password means trying possible passwords until one matches (that's the "dictionary attack"), and, given the imagination of the average human user, dictionary attacks tend to work: people just love using passwords which can be guessed. The workaround is to use a hashing process which is inherently slow, usually by iterating the hash function a few thousand times. The idea is to make password verification more expensive: having the user wait 1ms instead of 1µs is no hardship (the user will not notice it), but it will also make the dictionary attack 1000 times more expensive. Your long_string may be used for that, provided that it is really long (not 2 kilobytes, rather 20 megabytes).

HMAC may be used instead of a raw hash function to strengthen a password-verification system, but in a different setup. Given a system which checks passwords with salts and iterated hash functions, you can replace the hash function with HMAC, using a secret key K. This prevents offline dictionary attacks as long as you can keep K secret. Keeping a value secret is not easy, but it is still easier to keep a 128-bit K secret than a complete database.


Are Playstation 4 communications really harder to monitor? I have read on the net that authorities are having troubles monitoring Playstation 4 communications.
As usual the news are very non technical.

What makes the Playstation 4 network harder to intercept?

Many of the news were just sensational news, not actual. There have been reports surfacing after this that security agencies monitor xbox and playstation communications. It came up as a playstation was found in one of the Paris attackers flats. It was baseless and been debunked quickly (https://motherboard.vice.com/read/how-the-baseless-terrorists-communicating-over-playstation-4-rumor-got-started) however that didn't stop the hoax.

The communications also don't use crypto as opposed to many better communication techniques for secret communications.

So the answer is, its quite easy to intercept and Sony probably helps law-enforcement do it already. Some reports even say they are also using algorithms to search for suspicious activity themselves.


Under what circumstances is it possible to bypass screen lock and get data on Android? I would like to know how to get data on an Android phone with soft methods - that is, no physical methods, such as looking at the imprints on the screen, disassembling the device, etc. Let's assume that Android is upgraded to the latest version and there are no unknown bugs that would cause the insecurity of the phone.

I would like to know if my phone would still be safe under these circumstances, respectively, and what is the minimum requirement for theoretical full security:

The device has USB debugging enabled, but all trusted ADB hosts are safe and not touched by malicious people. (Looks like the ADB host has to be trusted before ADB can connect to it, and it is possible only after unlocking the screen, so it should be safe?)
The device has been rooted (such as a development image) and a number of common, famous apps (such as Root Explorer) that require root has been installed.
The disk is fully encrypted. In this case the hacker is allowed to disassemble the phone to get the storage module (and the storage module only).
Uses an 8-digit number password that is not so strong - not crack-able by trying by hand, but crack-able with a rainbow-table attack.

And are there any other thing that seems safe but not actually?

Android is updated to the latest version and there are no unknown bugs that would cause the insecurity of the phone...

Then yes, you are safe in that theoretical situation.

Unfortunately that situation will never be true - there are always going to be unknown bugs.

Additionally, one of the apps could be updated with a malicious update.


If a MITM has your public key and you are SSH-ing through the MITM, what is the maximum attack it can perpetrate? Firstly, let me start by saying that I am not attempting to hack anyone or anything (not that I would know how or where to begin, if I were).

For illustration purposes, let's call the primary key owner A, the "good" public key holder GOOD, and the "evil", MITM public key holder BAD.

Also, assume this MITM is in your ISP and you are attempting to connect via hostname vs IP (i.e., the MITM can tell you that you mean to connect to its IP).

It seems to me that there is zero difference between A connecting to GOOD and A connecting to BAD, assuming that BAD can behave like GOOD enough to convince A that he is in fact connected to GOOD (e.g., maintaining an SSH connection with A, etc.). This would give BAD the incoming half of the conversation (which, depending on the context, may be of great value to BAD).

Is the above assumption true?

With SSH, the server key pair is actually used for signatures: the server sends to the client a piece of data and signs it. By verifying the signature, the client makes sure that the piece of data is really from the intended server. That "piece of data" contains a Diffie-Hellman public key that the server just generated, and the client uses it to do the cryptographic key exchange.

To succeed at doing a Man-in-the-Middle attack, the attacker must either obtain the DH private key (but tough luck on that; the server keeps it, and rebuilding it from the public counterpart is way too expensive to be actually done with actual technology), or feed the client with a fake DH public key for which the attacker knows the private part. But the client won't accept a fake DH public key from the attacker, because that fake will not be signed with a signature corresponding to the server public key (the "permanent" public key, not the DH one).

To be brief, everybody knows the public key; it is public. It is not a problem if the attacker knows the public key. What would be a problem is if the client did not know the server's public key, because in that case the client would not be able to verify the signature from the server. Without this verification, the client can be embezzled by the attacker with a fake DH packet, and the MitM attack succeeds.

The client "knows" the server public key by remembering it. This is the reason why the first connection to a server is critical: at that point, the client does not know the true server public key yet. The client is supposed to verify the key fingerprint by (for instance) phoning the server sysadmin.

All of this relies on the magic of asymmetric cryptography:

You can verify a signature with the public key, but producing new signatures requires knowledge of the private key, and the private key cannot be (practically) deduced from the public key.
The DH key exchange consists in publicly exchanged messages, sender and receiver finally agree on a "shared secret" obtained by processing these messages, and yet someone observing only these messages cannot recompute the same secret.

Mathematics are involved.


Is this password entropy calculation correct? I'm trying to compute the entropy of a passphrase of the following pattern:

.... .... .... ....

Where . represent lowercase characters.

The passphrase follows the rule that the two parts of each 4-character sequence have a vowel and a consonant, e.g.:

anno domi arip keto

Which has the pattern
:: :: :: ::
where : represents a vowel-consonant pair.

Assuming an attacker knows all this, is the following entropy calculation correct?

log_2((2*5*21)^8) = 61.7 bits

Since there are 5*21 ways to create a vowel-consonant and 21*5 ways to create a consonant-vowel, we get 2*5*21, and because there are 8 of these the value is raised to the 8th power.

Yes, your calculations appear to be correct.

5 (vowels, if you don't count y) * 21 (consonants) = number of possible two-character arrangements.  So 105 different two-character arrangements in the 1 vowel and 1 consonant order.  And like you said the reverse order is also possible, so 105 more for a total of possible 210 arrangements.

210 arrangements ^ 8 two character groupings = number of combined total character combinations.  So approximately 3,782,285,936,100,000,000 possible combinations.

Log2 of 3,782,285,936,100,000,000 gives you the number of possible combinations represented in bits.  So approximately 61.7 bits.


How reliable is the method of overwriting deleted files with large files? In addition to the question posted regarding purging data without formatting and the ability to recover data with forensic tools, how reliable is the method regarding overwriting with large file sets?

As an example, if i delete multiple files roughly sized at 2GB stored on a SSD and attempt to overwrite it with single large file sets e.g. ISOs, will this method work? How reliable is it?

Is there another approach?

It has been suggested that the question may be a duplicate of recovering wiped SSD. This question is specific where the drive is not being wiped. There is no option to do so. The only option is to delete files and write files. There is no option to install any tools

Wear leveling on the SSD will prevent you from completely overwriting existing data, even if the operating system actually tries to put the new file(s) in the same sectors (as the OS sees them) as the old file(s), which is doubtful unless you totally fill the drive each time.


Can having certain restrictions/rules make passcodes less secure? Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,000,000 passcodes to try if they were to brute force. The phone locks for 5 minutes every time the passcode is entered wrong, too.

However, if I am expected to never use any sequential or repeating numbers, surely this reduces the space of possible codes by a huge amount? Thus making the phone easier to break into. Why would this policy be used?

Assuming the policy on sequential numbers is very defensive and concerns the following digit, and assuming that 9 is followed by 0, this reduce the number of available passcodes to 10*8^5=327.680

Which reduce the possibility to a subset containing 32.76% of the original possibilities, which is not that much different on a scale.

However, such a rule prevent the user from setting trivial passcodes such as 000000 or 123456 which are incredibly dangerous to set on a corporate phone as these are very common passwords that a potential malware will try to input.

In conclusion, the risk of reducing the number of available passcodes to chose from is small compared to the impact of letting the user set a trivial password.


Is persistence via scheduled tasks possible if the user is not elevated? As far as I can tell, scheduled tasks may only be created by those in the Administrators group by default. Does that mean that persistence can't be achieved via this method without gaining elevated privileges?

It is possible to use schtasks.exe without elevation, though you can't create tasks for other users without knowing their passwords, or for system accounts without knowing an admin password. For example, the line schtasks /create /sc once /st 14:08 /tn testcalc /tr calc.exe, run from a non-elevated prompt, successfully popped calc.exe for me at the expected time. It's possible it wouldn't have worked if I wasn't a member of the Administrators group at all, but I doubt that; unless there's a bug in the way schtasks considers permissions, it shouldn't have "seen" the Administrators group membership on my security TOKEN, since for a non-elevated process that group is only present in the DENY list (I can't do something if admins are prohibited), not in the ALLOW list (I can't do something even if admins are permitted).


What is the security benefit of using PostMessage instead of a callback URL in OAuth/OIDC? Of all the issuers I've found, (Facebook, Twitter, Azure AD, etc) only Apple's CloudKit has the feature of "post message" as a callback (unless it's buried in the other's SDK)

Here is a screenshot of the Apple Developer Portal

Question

What is the benefit of using the PostMessage API over a 30x redirect?
Do the other STS vendors offer this (AzureAD, Facebook, Twitter, Ping, ADFS...)

With the redirect response mode there are more opportunities for the access token to be leaked and it could be said that there's more responsibilities for the client application in order to do it right.

One of the consequences of using the redirect is that the access token will be accessible in the browser address bar, which can expose it to the resource owner (end-user) and although not a direct concern it can allow the end-user to do something insecure like bookmarking the URL or copy/pasting elsewhere. The client application should clear the response in the fragment as soon as it's processed to mitigate against this.

There's also the concern of the URL containing the access token being kept in browser history or leaked through the Referer header.

With the web message response mode the access token is never included as part of an URL and/or shown to the end-user so this ends up with better security characteristics.

In relation to support, I can speak from the Auth0 perspective as I currently work there. There have been a few mentions about the possibility of implementing that mode, however, nothing very concrete.

It's also fair to say that, even for SPA's, with a bit of server-side collaboration you can have something with the same characteristics of the web message response mode by using the form_post response mode. The postMessage would be done by your JS code instead of JS code owned by the authorization server.

This response mode is indeed supported by Auth0 (see note on form post usage) and given it's a final specification it possibly also has more widespread support than the web message.


Why do web users still use password manglers though password is sent in ciphertext There are many variations of password manglers. An example would be

  Hash( user password + secret key + domain site )

During website login authentication , passwords are sent in ciphertext from the client machine to the host machine via SSL/TLS protocol.

The password has already been encrypted , I see no benefit in hashing the encrypted password a second time , what am i missing out ??

It's possible you're misinterpreting one of the variations.

One useful variation, known as Challenge/Response, is that the website login, instead of asking the user for a password, sends a nonce (a number used once, that is an ad hoc random number) to the user. The user then replies with Hash(user password + nonce + whatever else the website knows).

The website performs the same calculation and compares its computed hash with the hash returned by the client. A match proves that the client knows the password, without ever having to send the password itself.

Sure, the communication is encrypted, but security should be thought of like an onion. The more layers the harder it is to crack, but only if you don't get sloppy on some layers figuring that the other layers will carry the load. Even if you know you're on a "secure" channel, talk as if you think it might not be secure. Even over an encrypted channel, not sending the password is more secure than sending it.


Does using a VPN protect against KRACK? Does using a VPN protect against KRACK? How does this work? How can it be bypassed?

I use a commercial VPN on my laptop and on Android. Is an OpenVPN connection to your home a good way to protect your devices?

A (properly configured, secured protocol) VPN connection will not protect you from being "forced" to join the malicious access point, but it will prevent your communications from being eavesdropped on. The same is true for properly configured SSL / TLS.

The attacker in the KRACK attack sets up a malicious access point, which your device connects to as part of the attack (note that your device must have already connected to this device and trust it). Because your VPN tunnel encrypts communications between your device and the tunnel end point, while you may have fallen victim to joining a malicious access point all communications through that tunnel would not be susceptible to MITM attacks.


US Department of Labor Watering Hole Attack So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware:

http://threatpost.com/watering-hole-attack-claims-us-department-of-labor-website/

Now, I have two questions:

How could the JavaScript that redirected the users be injected into
the DOL's site in the first place?
What technology was used the exploit the memory vulnerability in
Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

I'm asking so that I can prevent my own websites from being compromised in the same way.

How could the JavaScript that redirected the users be injected into the DOL's site in the first place?

From a cursory reading, it appears that the vulnerability is a simple XSS attack.

  What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)?

It appears to be a Javascript-only attack. The proper fix for that particular vulnerability is simply have the users use a more modern browser.


Is using the username encrypted with the password as key a good password storage scheme? On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on dotnet.
On login I do it again and check if there is a match.
My question is, how secure is this now when more and more databases are hacked? I do not know at any given time the user's real password. What the hacker would get from db is the username encrypted with an unknown password. With hashing there is the rainbow tables problem, but with this method not.
Knowing the decrypted value already (username) makes it easier to find the password?

What you do really is hashing: you built a hashing function out of a block cipher. Incidentally, "encryption of a known value with the password as key" is how the traditional DES-based crypt scheme for Unix was designed.

On the plus side, your construction includes the user name, which partially provides the effect of a salt: parallel cracking is discouraged because two users using the same password will end up with two distinct hash outputs. "Partially", because upon password change, the user keeps his username, so some form of parallelism is still feasible here; and, perhaps more importantly, the same username may be used in several Web apps (e.g. 'admin'), which makes precomputed tables worthwhile (and the point of the salt is to prevent parallelism, in particular the efficient use of precomputed tables).

On the minus side:

This is a homemade construction. 50 years of research in cryptography have taught us that homemade crypto is very rarely good. In fact, we can "know" that a given algorithm is correct only through years of review by other skilled researchers, and homemade schemes, by definition, never got much of a review.
This is limited. Rijndael is a block cipher that can accept keys up to 256 bits; thus, if you use the password as key, then it must fit within 256 bits. This prevents using so-called "passphrases" which can be strong but easy to memorize passwords by using a lot of space for its entropy (human brains don't like concentrated entropy, but are happy with diluted entropy).
This is way too fast, and this is the biggest immediate problem in your scheme. With a basic PC, an attacker can try a lot of passwords per second, in particular since modern PC have dedicated opcodes for AES. With a quad-core PC, one should be able to try up to about half a billion
of passwords per second. Not many user-chosen password can survive such an onslaught for long.

If you are interested in how password hashing works, then read this. The short answer, though, is still the same: don't use a homemade scheme; use bcrypt.


Is there an easy way to record how long it takes John the Ripper to crack passwords? We're doing a password audit by loading the password file into John and letting it run for a couple of days.

One of the first questions I got in the remediation class was "How long did it take to crack my password?" According to a password calculator the guy used, his password should have taken over a century to crack, but John guessed it relatively early.

Now, my manager is asking me to record how long it takes for each password on the next audit round, but I'm letting it run when I'm not here to observe and record.

Any suggestions on a way to record the time? I'm doing this on a Kali Linux cluster.

John the ripper logs its activity to stdout.  If you note that it's cracked a password, you can terminate the session with a ctrl-C.

The log file .john/john.log will note the account(s) that have been cracked, with a timestamp.  Grep that for 'Cracked' to turn those up.


How to mitigate SSL based DDoS attacks? as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without having the key to decrypt the traffic.

I recently spoke with on of the above mentioned companies employees (Lets say company A) and they said that the only way is to use one of their products, wich is located in your network and its purpose is to deliver content via ssl and send all traffic in plaintext to the defense solution (same company, also internal network) which then in turn gives the filtered "good traffic" to your internal webservers.

Other companies have the approach that you handout your ssl key to them, so they can decrypt and analyze your traffic and pass the clean traffic on to your servers.

Company A stated, that the later is a absolute nogo and that it shouldn't even be considered. Problem is, their solution can only filter as much traffic as your infrastructure and their appliance can handle while cloud solutions have much higher capacities.

So the question is, is there another way of mitigating SSL based DDoS attacks, is handing out your ssl key really that bad and why?

I know that there already was a question on "storing keys in the cloud - trusting the cloud provider vs. your own laptop, etc." so I'm sorry if some of this is a duplicate, but the answers there didn't really answer my question.

Let's clear up a couple of misconceptions:

DDoS mitigation partners cannot work unless they can decrypt traffic

Yes, they can - they just can't do it as well, as the content is not visible, so the solutions which work on traffic flow will still work.

Handing your key to a 3rd party is a bad thing

Not necessarily. In fact this is extremely common for large corporates - who typically have their infrastructure managed by 3rd parties anyway. What it does do is require that you replace some of your technical controls with contractual controls, and that you take greater oversight/audit responsibilities over the 3rd party.

Mitigation of the threat of the 3rd party misusing the key, or not protecting it is a straightforward one to assess and then provide a solution for.


Mysql database password and webform password I have a Mysql database where one table is meant to store user complaints/comments/suggestions. I am using Mysqli to connect to the database with a

    $con=mysqli_connect("myhost","myuser","mypassword","mydb");

At this time, the "myuser" and "mypassword" are the same as the id and password I use as the admin to log into the phpmyadmin backend. Is this the correct way to do this? Does this give out more power to the user than I want to? Does it imply that the users will be able to run DELETE and ALter statements on the table/database?

My concern is that since the id and password are the admin's, users actually sending the feedback could also use it to do something that could harm the database. Is it necessary to use the admin id and password in this code?

My shared hosting does not allow me to create additional users - at least that is what I have understood from my chat with their customer care (they say I need to take a dedicated server plan to be able to add more users. I don't have the budget to take on the extra cost of the dedicated virtual server). There is no Users table or User Privileges table in the installation.  Does this mean that I cannot create my own tables to manage users and assign privileges? Would any such tables that I create work exactly like those that come with the installation? Is there a restriction to table names - i.e. that any such tables that i might like to create cannot have certain names?

It is not the safest way to do this. A safer way, as you state, would be to have a unprivileged user.

It is unlikely that you can do so by hand; any "User" table that you created would probably be just that, a table, without any effect on actual database users. I guess that your "admin" user is actually a normal user with full privileges on his own database, that can't, say, issue GRANT ALL PRIVILEGES ON yourdb.* TO newuser@host IDENTIFIED BY 'password'; without getting a ERROR 1044 (42000): Access denied for user...,

As it is, you need to implement security at the application level instead of at the database level. However, the MySQLi interface is quite solid (barring shooting yourself in the foot) and it isn't too difficult to prevent possible SQL injections.

Barring that, the users will have admin privileges, but will be unable to use them.


Initialization of a LUKS encrypted partition with cipher or /dev/urandom I've created a few encrypted devices with LUKS and cryptsetup on Linux and am pretty comfortable with disk encryption in this regard.

I've seen it mentioned in many different places that when setting up a LUKS partition/disk, it is advisable to first overwrite the entire partition/disk with /dev/urandom. I've seen a few places that advise that this isn't necessary, as the disk can be overwritten using the cipher, which is much faster. (/dev/urandom max on a 4.6GHz system can get over 20MB/s, whereas I'm sure that an AES-256 CBC cipher can run at over 2GB/s, which means that my encryption of the disk could run at 100 to 102.4 times faster if I'm using the cipher as opposed to /dev/urandom, disk speed being the limiting factor here).

Is using the cipher to initialize the disk as "secure" as using /dev/urandom? I would assume so, as output data should be theoretically indistinguishable between the two.

Also, how do you do this to overwrite the entire partition/disk using the cipher? I've lost the link and can't remember how to do it.

To use the kernel's crypto module to initialize the partition/disk do this:

cryptsetup create --key-file=/dev/urandom eraseme /dev/sde
dd if=/dev/zero bs=1M of=/dev/mapper/eraseme
cryptsetup remove eraseme

This initializes a crypto mapping named eraseme spanning the partition/disk using data from /dev/urandom as the key.  Writes zeros to the mapping and then deletes the mapping.  Use --cipher option to use non-default cipher if required.

It is much faster than reading from urandom.  On my computer, writing to a ramdisk I get these performance figures:

640 MB/s zeros  (dd if=/dev/zero bs=1M of=/dev/sde)
270 MB/s crypto module using default cipher aes-cbc-essiv:sha256  (commands as above)
8.7 MB/s urandom  (dd if=/dev/urandom bs=1M of=/dev/sde)


Resetting a hijacked router If you reset a router that's been hijacked to factory defaults with the inbuilt reset button, will that take care of the problem?

If your only problem is that the router is compromised than a reset to factory defaults will probably fix this problem. But make sure that you are really doing a factory reset and not a simple reset (restart) of the router.

If your problem is also that an attacker was able to compromise the router in the first place then this problem has not been solved by a factory reset. Maybe it can be resolved by updating the firmware, but if a fixed firmware is out there depends on the vendor. Also you cannot be sure that the firmware really fixes the problem even if it claims so, because some vendors just fix the one bug which got reported or seen in the wild and leave other unreported bugs open.


Can you forward TLS connections according to SNI domain without terminating the connection at the reverse proxy? I am developing an application that needs to expose two services:

REST API with https and client certificate authentication (https://api.device.example.org:4431, server certificate issued by private CA)
Web server with regular https (https://device.example.org:4432, server certificate issued by public CA)

I would like to place a reverse proxy in front of these on port 443 that reads the SNI domain and forwards requests to the relevant port.

Is this possible without terminating the TLS connection at the proxy?

It is possible to do forwarding inside some proxy just based on the SNI extension in the ClientHello and without terminating SSL at the proxy. It is for example supported by haproxy or sniproxy. See also Can a Reverse Proxy use SNI with SSL pass through?.


What is the best way to upload a file securely? What is the best way to upload a file securely?

My client is a .NET Desktop Application and server is Apache Tomcat running JSP Files, running on a Linux OS.

You can normally upload the file using standard HTTPS way, however, exposing application server for uploads is always very risky. Especially if the application server has a lot of libraries built-in and so on. So ideally:

Create dedicated Tomcat instance just for file uploads with minimum set of libraries
Enable HTTPS on it and disable HTTP, harden HTTPS settings so it's using only latest protocol versions
Create user certificate which is used to authorize user to connect to the server
Create the username and password for each user
Now you can upload via HTTPS to tomcat controller any file, you can make it by using binary form to not consume too much bandwidth
If you have more of the infrastructure, you can use HTTPS -> HTTP proxy, e.g. in AWS, this makes things easier

On top of that, you can encrypt the file itself. If it's .NET application, it could be dedicated (per app instance, e.g. per customer) pre-shared symmetric key which is not stored on the destination server, so the file is copied from the upload Tomcat instance to another, isolated instance where it is decrypted.
Regarding pre-shared keys, it's not the best way, so you can use another Tomcat instance as Key Server. Having client certificate already, you can connect to Key Tomcat Instance and request one-time symmetric key, and the decrypting Tomcat Instance will re-request this key during decryption.

You can bypass the extra upload server if you trust your Main Tomcat. However, using HTTPS and Key Server with encryption is really recommended if upload needs to be secure. Also, the stored file might remain encrypted and the Main Tomcat server might not need / be able to query the Key Server at all.

This way, if your upload server gets compromised, the files are unreadable. If your key server gets compromised, the files are not readable either. Reducing the attack surface is the main thing. Use cheap Tomcat hosting to achieve that. Use JRE8 with G1GC to reduce memory usage. Use streams and don't load files into RAM.

See the diagram: