XSS on a single page web application I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server.

I can easily inject window.location.reload(true);. The problem is that I can only insert it at a certain location, for example, www.myapp.com/test/, and because it is a single page application, it reloads that single HTML of the website, and starts the website at www.myapp.com/. Therefore, my attack is not repeated, since it needs to reload to www.myapp.com/test/ in order to call the reload or refresh method again.

Any ideas how DoS attack through XSS can be achieve in single page applications where the URL defaults to homepage after refresh?

Can you create a bunch of Iframes that each have a src of www.myapp.com/test/5? or a programmatically create a bunch of

Those iframes might end up being a ddos of the browser instead of the server but the img ones might work.

then there is ajax which you should be able to simply call in an endless loop and send requests from JavaScript to myapp.com/test/5

This is from a jsfiddle (source) that calls a URL 5 times (what if it called it 50000 times?):

var counter = 0;

window.getData=function()
{
    $.ajax({
        url:'http://whisperingforest.org/js/getQuote.php',
        async: true,
        dataType: 'jsonp',
        success:function(data){
            $('.quoteList').append('
' + data +'
');
            counter++;
            if (counter < 5) getData();
        }
    });
}


ReverseProxy and PCI Compliance My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details.

I am writing a (Single Page Application/end-to-end javascript) website for them that is on a different domain than this billing gateway so naturally calling this service from javascript in the client (browser) violates the same-origin policy.

In the past, I have used proxies to get around same-origin policy issues. I would like to do something similar in this situation. However, I don't have access to the trusted internal network on which PCI compliant billing gateway resides so I can not put my proxy server there.

Is there such a thing as a reverse proxy that does SSL on both sides? Or how would I go about setting up a PCI compliant proxy solution?

I see two problems. Firstly, if the javascript handles the credit card details, the server providing the javascript must be PCI-DSS compliant. Secondly, any reverse proxy that abstracts/merges the underlying domains must also be PCI-DSS compliant, otherwise an attacker can simply subvert the proxy to point elsewhere.

So a PCI compliant proxy would be the best way to go. See 'How a reverse proxy can help you achieve regulatory compliance' section of this article. Or better yet, read this article about scoping the PCI compliant environment.

The basic principle is the same as any proxy for PCI-DSS: You secure the proxy, you secure network and you secure any application and database servers. As this list of servers and asset can grow quite quickly, the recommended approach is to only have one user<->company relationship/route for transferring credit card details. Your new application creates another relationship/route, hence the extra work.


Should I be disabling Java? First it was Apple, now it's the US government...

U.S. urges users to disable Java; Apple disables some remotely
New malware exploiting Java 7 in Windows and Unix systems

How serious is this "unspecified vulnerability"? Should all users be disabling Java until we know things have been patched?

Edit:- Some people have asked that the following distinction is made: Java is completely different to Javascript, so any recommendations below pertain only to Java.

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy.

For this specific hole, there are a few details there. It is all about the Java applet model. To understand:

Java is a programming language and a huge library of code, all running within a virtual machine. The VM means that code is much easier to port between architectures. So far so good; the same applies to several other frameworks, including .NET.
The strong typing of Java and the VM conceptually allows an extra feature, which you cannot have (at least not easily) with more bare-metal languages like C++: the possibly of safely running potentially hostile code. With C or C++ or assembly or whatever, such a feat requires some help from the hardware and the operating system (namely the privilege levels of protected mode, or, for the extreme cases, specialized virtualization opcodes). Strong types and the VM allow for a software-only sandbox solution, which could be integrated in, for instance, a Web browser.
Java applets are just that: a sandbox for running Java code which is downloaded from the Web, as part of a Web page. However, the people at Sun/Oracle didn't know where to stop, and were a bit too eager. Since sandboxed code is severely limited in what it can do, there are only two choices: learn to live with limitations (that's what Javascript developers do), or include in the sandbox an escape mechanism allowing some applets to do out-of-sandbox things, such as reading and writing files, opening arbitrary sockets, and running native code. The VM allows that, provided that the applet asks nicely, which entails fine-grained permissions, a digital signature and an explicit authorization popup.
It turns out that managing this system of "permissions" is very hard to do for the VM and library; namely, the library is very rich in code which offers access to various OS facilities, and they must all be plugged without forgetting any. There are hundreds, maybe thousands of "sensitive calls" to care about. The long history of security holes in Java is a testimony to the nigh impossibility of the task. If the competing technology from Microsoft (Silverlight, built over .NET) seems a bit less impacted, it is mostly because it is much less used worldwide, giving it far less exposure.

For the time being, the safest thing to do is to disable support for Java applets in your browser. Note that Java applications, and in particular anything which runs server-side, are not impacted.

The problem of safely running hostile code, while simultaneously maintaining rich functionality and fine-grained access control, is not a new problem. What this yet another Java mishap shows is that this old problem is still unsolved.


Is using video editing software to fill SSD with junk video secure? I'm about to sell an old 128GB external SSD, and I've read various guides saying it's difficult to be sure that data is erased when using traditional zero-fills etc.

I'm on Mac OSx, and I got the idea to use Final Cut Pro X to generate very large uncompressed video files of junk (just a plant in my window), and export them straight to the external SSD. A 2 min video clip resulted in a 35GB 1080p, uncompressed, video file! So 8 minutes should be enough to fill the drive, without using any duplicate data.

This sounds like it should be bullet proof, but there always seem to be unexpected "gotchas" when it comes to erasing data, especially on SSD's... Is this method enough to remove any previous data from the drive?

Generally, it is suggested to investigate if the SSD vendor advises a method for secure erasure of their product.

Often a security feature (like ATA SECURE ERASE) is present that will help you achieve secure erasure. The remaining risks here are:

The vendor built in method could have bugs and be subject to vulnerabilities and attacks
As this often involves discarding cryptographic keys from the SSD but leaves the cipher text untouched the standard of encryption we use at the present moment will eventually become subject to attacks in the future when computational resources are available to brute-force keys

While your method seems generally feasible I think we cannot answer whether this will fully wipe all data as it largely depends on the vendor implementation.

I think one known risk is that there is old data remaining on the media in unaddressable areas which would not be touched by you writing a video file.

However, maybe the more relevant question is for you to judge how sensitive the data is that was stored on the SSD? This should help to evaluate how thorough your erasure needs to be to arrive at the level of sanatization of the media you are looking for.


Securing Java REST Api for Saas usecase I'm building a Java RESTFul API with Jersey2. The API will be consumed by Developers. The developers should gain access to the endpoints via an access_token (preferably non-expiring).

I had a look at Kong and other oauth2 implementations but i get the feeling that this might be overpowered.

So i think a token-based RBA authentication should be fine for the beginning. The problem is, that this approach relies on expiration dates for tokens. But as i said - this is not what i want. So is it ok to have non-expiring tokens?

Also - what do you think? Is Oauth2 essential for my usecase?
And how difficult would it be to later on migrate from a simple security concept (RBAC with access tokens) to Oauth2?

I'll begin by answering with two other questions :

If you roll your own solution, how much time will it take you ?
If your API is public by design, how fast can your developer understand a non-standard authorization mechanism ?

OAuth 2.0 has the benefit of being pretty popular so you can expect your clients (developers) to already know it. You don't need to document all the gore details, you can just point beginners to the specs and existing tutorials.

Also if you're using Java, deploying your own authorization server with Spring Security + Spring Boot or Spring Cloud will be a matter of days, even if you start from scratch. Securing your resource servers (HTTP API) with Spring Security is also made easy.

From a very pragmatic standpoint, OAuth 2.0 is less overkill than building your own solution.


How do I verify a GPG signature attached for a cleartext email using the gpg command line? I received an email in cleartext from someone with a signature.asc attached. Looking at the raw source for the email, it was sent with Apple Mail + GPGMail. Reading the message in Thunderbird + Enigmail successfully shows up as a GOOD signature in the Enigmail details when opening the message. The text is not ASCII armored.

However, attempting to verify the message with gpg results in BAD signature. Using the attached (detached) signature file, I tried the following input files with no success:

Full raw email with all headers (this of course should not work because the mail servers add headers after the sender has finished composing and signing the message)
Raw email file without email headers (email starts at the From: header)
munpacked mime parts individually (the ascii part and the html part as message inputs)

Stumbling upon this email made everything clear (as well as glancing at RFC3156).

The email is of type multipart/signed which

  The multipart/signed body MUST consist of exactly two parts.  The
     first part contains the signed data in MIME canonical format,
     including a set of appropriate content headers describing the data.

  The second body MUST contain the OpenPGP digital signature.  It MUST
     be labeled with a content type of "application/pgp-signature".

The signature signs the first part. The first part was actually a multipart of the text and html parts. Every email client I looked at didn't make this heirarchy clear and flattened it into three parts (text, html, signature).

Verifying the signature just using the raw MIME text of the first multipart successfully verified.


Are any major websites offering ECDSA authentication? At the time the Cloudflare blog post “ECDSA: The digital signature algorithm of a better internet” was authored, Cloudflare was apparently one of "fewer than fifty" users of ECDSA certificates on the web. It seems they have since stopped (via ssllabs.com test).

I briefly surveyed several other major web properties using that tool (Google, Yahoo, Microsoft, Facebook, Amazon, Tumblr).  Only Google seems to offer an EC key and ECDSA suites.

When I test locally, though (with cipherscan or openssl s_client -connect google.com:443 -cipher ECDHE-ECDSA-AES256-GCM-SHA384), I seem unable to handshake ("no peer certificate available").

Is anyone able to connect to Google (or another popular site) using an ECDSA ciphersuite?

Facebook

They have deployed both ECDSA and RSA certs.

See SSL Labs report

Update 2015-11-10

About 7% ECDSA support.

Hubert Kario of Red Hat Security scans (used to scan?) the Alexa Top 1 Million sites using the cipherscan tool. This is the relevant table from his 2015-06 scan:

Certificate sig alg       Count     Percent
-------------------------+---------+--------
None                      18593     3.7038
ecdsa-with-SHA256         33851     6.7433
sha1WithRSAEncryption     147349    29.3529
sha256WithRSAEncryption   320910    63.9273
sha384WithRSAEncryption   4         0.0008
sha512WithRSAEncryption   9         0.0018

Alexa Top 10: 5/5 split

Here's a snapshot of the Alexa Top 10.

Google.com: Yes.
Facebook.com: Yes.
Youtube.com: Yes.
Baidu.com: No.
Yahoo.com: No.
Amazon.com: No.
Wikipedia.org: Yes.
Qq.com: No. No SSL/TLS at all
Twitter.com: No.
Google.co.in: Yes.


Has a plaintext password ever been used in a court of law as evidence to a crime? Regardless of how the password was obtained (decryption, bad hashing, confession):

Are there any prior known cases where the contents of the password was used to prove motive or guilt?

Or, looking at it from the perspective of an ISP doing anti-fraud checks: suppose 2 accounts have the same password hash; assume they also chose a very complex password, so any collision is unlikely to occur by chance.

Then the secondary account does something bad.

Is it conceivable that the other account would be investigated just because of the similar hash?
If the hash was unique enough could it be considered culpable by association?

Technically this could happen. Although I couldn't find any recorded cases.

Under key disclosure law several countries can obtain your decryption keys, if those keys were incriminating or a confession, there is nothing barring them from using it against you in court.

In the US, the 4th (edited as per comment!! my bad.) amendment protects you from giving up an encryption key until it is ruled you have to by judge and jury. If the key is obtained before the ruling it can be thrown out and not used against you.

As for the identical hash thing - if you have identical hashes - your password scheme sucks and can be easily cracked with a rainbow table or john the ripper. If the password is cracked/guessed and contains incriminating evidence it can be used against you or the FBI will not hesitate to boast that they guessed it and did not require a ruling.


Safely share passwords between users I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc...

I just want to layout my thinking as to how to use all of these, to create the secure application - and hopefully someone(s) can point our flaws or direct me if I'm seeing things wrong:

Hashing

So, first of all, I need to store hashes of account passwords (these are the account that log into the application to view the shared passwords).

After reading around, my understanding is that to make a hash "more secure", you need to use scrypt or bcrypt or pbkdv2. I've found an implementation of these in "CryptSharp" (hopefully this is a secure implementation) - also after further research (http://www.tarsnap.com/scrypt/scrypt.pdf) it looks like scrypt is a more secure way of creating a hash.

Encryption

As the data will be shared between users, I shall need to make sure that the system uses a master encryption key for the entire project, and that this is stored securely.

My thinking here is generate an encryption key and initialization vector (3 of them - I'll explain why) - these will be generated with RNGCryptoServiceProvider, and all 3 will be concatenated into Key1|IV1|Key2|IV2|Key3|IV3 so that they can be split and used with the encryption algorithms.

I need some way of storing this concatenated string of IVs and Keys so after some research I came across Microsoft's Data Protection API (ProtectedMemory.Protect( secret, MemoryProtectionScope.SameLogon ))  - my understanding with this, is that the App Pool will need to run under a user account, and "load profile" set to true. The resulting encrypted string will then be stored in an XML setting file.

With regards to encrypting the passwords to be shared, I read about cascading encryption (used in TrueCrypt). The encryption algorithms TrueCrypt uses are AES, TwoFish, and Serpent. I've found an implementation of these (http://www.bouncycastle.org/csharp/ - which again, I hope is a secure implementation). This is where the 3 IVs and Keys will be used; so effectively the data will be encrypted like so: Serpent(TwoFish(AES(data,key1),key2),key3).

Thoughts?

So, these are my ideas to create a secure data storage system; am I over looking something? have I misunderstood something? should I be doing something more?

I appreciate any advice on this.

Don't invent your own cryptographic protocols. It's easy to come up with all kinds of ideas and combine all kinds of techniques, but doing this properly is exceptionally hard and requires a lot of experience and extensive peer reviews. This isn't something you can do on your own in a few minutes, especially if you don't happen to be a cryptographer.

What confirms this impression is that you jump straight to random implementation details before you've even analyzed the problem and specified the goal. How is the nested encryption feature relevant at this early stage? This all sounds rather chaotic and vague.

I strongly recommend that you first get clear about the bigger picture and then choose an established solution for this specific scenario.


gpg2: How to get rid of "Please insert card with serial number", getting the same key from a different card / Yubikey I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers.

After switching the keys when I try to decrypt something (e.g. with pass), I get a popup:

Please insert card with serial number XXXXXXXXXX

(This is with GnuPG version 2.2.17.)

How can I get rid of the popup, telling gpg to ignore whatever the serial number of the smart card is that I used so far, and instead to look for whatever card has the private key that I'm trying to use?

Solution

Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.

You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.

If all your private keys are on external cards like the Yubikey, you can delete them all using:

rm -r ~/.gnupg/private-keys-v1.d

See here for more information about the private-keys-v1.d directory.

After the deletion of the keygrips, it seems beneficial to run

gpgconf --kill gpg-agent
gpg --card-status

to restart the gpg-agent and reload the card info.

Extra info: What happens when you don't restart/reload (for people who search for these error messages)

If you do only gpgconf --kill gpg-agent, the next decryption may show

gpg: decryption failed: No secret key

Reloading the card info fixes that.

If you do only gpg --card-edit, the next decryption may show

gpg: OpenPGP card not available: No such file or directory

Restarting the agent before that fixes that.

Personally I consider that a bad user experience, ideally GPG would automatically figure that out, but I don't know any technical details about it.


Can running a browser in Windows Compatibility Mode be a security issue? I have several clients that are having trouble logging into vendor's web service. When talking to the vendor about the issue, they told me to set them up with Chrome running in Windows XP compatibility mode. This is how they want the client to change the compatibility settings:

I have some reservations about this fix workaround, given that Microsoft does not support Windows XP anymore (unless you pay for it). Can running a browser in Windows compatibility mode be a security issue?

There are a few things that are enabled when setting compatibility mode, such as shimming.

There are also other changes that may impact on security:-

  There have also been some other changes from Windows version to Windows version. In older versions for example, if a programm [sic] loaded a DLL, the search path for the DLL also included the current directory. This is a security issue, so newer versions of Windows by default don't search in the current directory. With the proper shim you can simulate the old behaviour.

This would normally only be a security issue for the local machine if an unprivileged user had permission to copy a malicious DLL to the Chrome installation folder it could be loaded in place of the normally loaded DLL and be executed when a privileged user next ran Chrome (although UAC would still mitigate the damage as this will still apply in compatibility mode).

The attacker would of course need access to the machine, and would need a perfect storm of misconfiguration to succeed. There are no vulnerabilities in the compatibility mode changes that I know of that would enable an attack on the client to succeed from the web where it would not normally succeed without compatibility mode.


What are the security risks of USB fingerprint scanners in Windows 10? Hi I have a Lenovo laptop encrypted with Bitlocker, which I also use a fingerprint scanner with. Bear in mind I'm not working with super-secure information, more the level that a developer/manager for a business would have. What are the potential issues with fingerprint scanners and Windows 10 Hello

Of the kind built into a business laptop
Of the external USB kind

The kind of things I'm curious about are:

Is there malware that can intercept the external USB type of scanner as it sends the fingerprint to the computer
Where does Windows 10 Hello store the fingerprint information
Are there are settings in Windows Hello which sync it to the cloud/AD controller on the network inadvertently

Good to hear to are considering biometrics and want to learn more about them.

Using a fingerprint scanner is generally considered (in a windows hello context) to be a convenience not an increase in security, however, I can envision several situations where security could be increased or decreased depending on the situation.

Potential issues

Fingerprint scanner are generally considered to be spoofable, meaning a sophisticated attacker could make a fake fingerprint or even use some other trickery to login as you. See this article
If someone makes a fake fingerprint of you,you can't change your fingerprint. This is a problem with all biometrics, they are tied to you and unchangable.

As to some of your other Questions:

It doesn't matter if you use a external USB one or the built in one on your computer, they work the same way. If malware is on your computer intercepting your devices then you are already compromised and the app could be recording your keystrokes or pulling your passwords directly.
Windows Hello treats your biometric data about equivalently to the "PIN" on your computer, a local replacement for your password. The biometric data is local to your computer, and is not synced to the cloud. Microsoft considers that someone is physically present attempting to login to your device to be a factor in the multi factor authentication scheme that justifies their windows hello approach.
Basically, if you have an attacker physically attacking your device between your uses, you are in trouble. They could break your fingerprint scanner, and install a tiny camera to record you typing in your password. Or physically insert a keylogger or a host of other attacks.
It could increase your security if you setup the fingerprint in a secure location and only after use your fingerprint in public places, then an observing attacker would not be able to get your password from recording you logging in for example.


Strategies for signing sections of a text file to prevent tampering I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable:

I have a collection of chef recipes in git, defining labs e.g. a jenkins CI setup, which people will be able to fork and tailor to their own use
However, I can forsee circumstances when someone may want to add certain immutable sections of the cookbook, e.g. firewall settings
What strategy would make sense to lock certain sections of the file to validate that it hasn't been changed, while allowing arbitrary changes outside that
Ideally it would also solve the ability to obfuscate the sections if needed

Would I be adding my own DSL into the code - with a checksum for each protected block - pre-process it to unwrap and validate it before passing it to chef?

e.g. My first attempt at a format - still doesn't solve the problem of people just deleting all the signed sections - unless every file has to be signed

of course I might be thinking of this the whole wrong way around.

#---SIGNED-FILE SHA-256 507e74380188c07bad2fa66acb8cbbeeb63f84fcee5fd639499575654239cd49

#
# Cookbook Name:: jenkins
# Recipe:: default
#

# https://wiki.jenkins-ci.org/display/JENKINS/Installing+Jenkins+on+Ubuntu
# This is super-simple, compared to the other Chef cookbook I found
# for Jenkins (https://github.com/fnichol/chef-jenkins).
#
# This doesn't include Chef libraries for adding Jenkin's jobs via
# the command line, but it does get Jenkins up and running.

include_recipe "apt"
include_recipe "java"

#---SIGNED-SECTION-START SHA-256 e4d3d02f14ee2a6d815a91307c610c3e182979ce8fca92cef05e53ea9c90f5c7
apt_repository "jenkins" do
  uri "http://pkg.jenkins-ci.org/debian"
  key "http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key"
  components ["binary/"]
  action :add
end
#---SIGNED-SECTION-END

#---OBFUSCATED-SECTION-START SHA-256 5f536f2137dc7e2c5817de861d1329ead72b1e9d2dbb9dbe181ec7bc274dddeb
YXB0X3JlcG9zaXRvcnkgImplbmtpbnMiIGRvCiAgdXJpICJodHRwOi8vcGtnLmplbmtpbnMtY2kub3JnL2RlYmlhbiIKICBrZXkgImh0dHA6Ly9wa2cuamVua2lucy1jaS5vcmcvZGViaWFuL2plbmtpbnMtY2kub3JnLmtleSIKICBjb21wb25lbnRzIFsiYmluYXJ5LyJdCiAgYWN0aW9uIDphZGQKZW5k
#---OBFUSCATED-SECTION-END

package "jenkins"

service "jenkins" do
  supports [:stop, :start, :restart]
  action [:start, :enable]
end

I don't think I understand I understand the problem.  To help you think and explain more clearly about what you are trying to achieve, I suggest you decide: What are the legitimate actions that you want to allow?  Also, what are some examples of illegitimate actions that you don't want to allow?  Who do you want to be able to modify the non-locked sections of the file?  What are you trying to protect against?

My first suggestion would be: break the file up into multiple files, and make some modifiable and some not.

However I don't really understand what your goal is.  Anyone can make a local copy of the file and modify any part of it they want.  Nothing you do can prevent that.  I don't see how signatures help, because anyone can just ignore the fact that the signatures are invalid and continue to use the file (if necessary, they can modify the code that checks the signatures to ignore the invalid signature).  So it sounds on first impression like you may be trying to solve an unsolvable problem -- something akin to making water not wet.

If you are talking about preventing modification to the version of the file stored in git, why are you giving people you don't trust write access to your git repository?  Seems like you should just avoid doing that.

Edit 9/29: In your comments, you clarified the problem setting.  Now I can give a better answer:

Split the file up into two parts or two files, one intended to be changed and one not intended to be changed.  Label each part clearly, and indicate which part/file should be changed and which should not.

And, realize that no technical measure can force them to include the parts-you-want-not-to-change without changing them. This is not something you can solve through technical means. Instead, your goal should be to elucidate your intentions about which parts they aren't supposed to be changed. Then, you will have to rely upon social means to keep people from doing what you don't want them to do (i.e., you will be relying upon other people's good will, or upon the threat of negative consequences if they deviate from your recommendations).


Why don't call center scammers accept bitcoins? I've watching few YouTube channels which call scam call centers mostly based in India and waste their time basically Including a channel called Kitboga and another one called The Hoax Hotel.

A common theme is that all want some prepaid card like Itunes card in order to fix your PC or  pay your IRS taxes whatever. And all refuse to take bitcoins.

In fact, The Hoax Hotel did a video on that, tried real hard to make a scammer accept a bitcoin payment but the scammer declined, although he seems to be well aware of what bitcoin is.

That seems odd to me, a criminal organization, refusing to accept the de-facto currency for criminal activities. I have yet to watch a YouTube video where a scammer accepts bitcoin.

While the scammers might not know about cryptocurrency, their management must be well aware of them and I guess they should have told the employees how to use bitcoins like they teach them their scripts, I wonder why they haven't? Is it safer to get paid through prepaid cards?

Most people simply don't know how to buy bitcoin, and would probably require being walked through the process (expensive). Those few who do know how to buy bitcoin tend to be more tech-savvy, and perhaps less-easily fooled by call center scammers. A lot of people also associate bitcoin with criminal activity, which could also make it more-difficult to trick their marks into believing their call is legitimate.

From a scammer's point of view, it's best to use a few non-reversible payment methods which the most people are familiar with, and which the low-level call center scammers can verify easily. Compared to Western Union, Green Dot MoneyPak, and gift cards, bitcoin is just not that good an option.

You will find bitcoin and other cryptocurrency is often accepted by ransomware though.


Analyzing pcap on the fly I want to create a mini sniffing network. I asked in a previous question about how to capture and decrypt packets in real time.

Now I want to analyze it, and I am developing a script for it but can I do it on the fly? Like when dumpcap is running and writing to file can I read it at the same time and analyze new appended packets? Or is there a better way of sniffing and analyzing at the same time?

I will use two raspberry pi 2's. One for sniffing and saving pcaps and other for reading, analyzing and populating a database with extracted info.

As the documentation for dumpcap shows you can simply write to stdout, i.e. dumpcap -w -. Then you can put whatever you want after this, i.e. something like

 dumpcap -w - | your-own-analysis    # analyze it directly
 dumpcap -w - | nc ip port           # send for analysis to some remote system


What is the procedure to follow against a security breach? Last week, a couple of guys were fired from the company I work for; all of them had access to sensitive information.

One of them erased all the e-mails from the mail server, sent a massive e-mail to most of our customers, insulting them, and telling them not to do business with us because "We suck". Literally.

The system administrators failed to remove their credentials for the servers when they were fired, a very common mistake unfortunately. The current system administrators do not seem to know what to do under this scenario. Neither do I to be honest, and I would like to know what is the normal procedure to follow in case of a security breach, so I can make a recommendation to implement it in the company.

Serverfault has a great canonical answer on "what should we do now to clean up this mess", so I'll take a stab at "what should we do to prevent this happening ever again".

Your organisation needs to establish an "employee leaving" process and stick to it.
Your organisation will need to work out if they should treat all terminations the same, or differently between "hostile" and "non-hostile" terminations, or differently between regular employees and those with access to sensitive information.
IT needs to document the procedures for closing every account an employee might have, including accounts IT doesn't control.
IT needs to keep an employee account register that lets them instantly identify what accounts any given employee has. (This can be a lot of work.)
IT needs to have a list of all generic accounts and who knows the passwords to them. They also need to remove as many generic accounts as possible, ideally all of them.
When the decision is made to "hostile" terminate, HR need to meet with IT in advance and plan so the accounts are all disabled while the employee is learning that they have been terminated.
At the same time as the accounts are closed, their computer hardware and ID badges need to be secured.

IT, HR and senior management all need to commit to the above.

In addition, it also sounds from your question that your backup procedures are not good — fix that. (Don't forget to secure your backups. In particular, try not to have any people with permission to delete both the originals and the backups.)


What are the vulnerablities for revealing IP addresses in code One of my developers left the IP inside his code :

The code is as follows :

[WebMethod]
public string UploadFile(byte[] f, string fileName)
{
    try
    {
        MemoryStream ms = new MemoryStream(f);
        FileStream fs = new FileStream("http://103.16.141.197/ProBuildIndia/Operator/Sample/" + fileName, FileMode.Create);
        ms.WriteTo(fs);
        ms.Close();
        fs.Close();
        fs.Dispose();
        return "OK";
    }
    catch (Exception ex)
    {
        return ex.Message.ToString();
    }
}

If you note in his code he revealed the 103.16.141.197.

The known vulnerabilities I can think of are:

The attacker can run a nmap scan and detect which OS and ports were open
If directory listing was not properly implemented then it would be a issue of browsing directory
If the application was publicly accessible there were possibilities to copy the application design

The above were the known vulnerabilities that I could think of for revealing IP, but what are other vulnerabilities?

I think the vulnerabilities are the same for all Internet-accessible servers, the only increase in risk is that the code exposes some specific information about how to interface with it, and because it is "in code" the programmer might not think to protect it as well as they otherwise might for a server that is explicitly advertised.


Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection? It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server side it is desired to enforce a strict type HTTPS for all connections for the privacy of request headers and as a result HTTPS redirections are used. The problem is that any initial request where the client does not explicitly request HTTPS will be sent unencrypted. For example, client instructs browser with the below URL command.

google.com/search?q=unencrypted-get

google.com will redirect the client browser to use HTTPS but the initial HTTP request and GET parameters were already sent unencrypted possibly compromising the privacy of the client. Obviously there is nothing full-proof that can be done by the server to mitigate this vulnerability but:

Could this misuse compromise the subsequent TLS security possibly through a known-plaintext
attack (KPA)?
Are there any less obvious measures that can be done to mitigate this possibly through some
DNS protocol solution?
Would it be sensible for a future client standard to always initially attempt with HTTPS as the default?

google.com will redirect the client browser to use HTTPS but the initial HTTP request and GET parameters were already sent unencrypted possibly compromising the privacy of the client.

Correct. Except for HSTS preload.

Could this misuse compromise the subsequent TLS security possibly through a known-plaintext attack (KPA)?

Not exactly. If this event is exploitable, the desired outcome for the attacker is instead to influence the redirection towards something that they control so that they can "impersonate" the TLS endpoint. It would be much more difficult to use this to influence the subsequent TLS connection to the real server (closer to impossible actually).

Are there any less obvious measures that can be done to mitigate this possibly through some DNS protocol solution?

Not really. HSTS preload ensures that a browser will refuse to connect to an HTTP domain in the preload list, so there isn't an initial plaintext request.

Would it be sensible for a future client standard to always initially attempt with HTTPS as the default?

Yes, in my mind this would be a sensible default. There's always implications to guessing though.


Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones) I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer overflows and such.

There are plenty of similar frameworks designed for praciticing web apps' penetration, DVWA (http://www.dvwa.co.uk/) to name one, (so I don't intrested in these, but you can leave a link or two for other readers, of course), but when it came to user-side, client-server type of applications, I mean, binary/.NET/Java ones - I'd encountered some problems in finding them.

To the day the only one - http://www.mcafee.com/us/downloads/free-tools/hacmetravel.aspx - got into my list. It's an intentionally made vulnerable .NET application which uses MS SQL db to store its data - perfect example of what I'm searching for.

So, if anyone knows similar educational tools, or just simply a real application, specific build of which is crammed with intresting vulnerabilities, please share this info with me and others. Thanks!

You should look into CTF problems.  For instance I know picoCTF has a ton of binary exploitation problems, web exploitation challenges, crypto problems, etc.  It's a high school competition (which  actually ended just yesterday), but anyone can create an account and access the problems.  The problems will remain online indefinitely.


How to remove tcp header of packets captured with dumpcap? The traffic from Wireshark saved into a file with dumpcap.
In this file a have for example :

€     X       `þ $À6
@ íëÃNxXÀ¨£ P&E»kKí¨<`PEà;
HTTP/1.1 200 OK
Cache-Control: private

And I want to see only :

HTTP/1.1 200 OK
Cache-Control: private

      On windows 7 and I use this commands :
      cd\pro*
      cd wires*
      tshark -D
      dumpcap -i 5 -s 96-w packets.cap

The "garbage" prefixing the data you are interested in are the protocol layers (ethernet, ip and transport headers)

When you save the data captured with dumpcap, you are also recording these protocol layers.

To filter them away to only view the TCP data, you need to process your data through a program. Tcpflow is a tool that can extract data from tcp packets.

Take a look at this question, which is essentially the same you are asking.

In your scenario, you would want the command to be something like:

tcpflow -C -r <your-pcap-file>


Airodump-ng -1 DB networks I'm using airodump-ng to test my network's integrity and when I put Airodump-ng into monitoring mode, I see some networks with no ESSID and the PWR is -1. What are these networks? Are these hidden networks?

These are hidden stations. The reason there are some information missing is that these accesspoints don't send beacon packets. Beacon packets are packets that contain information about the network that is broadcasting them. This is how operation systems and applications get to know wich networks are available.

These networks bssids are shown anyway because there is traffic on that network and this traffic can't be hidden. Of cause the content of the packets might be encrypted but the protocol data isn't.

The power (-1) and quality can't be obtained because this process relies on receiving beacon packets. The beacon packets are sent in a given amount the software, airodump-ng in this case, receives these packets and rates the power and quality of the signal by how many beacons where received in if they where received correctly or corrupted.


Digital Certificate "Signature and Fingerprint" What's the difference between Digital certificate's signature and fingerprint (thumbprint) ?

I know that Signature: The actual signature to verify that it came from the issuer.
and Thumbprint (fingerprint) : The hash itself, used as an abbreviated form of the public key certificate.

But what's exactly inside both of it ?

Both are hash value but with which parameter certificate authority create it?

Here is the relevant quote from RFC 5280.

  The signatureValue field contains a digital signature computed upon
     the ASN.1 DER encoded tbsCertificate.  The ASN.1 DER encoded
     tbsCertificate is used as the input to the signature function.  This
     signature value is encoded as a BIT STRING and included in the
     signature field.  The details of this process are specified for each
     of the algorithms listed in [RFC3279], [RFC4055], and [RFC4491].

  By generating this signature, a CA certifies the validity of the
     information in the tbsCertificate field.  In particular, the CA
     certifies the binding between the public key material and the subject
     of the certificate.

Basically, the certificate signature is a CA signed value of the information encoded in the certificate including things like the subject, the issuer and the public key of the certificate. The process of validating the signatures is described in various RFCs as mentioned.

The certificate fingerprint is simply a sha1 and sha256 hash value computed on the entire certificate.


How do I know if Google keyboard input is safe for use? I wanted to send out a message containing some non-Latin characters on my Android phone. When I tried to change the keyboard input method, a warning came out:

  ATTENTION
  This input method may be able to collect all the text that you type,
  including personal data like passwords and credit card numbers. It
  comes from the app [Google App/Google Pinyin/SwiftKey/etc]. Use this input method?

Given that passwords are highly sensitive data, does it make any sense to give explicit consent to a possibility that Google may collect all my passwords and other personal data? Given the recent high profile NSA spying, how do I know if Google does indeed collect my passwords? If it is not collecting my personal data, why should such explicit consent be obtained from me?

Is there any workaround on an Android phone?

Valid concern for both Android and iOS now that Apple has enabled third-party keyboard options there.

For Android, there are several security solutions with firewalls that enable you to cut off network access to particular applications, even if full network access is allowed in the permissions of those apps. Some require root access and I cannot personally attest to the efficacy of these applications, but several work with vanilla Android and are very well regarded. That said, "well regarded" doesn't mean secure—these apps pose the same threats as the ones you're trying to restrict. If it functions without root access, then—for reasons beyond my familiarity with the platform—they require full network access themselves. For apps that do require root access, they get root access which is even worse (and the act of rooting itself poses a significant security risk for that reason). I suppose it's a question of which entity you trust more: Google vs. a third-party developer. This can easily spiral into a debate over which entity would be most fearful of the law and bad press, but of course that is not sound as a sole consideration in the scope of information security; an attack prevented today is better than an attack today, justice served tomorrow.

Not the easiest task to remove Google connectivity from your phone altogether, and the keyboard isn't going to be the bottleneck in a hypothetical breach on their part. Notwithstanding, there are keyboards that require neither root access nor any network access at all, although the user experience may prove dissatisfying/insufficient for your purposes. You can try Keymonk Keyboard which does not require any network access, but judging by the reviews it probably would not work that well for your purposes. One other option is to use something like LastPass or DashLane which I believe act as input methods like a keyboard does. Something brewing with 1Password that is worth looking into: they will fill in passwords without use of the clipboard (clipboard sniffing is another valid concern of this same nature, perhaps an even greater threat at the moment). All of those apps I listed could have their own ulterior motives.

At the end of the day, trust is more or less a (sad) fact of comfortable smartphone use today, and it can be difficult to determine who deserves it/who will respect privacy/whose infringements are most benign.


Authentication for external applications I need to design an application for internal corporate use. The application must be hosted externally. Ideally I'd like that application to be able to authenticate and authorize against the corporate ActiveDirectory.

However 2 problems here:

Authentication must work even if corporate network is unavailable.
I'd prefer to not replicate ActiveDirectory to an external location for security reasons. BTW is it right concern?

I have a few stupid ideas like having externally hosted "LDAP proxy" which would save credential hashes for limited time. That time should be enough to bring network up. While the network is down "LDAP proxy" checks credentials against local hashes. This idea seems to be too home-made and insecure. Is it possible to implement with ActiveDirectory Lightweight Directory Services (AD LDS)?

If the ideal above isn't feasible is there any 3rd party authentication solution? With account management, password policies, API, etc.

The only way to have a secure authentication system for a company that can still function while the corporate network is unavailable, is to not use the corporate network.   Consider hosting this service in the cloud,  or having a cloud based hot-backup.

Having a copy of the authentication database on each device is vulnerability, and a clear violation of CWE-602.  By definition this system is giving a user all of the keys to the kingdom.  The database must be accessible to authenticate a user off-line, and at this point an unauthenticated attacker has access to all of the data stored on the device (buss sniffing, attaching a debugger to the authentication process or a cold boot attack,  and there are other attacks...).

Attempting to "encrypt the database" is a manifestation of the DRM problem,  which has no solution.  (The only thread holding up DRM is the DMCA.  The DMCA will not protect an insecure database from compromise.)


What career path do I need to follow to become a CISO? I'm a security researcher and I want to know what career path you think I need to follow to become a Chief Information Security Officer.

What skills are necessary in this position ?
What field of information security is more important in this position ?

With the goal of reaching this position, what kind of stuff/path is better to look at in the next few years with this long term goal ?

P.S. First person experience is preferred.

From the CISOs I talk to, the only definite point is that they all come from very different backgrounds, but have a wide range of experiences...not just in the security industry (sometimes not even in the security industry)

Aim for a wide range of business experience, as at this level talking about security doesn't tend to have as much impact or value to a company as being able to talk about business risk, governance frameworks and value.

I wouldn't class any single discipline as 'more valuable' unless you count strategy, governance and business risk as disciplines. You'll want to be able to understand at a broad level what your teams across all disciplines are doing to help your organisation reach its preferred risk level at an acceptable cost.

This article from ComputerWorld UK titled "How to become a CISO" might also be of interest.

Also have a read through all the questions tagged professional-education - as there is a lot of useful information in there already.


Apache server compromised with apache backdoor redirect referer Everytime when I try to access my website it got redirected to some malicious spam site, after lots of search I came across term apache backdoor redirect referer,I have root access of cpanel and whm.
Need some help in removing this exploit  from servers.
Any help will be appreciated

(this started off as a comment, but its getting a bit long)

  I have root access of cpanel and whm

Yes, you need a lot of help - and more than can be sensibly provided here. You're probably going to need at least 2 days work from a competent web administrator. They are going to need to root access to the server via ssh.

If its not a dedicated host or if you don't have access to the root account via ssh, then only your service provider can help you.

In addition to removing the backdoor, whoever fixes this will also need to find the vulnerability which was exploited to install the backdoor.

Your problem is finding someone competent in them you can have some faith, and since your first port of call appears to be a free bulletin board, someone who is very very cheap. Unfortunately that's a near impossible task unless you're already well connected in certain IT circles.

I'm guessing from your post that English is not your first language. In the UK, if I were in your shoes I would be expecting to spend at least £2500 (Sterling) / $3000 (US) on consultancy services to resolve the problem (could be a lot more).

Leaving your site as is or removing the backdoor without addressing the underlying vulnerability will likely lead to it being used for other practices harmful to the internet / society. And as the site owner you might be called to account for its behaviour.

I estimate that it would take you around 2 years of full time study to acquire the skills you would need to tackle this yourself.

You need to have a long think about whether to

engage someone to restore your site and eliminate the vulnerability
scrub the site and start again (and how are you going to avoid the same errors you made last time?)
shut down the site and walk away

While I would like to encourage you to develop your skills this is way too much to take on without good security skills and a strong knowledge of systems admin/programming. Meanwhile your site is causing harm.


I just noticed that Teamviewer Host was installed on my computer on 5/4/17 without our knowledge. what does that mean? I just saw that teamviewer host was installed on our personal computer on 5/4/17. We have no knowledge of this. Why would this have happened and does it mean that someone has accessed our computer?

TeamViewer is a program that provides remote access functionality, and often has a range of legitimate uses. However, it is also commonly used in a range cyber crime activity.

An attacker may have installed TeamViewer onto your machine either by using other malware, or persuading another user to install it themselves through social engineering. They may then attempt to access your machine through TeamViewer, and potentially install malware, search for financial information, or perform other malicious actions.

I recommend you check the TeamViewer logs to see if anyone logged into your machine using it. Then, you should uninstall TeamViewer if you do not require the software, and scan your computer for malware.

See here for an example of a 2016 scam affecting customers of the UK telecommunications provider TalkTalk, which used TeamViewer.


Encryption algorithm keySize restriction in JSSE 7 I have an application which uses SSL (JSSE Implementation). Currently from my client side, the "Client Hello" message suggests a list of cipher suites that consists of both 128 & 256 bits key length encryption algorithm ( e.g. Cipher Suites: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) )
I want to filter out cipher suites which use AES 128 bits key length in the Client Hello message so I put this line in java.security file of client side

jdk.tls.disabledAlgorithms=DSA, RSA keySize < 2048, AES keySize < 256

However it does not work. Cipher suites like TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA are still there in the Client Hello message.

If I configure the parameter like this:

jdk.tls.disabledAlgorithms=DSA, RSA keySize < 2048, AES

then all the cipher suites which use AES encryption algorithm will be disabled.

I don't understand why the keySize constraint does not work in my case.

Rather old question, but just happened to come aross the same issue. Didn't have luck trying to avoid 128 bit AES ciphers by specifying "keySize < 256". What finally seemed to work was:

jdk.tls.disabledAlgorithms=..., AES_128_CBC, AES_128_GCM

This should force Java to only allow 256 bit AES ciphers - provided that the JRE allows using strong cryptography in the first place (which most recent JREs do out of the box, otherwise you still have to download and install the "Unlimited Strength Jurisdiction Policy").


Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs? We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test

Specifically we're losing points for the following reasons:

Forward Secrecy : With some browsers (more info)
Downgrade attack prevention : No, TLS_FALLBACK_SCSV not supported (more info)

We'd like to set it up for an A+ on that one (and improve other aspects not covered in that test). How can we do so?

First, for an analysis of TLS version and cipher suite selection, see my answer to Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

The summary is: TLS_DHE_* and TLS_ECDHE_* support PFS, but AVOID DSS, RC4, and so on.
The reason you're getting points off for not having FS with some browsers is the TLS_RSA_* cipher suites; take them out of your startup script.

Then, for an additional technical "how do I do this on Azure", please read How do I configure Perfect Forward Secrecy in Windows Azure (OS, or Websites)

The summary is: Run an Azure startup task like the one in this NuGet package in this Codeplex project, and make sure to disable SSLv3 entirely.

It sounds like your startup script is already doing a lot of this, which is great!

As far as TLS_FALLBACK_SCSV goes, your best bet is to get all your friends to give your feedback to Microsoft regarding the TLS_FALLBACK_SCSV Connect entry


Force https without 301 For my website's .htaccess I currently have:

RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

So that when someone visits the page over http they get a 301 and then connect over SSL/TLS. However, this still opens users up to MITM attacks via sslstrip. I noticed that if I go to http://facebook.com in my network log the request gets changed to https://facebook.com before a response comes back, preventing a MITM attack. I was wondering how this was achieved so I can force SSL/TLS better.

Thanks

Facebook achieves this with a HTTP Strict Transport Security (HSTS) policy.

This is delivered over HTTPS and informs the browser to automatically "rewrite" HTTP requests to HTTPS for that domain. The max-age parameter specifies how long the browser will honour the policy for.

It is also possible to list your site in the HSTS preload list. This list is shipped with browsers. The advantage of the list is that the site does not require the first (insecure) visit to be made in order for the policy to be set.


Did google chrome kill public key pinning? I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018).  See here, here, and here.

However, I haven't found any information about whether or not they actually pulled the trigger on their plans.  Moreover, in my own efforts I haven't been able to conclusively decide if public key pinning support has been removed from recent versions of Chrome.  This page seems to suggest it was removed in Chrome 72, but the linked discussion on that page differentiates between dynamic pinning (which is intended to be removed immediately) and static pinning (which may continue to be supported for a longer and unspecified period of time).  It's not clear to me from the status page which "kind" of pinning was removed.

So do recent versions of Chrome ignore public key pinning headers?  Have Firefox or Opera followed suit?

There are two types of pinning - public key pinning (PKP) and PKP over HTTP (HPKP). PKP is alive and well; browsers can be tested with the badssl pinning test, as Benoit E notes in a comment on another answer.
HPKP was planned to be removed in Chrome 65, then in 67 and actually deprecated in v 69.
It no longer exists in Chrome 72 and shows as removed, just as you found also.
TLS 1 and 1.1 are also deprecated in v72.
Firefox has a debate about it here.
Opera version 25 to 53 support Public Key Pinning.


When you enable 2FA, why is your second factor required to reset password? In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, say, a "lost password" flow).

My argument was, from a "moral" perspective, if you enable two factor, you need two factors to make any changes to an account - in the lost password case, the two factors would be access to your email + your second factor.

His argument was, even if you can reset the password with a single factor, two factor authentication is still doing its job: even if the attacker can change your password by gaining access to your email, the attacker is still unable to get into your account because of the second factor, thus, why do we need a second factor to reset?

Is there a logical fallacy here? How do you defend needing two factors to reset a lost password?

This is a security measure that is implemented independently of 2FA. Many places require you to enter your current password when you want to change your password. Password reentry may also be required to change contact information and account recovery options.

The reason for this is to prevent unauthorized changes. If it is possible for users to leave a session unattended, then it is possible for another person to make changes to the account. The most sensitive settings relate to authentication, recovery, and contact information since those could grant ongoing access to a malicious actor.

In order to mitigate the risk associated with unattended sessions, most services implement an idle timeout, reauthentication for critical operations, or both.


Obfuscating android malware I am exploring android malware forensics and am trying out payload generation and delivery, while also trying obfuscation. I have used commercial tools, e.g. ProGuard and also open sourced tools, eg. Obfuscapk. Now I am trying to advance further with my own obfuscation techniques, but am not sure where to start exploring and trying obfuscation on my own instead of relying on tools. Where can I start/learn more about this?

Your question is very open ended, so it's a little hard to be specific enough to be helpful.  I would suggest looking outside Android at (a) techniques used to detect malware and (b) techniques used to avoid detection.
As an example, some malware scanners look for specific binary string matching a payload, and the response from malware writers is along the lines of Metamorphic Code (https://en.wikipedia.org/wiki/Metamorphic_code)... which is basically having the code swap out different instructions with identical outcomes (eg, replace x = 5; with x = 3; x+=2;).  Similarly, some applications will compress & encrypt their payload code and build in a decompression/decryption routine.
Note that malware detection is usually a proprietary game, so usually your best bet is to start with the specific detection tools and try different things to see what it is they're picking up on exactly.


Attract Brute Force SSH Attacks I posted a question on Server Fault, but got downvoted and had the question closed.
One of the comments suggested looking over here, so here goes:

For my senior project, I'm working on an application which works to
handle brute force SSH attacks.
I have a VPS which seems to get a few hundred, if not thousand, hits a
day, but I'm getting two to three new VPS's just to analyze the
attempts.
What's the fastest way to get people to attack my servers?
None of the data will be made public - no IP addresses will be
released. It'll be completely consequence free. The servers will have
a fresh Ubuntu installation with a python script running, nothing
else.
I was thinking:

Ask on "hacking" forums
Offer reward ($15 Gift Card?) if they manage to break in
Honeypot

I don't care if my servers get hit hard - more data the better. There could be 1000 attempts/second for all I care.
I'm not sure if this is the right site to ask on, but I figured I'd try...

As another comment on the original question said, my VPS provider may not be happy if my VPS gets hit hard. If that is the case, I will deal with/talk to them about the issue.

There are mostly two kinds of attackers: the automatic, and the targeted.

Automatic attackers are not humans; they are infected machines, part of various botnets, which try to expand their basis by finding other machines to infect. Their strategy is mostly random: they try random IP address for an open SSH server, then try common passwords for common account names. There is little you can do to increase (or, for that matter, decrease) the amount of connections of this kind you will receive per day. Some network providers try to detect these occurrences and block them or limit their rate, so you could speak with your provider and see if he has such systems in place.

Targeted attackers are humans who want to crack your machine, specifically. To get that kind of attacker, you need to provide some sort of motivation. You could try to boast about some desirable "goods" stored on your server (e.g. tons of pirated copies of gams or music or movies), making it worthwhile to hijack your machine. You could try to host a political-oriented blog with highly controversial positions. Sometimes boasting will by itself attract attackers: everybody loves to shut up an insufferable know-it-all, and hacking his server looks like an efficient way to achieve it. In short words: make some enemies.

Note, though, that brute-forcing passwords is the lowest grade of attacks. If some of your newly acquired enemies are a bit competent, they will try other kinds of attacks, such as exploiting vulnerabilities in your software. Also, some of them could think "out of the box" and not target your server, but you, directly; for instance, if they look up the name of a domain you own, they might obtain your address or phone number, and pay you a visit in person. As a general rule, I advise against making enemies. There is no such thing as "consequence free"; there is only "improbable consequences".

If that is for research, then you could try to approach the sysadmins of some major sites or infrastructures. This is your senior project: therefore, there is potential academic support. With the help of your professor or advisor, you could try to see if an ISP or a big hosting service would agree with collecting data on their system; they might even find some fiscal benefit in collaborating with a scientific project. Alternatively, most sysadmins are addicted to Guinness, and may agree to help a co-drinker, especially after the third pint (your profile state that you are 17 and live in the US, so this solution cannot officially be workable for you).


Is CHAP authentication still secure? Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure?

I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in certain usage scenarios, MD5 is still technically secure (HMAC-MD5 for example).

I should say that I appreciate it's almost always a good idea to just use an algorithm that is known to be secure in all cases, rather than attempting to pick and choose when a partially broken algorithm can and can't still be used securely. This is more of an intellectual curiosity.

It depends what you mean by "secure" :)

CHAP:

Client authentication request send its user name to the server
Server responds with a nonce
Client calculates hash(nonce|password) and send to the server
Server verifies the password

Cons:

All data is transmitted in clear text i.e. it possible for an attacker to eavesdrop and brute-force the hash offline
The server needs to store the password in clear text


Home VPN outgoing requests anonimity I've been researching how to set up a VPN with a proxy as a learning exercise and also for the obvious benefit of increased "anonymity" and "protection" from prying eyes. I've found several tutorials on setting up a home VPN such as this one.

I understand that a remote VPN can obfuscate activity because its IP address is different than the client.

What I can't seem to find an explanation for is: How are the outgoing requests from a HOME VPN to an arbitrary destination on the web considered "secure" or "anonymous" if the requests are still coming from the IP address that can be tracked to my physical home address?

Doesn't that defeat the goal of "anonymity"? What am I missing?

It is not secure and anonymous per se. VPNs like that (RasberryPi VPN at home) will only make sense when you are in some insecure location (like starbucks, airport, public wifi etc) when there is very reasonable expectation that your connection will be monitored (and probably hijacked).

Using VPN to your rPi at home will (ideally) make all those connections as secure/anonymous as you were sitting at home at the time (instead of, say, starbucks). Which is by no means totally secure or anonymous, but is way better than what you'd get in hostile environment which is targeted all the time by many crackers (like airport wifi).


DNSSEC: Why are RRSIGs returned in the "Answer" not "Additional" section? Looking at Wireshark traces of DNSSEC responses, I see that the RRSIG is returned in the "Answer" section, even though it wasn't part of the query.

Why isn't it returned in the "Additional" Section, which is precisely designed for additional information besides the query?

It seems that the idea is to keep the RRs and their signatures close together.

RFC 4035, Section 3.1.1, Including RRSIG RRs in a Response

  3.1.1.  Including RRSIG RRs in a Response

  When responding to a query that has the DO bit set, a security-aware
     authoritative name server SHOULD attempt to send RRSIG RRs that a
     security-aware resolver can use to authenticate the RRsets in the
     response.  A name server SHOULD make every attempt to keep the RRset
     and its associated RRSIG(s) together in a response.  Inclusion of
     RRSIG RRs in a response is subject to the following rules:

  o  When placing a signed RRset in the Answer section, the name server
        MUST also place its RRSIG RRs in the Answer section.  The RRSIG
        RRs have a higher priority for inclusion than any other RRsets
        that may have to be included.  If space does not permit inclusion
        of these RRSIG RRs, the name server MUST set the TC bit.

  o  When placing a signed RRset in the Authority section, the name
        server MUST also place its RRSIG RRs in the Authority section.
        The RRSIG RRs have a higher priority for inclusion than any other
        RRsets that may have to be included.  If space does not permit
        inclusion of these RRSIG RRs, the name server MUST set the TC bit.

  o  When placing a signed RRset in the Additional section, the name
        server MUST also place its RRSIG RRs in the Additional section.
        If space does not permit inclusion of both the RRset and its
        associated RRSIG RRs, the name server MAY retain the RRset while
        dropping the RRSIG RRs.  If this happens, the name server MUST NOT
        set the TC bit solely because these RRSIG RRs didn't fit.


SSL/TLS: Version Change during Renegotiation or Resumption? Can the version proposed by Client be changed during SSL Resumption or Renegotiation?

Resumption Case:
In case of Resumption, as I understand, Client will send a Client Hello with the Session ID of an already established session. The Cipher should be kept same, but can we change the version in the Client Hello? I am unable to find which section in RFC 5246 or the preceding RFCs speaks about this.

Renegotiation Case:
SSL/TLS supports renegotiation feature to allow the Client and Server to change the Cipher negotiated during the first handshake which provided the flexibility to change the Authentication Method as well as Cipher for Data Transfer. But, can the Version also be changed?

The current TLS standard is not very clear on how versions should be handled. Annex E.1 contains some information, from which we can see that the implicit idea is that the selected version depends on what the client and server support, not on what the client and server may elect to use on a whim. If a client supports up to TLS 1.2 and a server up to TLS 1.1, then they should use TLS 1.1, always. As such, there should be no question of "changing the version" when resuming a session, or renegotiating.

There are several version fields:

Each "record" has a version field.
The ClientHello message contains the highest version supported by the client.
The ServerHello message contains the version that will be used on this connection.

Supposedly, the client will send its first ClientHello as a record bearing a version number 3.x for some value of "x"; 3.0 will maximize interoperability. Once the server has responded with a ServerHello stating that version 3.y will be used, then both client and server must use 3.y records. This makes version jumps somewhat delicate during a renegotiation. Also, CBC-encrypted TLS 1.1+ records are not compatible with SSL 3.0 / TLS 1.0 records (because of the additional per-record IV), so record-level versions are important once the first ChangeCipherSpec has been sent/received.

For a session resumption, annex E.1 states that:

  Whenever a client already knows the highest protocol version known to
     a server (for example, when resuming a session), it SHOULD initiate
     the connection in that native protocol.

from which I infer that if the previous session used version 3.y, then the client should use records with version 3.y. However, nothing prevents it from advertising an higher version number in the ClientHello.

Also, derivation of the master key into encryption and MAC keys uses the TLS PRF, which depends on the protocol version (TLS 1.0 and 1.1 use the same PRF, but not SSL 3.0, and neither TLS 1.2). Resuming a session with a different version is looking for trouble.

The whole area is murky. See for instance this Mozilla/Firefox bug report. In my experience, the following rules should be followed to minimize issues:

Rules for the client:

Send the first record as version 3.0.
Always advertise in the ClientHello the maximum supported version (e.g. 3.3 for TLS 1.2).
When the server responds with a ServerHello, use the version sent by the server as new version for all subsequent records, cryptographic computations, and protocol details.
Once the server has sent a ServerHello, enforce incoming record versions: subsequent records from the server should use that version. If a record from the server advertises another version, abort.
When renegotiating, if the server tries to use another version than previously, abort.

Rules for the server:

Ignore the version on incoming records, during the initial steps of the connection.
Once you have sent your ServerHello, enforce record versions: all subsequent records from the client should use that version.
When resuming a session, reuse the same version, as long as the version in the ClientHello allows it; otherwise, do a full handshake (e.g. if the previous session was TLS 1.1 and the new ClientHello says 1.2, resume with version 1.1; if the previous session was TLS 1.1 and the new ClientHello says 1.0, do not resume, do a new full 1.0 handshake).
When renegotiating, verify that the version advertised in the new ClientHello is compatible with the current version -- but do not change the current version. If the first handshake was 1.1, the second handshake will be 1.1, even if the new ClientHello says 1.2.

It is pretty much guaranteed that there are some widely deployed implementations which get it wrong at some point.


is encoding the same as encryption for malware obfuscation? I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it via AES and then decrypt it before executing.Would the end result be same?Is encoding better than encryption for shellcode obfuscation?

Encoding and encrypting are not the same: encoding does not need a key, encrypting does. XOR is not encoding, is a very weak form of encryption. Base64 would be an example of encoding. Uuencode is another example.

The difference between XOR and AES is the difference between a wooden box with nails closing the door, and a bank safe. XOR can be trivially decrypted, but AES does not.

In this specific case of code obfuscation, XOR is astronomically faster than AES. It will defeat most signature-based IDS systems, and will not increase the resulting code too much. AES will create larger code and will be slower.

On both cases, any human inspector will be able to decrypt the contents, as you will have to supply the key to decrypt the code. Otherwise your program would not run at all.


Will changing permission of /bin & /usr/bin increase security? Normally permissions of folders like /bin & /usr/bin ... are -rwxr-xr-x (755) - executable and readable by anyone. So my idea here is to change permissions to -rwxr-x--- (750) - not anymore executable and readable by others.

I want to limit executing commands inside my system (server).

(I was thinking about scenario where disabled functions of PHP are somehow bypassed and the door for executing commands are now open for malicouse user or attacker (on shared hosting), how can i stop him from executing system commands? (Offcourse premissions on other folders are set to limit his activity!))

Any ideas?

Sabotaging the normal usability of your system probably does not increase your system's security.

Of course, root, and thus, much of the system "maintenance" and startup mechanism will still be able to work normally, but you'll run into problems very quickly – what if your webserver writes logs and uses some external command to rotate them? That'll lead to hard-to-predict bugs, potential insecurities …

Even if that was not the case, an attacker that is able to escape their environment (e.g. the PHP interpreter) by executing files from /bin/ will usually also have the privileges to simply write the binaries they need into some other writable directory, mark them as executable and execute them (or they'll just load them as shared objects – or a lot of other things. Basically, the moment an attacker can exec anything, you've given them access at the level that the process is running at, nothing helps there anymore).


Managing multiple SSH private keys for a team I have a medium-sized team (~10 people, but we expect to grow) that manages a set of EC2 servers on AWS (currently a few dozens, but this is also expected to grow).

As EC2 requires you to have an AWS generated private SSH key, without a passphrase (that's how AWS generates them) in order to access EC2 servers, as the number of servers and different environments and products my team manages (and as people are moving on and off the team), I'm less and less happy with our current solution for securing access to EC2 servers - namely having a single private key that is copied to each team members local machine.

I'm considering a few options, and I would appreciate it if you can suggest a better option and discuss why its better:

Keep using a single SSH key for all our systems.

Pros: simple to manage, relatively secure (assuming team trust)
Cons: after a team member gets the key, there is no way to revoke access; a single leak compromises security of all systems; no passwords

Have a single SSH key for each product/environment, distribute to all team members.

Pros: Still not difficult to manage, relatively secure (assuming team trust)
Cons: keys can't be revoked; a single leak compromises all systems (maybe not all, if a junior member that doesn't have all the keys was the source); no passwords; difficult to use as the user has to unload and reload keys when moving between environments

Build a bastion server for each product/environment; create a single SSH key for each product/environment and install the private key in the bastion server's known user account; install each team members personal public key in the known user account.

Pros: allows key revocation; compromise of a bastion compromises only 1 environment; if a leak of a user key is detected, compromise of untouched system can be easily prevented; allows use of passphrases to access bastions
Cons: relatively complex to manage (creating additional servers and running non-trivial installation, adding team members, removing team members); costly (servers aren't free); complicates software tools used by team; complex key revocation

Use a key storage service; create a single key for each environment/product and store in service; control access to the service using a password or a personal ssh key; operations start by identifying the environment/product accessed and obtaining the key into the SSH agent.

Pros: easy to manage (assuming the service is available); keys can be revoked on a per user or per environment; single point to protect (that is not mission critical); Relies on OpenSSH agent to secure keys outside the service.
Cons: Single point of failure; may complicate usage scenario

I'm currently leaning towards #4, but are there serious issues I'm missing? Is there a service like that that I can use or do I have to roll my own?

Note: we don't use an orchestration/configuration server a-la puppet/chef - our orchestration software is mostly home grown and installed on each team member's local system. It is basically just a set of recipes loaded from source control and used to execute various scenarios, mostly using AWS APIs. Each team member has a personal AWS API key and the orchestration software uses it to run the AWS API. In addition, some scenarios call for SSH access to system servers, and here is where I have the problem described above. The EC2 servers are accessed using the default AMI user (usually "ubuntu") and the software uses NOPASSWD sudo to execute local operations.

Not sure why you're using AWS-created keys.  The "Network & Security / Key Pairs" screen also has an "Import key pair" button, I've successfully used it.

When you add a new team member who might be standing up new images, get his public key, import it.

Keep a copy of your standard "authorized_keys" file, with one or more public key per person, on a webserver or S3 (could be VPN-facing, or secured by a team-shared username and password, if you're trying to keep your team identities confidential.)  Now part of your deploy process is to do

curl -u username:password \
  https://team-server/private/authorized_keys.txt >/home/ec2-user/.ssh/authorized_keys

(Such a command could also be added to the instance user data to run at instance creation.)

To add a new team-member, add his public key to the file, then run that command on all servers.

To remove a team-member, remove his key from the file, then run that command on all servers.


Sql injection bypass against KONA(akmai) WAF I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible.

Parameter: query (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: query=-8014' OR 6594=6594-- iygp&locale=en-US

The waf used by the website is KONA(akmai).Sqlmap could not retrieve any data.
NOTE:-whenever i inject it.It gives back a 403 error generated by waf.

HTTP/1.1 403 Forbidden
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 294
Expires: Thu, 17 Jan 2019 12:04:34 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 17 Jan 2019 12:04:34 GMT
Connection: close
Cipher: ECDHE-RSA-AES256-GCM-SHA384
Source-Country: IN
Strict-Transport-Security: max-age=157680000; preload

<TITLE>Access Denied</TITLE>

Access Denied

You don't have permission to access "http&#58...;;" on this server.

Reference&#32;&#35;18&#46;e0a21ab8&#46;1547726674&#46;14c0c2e8

so my questions are:-

1.Is it a false positive?

2.If it isnt should i not automate it and try and probe manually?

There is a potential for automated tools to provide false positives in case of blind SQL injection even if there is a slight difference in responses. This may also be the case where WAF's are involved.

I would normally consider that anyone putting their site up for a bug bounty program have done their homework and secured their site reasonably to make it resilient to automated tools. If you get even a slight indication that the site may be vulnerable through automated tools, this must be followed by manual investigation to see if the site is actually vulnerable and what will be the impact if the vulnerability can be exploited.

The following SQLi resources may be useful for further manual investigation: http://pentestmonkey.net/category/cheat-sheet/sql-injection
https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/

Also, be wary of extracting data from the database once you know the SQL injection is exploitable and may result in data extraction. If the website stored sensitive information, the site owner might not want you to exploit the vulnerability to extract any potentially sensitive data. Always good to review the terms & conditions of the Bug Bounty program before hand.


When you XOR a random number with non-random number, does that give you a new random number? XOR has the following truth table:

0, 0 : 0
0, 1 : 1
1, 0 : 1
1, 1 : 0

So per bit in an XOR operation, there is a 50% chance of that result being 1 and 50% chance of it being 0. If you XOR a random number (all possibilities were equally likely when created, say from a CSPRNG) and a non-random number, does that result appear random?

A random value does not loose any of its randomness if it is combined without information loss with a non-random value. XOR against some fixed (i.e. non-random) value does not cause such information loss, i.e. the original random value can be recreated from the result by simply XORing again with the same fixed value. Contrary to that AND or OR  would cause information loss, i.e. they can not be reversed.

But the randomness does not increase either. Thus, if you XOR a 8 bit random value to a 32 bit non-random value it will result in 8 bit of randomness, not 32 bit.


Creating a rainbow table with predefined text I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password:

Hash(PredefinedString1+Password+PredefinedString2)

Given both predefined strings and the resultant hash of the concatenation, is it possible to use a tool such as rtgen to create a rainbow table based on knowledge of these strings?

You would have to either find a tool which already handles exactly this kind of hashing, or modify one to suit your needs. For instance, this project seems to contain an opensource rainbow table generation implementation.

Of course, such a table would be produced for specific values of "PredefinedText1" and "PredefinedText2" and would be useless to attack hashes which were computed with distinct text values. If you have only one password to crack, or if you have several but all in one go, then it would be more efficient to do a direct dictionary attack on the password. Rainbow tables, like all kinds of precomputed tables, are interesting only if you plan to attack several hashes at distinct times.


Hardening JRE deployment - webjava I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.

I have my system wide deployment config and properties files set up:

%windir%\Sun\Java\Deployment\deployment.config (points to below file)
%windir%\Sun\Java\Deployment\deployment.properties

For purposes of this discussion the contents of deployment.properties is:

deployment.webjava.enabled=false
# deployment.webjava.enabled.locked (commented out)

My goal is to disable webjava by default and force the end-users to enable it if needed. Then upon restart or next load I would expect that the system would default back to the disabled state. However, I have found that once the user enables this, unless that deployment properties file is modified again, the setting won't be read again regardless of restart, etc.

I realize I could un-comment this # deployment.webjava.enabled.locked (commented out) and it would be fine but the end user could not then modify if needed.

Question:
Has any one else had any success with configuring webjava in their deployment settings as I am attempting or have any other feedback with hardening the jre for end-users?

References:

http://docs.oracle.com/javase/7/docs/technotes/guides/deployment/deployment-guide/properties.html
http://www.darkoperator.com/blog/2013/1/14/centralized-management-of-java-se-environment-using-gpo-redu.html

UPDATE:
Brandon - thanks for your input.  Yes, you are right this is a work around.  We could set that so that upon next gpupate (e.g. login) the setting would go back to disabled.  Java control panel has a weird behavior that if this registry setting is set outside of the control panel, then next time the control panel is opened the setting will be read from somewhere else (? default settings somewhere I am not aware of) and thus it will appear as those the setting is still 'enabled'.  In fact the registry gets updated to 'enabled' (by virtue of deleting the registry entry we have made) simply by opening the control panel and not even clicking apply or OK.  A strange behavior indeed, but I guess it still gets us to the desired goal.  It will just take a little more training with the end users due to the confusing display of the setting in the control panel.  But then again, anything I was about to do would have required some end-user education.

I am a little surprised by the behavior you're seeing, but do have a suggested workaround.  In particular, the registry key HKCU\Software\AppDataLow\Software\JavaSoft\DeploymentProperties\deployment.webjava.enabled is responsible for controlling your configuration setting.  GPO can trivially set this value and the permissions on it to ensure that your end users have rights to enable the feature.  See this technet post on custom registry changes through GPO.

By going this route, you ensure that the feature is disabled during the application of GPO while logging on.


Is bruteforcing the last character of a salt a good idea? Would it be a good idea security-wise to store salts with their last character removed, and then bruteforce the last character to further the amount of time it would take to create rainbow tables and such? This is assuming the hashing algorithm in use is Whirlpool.

This would make logins take a little longer, but it would be a restriction on bruteforcing speed that cannot be bypassed like other methods can.

Thank you in advance.

Assuming that you're using per-user salts (i.e. a different salt for each user account), rainbow tables are already an impractical means of attacking the hashed passwords (rainbow tables are typically used where there is either no salt or a salt which is common to all accounts and preferably known to the attacker ahead of time).

Where you're using a password hashing scheme such as bcrypt, if you're looking to make this "harder" for an attacker it's best to use the mechanisms provided by the scheme (e.g. the work factor) rather than inveting your own.


Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users? Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users?
How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy.

But we have segmented the VLAN for both PCI and Non PCI users
Is it PCI compliant?

It all depends on how it's implemented but yes, it is certainly feasible. Let's say you have network segment A containing systems which handle cardholder data, network segment B with AD servers and network segment C with systems which do not handle cardholder data in any capacity, do not have access to segment A and management of systems within A and B is performed using a bastion host or jump server within segment B. In this scenario, there could be effective segmentation and, depending on security controls implemented, you should be looking good for using the same AD throughout. Throw in proper Role Based Access Control, monitoring and logging, risk assessment etc and you're getting closer to compliance.

As for the proxy, is the proxy transmitting cardholder data and what security posture/risk has it? The likelihood is that the proxy server will be considered to be in-scope though it could be used by both in-scope and not-in-scope systems.


How much are 0-days worth? I got discussing this topic with someone recently and we couldn't reach a consensus so I thought I should ask here. There are commonly thrown around figures regarding the cost of buying a remotely-executable 0-day for IOS, Android, Windows etc.
I've seen figures go up to $250,000 USD from companies like Vupen, however Vupen don't disclose anywhere on their site how much they will buy or sell exploits for.

With that in mind, is there any concrete proof of high-value exploits being bought and sold by companies and if so at what kind of prices (I'm excluding things like bug bounty programs etc and i've seen this article but i'm not convinced).

In addition to 'legally' acquired exploits, how much do comparable exploits go for on the 'black market'?

It's a bit like asking "How much does a car sell for?" in that there will be intrinsic differences between each exploit, dramatically altering the value. On top of that, the chosen way of monetization will dramatically affect the value also (White hat, black hat, etc). In general I'd suggest black hat methods would probably be more valuable in an absolute sense, ignoring the baggage that goes along with those methods - unless you could consistently produce exploits in which case it would probably be better to be a company such as Vupen.

This article may be of some interest to you - http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/

Edit: I apologize somehow I did miss that link to the forbes article you posted. I think the issue you have is that the information that you're after just isn't going to be publicly available. The prices customers would be paying along with who is even buying would be some of Vupen's closest guarded secrets, the same would be going for almost every company who is dealing in this type of product.

For an example of a different exploit market you could see something like 1337day[dot]com who has private exploits ranging from $1 - $7000, but not really the type of exploits you're asking about specifically.


Are there any specific advantages of using a blockchain tech in the data tier of an organization from a information security perspective? Blockchain seems to be the most talked about tech topic in 2016.

A cryptography powered distributed computing technology that has many potential applications.

Are there any specific ways / guidelines already laid out to leverage blockchain technology for general information security in the data tier of an organization?

Eg: Data integrity etc.

It's now 2018 and blockchain doesn't seem to have slowed down.  One idea that is potentially gaining traction is using major blockchains as a distributed timestamping service: if you insert an assertion into the blockchain (e.g., the SHA-256 of a file), you can prove that you were in possession of the file at the time that block was mined into the blockchain.  (Assuming you do not have compute resources >= 50% of the relevant blockchain.)


Ciphertext for email vs Ciphertext for database Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text:

ciphertext = KS[Message, Compress(Bob_PR[H(M)])], Alice_PU[KS]

KS = Session Key
H = Hashing
PU = Public Key
PR = Private Key

However, how can we do this when bob want to achieve confidentiality and integrity when the information is stored in a secure database? Whose key to be used to encrypt the msg? Is it a session key only? Do we need a session key at all? A possible solution could be:

ciphertext = KS[Message]

Provided that KS is stored together with the ciphertext in the database. BUT this is definitely not safe!

What is a better solution? How do we represent this in the notation?

If your original construction gives you the security properties you want, then simply replacing Alice_PU[KS] with Bob_PU[KS] should do the job.

Think of the database as a communication channel to your future self. Future Bob should still have his keypair, so can both decrypt the session key and verify the signature.


Token and cookie based mechanisms: stateful or stateless, session or nonsession based? Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some different terminologies used by different people. We can focus more on the concepts than terminology, and define terms before using them.

I found some different discussion on token based mechansim.
https://security.stackexchange.com/a/92123 says

  In Token-based Authentication no session is persisted server-side (stateless).

whereas https://stackoverflow.com/a/58398997 says

  Server still needs to store blacklisted tokens which defeats the purpose of stateless

A comment says

  it does not matter where the token is stored but only if it is associated with a state or not.

Stateless or stateful, and session based or non session based

Is "stateless" defined as "requests from the same client following the first one don't need to be authenticated"?
Is "stateful" defined as "every request needs to be authenticated"?

Is it correct that session based mechanism is stateful and non-session based mechansim is stateless? (I guess yes, session based == stateful)

Token based mechanism:

Is token used for authentication?  Or not for authentication, just as session id is not? ( I guess token is used only for authentication, so every request that sent back a token will authenticate with the server. In contrast, a request that sends back a session id doesn't authenticate with the server, although session id waives out authentication. Token is used for authentication, just as user password is.)

Is token based mechanism stateless?  (I guess yes, because token is only for authentication.)
Or is token based mechanism as stateful as cookies that contain session ID?

when is a token associated with a state, and when not?

Cookie based mechanism:

Is it correct that cookie can carry any kind of information, session ID, token, ...?

Is it correct that cookie can be used for implementing both stateful (i.e. session based) mechansim or stateless (i.e. nonsession based) mechanism, depending on what info a cookie carries? If a cookie carries session id, then it is stateful (i.e. session based)? If a cookie carries non session info such as token, then it is stateless (i.e. nonsession based)?

when tokens are written in cookies, it is still stateless?

Thanks.

Session is state.

Cookies provide a mechansim for providing state (persistent data) via http, a stateless protocol.

State can be used to represent the outcome of authentication, but can also represent all sorts of other things.