Identify a security risk in a car-sharing system A car sharing company provides a fleet of 20 vehicles, with the following features:

Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have booked the car for the corresponding period (see for instance how Co-Wheels operates).
The company provides a 24/7 emergency service, where an employee can come and unlock a car if needed. All vehicles are electric and must be returned to Vehicle-to-Grid charger at the end of the rental period.
All vehicles have a constant GPS tracking, in case of car theft, as well as external noise and pollution sensors monitoring surrounding traffic, which feed into the local Data Observatory

This is for an assignment for a Network Security module. I'm not asking anyone to do it for me, I just need this to start it off and I've been staring at the spec for a few hours and I can't think of a valid security risk. We can also make assumptions as long as they are reasonable.

Answering Peter's points here:

We don't have much information about that but I would assume that once a car is not booked but in motion the GPS tracking will flag it and someone will look into it (although that isn't stated)
That is a good one but I think every user and the service people will have their own smartcard so the system will know who has unlocked the car
In this case, there should be a penalty to the user who failed to return the car in time but he should still be able to return it.
For this, I would say it tracks the location at all times. As for outages, nothing is said but how would you use that in an attack?
I think it will be encrypted with a private key so theoretically, it should be safe.
I think it's safe to assume it's nonrepudable
The system admin will be able to monitor all cars and individuals will only see the location of where the car they have booked will be available to pick up let's say a few hours prior to booking
You will have to pay when you book the car so this is not a problem
If you can think of a legit way to obtain them then I guess it could work
Thanks for your suggestions, overall they seem to go into too much detail about how the system works which is not wrong, I just think that for the assignment we need to look more globally. For example, a possible attack is stealing a smart card to obtain access to a car but then the booking requirements takes care of that case and I can't think of anything like that.

If access to cars is not logged (entering and exiting), you can't say whether one of the users stole it or someone got in by "lockpicking".
If access to cars is not logged, you can't say whether the user, who booked the car, or one of the emergency service people stole the car.
What happens if user does not return the car in time with a legitimate reason, such as traffic jam, cops, etc. Will his access be revoked and he will be unable to return the car? Will he retain the access? Will it be logged? Also special consideration of how to log this with point 6.
Do you store last known GPS location? Do you monitor for outages and what is the response? Do you check the sanity of the data? There are GPS jamers out there.
How is data sent by car authenticated? Can an attacker spoof logs with/without access to the car?
Are access logs to the car nonrepudable, for example by signing the log entry by the smart card? How do you solve exiting the car, extensions of time and other data, where the smart-card may not be available anymore.
Who can monitor the location and use of the cars? For example, could other user spy on a user by checking that he has the car reserved and where the car is? When can the users see the position of the car, as I assume they would need to to know where the car they want to reserve is parked.
What happens if someone reserves a car and does not use it? How do you prevent denial of service by reservation of the cars?
Can someone with access to the car retrieve its crypto keys, or abuse them?


Block HTTPS/TLS (Wo)Man in the Middle Attack I found out that the landlord of my building is able to access all my internet URLs even though they are HTTPS. Ex they are able to see this entire URL: https://www.google.com/search?q=stackoverflow including path and query params.
I verified by clicking on the lock icon of my browser that the certificate issuer is "Google Trust Services". They are able to see all URLs, not just google.
Therefore, I am not able to understand how are they able to access all my internet traffic (I am certain they are able to access it). I am not sure if they can see the request/response body & content as well. We are using AT&T internet (not sure if they have a Netgear Nighthawk router connected in the middle). I cannot access the router interface (192.168.0.1) because the attacker (the landlord) is able to see all my URLs.
Is there a way to thwart their attack by using some browser plugin or a similar solution? I found out that Chrome has HTTPS Everywhere Plugin but that might not help because my browser is already showing that the connection is HTTPS. Ideally I would like to find a way to also detect (and prove) that they are looking at my web browsing history, ex: I can create a website and use javascript to log visitor information (but it will be hard to pinpoint that they are the attacker), in case I decide to show it to our local authorities.
I use Firefox and Chrome for browsing the internet.

In general, it is easy to get some information about the browsing of a person.  The information that is leaked is:

site that you are using
approximate length of the URL
approximate length of the page
approximate number of other resources
time

See Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable? for a more elaborate explanation.
In a corporate environment, there are a number of vendors that deliver TLS decryption, for example Palo Alto does this. In general this requires that the MitM-device CA has been accepted as valid on your computer. You may have done this inadvertently, though with Chrome, that is very hard. Or someone with access to your computer may have done this. If the latter: if they install certificates like that, they may have done other things as well. You may want to re-install.
Key-loggers are also an option.
It may be important to know that there is no legal way for your landlord to do this without your explicit and informed consent (at least in the EU).
The second part is how to prevent this.
Depending on your level of paranoia, there are two things you can do:

reinstall the systems
use a VPN (NordVPN, ExpressVPN, etcetera)

It is also possible to flood your landlord's logs:
while : ; do
   ranhost=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
   wget https://$ranhost.com
done

which will make it harder for him to extract the real URLs that you use, and will also give him the signal that you know he is doing something illegal.


How to safely save passwords for a future administrator? I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local administrator accounts to manage them. Right now, I am the only person working for the organization with any amount of technical knowledge about these things. As part of our disaster recovery plans, I am writing a complete manual for administration of everything in the building.
The problem is what to do about passwords. No one else in the organization wants to be responsible for having the administrator passwords to everything (and honestly I don't trust them anyway), but reducing the bus factor necessitates that a password be available somewhere for some other person to manage these devices in the future.
My first thought was to use something like LastPass's "Emergency Access" feature that allows another user to request access to an account, except that I have no idea who that future user might be to give them permission and I have no confidence in this feature working properly anyway (since my wife and I tested it with our accounts and it didn't work).
My current thought (loosely inspired by the opening scene of WarGames) is to generate secure passwords for the accounts and make scratch-off cards with the passwords on them. These cards would be kept in a sealed envelope in the manual binder. Access to the passwords then requires opening the envelope and scratching the cards.
I am not worried about someone going through the effort to steam open the envelope, scratch the cards, copy the passwords, then re-cover the cards in scratch-off material, and perfectly re-seal the (signed edge) envelope. Physical access control will prevent outsiders from doing that, and we are confident that all of our insiders don't want the passwords and wouldn't know what to do with these passwords even if they had them.
I know that this plan is still vulnerable to anyone with physical access gaining admin rights, but I can't think of any better options.
Is this a good plan? Are there better alternatives? Or am I overthinking it?

Offline password manager
I would use an offline password manager (for example, KeepassXC as an open source option) for the whole list of credentials that may need to be accessed by someone else.
The encrypted file containing the passwords can be given to any relevant persons and management beforehand, or it may be stored in some network location that's accessible also to some of your colleagues. But the passphrase (and possibly 2FA token) to access that file can be physically put in an envelope in a safe to be given to the appropriate person if/when needed.
This also means that you can continuously keep that credential list up to date without touching that 'envelope in a safe'.


Laravel | Why create a public_html folder and link/move it? I am using laravel on shared hosting.
Under my domain in my folder is the laravel app.
Now I see online that many people do weird stuff with the laravel public folder, they either move it to a different location or create a sys link, but why?
Isn't the laravel setup secure? As far as I understand nothing below the public folder can be accessed.
I simply put my laravel app into the domain folder and linked the domain to laravel/public.
I even asked my provider and they confirmed it that this is the way to go.
But I am really paranoid about security, why many other people do it differently, maybe they have different setups?

The only reason that some people changed/directed this folder to something else is because of older versions of the app cause problems some users say.
So that said, relax and don't be paranoid. Using the /public_html or just /public has the same security as if someone changes or redirect to another.
If you still want to make the change to be 'just sure'.
laravel by itself is already good in its security, BUT you can always take extra security measurements to make it extra secure.
What you can add by yourself as security extras:

SSL certificate installation
the app installed on a cloud-based platform for data losing security - (if out of nothing the security may go unwanted down or whatever)

And that's it actually, laravel with its version 7.x is so far the best build that is published from all other versions and is furthermore really secure.
Additional to add laravel's dev its Git of the latest published version. Click here
If there are security changes (and the system update fails in laravel) you can find and git them from there.


Is it good to auto log out users after when they change password? Is it a good practice to implement automatic log-out in an android App after changing the password through the app?

TL;DR : Yes.

There are only two cases here:

(Unlikely) Your application only works locally, with no use of the login and password on any remote server. If you don't logout for years the app will keep working as if nothing happened, so what's the point of changing the password?
Your application sends credentials to a remote server to establish a login. In this case you should not only logout the user from the Android application, but you should log them out of every instance of the application, on all devices on which the app is run, and also from all web instances if that's the case. If someone guessed the user password and you don't invalidate whatever kind of token you have, they'll be able to keep using those credentials, even if the user changes them.

So yes, log them out everywhere.


access control to data-center using rfid I don't know if "here" is the right place to make this kind of question...
so here it is..

Is rfid a good solution for controlling access to a data-center?
Because rfid is "wireless", is it hackable?
Is a biometric solution more secure?
For accessing a data-center, should I use a hybrid solution, like for example a biometric solution in conjunction with rfid?
Can any of you tell me a good solution, biometric, rfid or hybrid (with links to research more information)?

Any answers and opinions appreciated

Jorge

Some simple answers - with description:

1. Is rfid a good solution for controlling access to a data-center?

Not necessarily - because RFID broadcasts a signal, that can be picked up. In simple implementations a simple replay attack may be enough. Is RFID in a card? If so, what are the controls around it? ie if I steal the card do I have access, or do I also need a pass code?

2. Because rfid is "wireless", is it hackable?

Not a real question. Wireless does not make something hackable. The implementation could be good or bad. An attacker can pick up data remotely though, so factor this in.

3. Is a biometric solution more secure?

Biometric solutions have issues - the main one being that your biometric identifier is unlikely to be unique. The more unique it is made (through refining parameters) the more false negatives you will get, and if it is a fingerprint, what happens if your finger is damaged? Check out any studies on crossover points to see how appropriate it might be for your situation. Generally biometrics are used in addition to other mechanisms.

4. For accessing a data-center, should I use a hybrid solution, like for example a biometric solution in conjunction with rfid?

That would be better than biometrics alone.

5. Can any of you tell me a good solution, biometric, rfid or hybrid (with prices(a website link were I can research for more information))?

I don't have any published data. The implementations I have seen have been for trusted CA's - the protection they put in place includes physical keys, biometrics, dual-man controls, man traps and weight measurement on entry and exit...possibly overkill for this application?


Enterprise Security : Where to Start? I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far as I felt so far. SAML, SSO, OAuth, XACML... there are plenty of stuff to learn about; but frankly I am not sure from where to begin, so that I would understand the possible security threats, and then learn these stuff as answers for them.

I would truly appreciate, if someone could suggest any blog, book or any other learning resource in order to learn the theories in Enterprise Security Context, so that I could grab the basics in a perfect manner. I assume that this is something that most of the people keep looking for.

Thank you.

P.S: I see some comments mentioning that this is irrelevant to this forum, since it has been understood as some kind of a product recommendation. Please note that I have only asked for the learning resources/online material kind of stuff, but not specifically the exams or qualifications. This exactly is not a question regarding a bug fix or something like that, but surely is a much relevant question to this context, even if it represents a higher level. Thanks!

It may be that you need to narrow the scope a little in order to get started.

Which aspect of security are you interested in. From the list of standards, you seem more interested in application security & especially in authentication and authorisation?

That would be a much easier set of targets to learn at least to begin with.

Also, you may need to be aware of regional and sector differences in security requirements. Banking, health, US vs EU and so on. Each have important differences.

Having decided on a more focused approach, perhaps you could update the question to get some more specific advice?


Does Google have access to keystrokes on our Android device keyboard? I am using an end-to-end encrypted messenger on my smartphone. However, today I asked myself if the content of the messages is really secure because of the keyboard on my Android device.

As you know, the keyboard makes suggestions for words and also saves some previously written words.

So my question is if Google has access to the words I type on my keyboard or if this suggestion-system is offline-only?

According to their confidentiality statement, Google doesn't collect anything from what you type when using GBoard, except the searches you make using the G button (for an obvious reason, they need the search terms to perform the search). Suggestions are based on an internal dictionary AFAIK. You can also delete the stored words at any time in the options of the keyboard app.


Authenticating services with PKI (pycrypto) so I'm trying to solve an issue at work. We have a popular key value store which does security via tokens. The kv store issues a specific token which dictates which clients can query which keys.

I want to write a micro service which aids other micro services in obtaining this token. The idea is the auth microservice (the one issuing the token to other services) will have a public key in its database which corresponds with a private key that each service which needs access to kv store (and thus needs a token) owns.

The service which needs a token will query the auth service with its name, and it's private key (over ssl). If the auth service validates that the private key corresponds mathematically to the public key, then the auth service should return the token.

This seems to be a solid idea but I need some ideas on how to accomplish this. On all the pycrypto tutorials I see, they are about encrypting and decrypting a message, but that's not exactly what I want to do. I just want the auth service to know about the keys, and when presented with a public key, just say "yes" this matches your private key, here's the token.

Reading my outline could I get some suggestions of the best way to go about this methodology?

First, you don't pass private keys to another service. In general, a key should be considered compromised if it is ever passed to another service. If you want to totally trust the authentication microservice, then just use passwords for authentication. You can generate them in a secure manner manner avoid weak passwords.

The right way to authenticate with asymmetric encryption is to use a challenge-response model. In this, the authentication service would generate a random number, encrypt it using the client's public key, and then pass the encrypted value to the client. By responding with the clear-text secret, the client proves that they have the private key corresponding to the public key in the database. So the messages would basically be:

Client-->Server: Authenticate Alice
Server-->Client: Decrypt encrypt(text, Alice's public key)
Client-->Server: text in clear-text
Server-->Client: Here's your token...

Probably the best way to do this is to use mutual-authentication TLS. That manages the challenge/response within the network stack. By the time the microservice is called, you will already know that the user holds the private key. You can just return the token at that point. The messages would be:

Client-->Server: Give me the token for Alice
Server-->Client: Here's your token...

The first step, where the TLS handshake takes place, will involve multiple on-the-wire messages, but that will be handled automatically.


Separate networks on one modem for security reasons I'm not very familiar with networking issues, but my current project requires me to create an environment in which I will have 2 clients, but client 2 cannot see where client 1 is connected to and with whom it is communicating. Client 2 is able to scan the network without me having the opportunity to stop him.

I want to make 2 separate networks, and I was wondering, what is the best way for me to do that?

Two options I've heard of are "Router Cascading" and "VLANs".  What are the potential risks in using those to achieve my goal?

In addition, on client 1, I need to be able to port forward to receive incoming traffic. This open port cannot be seen by client 2. And client 2 should not be able to communicate with client 1 at all.

I can think of two ways offhand:

Put client 2 on a guest network. That will separate the two clients while still allowing port forwarding to client 1.
Use 3 routers. modem -> router1, then router1 -> router2 and router1 -> router3
Anything plugged into either router 2 or 3 is effectively VLANed from the other.  This will also allow you to assign a static IP to each router, and then port-forward from router1 to whichever router you have for client 1, and then set up that router's port forwarding as well. This is a bit convoluted but should do what you need. Additionally, anything else plugged into router 1 would be able to communicate with anything using either router 2 and 3.


Would saving GPG and SSH keys as another user improve security? Since e.g. SSH keys under Linux are owned by the user who created them, any applications running as the user, e.g. a web browser, should be able to read them from the ~/.ssh folder.

Say that there is only one user on a system: user A. If another user, B, is added to the system and the only purpose of B is to own and store the SSH and GPG keys of user A, applications running as user A should be unable to read the keys.

When user A wants to use the keys that he/she has chosen to store under user B, what would he/she have to? Would this method of storing keys improve the security at all?

Hence, I want the keys to be usable by user A when they are stored by user B, but I don't want the keys to be readable by the applications running as user A.

I don't see the point in this measure. When you have an untrusted application you should rather run it under a special unprivileged user. Otherwise it would be able to detect how you accessed the files when you need them at some point.


How to send a post request where it is neccesary to be logged in? First off, this is in information security because the request may be vulnerable if I can figure out how to run it.

Second, the actual issue. I intercepted and copied a post request on an unnamed social media site that I may be able to send externally, but you have to be logged in to send it.

I tried intercepting the login post request, but it has CSRF protection.

Essentially, I am asking how I can go about sending this post request from a logged in session, ex. is there a chrome or firefox extension that allows you to send post requests from the current page/session that you're in?

Postman for Chrome should be able to do what you need. Otherwise a simple solution is to just issue the post request through the Chrome console while you're already logged in.


How to address application database compromise I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really appreciate if someone could help out.
So the scenario is:

A small company decided to move their infrastructure to the cloud. During the migration activity, they identified one of the database servers had 4 unknown local Windows users on it. This triggered a technical review and internal investigation.

The issues found were:

There were 4 local unknown users created on the server.
There were a total of 30 database-level users on MS SQL database.
The database server is storing data for 20 web applications.
Basic findings were that 5 web applications were compromised, where
1 site was having command injection issues
1 site was having SQL injection issues
1 site was having XSS and CSRF issues
2 sites were not doing any input validation
None of the sites was using HTTPS
Two of the databases were found to have credit card information

The questions are:

Based on this scenario, is this a database, application or system security issue and why?

What are the logs that the company can review during the investigation?

My answer:

I think this is an application security issue.

Application security defined as "the general practice of adding features or functionality to software to prevent a range of different threats. These include denial of service attacks and other cyberattacks, and data breaches or data theft situations". In relation to the scenario:

web applications are stored within database server which means this makes it easier for an attacker to access the data because they only need to crack the administrator account for one server to have access to everything.
users are created via web applications and stored in the database server, we have yet to identify the privileges of the  4 unknown users. Any one or all of these unknown users could have malicious intentions. They could be identified as individuals with unauthorised access to the company’s network, which means the company may have already been a victim of data breaches or data theft.
issues such as SQL injection, XSS and CSRF are a common type of application security vulnerabilities where attackers can exploit and facilitate cybercrime. As a result attackers could target availability, confidentiality, and or integrity of the company’s data.
credit card information is found within two databases and 5 web applications were found to have no https. This is signs of data breaches and theft.

I suggest the company to look into database and web application logs for signs of an actual exploit, I will also look into security audit logs for any failed authentication attempts and heck the firewall for unusual traffic based off the location.

Based on your description, certainly there are multiple serious application security issues.

  Based on this scenario, is this a database, application or system security issue and why?

However, that does not rule out other issues. For example, the new users have not been detected until migration started, so there is a "security monitoring" (a subset of System Security) issue. Similarly, new DB users have not also been detected, and that could (depending on your processes) be within the scope of Database Security.

  What are the logs that the company can review during the investigation?

Depends on what logs are enabled for the systems as well as for the application. It seems you are using Windows servers, so there is a high likelihood that you will have copious event logs from windows systems both for user activity as well as database activity. Similarly, webserver access logs would also be available (irrespective of the OS).

I always recommend application logging (though not all app-level logging is done with security in mind) - and if done correctly they are extremely valuable when the compromise is done via application vulnerabilities.

Your investigation will have management objectives. What logs you review will need to be aligned to them. e.g., if the objectives do not include discovery of initial attack vector, you may be able to ignore application logs. If the objectives do not include preserving evidence to pursue with law-enforcement, you may want to limit the time you spend investigating disk artifacts (especially if you can restore the clean application from version control).


How to ensure reasonable anonymity when submitting information to a platform? An important boss in the company I work for has initiated a platform that allows any employee to submit questions to be answered in a periodical meeting which is broadcast to all employees.

This is done in an effort to allow issues to "bubble up".

The system is advertised as "anonymous" so that there is no pressure for an employee to ask about "sensitive" (e.g. issues that cannot be told to his/her boss). Of course, all questions are moderated, so that really bad ones are not ever read during the conference.

Although I have never heard of anyone having problems related to this platform, my concern is related to anonymity:

posting from work machine - this is clearly traceable, since all traffic goes through a proxy
posting from a personal device - should be anonymous, but there is a very small chance for someone to figure out the mapping between by work machine IP and other personal IPs (e.g. Gmail has an interface which displays IPs used to connect to the account).
posting from a personal device using an open Wi-Fi network or a proxy - I cannot think of a way to have anonymity compromised.

Question: How to ensure reasonable anonymity when submitting information to a platform?

By reasonable, I assume there are no illegal postings (e.g. disclosing of critical information, threatening someone).

Run the site that takes the employee messages both as a plain website and as a TOR hidden service. Provide an explanation on how to connect to the site via TOR if someone wishes to do so.

This way, the people who fear repercussions can connect from their personal device at home via the TOR Browser, which will make their reports as good as untraceable. Note that this applies only to the network origin of the message; depending on what's said in the message, it might lead to the original poster.

All the others who don't fear repercussions can still connect and use the site normally.

(You could also leave out the hidden service step and just use the TOR browser to connect to the site, but if the site provided a hidden service, that would  drive the point home that the company is serious about user privacy).


Password history with PBKDF2 Scenario:

Cannot use previous 15 passwords
Using PBKDF2 with iterations targeting 1 second execution time

In this scenario, when a user wishes to create a new password, the server must combine that password with up to 15 salts from the previously used passwords.  This means, worst case scenario, a user's password change would take about 16 seconds, significantly burdening the server.

How do I mitigate this stress?  Reduce PBKDF2 execution time to something like 0.1s?  Reduce the previously used password list?

From where is the "previous 15" requirement coming from?  That seems unlikely to actually improve security much - my first step would be to reduce that if it's not coming from a legal, regulatory, industry, or auditing requirement.

An attacker doing an online attack won't notice at all
An attacker with your PW database doing an offline attack against just the current passwords won't care during the attack
More complex pattern-noticing analysis on the attackers part is too complex to go into here, but imagine a user who uses football1, then football10, football100, etc.  The pattern's obvious if you have a few passwords, even if football100000000 might not be tried until until a very late stage of password guess (if at all, given how many hundreds of thousands of iterations you must be using)

Also note that trying N different PBKDF2 values at once means you can use multiple cores; i.e. for 15 PBKDF2 runs at 1s each, if you had 10 cores, this could take as little as 2 seconds (10 in the first second, 5 in the second second).  You will be using the same (or slightly more) CPU time, though - watch out.

Reducing PBKDF2 execution time decreases security significantly, since at attacker has to do less work in the same proportion you do less work.  If you can afford to target 1s of CPU time (presumably for fairly infrequent logins, or for a very hoss server farm), keep it!  That will dramatically increase an attacker's workload at the same level it reduces yours; I don't recommend it.

If you're targetting one second of PBKDF2 work per login, then 15 users logging in at about the same time is exactly the same workload as any 15 other unique salt PBKDF2 operations - make sure you can afford your current target times under your expected peak load for the next 2-3 years.  Also, how often will users be changing their passwords?

One other alternative:

Don't change a user's salt every time.

This is not a great idea, but can be done, and will solve your performance issue.  However, offline attackers with the full password list will have 16x the chances to guess passwords for each try.
Only changing the salt every 2 to 6 password changes would strike a middle ground - it would be less bad if you have very, very frequent password changes.

P.S. You know you're going to get users using P@$$w0rd1, P@$$w0rd2, P@$$w0rd3, P@$$w0rd..., P@$$w0rd999, don't you?


Unsolicited opt-out from data brokers I received several automated emails at an early hour from several data brokers (e.g., Spokeo) asking me to confirm an opt-out for my email address and name.  I did not request these, but did so about 2 years ago from most data brokers, and accidentally clicked on one of the links.  The originating email address as well as the domain/IP from the email server look legitimate and the links go to the appropriate domain.

I am somewhat concerned because it happened within a short period on several brokers that ostensibly are separately owned, suggesting a human may have done this manually.  On the other hand, it seems more strange the malicious.  Is there any reason a malicious third party might be doing this?

Theory

Maybe - and this is a fat maybe - someone is trying to desensitize you to clicking on opt-out links so that you get trained to click through any link you get for protecting your privacy.

What do you do?

Nothing. If you didn't request the email, then don't click it.

What's the threat of clicking on a link? (and how do you protect yourself)

someone could try to exploit vulnerabilities.

patch your browser
turn off javascript
don't click on unknown links

You could fill out a form and give away information

don't do that.
Type in the url for the site you want to login to.
check the certificate, etc.

If you didn't request the email, then don't click it.


How do EMV contactless cards protect against replay attacks? I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the company which validates the payment?

The most-authoritative reference on EMV replay (i.e., transaction cloning) is Peter Fillmore's latest talk from Syscan 2015

https://github.com/peterfillmore/Talk-Stuff/blob/master/Syscan2015/PeterFillmore_Syscan2015.pdf

Another great resource is Ricardo Rodriguez's talk from Rooted 2015

http://www.slideshare.net/cgvwzq/on-relaying-nfc-payment-transactions-using-android-devices

Which mentions the NFC Proxy talk from DEF CON 20 by Eddie Lee

https://youtu.be/tFi0vYuYeAI

Of additional interest is Ricardo Rodriguez's whitepaper on EMV relay attacks

http://conference.hitb.org/hitbsecconf2015ams/materials/Whitepapers/Relay%20Attacks%20in%20EMV%20Contactless%20Cards%20with%20Android%20OTS%20Devices.pdf

and Ricardo Rodriguez's website

http://vwzq.net

Some additional validation of these attacks was provided during a HackFu competition by MWR InfoSec

https://hackfu.mwrinfosecurity.com/hackfu-blog/params/post/465447/how-to-hack-a-contactless-payment-system.html

And finally, Michael Roland and Josef Langer write about the downgrade attacks against EMV, as well as the protections built into the protocol. As you can see, originally, the EMV contactless spec itself wanted to provide the protection (long before payment validation), but things don't always work out as planned.

http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12055-woot13-roland.pdf


Estimated cost to make a brute-force WPA2 attack feasible It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to afford the hardware, or the few experts who know how to debug and run their own WPA2 program in the cloud.

Assuming the resources available to the average hacker, are these brute-force attacks now feasible? what would be the estimated hardware cost to make a successful brute-force attack on WPA2-Personal?

400,000 PMK/s as said in the URL doesn't seem fast enough; what assumptions must these attacks be making?

The attacks assume a password that appears on the password list they are using (or at least in the space of passwords being considered, e.g. 8-9 alphanumeric chars).

The WPA 4 way handshake is vulnerable to offline password checking, but the key involved is 128 bits long - if the network password has sufficient entropy then it can't be brute forced in a reasonable time frame.

So there is no one size fits all answer to the question - it very much depends on the quality of the password on the target network and how much the attacker knows about that password (length, format, name of pets, ...).

Note that its a different story if the access point supports WPS - many implementations are vulnerable to brute force attacks, but with a consistently small keyspace. A normal consumer PC can crack a vulnerable WPS implementation in <12 hours.


Is it safe to whitelist my public ip to a server, even I am behind CGNAT? I have a few VPS and Databases in GCP, I can access them by whitelisting my IP, but just few months ago my ISP rollout their CGNAT and I was affected. As far as I know CGNAT, allow multiple subscriber to have a single public IP.

Is still safe to whitelist my IP or I need another means or extra layer of protection?

If whitelisting your public IP address is the only form auf authentication then it is not safe because with NAT (including CGNAT) this IP address might be shared at the same time with other clients. If instead whitelisting the public IP address is only additional defense and proper authentication is still done, then IP based restrictions are still useful: even if the same IP address is shared with some others which might thus pass this first line of defense it is still much better than have no whitelisting at all which would mean that all others could pass this line of defense.


Prevent cold boot attack on running laptop by overwriting ram I'd like to use my laptop as a recording device when I leave home, but there would still be the possibility for a cold boot attack or with DDR3 RAM even warm boot attack is possible as I have read.

Could one overwrite RAM before leaving the laptop locked and make cold boot impossible that way?

I found this:
http://manpages.ubuntu.com/manpages/utopic/en/man1/sdmem.1.html

Will sdmem really overwrite the RAM of a running system?
Is it possible to write a script that does this every time I lock my pc?

Yes, you can use sdmem tool for your purposes.

If you use only bash without any desktop environment you can simple add your command to $HOME/.bash_logout script.

In case of using GDM you can try to append sdmem command to /etc/gdm/PostSession/Default file.

Also you can to look this and this.

Good luck!


Is stripping out  characters an effective way of preventing XSS? I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks.

Will doing this keep a site safe against XSS?

UPDATE: If it won't protect me could someone explain what type of attack could get through?

It depends on the context the injection happens.

Obviously, if the injection happens in the context of an elements content like this one:

Your search for "❌" has returned the following results:

< is required to switch from text to markup. But even here, if you echo user input in a

You’ll need to look for other characters as you’re not in the plain text context. Here you should take care for characters which are special inside JavaScript string literals as well as certain sequences that can denote the script element’s end tag, e.g. </script>, or </script/.

Similarly, if you print user input in an element’s attribute value:

<input type="text" name="search" value="❌">

Here you have to take care of characters that are special for double quoted attribute values, i.e. the delimiting " quote. If you’re using single quotes or no quotes at all, different rules need to be applied.

Additionally to that, you don’t just have to look for syntax but also for semantics. Like there are javascript: and data: URIs that can be used for XSS. Or there is a JavaScript that uses part of the user supplied data for some evaluation, or retrieval of some additional script code, etc. There are hundreds of examples.

So always take the context into account in which you want to put user supplied data and encode that data correspondingly.


Why 29 A's in the new HP ilo bug? In the newest authentication bypass exploit:

https://www.exploit-db.com/exploits/44005/

29 "A"'s needed.

Q: But why? isn't buffers/variables usually the power of 2? so 16, 32, 64, etc.

(just to know more when I am fuzzing an application, how many "A"'s should I use in general :) since I was using the power of 2 and the power of 2 + 1 so far, but this 29 A's wouldn't even fit the power of 2 - 1)

The author of the code wrote it so the max values for the field were 28 most likely, 29 breaks it. As @gameOver said you can define a variable to be any length you want.

Here is a really silly python example of a buffer overflow, it is just dumb but it shows how an arbitrary limit is defined then breaks when it is exceeded.

#!/usr/bin/env python

import sys
if len(sys.argv) != 2:
    print("ERROR: Must supply 1 argument.")
    quit()
else:
    userInput=sys.argv[1]

fixedBuff=[None]*10
j=0
for i in userInput:
    print("Appending: " + str(i))
    fixedBuff[j]=i
    j=j+1

If you run that and increase your argument it breaks eventually. Very simplistic but it helps to show how a buffer overflow works.


What are best methods to mitigate damage from MS Office VBA macro viruses? We use Office macros in our work (for example: Excel User Defined Functions) so we cannot completely disable VBA in Office documents but I am looking for ways to avoid exposure to Office document malware macros, usually arriving in the older DOC or XLS format.  While most such email attachments we get are malware, a small percentage are legitimate from clients or vendors so we cannot easily block them all.

Other than anti-virus and Applocker/EMET I am looking for other methods of protection, perhaps by slightly hobbling VBA.

For example, is it possible to block VBA access to the web?   Is it possible to stop VBA Shell calls to other things like Powershell? Can we block VBA from making Win32 API calls?   Our normal VBA macros would not need this functionality...

See this recent article. Basically you need to configure a trusted location within Administrative Templates.

Obviously this is for Windows only. Not sure if it is possible for OSX.


Using anonymous email as official email Assuming I have created an email in hushmail through of tor, and if I use it as my official email in a site such as Github. Will it throw my anonymity away as I use github from a regular browser?

To a large extent, yes, you will lose your anonymity.  Github (and anyone monitoring Github) will be able to connect your email address to your IP address.

A key element of anonymity (or more technically, pseudonymity) is keeping your separate identities separate.  Your Hushmail account accessed over Tor is one identity, while everything you do through direct Internet connections constitutes a second identity.  By using your Hushmail account for a direct-connection service, you've tied those two identities together.


staying not signed in: is it the safest procedure? each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as often as I reopen the browser and want to browse within my private accounts.

I do that because I've always supposed that such a method is the very safest, since I hope it protects me from running the risk to have my saved passwords stolen.

But I wonder if it could involve some other kind of risks and how much I should worry about (for example I refer to the possibility that an unwanted kaylogger could read my passwords while they are being typed on the keyboard, and that such a risk becomes higher the more frequently I do log, if I guess correctly how a keylogger basically works).

I'm worried abut other kind of scenarios which I'm unware of, as well.

Which is the safer method? -> Should I Keep my accounts logged in or should I not?

Risks of keeping logged in:

CSRF and XSS attacks could be used to compromise your sessions, if the site in question is vulnerable.
If the application uses weak or predictable session tokens, yours could be brute forced.
A physical attack (e.g. laptop stolen), could possibly allow access to all your logged in sessions. This could be mitigated using disk encryption, or if using a browser that encrypts cookies like Chrome it can be mitigated with a strong password on your OS account. Both mitigations assume your laptop is locked/logged out at the time of attack, preferably logged out to prevent cold boot attacks from reading the key from memory.

Risks of typing the password each time:

You may be vulnerable to phishing unless you diligently check the domain and the HTTPS padlock each time.
Keyloggers may get your password, although if they do this your machine is compromised therefore you've already lost.

I would suggest the use of a browser based password manager to mitigate phishing, as your password will only be filled if the domain matches, although I've not seen any yet that protect against ssl strip style attacks (that is, they validate the domain, but not that the protocol is HTTPS).

Risks of a password manager:

If they autofill password boxes without prompting, an XSS attack could grab the password should the site be vulnerable.
You're trusting software or service with your keys to the kingdom.
You could be at mercy to any vulnerabilities in the client-software or server-side storage (if applicable).
All your eggs could be in one basket should your master password be compromised.


To trust, or not to trust? Adding exceptions to the Trusted Certificates List in (firefox) Light I recently installed the Light (a more compact forking of Firefox).

I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of trusted certificates?  Yes, this gets at the issue of trust, and that is an enormous problem in itself.  But let us suppose that I felt comfortable trusting the certificates that came bundled in my browser (whether it be Firefox, Light, or IE)

In my case, the error is (Error code: sec_error_unknown_issuer).  It must be that Light doesn't have the full list of trusted authorities that the full Firefox does.

I can see the certificate in question, and I can see the name of the issuer of the certificate (in my case, Starfield Secure Certificate Authority - G2).  And yes, if I go to the big Firefox list of trusted certificates, I can see similar names there (Starfield Services Root Certificate Authority - G2, and Starfield Root Certificate Authority - G2), although not an exact match.

But I imagine that is not enough: it is not an exact match.  But let us go further: let us assume that the name of the issuer were a perfect a match.  Presumably, if a website is trying to steal my information, or run malicious code in my browser, it will be smart enough to fake the name of a trusted certificate provider.  What is it in the certificate itself that I must verify to make sure that the certificate that I am being presented is authentic, and there is not some bozo somewhere faking a trusted certificate?  And, is there a way to get that authentic certificate from the horse's mouth, so to speak, instead of from the webpage I am currently trying to browse?

The question is, assuming you've decided which CA's (Certificate Authorities) to trust, how do you get their certs.  If you trust "Starfield Services Root Certificate Authority - G2" and you want to know if you should trust the hypothetical ""Starfield Services Root Certificate Authority - G3" (for example), you do have to "get it from the horse's mouth" as you put it.

There are a few options...  Easiest is, if Starfield helpfully "bootstrapped" their own trust for you.  If "Starfield (trusted) CA" signed the "Starfield (new) CA" cert, then you could trust it is authentic.

If not, then you need to get the public key from Starfield in some way that makes you confident it is really theirs, then use that to verify the signature/fingerprint on the new CA cert they've issued.

From a practical standpoint, if you trust some browser to have done the legwork for you, you can grab the trusted CA cert from its truststore.

Ultimately, you choose which CA's to trust in their job of asserting other websites' legitimacy.  You make that choice by your choice of CA certs in your truststore, or you let your chosen browser make that choice for you.  If SuspiciousWebsite(tm) presents you with something signed by LegitimateSoundingCAYouDontHave, that's when you need to decide if you trust that CA or not.  I'd never accept an unknown CA cert offered up to me by some website.  Either get the root cert from some other browser's truststore, or directly from the CA entity itself.

Once you've accepted a CA cert, you trust anything that cert signs.  If you let a badguy's fake CA cert in, that bad guy can trivially spoof your bank or any other site.


What kind of damage can a website with malicious javascript do? Imagining I want to develop a website to intentionally harm its visitors, what kind of attacks can I do ? I figure a typical CSRF attack would work, but could I steal cookies from another website that isn't mine? What else could I do?

I'm developing a system that allows third-party html/javascript code and I need to prevent any exploits I can.
Google Caja and similar systems aren't really relevant in my case, I think, since there is no host and guest code on the same page, only guest code.

Javascript is an engine executing code client side. If you allow third party uncontrolled javascript in your site, that means that potentially visitors of your site may execute arbitrary code in your browser.

Damages can come at various levels:

simplest and lightest: simply play with the browser. As an example start a background loop that repeadetly shows popups
slightly more advanced: remove the browser menu and intercept the close event to prevent user to simply close the application to get rid of the popups
still one step further, play with the stored browser config by changing shortcuts or favorites to call an infected page
hardest but more harmfull: use flaws of browsers to escape from the browser sandbox and directly access the underlying system

Depending on the system, the browser and their configurations, some of those attacks will not be possible. But even the lightest one, the background loop that continuously open popups is extremely annoying for a user, and you can be sure that he/she will never come again to your site.


How can my IP camera be hacked behind a NAT? I keep reading about hackers accessing laptop and home security camera systems. Most home users are using SOHO routers meaning they are on a private IP range behind a NAT. I realize NATs aren't designed for security, but if an IP camera is behind one, how can a hacker access it?

Would it require either the camera's software or the router to have a security hole (0 day, bad code) or end-user misconfiguration (weak/default password, open/mapped ports) that would let the attacker in?

The cameras are often designed for ease-of-use by people who want to watch the streams of their goldfish or children.   To make it easy to use, the cameras often call home to the manufacturer's website for remote viewing.  Often these sites are insecure.

Another method is UPnP sets up automatic port forwarding:

https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_traversal

  One solution for NAT traversal, called the Internet Gateway Device
  Protocol (IGD Protocol), is implemented via UPnP. Many routers and
  firewalls expose themselves as Internet Gateway Devices, allowing any
  local UPnP control point to perform a variety of actions, including
  retrieving the external IP address of the device, enumerate existing
  port mappings, and add or remove port mappings. By adding a port
  mapping, a UPnP controller behind the IGD can enable traversal of the
  IGD from an external address to an internal client.

It's easy to disable these features if you're aware of them.


How can I encrypt a password for storage without having to remember another password? I've recently started using a password manager (1Password). I have a really good master password (using diceware) but I'm worried that if I forget it then I can't access 1P and all my passwords.

One solution is just to write it down on a piece of paper (they suggest I do this), but I don't have a safe and live in shared accommodation. Ideally I would really like to store the password online, so I can recover it no matter what (fire, lost phone, etc.), but if I want to encrypt it then I'm back to square one as I then need to remember that password.

So is there any way to store a master password online, encrypted, without having to remember another password?

How can I encrypt a password for storage without having to remember another password?

You cannot. But you can reduce the risk associated with the loss of this "master password".

Here are my private and professional method (which I wouldn't sell as perfect).

As the person in charge of some confidential information, I have to deal with the case I would die before being able to transmit everything to the next person in charge. Therefore, I made a printed copy of the master password of my software safe.

For my private use, this printed copy is in a closed envelope with the name of my wife on it as the unique person allowed to open it in this case.

For my professional use, this printed copy is in a closed envelope with the name of the persons allowed to open it in this case. This envelope is stored in my physical safe with a fully mechanical lock.

Concerning the choice of this master password, I printed a list of a few of them generated with a validated password generator, and then tested them on a validated  OS without looking at the screen (cat >/dev/null) to validate my memory error rate to select the best one.


How to detect a scan on a local machine? Is there any way to detect a scan on the local machine ( the pc  that I'm using with a linux os -ubuntu-) from the network that I'm connected to?

I know that for the webservers we could check the apache log for some details that could notify the admin about some unseal behavior but for the   this case where there isn't any webserver or a shared network service that I could follow its logs how can I find out if there is anyone who is scanning the device?

Scanlogd should be what you are looking for. However, this is TCP oriented.

  scanlogd detects port scans and writes one line per scan via the
  syslog(3) mechanism. If a source address sends multiple packets to
  different ports in a short time, the event will be logged.

For most NMap scans Snort and p0f are both capable IDS. How to Detect NMAP Scan Using Snort is a guide about configuring Snort to detect: nmap -sP -p 22 192.168.1.105 among other scans.

  Ping Scan [-sP] This scan type lists the hosts within the specified
  range that responded to a ping. It allows you to detect which
  computers are online, rather than which ports are open. Four methods
  exist within Nmap for ping sweeping.

  The first method sends an ICMP ECHO REQUEST (ping request) packet to
  the destination system. If an ICMP ECHO REPLY is received, the system
  is up, and ICMP packets are not blocked. If there is no response to
  the ICMP ping, Nmap will try a "TCP Ping", to determine whether ICMP
  is blocked, or if the host is really not online.

  A TCP Ping sends either a SYN or an ACK packet to any port (80 is the
  default) on the remote system. If RST, or a SYN/ACK, is returned, then
  the remote system is online. If the remote system does not respond,
  either it is offline, or the chosen port is filtered, and thus not
  responding to anything.

  When you run an Nmap ping scan as root, the default is to use the ICMP
  and ACK methods. Non-root users will use the connect() method, which
  attempts to connect to a machine, waiting for a response, and tearing
  down the connection as soon as it has been established (similar to the
  SYN/ACK method for root users, but this one establishes a full TCP
  connection!)

  The ICMP scan type can be disabled by setting -P0 (that is, zero, not
  uppercase o).
  Source

What's the most effective way to detect nmap scans speaks about this further.


Why does my "Client Hello" change depending on server config? I have the requirement of configuring all of our applications to use only PFS ciphersuites where possible.

I have an application (HP Network Automation), which supports DHE key exchange (although not ECDHE), but when I limit it down to only the following two suites:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

I cannot connect via IE11, FF or Chrome.

I have looked at wireshark traces, and when I have no restrictions on the server end, the Firefox Client Hello contains 66 suites, including 6b and 67, which are the two listed above.

However, when I restrict the server to only offering the above 2 suites, my Client Hello only contains 11 suites, and doesn't include 6b or 67.

I thought the Client Hello was the first real communication, (not including TCP handshake), so how can server configuration influence the CLient Hello?

N.B. These applications can only be accessed via intranet and VPN, so we have control over which clients will connect. We don't need to offer legacy suites.

I can confirm that I have tested hardened web servers for compliance and had no issues with IE or FF negotiating these ciphers. The only hiccup is that default configuration of FF, unlike other browsers, is configured to accept AES128-based suites over AES256-based suites if both enabled.


Issuing TSA (Time Stamping Authority) certificates What is a practice for issuing TSA (Time Stamping Authority) certificates?

I read that TSA certificates should be issued directly from Root CA, but basically TSA certificate is end entity certificate and Root CA should't be issuing certificates for end entities.

Should I issue TSA certificate from Root CA or should I issue dedicated Intermediate CA for issuing TSA certificate?

Your argument is correct, in most cases you should create an intermediate certificate, which issues your timestamping certificate.

The only reason I can think of for creating it directly from root would be, that managers of very small PKIs want to avoid the additional administrative overhead of an extra intermediate CA for a certificate type which will only be issued very seldom (probably less than one certificate per year). It can be done in a private enterprise setting, but it is definitely bad practice.


Can a drive-by download attack crash the OS? Are there cases where a serious drive-by download attack could crash the operating system or the browser ?

Yes. This is part of the more general first immutable law:

  If a bad guy can persuade you to run his program on your computer, it’s not your computer any more.


Do payload sizes reveal URLs when HTTPS is deployed on news, blogs, etc? Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow to an observer? If so, how would a site remedy this?

Yes, if the site is public and its content is known to the attacker, the attacker with access to the encrypted traffic can find out which page on the blog the user visited just by measuring the size. The website could remedy this by padding all lengths of all pages to the maximum, and always including the same number of images, each with padded sizes. The images also need to be loaded by the browser on the same time for all pages.


Why even use a one-time pad if the key distribution is fully secured? I had a job interview yesterday where they asked what the only scenario where a one-time pad can be broken would be, my answer to which was "when the key distribution process is not secure enough".

They praised my answer, but they asked me another question: Why would you even use a one-time pad if the key distribution is 100% secure? Why not simply send the plain-text message since you are sure that distribution is 100% secure?

What is the correct answer to that question?

You can distribute the key now and send the message later.

Suppose you are a spy sent on a mission behind enemy lines. You take the key with you (secure distribution) and when you discover a secret you can securely send it using the One-Time pad.


Automatically determining whether particular product version is vulnerable? I'm building a system that contains a lot of data about different versions of various networking software (client software, servers, etc) in a human-readable format. Is there an API that I could query like "Are there any unauthenticated RCEs for Microsoft Exchange 2003" and it would return me with a yes/no answer?

cvedetails.com offer API access, however I couldn't find any official documentation except for the names of the query parameters. Entries in the database can be filtered for example by vendor, product or vulnerability type.

To get all entries for vendor "Microsoft":

GET http://www.cvedetails.com/json-feed.php?vendor_id=26

To get all entries for product "Exchange Server" & vulnerability "Code Execution":

GET http://www.cvedetails.com/json-feed.php?product_id=194&opec=1


Way of categorising and organising types of security issues and areas I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be implemented. Everything from SAST, architecture to what ciphers to use.

At the moment it is a big mess of issues. I need a way to organise them in to coherent categories in order to make sense, group different issues that fall under a similar topic and prioritise maybe. It would also be useful to see a if there are any areas I have not considered.

I have been looking around for standardised model or informal lists of categories to cover but what I have found has been very limited and specific.

I have considered something like:

Prevention (Configuration, SAST, DAST, WAF, DLP etc..)
Detection (SIEM, Vulnerability Scanning, Pen Tests)
Response (Malware removal etc)

The issue here is:

I feel like I am trying to reinvent a wheel
This is overly simplistic, especially for prevention which can be broken down in to so many categories.

I would be surprised if there isn't a pre-existing system I can use. Just a matter of what to google for.

NIST has two documents which cover Information Security categorisations and subcategories.

The CyberSecurity Framework (NIST CSF - see https://www.nist.gov/cyberframework) is the more simple of the two but certainly provides what you're looking for at a high level. The main categories are Identify, Protect, Detect, Respond, Recover and each of these has some subcategorisation. The CSF covers just over 100 items which makes it very approachable.

The other document is Security and Privacy Controls for Federal Information Systems and Organizations (see http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf). Security controls are enumerated in Appendix F.

Where you have findings which don't fit with the above categorisations, you can create your own miscellaneous section. However, by adhering to NIST, at least you're presenting findings using a recognised industry framework which can be used for various clients and ensure you're speaking a standardised language.


Responsible disclosure: company is dedicated to security but doesn't answer Context: recently I found a vulnerability in a webapp for a big company. They have a full policy on responsible disclosure which I followed to avoid legal issues.
The company commits itself to answering within a time period (in this case two weeks). However that period has ended and I haven't received any response, not even an acknowledgement that they know the problem exists.

How should I handle this?

There are other questions like this one, but often about disclosure to a company without a policy.

Many companies do not acknowledge or discuss a security issue (even with the researcher) until a patch has been released and the majority of users have updated (Apple is a good example of this). Some companies may send you an email saying thanks for your report but not further acknowledging it until the patch is released. Public disclosure is rarely a good idea due to the risk of getting legal action taken against you. If I were you I'd keep waiting and if more than a few weeks pass without a patch that fixes the issue, contact them again and again. At some point, it'll hopefully get patched. Good luck with getting this vulnerability fixed and thanks for disclosing responsibly.


Why does ATMs have a green plastic thing in front of card reader? To me this looks suspicious, it looks easy to hide a skimming device here.

A slot flush to the front would be safer, in my opinion.

There has been a constant rise in ATM frauds and scams most specifically ATM skimming effecting consumers secured transactions. In order to combat ATM skimming ATM machine manufacturers are manufacturing ATM with anti skimming technologies which appear as a green casing that protrudes from the card insertion slot. Many a times there are chances that ATM thefts might occur by simply mirroring these anti skimming parts, for which one should always remain careful. - What is the green thing on the card reader at ATMs?

But ATM MagStripe skimmers still exist!

Green Skimmers Skimming Green

Despite the flawed anti-skimming system, it's worth realising that the credit/debit card's magnetic stripe is inserted perpendicular (longways) allows for easy skimming.

Being flush would also allow for skimming devices to be connected, only much easier.

  ATM manufacturer Diebold claims to have found the answer to skimming fraud with a new reader that requires users to insert their card sideways on to prevent the copying of data stored on the magnetic stripe. - Diebold takes 90-degree shift to counter ATM skimming

With all this knowledge, why not discontinue magnetic stripe and end the raising fraud pandemic?

  Replacing the 15 million payment terminals in the United States would cost roughly $6.75 billion, according to Javelin’s estimates. - Why Is the U.S. Determined to Have the Least-Secure Credit Cards in the World?

Alright, so it's actually more economical for banks to have an annual reserve to pay fraud costs than overhauling the current infrastructure.

  Even if the US merchants had surpassed the 75% adoption stage, however, it would still be prudent to include a magnetic stripe on the back of chip cards to ensure that no payment transaction will be lost, within or outside of the country, as a result of the lack of an updated merchant payment system. Why do credit cards with a smart chip still have a magnetic strip on the back of them?


system security needs classification I am working on a way to classify our systems (everything that is reacheable through ip) on how bad it would be and how possible it is, that someone would get unauthorized access using exploits.

I do this to determine how deep and how often I am going to check them with vulnaribility scanners like OpenVAS.

So far I have the following criteria:

Are there any plaintext credentials on the affected system or files which can be decrypted easily to get access to other systems?
Do users on the affected system have special rights to connect and authenticate to other systems?
Is there any personal-related data on the system?
Does the loss of the system affect other systems which rely on it too?
Is it costly in time or money to replace the system if an attacker destroys it or makes it useless (Software)?
Is it a productive or just a demo/test system?
Is only a sole department concerned with the temporal loss of the system or multiple ones?
Does the affected department rely invariably on the system or is it possibly to maintain operability over a short time without the system?
Does the configuration and software on the system change often, so it´s more likely that misconfigurations happen or new vulnerabilities get patched into the system?
Is it a physical system or a virtual machine?

I would appreciate if someone has a point or two to add or if theres already a standard for classifying systems that way.

This sounds like you might be looking for some of what is covered in the CERT-RMM.

http://www.cert.org/resilience/products-services/cert-rmm/index.cfm

I suspect the scope of the Resilience Management Model may exceed your current project but the objective you describe appears to be part way down the path of what RMM codifies.  One other tangental benefit is that you can point to the work that you are doing as following a documented and promulgated system.


SSL interception with Burp Suite using Firefox - Strange behavior when intercepting twitter I am learning Burp Suite(Free Edition v1.6). I have set it up with the default settings. The proxy listener is listening to 127.0.0.1 on port 8080 and Certificate option is set to 'Generate CA-signed per-host certificates'. I am using Firefox 33.0.2 and have configured the proxy settings appropriately. When I try to browse to https://www.facebook.com/, I get a 'This Connection is Untrusted' page, which is expected, understandable. I have options to 'Get me out of here!' and 'Add Exception'. Most other sites on SSL also do the same. Except, that I encounter a somewhat different behavior when I try to browse to https://www.twitter.com/. I get a 'This Connection is Untrusted' page, but this time without an option to 'Add Exception'. In both cases the Technical Details indicate the same issue.

www.***.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer)

Please note that I know I can import Burp's CA as a trusted CA in my browser, but what I am wondering in the specific case of twitter do I not get the option to add the certificate as an exception. This behavior is consistent across at least the 2 browsers that I have tested - Firefox and Chrome.

UPDATE
I have disabled the certificate pinning option in Firefox, and I still see the same results.

UPDATE 2
The option to add the certificate as an exception is there, but hidden with the following code -

<h2 xmlns="http://www.w3.org/1999/xhtml" hidden="true" id="expertContent" class="expander" collapsed="true">
      <button onclick="toggle('expertContent');">I Understand the Risks</button>
</h2>

But why in the world does Firefox decide to do this? Even after "certificate pinning" is disabled.

This is a security feature called certificate pinning (or public key pinning). In this case the browser knows which certificate (or public key) to expect and refuses any attempts to override it by the user. Twitter is included for public key pinning since Firefox 32.

See https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning for more details.


uninstall and reinstall after hacking My computer has been hacked. If I uninstall and reinstall do I loose my files?
The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my computer and I needed to clean it up and change all of my passwords. I also needed additional security..more than anti virus. What do you suggest?

what kind of software is needed to manage errors and tracking?

I agree with @polynomial, this sounds like a scam. Facebook would never call you, there's no such thing as a Facebook tech. Do not pay them any money! It could be that your computer has been infected and that you are getting pop-ups telling you that your computer is infected and you need to call a number to get it fixed, this is also a scam where they sell you a fake AV tool that will remove the so-called virus.

If someone has called you out of the blue then tell them to take a long walk off a short pier. Make sure your computer has all OS updates, Adobe updates, Sun Java updates, etc installed. Also make sure you have an antivirus installed and it is up to date. Microsoft has a free one that is actually pretty good.

If you have pop-ups on your computer telling you that your computer is infected by a virus, then it is. The virus gives you a pop-up telling you your computer is infected in hopes you'll fall for the scam. The only way to recover from this is to re-build your computer. Get a portable hard drive and copy your important files to it, then completely re-install the operating system. Make sure it has all the updates on it, and an Antivirus program. Use the AV to scan the portable hard drive and if it is all clean then copy the files back.


Windows 10 Wi-Fi vs Airplane Mode Security Does Windows 10 Airplane Mode provide the same level of security/protection as turning off Wi-Fi?

I know that turning on Airplane Mode disables Bluetooth; however, as far as connecting to the Internet, is there any fundamental security difference in turning off Wi-Fi versus turning on Airplane Mode on my PC running Windows 10?

Airplane mode turns off all active wireless controllers. So that is both Wi-Fi and Bluetooth.

Once turned off, there is no possibility of any external agent getting into the computer without physical access unless malware or remote management is also present that could be use to turn the wireless controllers back on again.

Turning off the controllers means turning power off which saves battery too.

The same is true of turning off Wi-Fi. So no, there is no difference except that turning off Wi-Fi is likely to only turn off a single wireless controller.


Somebody called a number from a pop-up on their MacOS computer and installed a program called GoToAssist. What is the best course of action now? Somebody I know saw a pop-up on their iMac running Sierra (10.13.5) that advised them to call 877-336-5833.

They called the number and the representative advised that they install a program called "GoToAssist" to gain remote access. They did.

At this point, I'd like to clean up whatever might have been installed.

I looked through files that were modified on the date they called the number.

One possible file of interest was:

/Library/Logs/DiagnosticReports/GoToAssist Customer_2018-06-28-181403_Irwins-iMac.wakeups_resource.diag

...created on Jun 28 18:14.

Another, found in the user directory was:

./Library/Logs/com.logmein.g2a.rs/Customer/20180628_181221/GoToAssist Remote Support Customer_00.log

which showed me that the GoToAssist session was exactly between 2018-06-28 18:12:19.403450 and 2018-06-28 18:28:09.964376

With that, I can narrow down file changes:

$ sudo find / -newermt "2018-06-28 18:12" ! -newermt "2018-06-28 18:29" > /tmp/changed.txt

But, I am not really sure what to look for.

And I realize that if they are being sneaky, they can change the modified dates anyway.

I did notice that the user's .bash_history was modified at that time, but the last thing that is in there is something I did a week before. So, that makes me think that something was deleted from the .bash_history??

Would it be best to just cleanly reinstall everything?

Do tools like MacKeeper work well for finding things like this? Or any particular anti-virus software?

Or would the smartest approach be to just cleanly reinstall the operating system and restore their personal files?

That is probably what I'm going to end up doing, but I am and also don't want to waste time if I can simply find whatever application that they might have installed and removed it.

I don't want to be paranoid, but I realize that with a scam like this, one can easily install whatever they want and I want to be cautious.

File created/modified dates are not enforced to be accurate in any way, and can not reliably be used to detect malicious changes.

They probably did use real GoToAssist for its ambiance of credibility... this is not the software you are worried about, and not what you care about removing.

This system has been fully compromised, no utility is going to help you to be certain that no malicious parts remain.

Reinstalling the operating system and wiping the drive is the only way to even vaguely trust this computer again. This is not paranoia at all, just good practice. Make sure that no executable files are restored. One of the possible scams here is ransomware... Turn the machine off and leave it off. Do not boot the compromised system install again.

Backup the files that really matter to something that is offline and not updated with changes, like an external hard drive that is left disconnected. Change all passwords that might have been available on that machine.

Paranoia would be wondering if the machine was flashed with bad firmware or some other hardware level permanent security compromise.... Apple is probably reasonably good about security here, but there are "jailbroken" iPhones.


How misappropriation-resistant are common deployed signature formats? Given an RSA signature as produced by

openssl dgst -sha256 -sign rsapriv.pem -out afile.sig afile

and without access to the private key used for that, one can¹ come up with a fully functional RSA public/private key pair such that signature afile.sig verifies against that new public key and any desired file.

This does not break the basic security promise of signature, which is that given a public key, it's impossible to come up with a signature and a file that matches the public key, unless the holder of the matching private key is involved and is willing that.

Nevertheless, that could enable signature misappropriation attacks with some level of social engineering.

Say afile.sig and afile are hosted on a trusted website, in order to authenticate afile. Malory makes a key pair matching afile.sig and afile, perhaps gets it certified, then has something to pass as evidence for affiliation with afile or/and the trusted website, on the tune of: "the website entrusts me for matters related to afile, since it host my signature for that. Yes I made that signature, check it yourself against my certificate!".

In a variant, afile is on a website under control of Malory, who makes whatever bfile, then a key pair matching afile.sig and bfile, and tries to pass bfile as the real thing since it checks against a (rightly) trusted signature.

Which deployed signature formats are resistant (or not) to such signature misappropriation?

Mildly formal definition: a signature scheme is misappropriation resistant if, given one of its public key Pub, message M, and legitimately computed signature S (thus passing verification), it is computationally infeasible to exhibit a public key Pub' and a message M' such that

Pub', M', S pass signature verification.
When later given a random message M", the attacker exhibits with sizable probability S" such that Pub', M", S" pass signature verification.

Exhibiting Pub' and M'=M (resp. M'≠M) would be misappropriation without (resp. with) alteration (of the message). Pub'≠Pub is implied by condition 2 and the usual security property of a signature scheme. We define weakly misappropriation resistant by replacing 2 with Pub'≠Pub.

If the public key, or a second premimage resistant hash thereof, is part of the signature, or is hashed with the signed data (as in EdDSA), then the scheme is misappropriation-resistant.

In OpenPGP, it seems the signature embeds the key id, which is the low-order 64 bits of the hash of the oublic key. We'd need to generate 264 suitable public keys and hash them to carry the attack. That's not unimaginable, but a lot of work.

And then there are all the other formats that I do not even know about.

¹ That's a matter of seconds for standard modulus size. The resulting key is fully PKCS#1 conforming, and can even be made secure. Disclosing details on how would risk to ruin an ongoing CTF asking for similar math, but trust me, it works.

Mildly formal definition: a signature scheme is misappropriation resistant if...

The properties you describe as signature misappropriation have acquired a few different names in the academic literature:

Conservative Exclusive Ownership is name of what you describe as misappropriation resistance without message alteration. Schemes lacking this property are said to be vulnerable to key substitution attacks or duplicate signature key selection attacks.
Destructive Exclusive Ownership is name of what you describe as misappropriation resistance with message alteration. Schemes lacking this property are said to be vulnerable  to message key substitution attacks.
Weak Variants are also defined where the attacker does not know the correct private key as in your weak notion.

We wrote a paper which contains formal definitions of these properties and their consequences: See sections 3.1.1 and 3.1.2 of Seems Legit: Automated Analysis of Subtle Attacks on Protocols that Use Signatures. It has a discussion of their history and references to the papers which first described these properties.

  If the public key, or a second premimage resistant hash thereof, is part of the signature, or [...], then the scheme is misappropriation-resistant.

This seems intuitively true and the very first paper to discover this kind of attack made the same observation. However, this isn't true in general as the attacker can use the message alteration property so that the included public key is changed to be the theirs. However, you are correct that EdDSA's specific design does prevent this.

  Which deployed signature formats are resistant (or not) to such signature misappropriation?

Vulnerable to "strong signature misappropriation" (lacking CEO/DEO):

RSA with PKCSv1.5
RSA with PSS
DSA
ECDSA with the elliptic curve parameters treated as part of the public key.

Vulnerable to "weak signature misappropriation" (lacking  wCEO/wDEO):

ECDSA with fixed elliptic curve parameters

Source: Seems Legit Paper, Table 1.


Utilizing OCLHashcat to crack WPA/WPA2 passwords obtained via airodump-ng Wondering if its possible (edit - Found ways to do so, the question now is does it make more sense) to do so? Did a little bit of searching but it would seem that most people utilize Aircrack-NG. Hashcat would allow you to utilize your GPU, and access to rule-based dictionary attacks - Is there some feature in Aircrack-NG that im missing that would make it superior to cracking these? Or just convenience? Not worth the setup time if you don't have a strong GPU?

When it comes to cracking WPA/WPA2 with Hashcat or Aircrack-ng, I recommend using Hashcat.  It provides a number of builtin features that can prove to be very effective.

Hashcat has builtin rule sets and easy to use GPU support.  For example, the rule sets provide a simple way to create new passwords out of you existing password dictionary.  This is builtin to Hashcat and doesn't require using another tool (such as John The Ripper) to apply the rule sets to your password dictionary.

Hashcat has most of the functionality you'll want for cracking WPA/WPA2 baked right in. Also, if you are serious about cracking passwords, you'll likely always want to use GPUs for this type of task.


Do certain Virtual Machine programs "Sandbox"/protect the main OS better than others? Does the category of VM matter? I am looking into VMs to use, and from wiki https://en.wikipedia.org/wiki/Virtual_machine

I notice there are 3 main types of VMs.

FULL VIRTUALIZATION

  In full virtualization, the virtual machine simulates enough hardware to allow an unmodified "guest" OS (one designed for the same instruction set) to be run in isolation. This approach was pioneered in 1966 with the IBM CP-40 and CP-67, predecessors of the VM family.
  Examples outside the mainframe field include Parallels Workstation, Parallels Desktop for Mac, VirtualBox, Virtual Iron, Oracle VM, Virtual PC, Virtual Server, Hyper-V, VMware Workstation, VMware Server (discontinued, formerly called GSX Server), VMware ESXi, QEMU, Adeos, Mac-on-Linux, Win4BSD, Win4Lin Pro, and Egenera vBlade technology.

HARDWARE VIRTUALIZATION

  Hardware-assisted virtualization[edit]
  Main article: Hardware-assisted virtualization
  In hardware-assisted virtualization, the hardware provides architectural support that facilitates building a virtual machine monitor and allows guest OSes to be run in isolation.[18] Hardware-assisted virtualization was first introduced on the IBM System/370 in 1972, for use with VM/370, the first virtual machine operating system.
  In 2005 and 2006, Intel and AMD provided additional hardware to support virtualization. Sun Microsystems (now Oracle Corporation) added similar features in their UltraSPARC T-Series processors in 2005. Examples of virtualization platforms adapted to such hardware include KVM, VMware Workstation, VMware Fusion, Hyper-V, Windows Virtual PC, Xen, Parallels Desktop for Mac, Oracle VM Server for SPARC, VirtualBox and Parallels Workstation.
  In 2006, first-generation 32- and 64-bit x86 hardware support was found to rarely offer performance advantages over software virtualization.[19]

OS VIRTUALIZATION

  In operating-system-level virtualization, a physical server is virtualized at the operating system level, enabling multiple isolated and secure virtualized servers to run on a single physical server. The "guest" operating system environments share the same running instance of the operating system as the host system. Thus, the same operating system kernel is also used to implement the "guest" environments, and applications running in a given "guest" environment view it as a stand-alone system. The pioneer implementation was FreeBSD jails; other examples include Docker, Solaris Containers, OpenVZ, Linux-VServer, LXC, AIX Workload Partitions, Parallels Virtuozzo Containers, and iCore Virtual Accounts.

I was wondering if there is any security advantages of using one of these types over the other?

I also am curious, if there is one type of VM that is more secure than the others, if there are specific VMs we should be looking at, i.e., is there some specifics we should look to be the most protected, or are all VMS pretty much the same?

In this link https://superuser.com/questions/327224/how-can-i-safely-open-a-suspicious-email

There was an answer about using "Sandboxie" and there was a diagram included to mention what it does, and how it protects you, which got me curious if this is how they all pretty much work, or if there are certain specifics we should make sure to look into before using one of these VMs?

In the absence of bugs in any of them, they should all give similar security guarantees, though the "OS Virtualization" (jails, containers) should give the best performance as it removes the need for multiple operating systems, is quick to start, and allows the single operating system to share all of the machine's resources more effectively. (Modern operating systems use all otherwise-unused RAM as a filesystem cache. When you run a second OS in a VM, you have to give it a specific amount of RAM. The virtualized OS will use all of that RAM, and has no way to give up some of the RAM as "unused" to the host system to let the host system use it as it wants.)

However, OS Virtualization (jails, containers) gives the untrusted code access to the host OS's kernel, which is a large surface area where privilege-escalation vulnerabilities are often discovered. Privilege-escalation vulnerabilities are more rare in Full/Hardware virtualization systems (Virtualbox, etc).


If you send a bitcoin payment to a seller, will they learn your IP address? Since you send bitcoin payments through one of the Bitcoin clients, I assume it announces the payment to the network, so each computer it connects to in order to do so would know the IP address from which you announce the payment.

So when you make a bitcoin payment, who gets your address IP, and also which of them will know you are the originator of the transaction message and thus the wallet owner, and not just re-broadcasting it?

Does the sellers themselves see your IP address, and can they be reasonably sure that they are seeing the IP address of the wallet's owner (and not somebody else)?

Edit: Some clarifications - I'm not talking about visiting the seller's own webpage, suppose I'm viewing it through Tor. And I'm not talking about using an online wallet, since you don't really connect to the Bitcoin network yourself then.

The receiver won't learn your IP, but a somewhat determined adversary could. (Of course, if the seller is an adversary, then they could.) This isn't a part of the protocol (there's no sender_IP field in the transaction), it is accomplished via listening in many places on the mesh network and doing statistics to determine the originating node of a transaction. Bitcoin unmask attack. No one knows you're the originator, unless they're watching many nodes in the network. The transaction, when first sent, is indistinguishable from a forwarded transaction; so the first node to see it will think the true sender is just forwarding from another node.

You don't want to run Bitcoin over Tor, because it would allow the exit node to arbitrarily confuse your client as to the real state of the external bitcoin network. It can do this because it is the middle man in the only link b/t the client and the outside world. Bitcoin over Tor attack. To understand how this can work even with bitcoin's POW system, consider that, since there is only one point of connection (the Tor exit node) b/t the bitcoin client and the rest of the network, it is trivial for the exit node segment the network, isolating the client from all legit nodes and all legit POW. The attacker can then run its own bitcoin node on the segmented network, making the only hashing power on the network that of the user (you) and of the attacker. To execute the well known 51% attack, all the attacker needs is more hashing power than you. (Given that most clients don't having hashing enabled at all, any amount of hashing the attacker wants to do would be sufficient, given enough time.)

To be clear, you can use Tor to proxy your browser. But don't use it to proxy your Bitcoin client.

If it's really a problem, and you're willing to sacrifice absolute control of your coins, I would recommend using a web client that doesn't require much info to register and doing so through Tor. That way the unmask attack only unmasks the web client's server, which has no way of tracing you since you access it through Tor. If you're not willing to sacrifice a little control, then I don't believe there is a totally anonymous way to transact in Bitcoin.


How to manage employee OpenPGP keys? I am trying to create a secured policy for storing and maintaining keys between users of my company.

I am rather new to OpenPGP and thus need some advice.

Currently, the idea is:

Generate a master key per user with only the certify capability. Backup this key in a physical vault.
Generate a revocation certificate for this master key, and also store it in a physical vault.
Generate an encryption subkey and store it in a physical vault, then move it to a Yubikey.
Generate an auth subkey (for ssh) directly on the Yubikey.

This is a sort of summary of what I found on the internet as the proper way to manage user keys with GnuPG.

Now I have a bunch of questions:

What happens if someone leaves the company? I guess I should use the master key revocation certificate to cancel the master key and all its subkeys.
What happens if a user loses his Yubikey? Should I revoke the whole master key, or only the subkeys?
In case the key is lost, I would need to provide a new one to the user. Can I just import the old master+encryption key on it? and then what, generate a new authentication SSH key? In this case why bother differentiating master/encryption key?
How do I handle the fact that some users should share the same key? For example, the key for signing packages, or the key for encrypting some shared files.

I'm also open to any good documentation on the subject. I dug through the docs on the GnuPG website, but the manuals, handbooks and wikis are more like "usage sheets" rather than explaining the whole process. I do understand asymmetric cryptography, but there is a mental gap between understanding the concept, and doing mumbo-jumbo with these concepts to have a clean process.

I am trying to create a secured policy for storing and maintaining keys between users of my company.

The following answer is based on those requirements I assume based on your post (I'll call your users employees in the following):

You need to be able to revoke employee keys.
You want to be able to decrypt information encrypted for employee.
Employees should not be able to change anything on their keys on their own.

Be aware this also stops your employees from participating in the web of trust, as they are not able to issue certifications any more (you might want or not want this). Consider letting the employees create the keys, but handing you over an encryption subkey if you require so and have them add your company key as a designated revoker. This is comparable to key handling with a company-owned X.509 PKI infrastructure.

  Currently, the idea is:

  Generate a master key per user with only the certify capability. Backup this key in a physical vault.

The certification restriction seems reasonable, so nobody is (should be) by accident encrypting for the primary key and your employees are not able to read the message.

  Generate a revocation certificate for this master key, and also store it in a physical vault.

Alternatively, you could also add some company as designated revoker. This might make handling a bunch of revocation certificates easier, and maps to what actually happens (the company revokes the employee's key):

gpg --desig-revoke [key-id]

  Generate an encryption subkey and store it in a physical vault, then move it to a Yubikey.

This seems required if you want to stay capable of reading the employee's messages. Might be a legal issue in some jurisdictions or require you to prevent any private usage of company mail addresses.

  Generate an auth subkey (for ssh) directly on the Yubikey.

Both authentication and signature subkeys can simply be exchanged if not used any more. Not holding a copy seems reasonable security-wise, all effort you have to do is distributing the new key (and possibly switch keys on servers).

Especially if you have shared infrastructure, you might even consider using monkeysphere on the servers authenticated against. Monkeysphere relies on the OpenPGP web of trust (ie., signatures by a trusted company key) on the employee's primary keys, and adds their subkeys to sshd, so you can even escrow authentication subkeys without changes to the individual servers, but it is rather uncommon and rarely used, but integrates well with GnuPG authentication subkeys used for SSH.

  Now I have a bunch of questions:

  What happens if someone leaves the company? I guess I should use the master key revocation certificate to cancel the master key and all
  its subkeys.

You only need to revoke the primary key, the subkeys are automatically invalidated if the primary key is. Remember to invalidate authentication subkeys for sshd!

Instead of using pregenerated revocation certificates (which do not include the current date, and no specific revocation reason), better use the primary key for revocation (GnuPG generates a new revocation certificate on the go).

  What happens if a user loses his Yubikey? Should I revoke the whole master key, or only the subkeys?

The primary key is safely stored in your vault, so why revoke it? Revoke the subkeys, generate a new set, and hand out a new Yubikey. The advantage is, that all incoming certifications stay valid, and you don't have to distribute a new primary key. In fact, all that need to be done is an update of the employee's key for all users.

  In case the key is lost, I would need to provide a new one to the user. Can I just import the old master+encryption key on it? and then
  what, generate a new auth ssh key? In this case why bother
  differentiating master/encryption key?

You didn't yet describe storing the primary key on your employee's YubiKeys. They're not required for day-to-day usage, better don't put it there anyway.

  How do I handle the fact that some users should share the same key? For example, the key for signing packages, or the key for
  encrypting some shared files.

OpenPGP allows to add multiple recipients for encrypted messages. Is this an alternative? Signatures might be verified through a company key that signed employee keys.

You cannot withdraw a shared key easily, all you can do is revoke it. Otherwise, you have several options:

Have some signing/decryption service. This might be a build server also signing packages for some authenticated users. There are also OpenPGP mail transfer agents that encrypt/decrypt on the go, you might use it for mapping a group encryption key to multiple users (the MTA decrypts with the private group encryption key, and reencrypts for all employee encryption keys).
Distribute the subkey to all employees as files. This will get annoying if you need to revoke a subkey (for example, one of the employees leaves), as you have to escrow the distributed key.
Distribute the subkey on OpenPGP smart cards (or YubiKeys, which implement the OpenPGP smart card protocol), so you can actually withdraw the smart card (as the key cannot be exported from the smart card). Disadvantage is, if one employee loses the key or does not hand it back after leaving the company, you still have to revoke. Managing safety of physical devices is easier, as they cannot be copied easily.
Have a shared key on a single, well-guarded smart card (which cannot get lost or stolen easily) multiple people have access to.