How do you capture ALL the traffic from an Android app? I want to capture all the traffic from an Android app for its pen-testing. How do I do that?

Here's what I've already tried:

I installed the app on an emulator and started the emulator with a http-proxy pointing to a local port. The local port had ZAP running on it. I'm able to intercept the traffic from the browser but not from the app.

Well, may be my app uses https and I thought I had some certificate problem. So I exported the OWASP ZAP's certificate and pushed it on the android emulator. Of course, Android >= ICS versions have their cert names hashed using OpenSSL. So I followed some instructions here and I managed to get my ZAP's cert on my device. Still, I'm not able to intercept the traffic.

My next line of thought was: May be this app is damaged. So I installed Facebook, Pocket and Guardian (news) apps from the app store into the emulator and tried intercepting their traffic. I can intercept the traffic from Guardian but Pocket and Facebook are unable to connect to internet (so is my app). However, I can browser the internet from my browser on the emulator.

Honestly, I'm at my wits end. I don't understand why this is happening. I haven't done a lot of pen-tests before so, I guess I lack experience. Could anyone help this poor soul?

(Of course, I can always use Wireshark, but it wouldn't be able to MiTM the requests and responsees the way ZAP or Burp does.)

EDIT:

After "Google-ing" like a madman, I finally found that Android doesn't have a support for global proxy (which works for, both browser AND apps). More info can be found here.

You are unable to intercept Facebook traffic because it uses SSL pinning.

On pen-testing an android application you may come across four different scenarios. I will list them down below concisely. A much more detailed article can be found here >> My Blog The article also contains videos which you can refer to.

Non-SSL Application

This is the simplest Android application which you may come across. Games are examples. Much of the traffic goes over http. To intercept the traffic you only have to point the wifi proxy settings of the device/emulator to the laptop where Burp/Zap proxy is running.

Applications which uses HTTPS traffic and rely on device's trusted credentials

Applications like Instagram uses HTTPS to communicate with the server however they rely on the device's trusted credentials. To intercept this traffic you can add your proxy certificate to your device's trusted credentials by adding opening the same from Settings > Security > Trusted credentials

Applications which uses SSL pinning

Certain applications may use SSL pinning to ensure the application being secure even at the event of a trusted credential getting compromised. Cydia substrate module Android Trust Killer or Xposed Module JustTrustMe can be used to bypass SSL pinning control.

Applications which use their own Credential Store

The Facebook Android application uses it's pwn credential store and that's why you are not able to intercept the traffic normally. To bypass this you will have to dissassemble the application to smali code. Add the certificate in desired format to the code, recompile it, sign it and install it again. The process is detailed here >> Blog by DewHurst Security.


How to find if a USB has been plugged in on a certain date? (Linux/Mac) Starting from this great script offered by Daniel Azuelos

cd /Volumes/suspicious_USB
/usr/bin/sudo find . -atime -21 -exec ls -dluT {} \;

How is it possible to modify it in order to find if a USB flash was plugged in, on any random computer, on a certain date? Say, for instance, May the 3rd? Any way to detect if a file was opened or copied?

Both Linux and Mac terminal scripts would be appreciated!

I found the times when USBs were plugged in with this:

# cat /var/log/messages | grep -A 20 "usb 1-1: new high-speed USB device"
May 17 16:54:28 trogdor kernel: usb 1-1: new high-speed USB device number 8 using xhci_hcd

# cat /var/log/messages | grep "Unmounted" | grep sdf
May 17 16:56:36 trogdor journal: Unmounted /dev/sdf1 on behalf of uid 1000

Then checked what files were modified in that time range with this:

# find / -executable -type f -newermt "2018-05-17 16:54:00" ! -newermt "2018-05-17 16:57:00" -ls

I agree it's not a great solution, and far too manual. As far as I can tell there is no elegant way to see in the logs if files were moved to or from a device.

Bit of explanation:
By default CentOS7 holds logs for 4 weeks after their cycled out, so the logs should be there to sift through in /var/log/messages-${date_in_some_format}.

$ cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4
....
....

And anything of level info or higher is logged to /var/log/messages according to the rsyslog configuration file, including USB attach/detach in a barely-helpful format.

$ cat /etc/rsyslog.conf
# rsyslog configuration file
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

I plugged in my USB and copied malicious.sh from it into /tmp/ and /home/trogdor/

-rwxr-xr-x.  1 trogdor trogdor   44 May 17 16:55  /tmp/malicious.sh
-rwxr-xr-x.  1 trogdor trogdor   44 May 17 16:56  /home/trogdormalicious.sh

In the logs I searched for when USBs were attached, and then when they were detached. I used -A to output 20 lines after the matching line, to find where the device was mounted so I was sure that this was actually the device that was being unmounted (/dev/sdf in this case). Older logs are by default stored in /var/log with messages-${date in some format}

# cat /var/log/messages | grep -A 20 "usb 1-1: new high-speed USB device"
--
May 17 16:54:28 trogdor kernel: usb 1-1: new high-speed USB device number 8 using xhci_hcd
---
May 17 16:54:29 trogdor kernel: sd 11:0:0:0: [sdf] 31258624 512-byte logical blocks: (16.0 GB/14.9 GiB)
--

Then because the last line shows it was mounted on sdf :

# cat /var/log/messages | grep "Unmounted" | grep sdf
---

May 17 16:56:36 trogdor journal: Unmounted /dev/sdf1 on behalf of uid 1000

I ripped off this for the find time range. The times are recent, but the same applies to times in the more distant past. The output has to be sifted, but it's not as bad as it could be, assuming that the malicious files are uploaded quickly.
I also checked only for executable files.

# find / -executable -type f -newermt "2018-05-17 16:54:00" ! -newermt "2018-05-17 16:57:00" -ls


Integer overflow check not detecting some cases Something very weird happens when I control my code execution to fish out integer overflows. The control program checks the value of the overflow flag using inline assembly.

Code:

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>

int add_u32(uint32_t a, uint32_t b, uint32_t* r) {
volatile int no_overflow = 1;
volatile uint32_t result = a * b;
    __asm__ __volatile__ (
    "jno 1f ;"
    "movl $0, %[xo] ;" "1: ;"
    : [xo] "=m" (no_overflow) );
    if (r)
        *r = result;
     printf("overflow flag:%d\n", no_overflow);
     return no_overflow;
     }
int main(void) {
    uint32_t quantity;
    uint32_t price = 5;
    uint32_t total;
    printf("Please enter desired quantity\n");
    scanf("%d", &quantity);
     if (add_u32(quantity, price, &total) == 0) {
    printf("Wrong input, program shutting down...");
     return (1);
    }
     else {
    printf("Total price:%d\n", total);
    }
    return (0); }

This code detects payloads like

  123456789123

but payloads like:

//123456789123222900000 results in 836000
//123456789123222800000 results in 336000
//123456789123222733000 results in 1000
//123456789123222732801 results in 5

Why does this happen and how can I fix this?

Your program will work only for x86 as uint32_t is the size of x86 registers. In x64 the registers are 8 bytes and do not consider overflow unless the overflow is above 8 bytes.

   0x40066e <add_u32+40>    mov    eax, dword ptr [rbp - 0x14]
   0x400671 <add_u32+43>    imul   eax, dword ptr [rbp - 0x18]
   0x400675 <add_u32+47>    mov    dword ptr [rbp - 0xc], eax
 ► 0x400678 <add_u32+50>  ✔ jno    add_u32+59                    <0x400681>

The overflow flag was not set in x64 even when my number was 0xffffffff(2**32-1). Also technically scanf("%d", &quantity); would not be the bestway to get input here.


is UPnP / NAT-PMP really necessary today? The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and of course the problem of CSRF.

But for some applications it would be good to have such a thing. Other possibilities like statically forward ports seems also less secure because then the port will be open all the time - also you have to maintain static IP addresses for all internal hosts, that should be reached.

The question is now: is it really necessary to have open ports for certain applications like btsync or some kind of instant messanger? Should a program depend on UPnP or is it possible to live without it? (bad question, i know - because in any case i have to live with bad security or bad application behaviour...)

Any program that supports peer-to-peer communication needs to support some form of NAT traversal in order for two computers, both behind NAT gateways, to communicate with each other.  Static port forwarding works, but is too confusing for most people to set up, while hole-punching isn't reliable and may require a trusted third-party server.  This pretty much leaves UPnP and similar router-configuration protocols as the only solution.


CSRF Encrypted-Token pattern protection implementation I'm implementing CSRF protection using the Encrypted Token Pattern (as per https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Encrypted_Token_Pattern).

I understand that the 2 main differences between that pattern and the Double Submit Cookie Pattern are:
1. the token itself is an encrypted token, with expiration
2. the token is stored not in cookie, but instead in DOM element or JS variable (through minified, obfuscated external JS file).

I also understand that just as other prevention methods, this one as well is not safe if your site is vulnerable for XSS attacks.

my questions are:
1. what would be the recommended expiration to give to the token? for example if my site session lasts 12 hours, would it be OK to set expiration of 1 hour, or is it recommended to be limited to minutes/seconds?
2. how do you handle expiration from UX perspective, in case the expiration is short?
for example - if the page was loaded at 0sec, but the action was submitted by the user at 80sec and the expiration is 60sec - the submitted token would be expired and the action would fail.

Thanks,
Gonen

Here is a very condensed breakdown on the differences between the Encrypted and Synchronizer Token patterns:

The Encrypted Token Patterns does not require server-state
It does not require cookies It does not require two tokens
It does not require any effort on the client-side other than including the token
in HTTP requests
It does not require any other application in a subdomain to be XSS-proof

Essentially, the main difference from an implementation-perspective is that the Synchronizer Token Pattern requires 2 tokens, whereas the Encrypted Token Pattern leverages a single token. Michael's answer covers your questions in terms of timeout and UI-refresh. For more information on the subject, I've just posted this entry on how to leverage the Encrypted Token Pattern in ASP.NET. I'm happy to answer any questions you may have on the subject (I designed the Encrypted Token Pattern).


Are RFC 2104 and FIPS 198 compatible with each other? Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?

When testing with two libraries, one implemented against the RFC and another implemented against the FIPS spec, both seem to produce the same results.


Should I know my users passwords so I can check they can logon? I have an issue with support for a system and I don't know what approach to take.
It boils down to the question:

  Should I know my users passwords so that I can check with certainty
  that a particular user can logon and there is not a problem with their
  account?

If I can view my users passwords I can logon as a particular user, but this ability to see their passwords 'feels' wrong and I'm sure that there is a better design to overcome this problem.

Environment:

We have a bespoke Java web application that supports users being able to log in only with the correct user id and password. A systems administrator is responsible for creating users (and also their initial password), but users can go to a settings page to change their password.

Our system stores the usernames and passwords but the passwords are encrypted. A Salt it also applied to the encrypted password. The goal here is that only the user knows their password. We don't want to know it and we don't want to be responsible for it. Hopefully we are following a good password strategy!

Problem:

Alice, a registered user, cannot login to our system for some reason. She gets in touch with support and complains that our system does not work. Often this is user error but we have to follow procedure and check that the system is running.

We can test the system with our own administrator accounts and see that the system is working fine.  We can also look at Alice's credentials and see that her account is not disabled or locked.

But Alice insists that she has a problem and that our system is broken.

Since we do not have Alice's password we cannot log on as Alice so we cannot state with 100% certainty that her account is actually working.  We cannot rule out that the account has not become corrupt in some manner.

So should we have a system where we can log on as a particular individual (Alice) and prove
that her account is working?

We really don't want to be responsible for the users passwords, but without a user's  password how can we have confidence that the system is working? I also don't want to get into a situation where we are asking the users for their passwords since they (probably) share these passwords with other accounts.

I need to present a strong case to management as to how we resolve this sort of situation. They are of the belief that we should know all of the users passwords to overcome issues such as these.

Advice please.

You can replace the users passwordhash with a hash you DO know the password for, save the users passwordhash so you can place it back later and then login to the system with the users credentials.


Does compiling a program in Visual Studio (Windows Forms, VB.NET) leave a MAC address in the executable? I am not making an installer. It is just a form as a portable .exe file. Asking because it's generating links to an external Web API (not mine) that is an openload crawler. Although technically legal (streaming is also legal in my country) I still do not want to be linked to it in any way if it spreads further than my circle of friends. It's very useful if you're as lazy as me and hate ads/malware.

It's impossible to give you a definitive answer to this. The short answer: it is unlikely that your MAC (or IP) address will be included in any executable you compile for the purpose you described, unless you intentionally included it.

In order to be more certain, you would have to do a code review of every dependency you have used in your project, which could be a pretty big job.

As pointed out by Z.T. in a comment to your question, though, one way to make it much less likely would be to compile your code in a virtual machine. Exactly how to do that is beyond the scope of an answer to this question; this guide should be adequate to get a virtual machine of Windows running under Windows.


Scan a web application in OpenVAS As the title says.
How can I do it in OpenVAS?
The other group has a website for example: https://thiswebsite.com/main.php
and in that website there is a web application for example: https://thiswebsite.com/application/register.asp

Both sites are hosted in the same server.
I don't know if scanning the IP address of the server will be enough to know the vulnerability also of the web application.
Upon trying we only get results containing php vulnerabilities.

also, is there a tool where we can see what OpenVAS is doing during the scan?
Something like, you can see what port the tool is scanning currently, how much load/traffic is being thrown on the target.

Thanks.

OpenVAS is not an application scanner. It is a vulnerability scanner. It is worth reading Greenbone's documentation on it here.

If your web application has a vulnerability that OpenVAS has in its database, and you scan the IP address and port that the web app is on, then yes, it should be found.

Greenbone also gives you the progress of scans by IP (but not by port, as far as I can remember)


Can google read my mind? I had just been looking, in a plain text file, using a VI-ish editor, at my notes about garlic.  I did not use the clipboard.  The file is on my HD; nothing is 'in the cloud'.  In the editor, I had searched for both 'garlic' and 'fertil'.  After which, I went to Google and typed "fert", which they auto-completed as "fertilize garlic"!  (Which is what I was going to search for.)

How?  I don't think I've googled anything about garlic in years.  Really.  If they'd finished with "... blueberries", it would make more sense, since I have been googling that recently.  But not garlic.

I do not have chrome installed. (I use Firefox.)  Task Manager (Win 7) doesn't show any process I recognize as google-related.

So, can they be tracking my keystrokes?  Or what?

EDIT: I don't imagine this changes anything, but my browser history (back to December) shows no 'garlic', other than the one in question.  It does show three google 'fertilize blueberries'.

EDIT 2: It could be g-mail?  Not a no-brainer - there are only a few more 'garlic' than 'blueberr...', and the 'blueberries' are winning recently.  But, 'garlic' is there at least, and who can know the mind of God?

There are several possible ways that Google could have found this information.

Demographics

There is a chance that Google has records of all your searches and data, and uses this data to group you with a demographic of users. For example, if you look up things like "bikes" and "scooters" - Then when you type in "ska" - Google may predict that you're going to type in "Skateboards" because many people who type in "bikes" and "scooters" also look up "skateboards."

History

There is a chance that Google has record of you searching about Garlic from years before, and something about the parameters was unique enough to allow Google to make the appropriate guess.

Keystrokes

Theoretically, this is possible but unlikely. Google is installed on your computer though, and with the appropriate permissions, it could read your data.


Internal CA for Digital Signature Solution - PKI Based I'm trying to set up a digital signature solution which would work with a internal PKI.

We have considered Microsoft Certificate Services, but we don't want to rule out any other option to set up a CA.

Do you know what other open-source options do we have?

Microsoft's Certificate Services is a CA. It does its job reasonably well(*) as long as you comply to "the Microsoft way", which means Active Directory throughout, with domains and forests and federation. This usually implies several dedicated servers.

As for open-source solutions, I heard good things about EJBCA. Some people try to do PKI "by hand" with OpenSSL (the command-line tool), but this means that you will basically write your own PKI (95% of PKI is procedures, not software) and this requires a thorough understanding of the arcanes of X.509. This is not a good plan for the unwary.

(*) Except that it does not scale well at all; the CA becomes sluggish after 50k issued certificates, unusable at 300k.


Can you whitelist a single CA for a domain? Simply: For my domain (say example.com), I want my computer to only trust HTTPS certs signed by my personal CA, and ONLY my personal CA.

Otherwise any one of the CAs I have on my computer could create a valid cert for my personal domain and I would never notice.

I have heard of Name Constraints, but it seems to limit what each CA can do, not limit a computers trust for a domain to only a single CA. Are there any other ways that I can accomplish this restriction?

You can use a Certification Authority Authorization (CAA) Record on your DNS zone.
It specifies the CAs you want to issue your certificates from. It can be more than one. And you can even have a special record with a mail address to report violations.
For example, take a look at those records:
example.com.  CAA 0 issue "letsencrypt.org"
example.com.  CAA 0 issuewild "comodoca.com"
example.com.  CAA 0 iodef "mailto:example@example.com"

In this example, LetsEncrypt can issue certificates for example.com, but not wildcard certificates. Only Comodo can issue wildcard certificates. And if someone else issues certificates for example.com, an email should be sent to example@example.com.
So if someone tries to issue a certificate for example.com at VeriSign, VeriSign would check the CAA record, see they aren't authorized to, and inform example@example.com. And Certificate Transparency requires that CAs log all certificates they issue, so any third party can check the certificates on the log and the corresponding CAA Record on the domain to see if any CA issued a certificate when they should have not.


Two-factor authentication w/certificate and username & password? Example scenario:

ActiveSync

Authentication method:

certificate-based authentication AND Active Directory domain username-password

Encrypted on device:

public & private key
AD username & password

Question:

If a certificate is used for authentication for a reverse proxy and a username & password is used for Outlook Web Access, is this considered two-factor authentication? Is it useful at all if the certificate public key is part of the Active Directory user account? What are the arguments for or against this implementation?

Notes:

Isn't this design more insecure (since the AD domain username & password is stored on the device unnecessarily)?
I can't find any papers out there, but I'm sure there is a general acceptance that storing AD domain username & passwords on devices has more potential threats that just a certificate public/private key pair.
Isn't there an option w/Exchange where the certificate issued for ActiveSync can be forced to be only used for Exchange access? (the certificate couldn't be used for HTTPS authentication to an application, for example?)

The question is a bit hard for me to decipher, but I am going to assume you are considering authenticating users by having the user present a username and password, and also having the user authenticate with a private key (client cert) that is stored on the user's device.

Short answer: yes, this is generally beneficial. If the user authenticates by both a client cert and a username/password pair, then yes, I would consider this two-factor authentication.

Even more important than whether it "counts as" two-factor authentication is whether it adds security, and whether it meets your security needs.  Generally speaking, I would say that yes, this approach is useful and does add security, compared to just using username and password.  You haven't provided enough information to assess whether it is adequate to your business needs, but I can share some thoughts on the strengths and weaknesses of this approach.

Security analysis. Generally speaking, requiring the user to authenticate using both a client cert and a username/password pair should be more secure than either one alone.  I'll assume the client's private key is stored only on their device, and the user's password is not stored on the device.  Here are some benefits:

Benefit: Security against social engineering. One weakness of passwords is that, since users know their own password, users can often be tricked into revealing their passwords, for instance by phishing, by spoofed email, by someone pretending to be from the IT help desk, or other forms of social engineering.  Client certs address this risk: the benefit of the client cert is that the private key is a secret that the user does not know, so the user cannot be fooled into revealing it.  An attacker may still be able to use social engineering to steal the user's password, but they won't find it easy to steal the user's private key, so they won't be able to get access to the user's account.
Benefit: Security against password guessing attacks. Another weakness of passwords is that users often choose poor passwords (which can be guessed through dictionary attacks).  Also, users often reuse passwords on multiple sites, which means that a compromise of one site can negatively affect the security of the others.  Client certs eliminate this problem: the private key is chosen randomly by a computer, and thus does not have problems with low entropy.  Consequently, even if an attacker can guess the user's password, the attacker cannot gain access to the user's account.
Benefit: Security against lost devices. One shortcoming of client certs is that the private key is stored on the user's device.  Thus, if the user's device is lost or stolen, the private key is compromised and the new possessor of the device may be able to access the user's account.  Using a password in addition to a client cert addresses this threat.  If the user's device is lost or stolen, the recipient of the device probably won't be able to access the user's account, because the recipient won't know the user's password (assuming the user did not choose a password that was totally terrible).

However, there are also some limitations and pitfalls with this approach which are worth being aware of.

Limitation: Does not defend against client-side malware. This form of two-factor authentication does not defend against malware or spyware on the user's device.  Such malware can record the user's password and also grab a copy of the user's private key, thus capturing all credentials needed to access the user's account.  So, if you are concerned about client-side malware, you will need to use some other approach to mitigate that threat.
Pitfall: Don't store the password. There is a pitfall with this approach.  If you store the user's password on the user's device, then the password just becomes one more secret on the device; the security is then no better than just using a client cert.  In particular, at that point, if the user's device is lost or stolen, all the information needed to access the user's account is present on the user's phone, so the user's account must be considered compromised.  Therefore, if you are writing a custom client app, it is important that you avoid storing the user's password on the user's device.  Similarly, if this is intended to be accessible over the web, you must ensure that the user's password is not stored in their browser password manager.

Caveat. One word of caution about my analysis.  I am addressing the general concept of authenticating users with a combination of username/password plus client cert.  I cannot speak to implementation details about Outlook, Active Directory, Exchange, ActiveSync, reverse proxies, or other aspects specific to the Windows environment, as I'm not familiar with those details.  I can only analyze the general approach.   If I'm missing relevant implementation details, then my conclusions may not apply to your situation.


Does DH parameter file need to be unique per private key? There is scant information available online on the DH parameters used in DHE ciphers (and the kind that's available is aimed at cryptographers, not systems administrators). Basically, as a sysadmin, I would like to know whether the dhparam.pem file needs to be unique per each private key, or can be shared between various TLS sites hosted on the same server.

TL;DR Yes, parameters (not keys) can be shared.

First, don't say "parameter keys". Parameters and keys are related but different. The whole point of parameters is that they define a mathematical group within which keys are chosen and used. Generating parameters is costly (moderately so for DH and DSA, much more so for ECC); generating a key for given parameters is much cheaper. Further, a main point of DHE ciphersuites is that your SSL implementation generates a new ephemeral key for every connection. If you are running just one server with a fixed set of DH parameters, and that server handles more than one connection from one client using DHE, you are already using multiple keys with the same parameters. And similarly for ECDHE, but more on that below.

There is no harm (added) to connection security in using the same parameters for multiple servers as long as the parameters are not chosen or influenced by an attacker or otherwise grossly bad -- in which case they should not be used for even one server. The only case I see for multiple parameters is if you have some (possibly virtual) servers which must support (typically older) clients which can only handle DH 1024-bit, which now has a fairly small safety margin, while other servers want the greater margin -- and/or compliance with standards such as NIST 800-57 if applicable -- of 2048-bit or more.

(Added) One caveat: if you are trying to conceal that servers are under common administration, using shared but otherwise unique parameters gives a clue that their admins might be the same -- but not a strong one, because it could be they are simply using the same software. For example, Apache for a long time had a builtin default set of DHE parameters, and before Snowden and Logjam almost everybody used that default without thinking about it, so all those servers used the same parameters (when they used DHE at all) even though most of them were wholly unrelated and separate. (Similarly, researchers who have scanned the net for common RSA moduli or factors -- which is a security weakness, and a very bad one -- have tracked some of them down to particular hardware or software products, with no other commonality.)

For ECDHE (and ECDHA and ECDH and ECDSA, although those weren't your question) there are standard parameter sets -- commonly called named curves -- that are much easier to use and also more widely/reliably interoperable, so you should not even try to generate your own. As of now it appears best to always use P-256 or maybe P-384, the two standard curves (out of dozens) "blessed" by NSA in its Suite B profile.

See pretty-much-duplicates:

What are the implications of using the same DH parameters in a TLS server?
Can someone explain a little better what exactly is accomplished by generation of DH parameters?
How often should the DHE p and g factors be recycled?

UPDATE: since this has been necroed, I'll add that (for TLS) rfc7919 in 2016 recommends use of standardized parameters (the same for all users, chosen by a variant of the 'nothing up my sleeve' method from IKE rfc2412 & rfc3526), and TLS 1.3 rfc8446 in 2018 requires standardized groups for both classic/integer/Zp/modp/FFC DHE and ECDHE, dropping the 'explicit' EC option in 4492 that no one used anyway.
(And 1.3 generally requires [EC]DHE, because it dropped the plain-RSA and static-[EC]DH forms of keyexchange, though there is still PSK for the few cases that is manageable.)


Is it a good idea to use two salts? Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course.

So for example, if you're using Golang as your backend, would it be a good idea to generate a 20 character long salt from /dev/random, bake it into the Golang binary, and use it with 20 character long salts generated from /dev/urandom that are unique to each user? The hashing process would look like userSalt + serverSalt + password = password digest

The idea behind this is that even if an attacker gains access to your database, they still wouldn't be able to crack passwords because they would also need to decompile your server to get the serverSalt. Even if they got the serverSalt, they would then need to generate rainbow tables, which would take a long time due to Bcrypt.

Thank you in advance!

Salts are not meant to be private anyway. They are meant to avoid dictionary / rainbow tables attacks on your hashes (see Why are salted hashes more secure for password storage? for more details).

hashed_pwd = hash_function(salt + password)

So using two salts serves the same purpose as using one salt.

hashed_pwd = hash_function(salt1 + salt2 + password)

If salt1 + salt2 ==  salt you get the first code back.


Virus Warning after clicking on a Google search results link When researching a high school project on the guillotine, my daughter googled:

  quillotine quotes

One of the top results was:

  topfamousquotes.com/quotes-about-guillotine/

Apparently she clicked on that link from Google, and

that page was opened in the browser
another tab opened in the browser (Chrome on Windows) which looked sort of blue-screen-of-death-ish and opened a dialog saying that we had a virus and we should phone such-and-such a number (supposedly Microsoft support), while some audio played with a woman's voice telling us similar info.

I tried closing the browser tab, but was unable to do so.  I was also unable to switch to the other tab.

I killed the Chrome task and shut down the computer.

Can anyone tell me what was going on, and if I should be scared about re-staring that computer?

You should be okay. It is one of the oldest tricks in the book. The practice is refereed to as Malvertising. The idea is to make it appear the machine is compromised or having issues. They then usually direct you to a fix or a recommended program. However those are actually the real malware. And they may be ransomware, adware, bots, a remote admin tool, or some other malicious program.

Ignoring them and closing them is usually enough to neutralize the threat. However it is a red flag the site is suspicious as they partake in such ad campaigns. So I would avoid the site altogether instead of brushing it off. Especially if they let the advertisers use rich media for ads like Flash or allow them to inject scripts on the site you are visiting.


i, I, o, O packet inspection points inside a Check Point firewall In a Check Point firewall, can you please explain what occurs between the POSTIN (I) and PREOUT (o) inspection points?

Between the POSTIN (I) and PREOUT (o) inspection points most of the policy processing/routing is done.

So the question is actually what is not done between POSTIN (I) and PREOUT (o).

This includes (not a complete list, depends on version and implementation):

Packet sanity checks - IP options and state checking.
VPN decryption/encryption - Packets are decrypted before processing by
rule base.
SecureXL processing – Packets are accelerated and may
bypass POSTIN-PREOUT altogether if packets were already allowed
through policy and traffic can be accelerated.

The iIoO is only default inspection points. For a full list of the in/out chain running on your firewalls run fw ctl chain from SPLAT.

Also see this old but still good reference document http://www.checkpoint.com/techsupport/downloads/html/ethereal/fw_monitor_rev1_01.pdf.

Hope this helps.


series of SSL errors across multiple sites -- reason for concern? Rebooted my rMBP late 2013 recently, and saw a set of SSL errors (unable to verify certificate) across a wide range of sites (google, gmail, mubi, medium) and also in the Calendar app as it tried to connect to Google. Never seen this kind of thing before -- any reason for concern?

never mind, found the answer: my computer's time was incorrectly set on reboot for some reason.


How to prevent attacks against client side validations? I have a login form where am accepting Mobile Number of the User for login.

When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations consist of checks like does Mobile Number starts with 9, 8 or 7, is the length of Mobile Number equals 10, etc.

Once these kinds of validations are done, am checking at Server side if entered Mobile Number and password matches(Authentication).

Since I have some checks in JavaScript, one can view the source and come to know that these kind of checks are there. And one can modify this code and let that to reflect for all Users. For eg., one can change the code which does the check if Mobile Number starts with 9, 8 or 7 and replace 9 with 1(say). So, if one enters Number starting with 9 it will fail.

How to prevent these kinds of attacks? An obvious way is to put these checks at the server side, but I have at least 10 different checks and I don't want to overload server-side checks.
How can attacker change those values in my JavaScript and let that to reflect for all Users?

EDIT : My client side JavaScript code looks like below,

var checkMobileNumber = form.mobileNumber.value;
if (checkMobileNumber.charAt(0) != 9 && checkMobileNumber.charAt(0) != 8 && checkMobileNumber.charAt(0) != 7) {
  //Throw some error
}

To do 10 checks on the server side is likely not going to put any real stress on your server. Unless you are at the point of thousands of request per second, you will be okay. At that point, you would probably implement clustering, etc. Security is always worth the extra cycles. Client side validation is never sufficient. When you think about validation, you should think about filtering RAW HTTP without regard for the fact that the "browser" may have generated the content.

Even if there is client side validation, there are still Man-in-the-middle attacks, where they can change the content of the raw HTTP request after the validation has occurred. Client side validation is really for end user convenience so they don't submit, then get an error message and have to resubmit. I would not consider client side validation in a browser based application to provide any security for processing being done on the server.

As for how an attack can modify your validation, it would depend on many things. For example, what are the dynamic values on the page - do you take parameters from the query strings (GET parameters) without filtering? This could lead to XSS or CSRF attacks because they can change those values and your application will process them. Of course you can protect against this with proper escaping and other techniques. The attack may also have loaded some type of user script or proxy which can inject code into the page.

Since you are using "reflected", you may want to read more specifically about a "reflected XSS", which is just one type of attack vector. From OWASP:

  Reflected attacks are those where the injected code is reflected off
  the web server, such as in an error message, search result, or any
  other response that includes some or all of the input sent to the
  server as part of the request. Reflected attacks are delivered to
  victims via another route, such as in an e-mail message, or on some
  other web server. When a user is tricked into clicking on a malicious
  link or submitting a specially crafted form, the injected code travels
  to the vulnerable web server, which reflects the attack back to the
  user’s browser. The browser then executes the code because it came
  from a "trusted" server.


Issue regarding installation of SHA256 scertificate Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below:

Kindly let me know why am getting the exclamation mark in the yellow triangular box at the Key Usage and why is it showing "Thumbprint alogrithm as "sha1"

Here's the complete look of the certificate data in Internet Explorer.

Key Usage error

The key usage field shows exclamation mark because this field is marked as critical. This is not an error.

  why is it showing "Thumbprint alogrithm as "sha1"

Beacuse the certificate thumbprint (the field below it) is created using SHA1.


Should I worry about a cmd opening and typing "echo off"? I some days see a cmd.exe opening and typing "echo off", then disappear.

My computer is slow, but I'm not sure if a program running with first line "echo off" would be so slow as to let me see it being typed... That's a reason to believe it's a person.

On the other hand, if someone else log into one's pc, it will open a new session, so you'll not see what he's running, right?

I'm not sure if I should worry.

I'm running Windows 10.

Seeing echo off in a prompt will only tell you that a batch script is running, and that commands following the echo off will not be displayed in the terminal.

Check your device for any unknown connected USB devices, such as a 'rubber ducky'.

Go through msconfig (Windows Key + R, input 'msconfig' and run it) you can examine the contents of that dialog for any startup scripts.


Best practice in web application security authentication to avoid bruteforce attack I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that I'm thinking to cover are:

Show captcha after 3 failed login attempts based on Session, but the problem is that some related articles said it should not be based on ASP.NET session as it somehow could be cleared.
Showing the two factor authentication after the captcha, but should I also show the captcha based on the failed count from the previous step? Or I should count from the beginning?
Also I'm thinking of blocking the user's IP for a certain period but that might affect other users working from same IP! What if the hacker has a tool for changing the IP periodically?

Could you please advise me, with references if it is possible, what is the best way to cover these security issues?

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the username that is used to authenticate, not any IP addresses. If there hasn't been an attempt in the past 5 minutes (or if the user authenticated successfully), you reset the counter.

The result is that a user that makes a typo in their password isn't affected the first few times, but any brute forcers will very quickly reach a point where brute-forcing is effectively not viable anymore.

Aside from preventing your web application against brute-force attacks, you should also ensure standard password protection practices like hashing & salting (preferably with PBKDF2 or bcrypt), secure password resetting, and mitigation against username enumeration.  But I assume that, since you post on here, you already know that.


Nginx: How to block IP by hostname regex I'm running a small wordpress site with nginx + php5-fpm.

I have noticed that I get a lot of botnet attacks from IPs with hostnames like:

52-182.static.spheral.ru
208-135.static.spheral.ru
118-239.static.spheral.ru

The actual IPs associated with these machines is quite varied, there isn't really a discernable pattern:

195.62.52.182
195.88.208.135
193.19.118.239

How do I just block requests from all machines with IPs matching the hostname pattern:

*.static.spheral.ru

I'd like to do this directly in nginx, to avoid the additional hop (and drain of machine resources) it would take to do this from the php process.

I believe that blocking by hostname would allow me to pre-emptively block future attacks from the same botnet but from IPs that have not yet been revealed to me.

(P.S. I'm happy to install an nginx plugin / additional software if need be.)

First off, let me start with an important fact: Regex on reverse IP lookups is a bad idea for blocking incoming requests. Reverse DNS is an informational function. Unlike DNS where it is critical for the domain to point to the correct IP address there is little consequence for having the reverse lookup of an IP point to an arbitrary domain. Thus it would be trivial for an attacker to cycle through arbitrary domains in their reverse DNS records to constantly bypass the filter. Relying on reverse DNS for security functions can be classified as CWE-350 (https://cwe.mitre.org/data/definitions/350.html).

In this case the source of the problem seems to be a specific provider so you could just block their entire IP range. Lets start by finding one of the IP addresses (I'm assuming the reverse IP->hostname entry is valid in this case):

~# nslookup 52-182.static.spheral.ru
Server:     192.168.153.2
Address:    192.168.153.2#53

Non-authoritative answer:
Name:   52-182.static.spheral.ru
Address: 195.88.209.9

Now lets determine their IP range/provider:

root@bt:~# whois 195.88.209.9
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '195.88.208.0 - 195.88.209.255'

% Abuse contact for '195.88.208.0 - 195.88.209.255' is 'info@spheral.ru'

inetnum:        195.88.208.0 - 195.88.209.255
netname:        IPSERVER
descr:          Operated by IT Expert LLC
remarks:        Abuse mailbox: abuse@ipserver.su
country:        RU
org:            ORG-Al123-RIPE
admin-c:        SOV63-RIPE
tech-c:         SOV63-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-by:         MNT-SPHERE
mnt-routes:     MNT-SPHERE
mnt-routes:     FIORD-MNT
mnt-domains:    MNT-SPHERE
created:        2009-04-15T12:34:23Z
last-modified:  2016-04-14T09:38:32Z
source:         RIPE
sponsoring-org: ORG-SL202-RIPE

organisation:   ORG-Al123-RIPE
org-name:       Antaro ltd.
abuse-mailbox:  abuse@spheral.ru
org-type:       other
address:        127473, Moscow, 2 Schemilovskiy per., d.5/4., str.1
abuse-c:        AC29892-RIPE
mnt-ref:        ANTARO-MNT
mnt-by:         ANTARO-MNT
created:        2009-04-14T08:02:50Z
last-modified:  2016-02-15T16:45:17Z
source:         RIPE # Filtered

person:         Strekozov Oleg Vladimirovich
address:        Russia, 107031, Moscow, proezd Dmitrosvkiy 8
phone:          +18552100465
nic-hdl:        SOV63-RIPE
mnt-by:         MNT-SPHERE
created:        2012-05-05T22:19:17Z
last-modified:  2014-09-15T13:18:40Z
source:         RIPE

% Information related to '195.88.208.0/23AS28917'

route:          195.88.208.0/23
descr:          IPSERVER
origin:         AS28917
mnt-by:         FIORD-MNT
mnt-routes:     FIORD-MNT
created:        2012-12-24T08:35:13Z
last-modified:  2015-03-10T14:32:44Z
source:         RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.87.3 (DB-2)

Based on this information you can make an official complaint about these attacks to info@spheral.ru and escalate to abuse@spheral.ru and abuse@ipserver.su if your abuse report isn't being addressed.

You can also block future attacks with the range 195.88.208.0 - 195.88.209.255 or 195.88.208.0/23 if you prefer CIDR notation.

I hope this helps.


Are Modern Servers susceptible to HTTP Splitting Attacks Note: I know how HTTP Splitting works.

Note 2: I am not working in WebGoat. I am trying to make this on my own.

I am trying to imitate the HTTP Splitting attack on my machine. For that I wrote this php code:

<?php
header("Location: " . $_GET['page']);
?>

And then I enter the following URL:

http://localhost/webgoat/httpsplitting.php?page=index%0aContent-Length:%200%0a%0aHTTP/1.1%20200%20OK%0aContent-Type:%20text/html%0aContent-Length:%2017%0a%0a<html>Hacked</html>

But then also when I intercept the request using webscarab, I see that these headers are not included in the web server's response.

Additionally I saw in wireshark that the LF sequence (i.e. %0a) is not converted into its ASCII format and is used as a string and not as a line feed.

So, I came to the deduction that modern web servers are not susceptible to this attack. Am I correct ??

This it not an issue with your browser, but instead an issue with the PHP header function being immune to HTTP splitting attacks. The same goes for set-cookie function call.

You can read more about this here https://stackoverflow.com/questions/6287713/is-php-immune-to-http-response-splitting-vulnerabilities

A short excerpt:

 [...] Although response splitting is not specific to PHP, the PHP interpreter
contains protection against the attack since version 4.4.2 and 5.1.2. [1]


Prevent a file from being encrypted Is it possible to prevent a file from being encrypted, or at least being easily decrypted in case of encryption?

For instance; with the Crypto Locker malware attacking users, could you set up a honeypot with a file to somehow reveal the key needed to decrypt the rest of the files?

Or could you construct a file (or pad an existing file), such that encryption is either unfeasible or impossible.

I'm already aware of Known-plaintext attacks, but the article says that ciphers such as AES is not vulnerable to it.

Note: This is not a specific problem I have, merely a fun idea I can't get out of my head.

You could try to put the file on a filesystem which is mounted as read-only. That would at least thwart any attack which uses the normal attack path via file access over the operating system. However, when the malware doesn't use the normal filesystem and does instead attack the raw hard drive devices, this will not help you.

The best way to restore a file which was destroyed by a malware attack is to restore it from an off-machine backup. When you have any valuable data, you should really have a proper backup and recovery strategy.


CURLOPT_SSL_VERIFYPEER and potential security issues In PHP/curl I coded a simple login to a WordPress-based website to login to WP from a mobile client (an iOS app). The website supports https, it is hosted in a shared hosting environment and the certificate they offer by default is a common Let's encrypt certificate.

Problem is anything works just fine but, being not a security expert, I don't understand the implications of some basic security settings: eg. by coding

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

am I potentially causing some security issue? And, if so, what could I do?

Any help is appreciated

Yes, there are security implications. You've completely turned off certificate validation, you'll accept invalid certs. You've opened yourself to MitM attacks, and you might as well transmit over http, because you dropped all the security goodies of https.

You should look into why your server doesn't accept let's encrypt certificates (I'm assuming that's why you turned off the verification) and what you can do about it. Alternatively you can look into getting a cert from another CA.


What if a resolver doesn't support DNSSEC? I've been reading about DNSSEC lately and had a question about DNS-Resolvers installed elsewhere on the internet.

If a client is using a DNS-Resolver that doesn't support DNSSEC will it fall back to using using non-secure DNS? Is this the norm now, or are most resolvers able to perform DNSSEC lookups?

If I sign up for DNSSec for my domain example.com, only Resolvers that support DNSSec will look for the signature.

Resolvers/Clients without support for DNSSec will not look for a signature.  This is equivalent to "falling back" to not using DNSSec.

There are a few wrinkles with how DNSSec is implemented.
Windows 7, for example, provides a "non-validating security aware stub resolver" which means that instead of maintaining trust on the Client, Windows 7 leaves it up to a DNS Server that supports DNSSec to validate the answer it gets to your DNS query.  So, what if you are on Windows 7 but using a DNS server that does not support DNSSec?

You can test this behavior by changing your dns server in Windows settings and then visiting http://www.dnssec-failed.org/, which is a deliberately broken dnssec domain.

I tried it once with a non-dnssec server and again with Google DNS, which supports DNSSec.  My non-dnssec server allowed me to get to the site while Google DNS prevented me from reaching the site.  This proved to me that, as you put it, it will "fall back" to not using DNSSec.


Snowden: "The NSA can remotely turn on your iPhone." Watching the Snowden interview last night, Brian Williams asks him what degree of control the NSA has over smartphones -- in particular, whether or not they can remotely turn them on in order to collect data. Snowden replies "Yes" and goes on to say some scary things about the kinds of data that government agencies can collect.

I've never heard of this before. What kind of mechanism would facilitate this? Do iPhones have some kind of wake-on-LAN feature? Is this an actual feature which is well known, or conjecture by Snowden? I see this question provides concrete evidence in the case of smart TVs in addition to some hazy assertions that "anything is possible" -- has such a thing been demonstrated to exist?

There is a semantics issue at play here that make answering definitively very difficult.

What precisely did Mr. Snowden talk about when he said "Yes they can turn your phone on."

Did he mean activate a device that is in a shutdown (not standby, low-power-ready-to-function) state?

Doubtful.

Did he mean activate a device in a low-power, standby state?

Possibly. This is a no brainer, and exactly one of the features a "stand by" state is intended to facilitate. A carrier or gov agency exploiting it via code or warrant is nothing surprising.

Did he mean 'turn on the microphone or other sensors when an active call is not in progress, to allow recording of ambient noises and conversations near the device?'

Probably, and this is a known capability of service providers and thus government agencies for some time.[1]

[1] http://en.wikipedia.org/wiki/Covert_listening_device#Remotely_activated_mobile_phone_microphones


Are hashes a reliable method of ensuring a file has not been tampered with? Suppose I have a file and that I want to confirm that this file is the same as the original (IE: it has not been altered in any way) using hashing.

If I were to use a hash function that has no known collisions (such as SHA-256 or SHA-512, according to this post: https://crypto.stackexchange.com/questions/3049/are-there-any-known-collisions-for-the-sha-1-2-family-of-hash-functions) and I confirmed that the checksum posted by the author was legitimate, would it be reasonable to assume that the file is authentic if it's checksum matches the one released by the author? Or would there possibly be a way to circumvent this protection?

Yes! This is absolutely a valid method of ensuring files have not been tampered with.

For some background, cryptography as a field provides a handful of useful services when applied. The low-level details of what these are changes depending on who you ask, but they all center around 4 key things:

Confidentiality (so only the correct parties can view the data)
Authentication (so we know who the correct parties are)
Non-repudiation (so the correct parties can't say they didn't do it)
Integrity (so the correct parties get the correct data)

Sometimes availability (making it so the data can be accessed whenever it's needed) is also included in there. (Here's a Microsoft reference on cryptographic services for the curious.)

Different types of cryptography provide different levels of service. Asymmetric key cryptography provides all of them: using (secure) asymmetric key cryptography, only the known correct parties can get the correct data and can't say they didn't make the data. If you don't have the key, you can't get the data, and you can't the key unless you're the correct party.

Hashing is an interesting case, where it's extremely valuable as a concept and a practice but is very limited in what it can do. Of the 4 cryptographic services, hashing only provides integrity. It provides nothing by way of confidentiality, authentication, or non-repudiation, but cryptographically secure hashing is a fantastic way of ensuring that everything about 2 pieces of content are exactly identical. In fact, in some ways that's the only thing hashing can do.


Should I trust signed GOG games, which are not original? First I don't want to promote any kind of pirated software here, just don't know where and how to ask this question.

I find out crackers share games released on GOG (which are DRM free), it's interesting that executables are officially signed, so it's perfectly original software, except it's not bought by those who download.

now my question is, how do they manage to do this? are these games 100% free of malware? it should be if it's signed.

what benefit does somebody have to buy a game and then share it?
I understand pirated games almost always packed with malware, hence not signed (so cracker has some benefit here) but this is different, no benefit.

are there any security precautions regarding such signed software?
and why does somebody let their product be sold on GOG.com without DRM protection in the first place?

GOG is not a pirate or cracking group. Removing DRM is a good thing for anyone owning an original product.

They officially re-sell games and their modifications of the games make the more compatible with latest operating systems. Removing the DRM is not the only thing they do.

I do not like the fact that they add various custom registry entries when installing their games, but it is nothing serious, just new junk reg entries most software today adds (original game installers included).

As for the quality of the products, mostly it is better than the original due to the compatibility fixes they make. Imagine playing MS-DOS era games on Windows 10 and actually having no trouble of any kind.

That does not mean the alterations they sometimes do will be liked by all. For example, I do not liked that for some old MS-DOS games they changed the OSTs from .mids to .mp3s (because of compatibility reasons mentioned above). The music is no longer the original one - and I do not agree with such modifications, even if they are done due to compatibility requirements. These are rare cases, though.

So no, they do NOT contain any malware or anything dangerous. In fact, running their games is safer to your own system compared to the original releases exactly due to the lack of DRMs.

Why the original owners of the games let them do what they do is quite another off-topic long story, but basically it's sufficient to say that it happens because they too do get profit out of this.


Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated?

What kind of vulnerability can be exploited by HEAD method?

Tests:

lynx --dump --head http://www.terra.com.br

  HTTP/1.1 200 OK Server: nginx Date: Wed, 16 Jul 2014 14:44:35 GMT
  Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection:
  close Vary: Accept-Encoding X-Cache-Status: HIT Content-Language:
  pt-BR X-Ua-Level: Set-Cookie: prisma=WEB-20; path=/;
  domain=.terra.com.br Set-Cookie: prisma=WEB-20; path=/;
  domain=.terra.com.br Age: 0 Vary: Accept-Encoding, X-UA-Device,
  X-prisma X-Device-Type: web X-Xact-Hosts: montador=1sh X-Xact-Uuid:
  be9ef8c3-163a-40af-8472-0982226424e1 X-Ua-Compatible: IE=Edge
  Cache-Control: no-cache X-Ua-Device: Lynx/2.8.8rel.2 libwww-FM/2.14
  SSL-MM/1.4.1 OpenSSL/1.0.1g Set-Cookie:
  X-XAct-ID=da20bbf3-3a14-4d86-a23b-6fe36f5adae9; Domain=terra.com.br;
  expires=Wed, 31 Dec 2036 00:00:00 GMT; Path=/ Set-Cookie:
  novo_portal=1; Domain=terra.com.br; expires=Mon, 01 Sep 2014 00:00:0 0
  GMT; Path=/

$ lynx --dump --head http://www.myserver.com.br

  HTTP/1.1 403 Forbidden Date: Wed, 16 Jul 2014 14:44:44 GMT Server:
  Apache Last-Modified: Tue, 01 Apr 2014 05:28:27 GMT Accept-Ranges:
  bytes Content-Length: 4874 Vary: Accept-Encoding,User-Agent
  Connection: close Content-Type: text/html

UPDATED:

The answer of the GET method is also applicable to TRACE, DELETE OR TRACK methods?

Apache conf:

RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]
RewriteRule .? - [F]

"Does doing X improve the security of my system?" -- this is a bad way to approach these issues.

"Does doing X improve the security of my system enough to justify the costs?" -- is the right question to ask.

Does blocking HEAD requests improve the security?  Yes, by about .01%.  Flaws in the code that handles HEAD requests would be harder (or impossible) to reach with requests.

But… the costs of blocking HEAD requests outweigh the benefits in most cases.  Increased traffic to your servers, time to implement, slows down troubleshooting, etc.  Making one change like this isn't a big deal but if you make 50 changes that take 30 minutes and minimize your risk by .01% then you've spent 24 hours for a .5% improvement.  There are probably better uses for your time.


What is more secure: Many subdirectories, or many subdomains? I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:

www.mydomain.net/enroll

www.mydomain.net/admin

www.mydomain.net/

... or I can configure them as a site:

enroll.mydomain.net

admin.mydomain.net

www*.mydomain.net

Since I intend to install SSL on my site, I plan on buying the domain with a SAN Name of "www.mydomain.net" OR "*.mydomain.net".  My question is what approach is more secure?

Is there any guidance as to what the cookie domain should be, or the federation URI?  My concern with the VirtualApplication approach is that the root cookie for "/" may open me up to various attacks.

Similarly, I'm concerned about using a wildcard certificate since it's more expensive and the fact it's a wildcard removes any possibility of an EV cert.  Also I believe wildcard certs do not have a strong warranty (in case of SSL tampering).

Neither is necessarily more secure, but I will give you some opinions and perhaps facts.

Host-extract can determine hostnames, which is also possible via virtual host enumeration.

DirBuster, skipfish, and fuzzdb can rely on forced browsing, directory indexes, and predictable resource locations to find vulnerable directory structures and other issues. Spiders and crawlers can traverse directories, and certain ones can also traverse hostnames (I know that skipfish is capable of this).

In some ways, virtual hosting is more difficult to manage (you mentioned SSL, which is a great point). If this is easy for you to manage, it may end up being more secure because of the ability for directories to leak much more information than hostnames, and to be vulnerable to attacks such as XSS much more easily (as @Rook describes in his answer).

I prefer to at least separate out sites (by hostname) which contain behavior (e.g. Flash, Ajax, Javascript libraries, RIA frameworks, dynamic pages, etc) versus ones that contain formatting or static content (HTML, CSS, XHTML, non-dynamic pages). I think it's also good practice to separate out SSL domains from non-SSL domains. The reason here is because you can provide more stringent controls around contextual-escaping on SSL/TLS hostnames than you would on non-SSL/TLS hostnames. If you separate out Javascript from CSS from HTML, then you know which contextual-encoding must take place on which hostnames as well. I have more suggestions about how to handle XSS in this post where I mention to not build HTML on the server and other tidbits.

Usually this is never up to a security professional, or security team. It's up to the developers, marketers, and SEO experts. They decide what gets a hostname or a URI structure. I will research into this topic further and update my answer as I get new information. It's an interesting question.


Bypass WAF/IDS with SQLMAP? How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this:

python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs

How can I test against WAF/IDs in this case?

Basically, you should use the option -tamper and use the tamper scripts. However, please consult the command line helper, or visit the SQLmap wiki page.


Smooth root certificate rotation I am surprised that I couldn't find one concrete example of how to do root certificate rotation. For example:

Root CA has 2 years validity period
Intermediate CA has 9 months validity period
leaf certificate has a 3 months validity period

The renwal/replace time are:

Root CA is going to be replaced every 1 year
Intermediate CA is going to be replaced every 6 months
leaf certificate is going to be renewed every 2 months

This gives

1 month buffer for service to renew its certificate before the certificate expires.
3 months buffer for intermediate CA to sign new service certificate. By the time the old intermediate CA expire, all the old issued certificates are expired as well.
1 year buffer to distribute the new root certificates to client. We want to give enough time for clients to pull the new root certificate before the old one expires.

Questions:

We have root 1 and root 2 overlapped for 1 year, when should we start signing new CSR using root 2 certificate?

If the one year overlapped time is just for cert distribution, by the time root 1 expired, all clients should already have root 2 trusted. However, by the time root 1 expires, we haven't signed any new server certificates with root 2. It means when the time root 1 expires, all the services will be down. I guess we will need to ensure all services are using cert from root 2 before we can retire root 1? and we also have to ensure all clients have root 2 key before issuing server certificates using root 2? I think that makes sense but in terms of timeline, how should we managed that? In the 1 year overlapped time, maybe we can do 6 months distribution time, and 6 months signing time. so by the time root 1 retire, everything will be running on root 2 already?
And if we are using private CA, (lets say AWS private CA) , do we need to implement a service to ensure things above will happen?
Given that we own all the clients and servers.

I would start from the bottom and work my way up to the root.
Your leaf certificates will be valid for 2 months, that means your current intermediate must still be valid for at least 2 months when issuing a new certificate. In other words, you need a new intermediate in place and ready to use every 4 months (given that an intermediate is valid for 6 months).
You could fit 6 intermediates within the lifetime of one root (24/4 = 6). However, you cannot issue leaf certificates for the old root after its lifetime exceeded 22 months (because the leaf would then be valid longer than the root).
In your scenario, I would create a new root every year, distribute it immediately, and start using it after 4 months.
But why is the lifetime of your root certificates so short? The purpose of root certificates is to have a long certificate lifetime (10 to 20 years) and a root is typically kept offline with the private key stored securely in an HSM or a smart card and only brought online to sign a new intermediate or a CRL. There is no need to rotate a root certificate often.
You could then create relatively short lived intermediates and rotate them often if that is your requirement. It is easy to distribute intermediates (they get sent to the client along with the leaf certificate during a TLS hanshake), but burdensome to distribute and deploy a new root (because this has to happen out of band).


VMWare Fusion Encryption and Snapshotting VMWare Fusion 5 has an encryption feature that I have enabled, with what I would consider a hard-to-brute-force-crack password.

How secure is the data in this VM? If I shut down the VM each time (instead of just pausing, perhaps), will this protect the data on the host machine's physical hard drive?

Sort of a follow up -- I would like to establish a "base" snapshot, and then work, work, work, produce deliverable, and then revert to the base snapshot. It seems all the data for the snapshots are stored in delta files, which I would guess are encrypted as well. Would this snapshot-revert process protect the data in that delta after it has been reverted (deleted)?

I find very little detail on what kind of encryption they use; at best, I find on this page that VMWare Fusion 4:

  [...] incorporates advanced encryption standard (AES 128-bit) technology to allow you to encrypt virtual machine data, such as the virtual machine state including both the disks and memory, as well as the information for the virtual machine configuration.

So, presumably, the encryption covers everything that goes to the host disk, including the contents of the guest RAM in "pause" state. "AES 128-bit" means that it is possible that the encryption is properly applied. But this is not a guarantee. There is nothing on how the password is converted to a key (a common source of weaknesses).

It can be hazarded that the encryption method does not include an integrity check -- because checking a global MAC upon booting or recomputing it when shutting down the VM would entail reading the whole virtual hard disk, which would take a non-negligible amount of time. I don't believe in partial MAC either because that would wreck page alignment, and chaining the MAC together is a difficult subject. Therefore, I deem it probable that the encryption is "just" encryption, and does not detect malicious alterations.

A consequence is that the confidentiality obtained through encryption is probably not robust against attackers who can have some degree of control on the data inside the VM (e.g. people with guest accounts inside the VM). Mutatis mutandi, the same kind of vulnerability plagued the hard disk encryption of PlayStation 3 in earlier versions (encryption of a disk sector was deterministic and did not depend on the sector location, so you could swap around the sectors from a basic PC to bring target sector into locations which were nominally a user file). It is possible that the VMWare people did a better job, because it can be done, but the lack of information makes it difficult to confirm or infirm.

Due to the unavailability of details, I suggest that you rely on solutions where what happens is more obvious, namely putting your VM on an encrypting volume (e.g. with TrueCrypt, which has much better documentation).


Recommendation for implementing encrypted MySQL database To give a quick background, we need to implement a solution where we can guarantee that information is stored encrypted. Access to the encryption data will only be possible through an application that has dedicated access to the database. With every "request" to this application, authentication details will be provided that is then used to create a log of who has read what information and when.

My main requirements are:

MySQL 5.5
Database will be replicated for backup purposes. One should be able to restore from such replicated database, but by accessing a replicated database I should not be able to read any information.

My idea is to use application-level encryption and store explicit encrypted values in the database. That is, on a technical level, the database has no way of knowing that information is encrypted. The actual "structure" of the database (tables, columns etc) isn't something we consider secret. To implement the application-level encryption I'm thinking of applying AES_ENCRYPT/AES_DECRYPT that is built-in MySQL, using a passphrase that is only known by the application.

Does anyone see a problem with this approach? Surely, the passphrase must be kept secret. If the passphrase would leak, I thinking that it would be trivial to re-encrypt all values with a new passphrase. The database isn't expected to be large, performance requirements are low. Development and testing environments would be easy to have, as the only difference would be the passphrase used.

Potential problems -

You have to ensure you use SSL - otherwise the keys are sent in plaintext.
Your code is going to be littered with encrypt/decrypt calls. There is also the overhead of injecting in the key and sending it every time - if the network is your bottleneck then you could have majorly reduced capacity.
The keys have to be in the web application and are constantly sent to the DB server. This means two points of failure instead of one.
This relies on developers being vigilant. If at any point someone adds in a method which sends/receives data without the calls then its going to sit there in plaintext.
Some data may not be possible to encrypt this way without crippling the DB performance since it can no longer look at values directly or store them in a logical order.
Debugging becomes much much harder. Querying the DB to look at what is stored there is no longer trivial.

  I thinking that it would be trivial to re-encrypt all values with a new passphrase

How much data do you expect to have? "Trivial" often doesn't scale. This might involve taking your entire system offline for an extended period of time.


RC4 encryption of torrents safely Torrent clients offer encryption of traffic using RC4, and people consider this very safe to hide traffic information from ISP.

Now since I have a website with SSL encryption, I know that RC4 has a vulnerability. But does this apply to torrents encryption?

How safe is it to encrypt torrent traffic with RC4?

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP.

People are wrong to do so, but not because RC4 is even remotely the weak point. Simply knowing which IPs you're connecting to allows precise determination of the torrent you are downloading by an opponent who simply scrapes trackers or DHT to determine which IPs are in which swarms. This is leaving aside the even bigger problem of your torrent client actively -publishing- your IP in these lists to allow other peers to discover it.


What is closed system esignature? I need to find a solution for one of my clients who is asking me to implement a esignature solution.

I was thinking of suggesting some solutions like DocuSign or EchoSign.

But recently my client said he wants a closed system esignature.

I searched some sites and i found out the basic difference between closed system and open system esignature.

http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfCFR/CFRSearch.cfm?CFRPart=11&showFR=1

The Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.

And the Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.

So does this mean that i can't suggest Docusign or EchoSign anymore? Do i need to create my very own esignature solution for this or is there any libraries or framework available that can ease my process?

The basic difference with a closed system for esignatures is where the esigned document resides.  With SaaS or Cloud based eSigning, the actual esigned document resides on their servers(for some period of time) as they offer the esigning as a service.  You do have methods to retrieve the documents, but "moving" the document from the evault it was originally stored in opens legal questions as to tampering or modifying the document's data.  With a closed system (like the one from my company, eSignSystems) the evault/server that maintains the tamper evident-sealed document (after it is signed) sits behind the customers firewall, not in the cloud.  All security as to access, process and authentication is controlled by the customer.  We believe this ensures a more legally enforeable document should the esignature ever be disputed.


Is it safe to show user a message if account is locked I am working on a web application, security is high priority.
So, if a user has failed to login more than 3 times, the account will be locked.
Should I display a message to the user saying "your account has been locked"? It would help to attacker to get the username.

While @Simon's answer is excellent, I would like to add one additional point. Do not lock out user accounts due to failed login attempts.

By doing so, you are introducing a huge DoS vulnerability in your application. Any malicious attacker can simply lock out a large number of your users by repeatedly failing the login process. You will also be introducing a large support headache because users will fail the login process. Sometimes repeatedly. Remember the third facet of the CIA triangle, Availability. Your application is useless if no one can use it.

Instead, what you should do is throttle the amount of login attempts allowed. Introduce a "time-out" period instead of permanently locking the user's account pending some action on the users part. This will sufficiently stop online bruteforce attacks while keeping the support emails and calls to a sane level.


Password strength in Wordpress Network Very similar to this question at Wordpress Development, but intentionally asked here.

A password, that contains:

at least one capital letter,
at least one small letter,
at least one number and
at least one non-alphanumeric character,

is considered moderate to strong (sometimes even very strong) on all systems, that I've been using so far... except Wordpress, where it is considered very weak.

What am I missing here? Am I dreaming, that password like above are at least moderate, while they're actually very weak (and person, who made Wordpress Network's password strength meter is right) or someone at Wordpress has passed some borders and is treating moderate passwords as very weak, while they're actually moderate?

There are different ways to measure password strength.  Most sites probably do as you think, which is some formula that takes into account special characters, capital letters, numbers, etc. and the combination thereof.  Another way, which it sounds like WordPress might employ, is measuring password strength by entropy.

In information theory, as the linked Wikipedia article says, "Instead of the number of guesses needed to find the password with certainty, the base-2 logarithm of that number is given, which is the number of "entropy bits" in a password. A password with, say, 42 bits of strength calculated in this way would be as strong as a string of 42 bits chosen randomly, say by a fair coin toss."

You can test whether WordPress works in this manner by gauging how strong it calls your password as you simply make it longer (they probable include bare minimum length and complexity).  It is actually quite likely they are using a hybrid version of these.


Is it possible detect a device using a 3G connection? Someone has a hidden smartphone and are using the internet in a 3G connection.

Can I

find where is he? Maybe using a signal detector.
find who is he? Maybe know the MAC number.
just find if someone is using 3G in that place?

There are hardware devices available that will detect a 3G signal. Pulling the MAC address or such involves intercepting the traffic, which has legal implications, so consult a lawyer, and be prepared for them to yell at you for even thinking of intercepting phone calls without a warrant.

There are also devices that can jam a 3G signal. Again, there may be legal implications.

Lastly, as so often is the case in InfoSec, be careful not to get too hung up on technological solutions. This is also a human issue. Have you made it clear, in your policy, your employment contracts, and in your employee communications that using a 3G device will result in immediate termination?


Session-storing an encryption key password For a webapp which stores encrypted files, a public key is used to encrypt random key/ivs, which are used to encrypt the stored files. The private key, used for decryption, is guarded with a password that must be supplied by the user to access the files (the nature of the system is such that only one user has/needs the ability to access the files unencrypted).

In order to prevent the user from needing to type the private key password on every page load, it should be stored (say, for 10 minutes). The question is, where/how to store it?

Putting it in a cookie is analogous to the user typing it on every
request, so that's an advantage. But, then someone with access to
their computer could look at their browser's data and see/retrieve the key in plain text. Plus it's up to the browser to expire it on time (which it could choose not to do)
On the other hand, it could be stored in session data on the server.
This gives better control over its expiration, and means the key
isn't flying all over the internet with every request (obviously,
this is all over https, but still). But that means storing the
password, the key, and the data all on the same machine (albeit
temporarily), which doesn't seem that great either.

Is one of these objectively better? Is there a better alternative than either?

If you are caching the key, there is always going to be some risk.

That risk can be mitigated by:

Restricting the amount of time the key is kept in memory
Restricting to dynamic memory only so that it is lost on page close
Using a hardware or virtual key store to make access to the key easier but more secure. Ubikey or Windows certificate store would be examples.

Private keys MUST NEVER be stored on a server unless they are themselves encrypted with a key that only the user has (making the process rather redundant). Once a users private key is stored on a server, it can no longer be considered secure.


UEFI Firmware integrity measurement We know that UEFI measures the OS bootloader image integrity every time we power on our computer if secure boot is enabled.

With the growing attacks and discoveries of UEFI vulnerabilities, the following questions arise:

I want to know if there's a specification on UEFI that measures the integrity of the UEFI firmware before the Secure Boot process, so It can prevent or avoid flashing attacks to alter the firmware.

Also, I want to know if the integrity of the firmware of the rest of the devices attached to the computer is measured.

My concern here is that if your firmware gets compromised (flashing exploit), the installed malware is able to perform any tasks, thus tricking the early secure-boot protocol.

In most cases the UEFI sits in a non-volatile memory (e.g. Nand memory embedded into the mother-board) , a good approach for such protection against FW compromise may be :

BEFORE first writing of the UEFI FW:

1.calculate RSA singature - has to be a strong implementation of RSA (e.g. 4096 modulus length + OAEP padding scheme)

2.Store both public key and signature concatenated to the FW image

3.if there is an option to use OTP memory block(considerably low-cost HW) - provision SHA-512 of the public key to OTP(optional)

On each loading of FW:

1.Verify SHA-512 of the public key concatenated to the FW image(optional)

2.Authenticate RSA signature

3.proceed with boot

This approach is fairly secured and not very expensive since RSA signature authentication will not consume much time (public exponent has few bits in it and thus the exponentiation will be fast enough).
I didn't find any such scheme in the secured boot specification , I hope that they will add something of that kind in the future.


What is the difference between a Hash Function and a Cryptographic Hash Function? I mean, is it just a matter of "how difficult is it to reverse the function with the current technology"?

Or is there a mathematical concept or property that makes them different?

If it is a matter of "how difficult is it to reverse the function", then is it correct to say that with the progress of the technology, some Cryptographic Hash Functions stop being Cryptographic to be just Hash Functions? Is this what happened to MD5?

Every cryptographic hash function is a hash function. But not every hash function is a cryptographic hash.

A cryptographic hash function aims to guarantee a number of security properties. Most importantly that it's hard to find collisions or pre-images and that the output appears random. (There are a few more properties, and "hard" has well defined bounds in this context, but that's not important here.)

Non cryptographic hash functions just try to avoid collisions for non malicious input. Some aim to detect accidental changes in data (CRCs), others try to put objects into different buckets in a hash table with as few collisions as possible.

In exchange for weaker guarantees they are typically (much) faster.

I'd still call MD5 a cryptographic hash function, since it aimed to provide security. But it's broken, and thus no longer usable as a cryptographic hash. On the other hand when you have a non cryptographic hash function, you can't really call it "broken", since it never tried to be secure in the first place.


Is it safe to use an auto pay feature on my smart watch that stores card info? (So guess what I got for Christmas...)

While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially duplicates your credit card's magnetic info and stores it within the watch (or the phone it is paired with? not sure on that). It is great to just walk up to a payment terminal and bring your wrist close to it and the smart watch does the payment for you by surrendering the stored card info. Not that it is such an awesome feature that I would buy a smart watch for that, but since I have it now I am thinking of using it.

Making my question more generic to all smart watches and IoT devices that have such auto-pay features: from a security standpoint, how safe is it to store your credit card's magnetic info on a smart watch like that? Is it about as safe as storing it on your phone or on a website like Amazon? I worry that a smart watch's OS might be easier for attackers to target since it is more likely to have security vulnerabilities than a more mainstream and major OS like Red Hat or Mac OsX (not saying these don't have major vulnerabilities but still...). So if I have my credit card stored at a bunch of places like Amazon, Android phone, smart watch etc., attackers are more likely to target something like a watch to steal it from. Am I correct in this assumption?

Side note: I confess that I do not yet fully understand how the watch is able to act like a credit card to make payment at terminals. From what little I understand, it stores some limited one-time "payment tokens" that allow it to make payments.

How tap to pay works

Assuming you are not using magstripe emulation (Samsung is one of the few companies that do this), you will be communicating with the payment terminal in a similar way to how a contactless card would communicate with it.

How secure it is

The UK Cards Association says the following:

  Reassure the customer that contactless is secure. Contactless technology uses
  secure technology (the same as chip & PIN) so customers can feel confident
  when using it to pay for items.

  There is a maximum amount for a contactless transaction of £30 (if it is a
  higher value payment the customer will have to verify themselves). The card
  or device has limits built into it when it is being used for a contactless payment.
  This means it can only be used for a certain number of consecutive contactless
  transactions before the customer is required to perform a chip & PIN
  transaction.

  All contactless payments, as with other card payments, are covered by the
  issuing bank in the event of fraud, so the customer won’t be left out of pocket.

  All contactless devices rely on the same underlying, secure transmission
  technology. On mobile devices the cardholder’s payment details are held
  securely and may also be protected using a process called tokenisation
  .
  This substitutes the cardholder’s account number for a ‘token’ value
  that is only valid for transactions from that device

Like all technologies it has advantages and disadvantages:

Advantages:

The card number is tokenised, so your physical card number is not stored on your mobile device
The transactions are online (in the UK), so any fraudulent activity can be detected quickly.
Unlike magstripe, the terminal cannot just replay the data it recorded talking to a card to make a payment with another terminal
As the magstripe is not present, a skimmer cannot record the details and then use them to make copies of the card.

Disadvantages:

Storing your payment details on your device is another copy of the details
Depending on the device you may be able to pay without noticing, (On Android your screen must be on, but you do not need to unlock the device).

References

Guide for retailers:
Accepting contactless and higher value contactless payments


How does Window Hello protect against brute forcing? With my Windows 10 computer, I have the option to set up a PIN with Windows Hello (I believe it's with that program). My normal Outlook password is 15+ characters mixed with upper case and lower case and numbers and symbols, but my PIN is only a few digits. Let's say I had an eight digit password, that's only 10⁸ possibilities. With something like the Hak5 Rubber Ducky, I figure that's probably trivial to crack, especially with some light social engineering/research.

I haven't personally tried inputting a bunch of wrong PINS, but I'm wondering if someone has an official source/literature explaining the security process.

The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which
  is a secure crypto-processor that is designed to carry out
  cryptographic operations. The chip includes multiple physical security
  mechanisms to make it tamper resistant, and malicious software is
  unable to tamper with the security functions of the TPM. All Windows
  10 Mobile phones and many modern laptops have TPM.

  User key material is generated and available within the Trusted
  Platform Module (TPM) of the user device, which protects it from
  attackers who want to capture the key material and reuse it. Because
  Hello uses asymmetrical key pairs, users credentials can’t be stolen
  in cases where the identity provider or websites the user accesses
  have been compromised.

  The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses,
  the device is locked.

(emphasis mine)

Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password


Logging in as administrator in windows 7, is there a downside? I have a very straightforward question. Is there any downside to logging in as an administrator all the time in windows 7?

I mean, it asks you whenever a program asks for permission to do something as an admin so how is this any less secure than logging in as a regular user.

One shortfall I see is that as an admin it does not ask for your password each time this occurs so in theory malicious programs could click the "allow" but for you. But supposedly the dimming of the screen prevents other programs from running. Whereas if you are required to input a password at least the malicious program would have to have this.

Anyway the question comes down to, name vulnerabilities of logging in to windows 7 as an administrator vs as a standard user. Especially with the UAC features that have been added.

The dangers are the same with logging in as root in any system.

Suppose a malware has found a way to bypass UAC, what can it do?
If you're logged in as administrator/root pretty much everything it could ever want to do can be done.

On the other hand if you're logged in with a normal user all it can do is corrupt/infect the users files in the users home and everything else will get denied unless it provides the administrator password.


Can the ISP (or anyone spying on my WIFI network) see which VPN IP I'm connecting to? I know that even when connected to a VPN, the ISP (or anyone who controls my WIFI network) could see that I am connected to (A VPN brand), what I would like to know is would they obtain the exact IP that I'm connected to.

As a side note, what could the ISP really see when I use VPN? I imagine packet size and frequency should be compromised, but what else? (MAC? hostname? DNS info?)

Yes, your ISP would be able to know the entry IP of the VPN you're connected to. They are the ones connecting you to that specific IP, after all. They should not be able to know the exit IP, though, and therefore should not be able to see what ultimate site you're connected to or what you're doing there (this assumes the VPN is encrypting your packets properly, of course).


When using a shared / public VPN, can others on the same IP address log into your accounts? I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account.

Does this work the same way for shared VPNs, especially on sites that are not https? Can someone on the same VPN network tap your traffic and cookies, gaining access to your private accounts?

... can others on the same IP address log into your accounts?

Authentication has nothing to do with the source IP address and thus with a shared use of a VPN - unless the authentication is explicitly done by source IP. For the common use cases you describe (Facebook login etc) the authentication is not done by IP address but by username and password and after that bound to a session cookie which itself is stored only in the specific browser.

This means that users sharing the same browser would be treated as the same but not users using the same VPN or otherwise using the same IP address (like all users behind the some home router). Even different users on the same computer would be different if they are using different accounts and thus different browser profiles.

  ... Can someone on the same VPN network tap your traffic and cookies, gaining access to your private accounts?

Sniffing the traffic is a different scenario from just sharing the IP address. For one, the VPN provider itself could of course sniff all the traffic. Usually sniffing between users in the VPN is not possible but a misconfiguration of the VPN could actually make this possible. Apart from that a VPN only provides protection from the local VPN entry to the VPN exit. Since the VPN exit is almost never the ultimate target attackers could sniff the traffic after the VPN exit too. Therefore you should use end-to-end encryption (i.e. HTTPS) to the target no matter if you use a VPN or not.


How does ransomware connect to the Tor deep web? A lot of ransomware and malware uses deep web services to get their key.
I was wondering if they carry the Tor browser with them or if they use some other technique, as I don't think everyone has Tor installed on their system.

Malware that needs to access a website in the Tor network often employs a Tor2web service.
These free services enable you to connect to an onion site with your regular browser. They provide a gateway to the Tor network over HTTP or HTTPS and connect to Tor themselves. This way, the malware doesn't need to come with a full-blown Tor client.
One of the most popular Tor2web domains is onion.to. You can basically append the .to extension to almost any onion link to access it from the clearnet. E.g., a mirror of The Hidden Wiki can be accessed this way:
https://zqktlwi4fecvo6ri.onion.to/wiki/index.php/Main_Page

While Tor2web is straightforward, there are also cases where ransomware prompts victims to download the Tor browser manually themselves and some malware uses actual Tor components to obscure their C&C communication:

Malware can just as easily use Tor as anyone else. In the second half of 2013, we saw more malware making use of it to hide their network traffic. In September, we blogged about the Mevade malware that downloaded a Tor component for backup command and control (C&C) communication. In October 2013, Dutch police arrested four persons behind the TorRAT malware, a malware family which also used Tor for its C&C communication. [...]
In the last weeks of 2013, we saw some ransomware variants that called itself Cryptorbit that explicitly asked the victim to use the Tor Browser (a browser bundle pre-configured for Tor) when paying the ransom.

(Source)


Open source centralized authentication for heterogeneous network I'd like to centralize all authentication on my network using something like an LDAP server.  Clients consist of Windows and Linux servers.

I'm looking to manage authentication for virtualized servers in a multi-tenant situation. Thousands of VMs with hundreds of organizations. Skillset leans towards Linux, but I do have experience with Windows. It's only authentication I'm looking for.  I do want something that can tie into dual factor auth later on. I use other tools for configuration management. Authorization is handled by the individual virtual servers and left to the tenants.

Please share your experiences with centralized auth!

(This is probably not quite the answer you're looking for.)

I've managed to use Active Directory as an LDAP server and Kerberos KDC successfully in the past. It worked the the MIT Kerberos libraries (available on Linux and OSX clients); obviously, it works with Windows clients too. AD isn't open source, so it doesn't really answer your question.

I've heard doing it the other way (e.g. OpenLDAP server for Windows clients) was a bit more difficult, since the Windows clients were expecting a few specific pieces of information presenting in a certain way (not necessarily well specified), but this comes from informal conversations.

This might be of interest:

http://www.samba.org/samba/docs/man/Samba-Guide/kerberos.html
https://serverfault.com/questions/34022/active-directory-vs-openldap

Without more details regarding what you're trying to achieve, it's difficult to be more precise. The solutions you'll be able to use are likely to depend on the following points (in no particular order):

Is it for a large network?
What skills to the IT authnz team have (more Linux/more Windows)?
Is it only for authentication?
What kind of attributes do you want to use across your machines?
How do you intend to deal with policies and authorization once you've authenticated the user?