How can I verify that an organization is what they say they are online? I'm creating a website that only allows nonprofits and government organizations (parks, etc) to sign up and post service project listings. The accounts posting the listings must be verified to protect the safety of the volunteers who want to go do the service projects.

All nonprofits have an EIN that can be confirmed using an online database, but the downside is that anyone can look up the EIN and pose as the organization. In this question, the answer is to use financial transactions to verify the person, but with an organization, the volunteer coordinator (who would probably be making this account) likely doesn't have access to financial data (I've never worked with an organization like this so I could be wrong here).

I thought about email verification, but not all organizations have contact emails posted on their websites to confirm against, as well as the access problems already mentioned with financial data.

How can I verify that the person making the account is a representative of the nonprofit or government organization that they claim they represent?

I would suggest having multiple ways someone could confirm their identity with your site. Similar to how the DMV requires two forms of ID to get a driver's license (one from 'option A' and one from 'option b', etc...)

There are many examples already given: (if possible, I would give the user many options and only require a few)

Verify by email: Send an email to an official domain email address (perhaps even the whois email address).
Use a text message/call system with a pin. (you can also use the official whois data)
The old 1 cent bank deposit confirmation as that answer you found states.
Have the user upload a unique file to their website

Here are two more:

Google when adding your business, they send a postcard with a time-sensitive code on it to the registered business address. You could simply look at the whois contact info and mail a verification letter to them. Even if their site is registered as 'private' whichever company is 'protecting' your information obviously must know your real/listed address and thus may forward the correspondence. Here is some more info on how Google does that and here is still more info.

A more automated way to do this is how Paypal implements a real photo id verification system. You simply scan a copy of an official id card and send it to them. For your purposes, you can ask for any official documentation related to the company/organization (tax forms for instance).

Bare in mind, none of these are sure fire solutions. Even the best systems are sometimes vulnerable to fraud. I would strongly suggest audits as a means to continually veht your user base.

Also, you may want to look into a rating system for your volunteers to rate that organization after the fact -a lower rating gets flagged for your review...


Best practice to verify data against a CA Let's say that I have signed my public key with a trusted CA and the CA provided my with a signed certificate, and I want any client applications to verify against this certificate. The general process is that the client verifies against the CA's public key, and not my own, so I do not even need to transmit the public key, but what is the best practice to implement this in a C# client application?

My current chosen approach is that on the server application, I am storing the certificate (which contains my private key) in my local store, which I use to sign data. Then, on the client application, I am loading the Root store of the Current User and I pass the certificate name of the CA which signed my certificate, and if this CA is found in the store, I retrieve its public key and I verify against that. If my public key has been signed by the CA, then verification should succeed, otherwise it will fail. Is this the correct way of implementing it? If not, please provide better solutions.

The following are my questions regarding my chosen approach:

Can the Certificate Name of the CA change? If so, I would have to
change it in code. If this can change, what else should I use to
search for the certificate? Maybe the SerialNumber?.
Can someone create the same Certificate Name. I am assuming that you
can. For instance, a hacker might create a certificate name which is
the same as an established CA, but it is obviously up the user to
add it to the trusted store on his machine. If he does not, then the
hacker does not have any power whatsoever. Also, I do not think that
two certificates can have the same Serial Number.
If my private key is hijacked and I revoke the certificate,
verification should start failing on the client's applications. It
will start verifying successfully once I start signing the messages
with the newly issued certificate by the CA. Is this correct?

Finally, I do not currently possess a signed certificate so I cannot test this out. That is why I am asking these questions, so that if this approach is correct, I can proceed to buy a certificate since I know the way forward. Also, hopefully, this question might help other people with the same problem.

Thanks in advance.

Let's say that I have signed my public key with a trusted CA and the
  CA provided my with a signed certificate, and I want any client
  applications to verify against this certificate. The general process
  is that the client verifies against the CA's public key, and not my
  own, so I do not even need to transmit the public key, but what is the
  best practice to implement this in a C# client application?

You DO need your public key (contained in the certificate) on clients to validate the signature you have done with your private key. You use the CA certificate to validate your certificate signature (a certificate is a public key + some info about the owner (subject) of the certificate).

You may send your certificate on every request or have it cached on the client, that is language independendt.

  My current chosen approach is that on the server application, I am
  storing the certificate (which contains my private key) in my local
  store, which I use to sign data. Then, on the client application, I am
  loading the Root store of the Current User and I pass the certificate
  name of the CA which signed my certificate, and if this CA is found in
  the store, I retrieve its public key and I verify against that. If my
  public key has been signed by the CA, then verification should
  succeed, otherwise it will fail. Is this the correct way of
  implementing it? If not, please provide better solutions.

It is not the correct way. You should have your certificate on the client. Verify the certificate using the CAs certificate and then use your certificate (that contains a public key) to verify the signature.

  The following are my questions regarding my chosen approach:

All of those wont happen if you correctly validate your certificate against the CA certificate. I would recommend not to reinvent the wheel here, and use some standard Certification Path from a good library, since it is complex to get it all right. I´l explain above how each thing is solved in a Certificate Path validation:

  Can the Certificate Name of the CA change? If so, I would have to
  change it in code. If this can change, what else should I use to
  search for the certificate? Maybe the SerialNumber?.

Your certificate has fields that identify correctly and exactly the issuer of it, using many fileds from the certificate that should not colide. If they colide, still, the signature of your certificate needs to match.

  Can someone create the same Certificate Name. I am assuming that you
  can. For instance, a hacker might create a certificate name which is
  the same as an established CA, but it is obviously up the user to add
  it to the trusted store on his machine. If he does not, then the
  hacker does not have any power whatsoever. Also, I do not think that
  two certificates can have the same Serial Number.

That will be soved by the signature of the CA on your certificate, that you will verify before using it.

  If my private key is hijacked and I revoke the certificate,
  verification should start failing on the client's applications. It
  will start verifying successfully once I start signing the messages
  with the newly issued certificate by the CA. Is this correct?

That will be solved by revocation checking, that you should enable on the certification path verification. When theprivate key is hijacked, you need to ask the CA to revoke it, and it will be added on a CRL (certificate revocation list) that is checked on the the certification path verification.

  Finally, I do not currently possess a signed certificate so I cannot
  test this out. That is why I am asking these questions, so that if
  this approach is correct, I can proceed to buy a certificate since I
  know the way forward. Also, hopefully, this question might help other
  people with the same problem.

You might create your own CA and do tests, using Microsofts CA, openssl or other tools. There are a lot of tutrials on that availble.


Security of wireless connection vs. wired connection on wireless router Would using a wifi dongle to connect my computer to a wifi enabled router make my computer more vulnerable to someone who wanted to gain unauthorized access to it, than connecting to the wifi router with a cable?

The answer of this question depends on your usage of the router.

First I want to mention that it depends how you implemented your wifi connection. If you are using WEP it's like you are using no encryption. Sadly there are so many problems with this standard that you should not use it at all. If you switch to WPA2-AES with a PSK you got better security at all but that's also not unhackable. If you want to increase your routers security I would recommend to disable the WPS function. In many hacks this was the entry point of some hackers but in newer versions security got better at this point. Anyway I would still recommend to deactivate it.

If you are connecting your PC with a cable with the router and disable the WIFI I would really say this is the best solution for your LAN. So you closed one entry point. It's like closing one door.

If you want to leave your WIFI enabled I would say Yes it makes a difference but just if someone got your WPA Key, so he will be possible to decrypt your packets. But if that happens, your PC will not be safe at all. No matter if u are using a cable or a wifi connection.

Hints:

Try using a long PSK (WPA Key) for your Router
Disable WPS. It's anyway just for comfort
Alter your PSK every year or if you think you are compromised
Don't save your Key in any Keyservers
Alter your standard admin user and password at the router
Disable UPNP services
Disable web access throught WAN
Update your router!
Disable SSID broadcasting
Use MAC filtering
Disable TKIP

Hopefully this information helps you. If you got more questions or want to get more details about it feel free to ask!


Stateless Firewall configuration and random port number from server When I was reading about web servers, I  came to know that though servers listen to static port (say port 80 for http), immediately after the connection, they assign a different port and thread to process. This helps in scalability; otherwise the server cannot listen to the static port until the processing of the previous request is finished.

Now my question is that if you have a stateless firewall at the client side (I know it is not a common scenario), how can we configure this? We can allow outbound and inbound to/from the destination server at port 80. But since the target port is randomly assigned, we cannot be sure of the inbound port number. Since the firewall is stateless, it doesn't have any previous knowledge of outbound connection initiation. How do we configure this then? Thanks in advance.

You have a misunderstanding of the communication. The server is not assigning the high port (it’s not actually random), the client is the one doing the high port selection which in turn establishes the firewall permissions for that high port.

Nor does the server assign a new port to get off of 80 (or whatever). It continues listening on 80.

A “connection” is a quad of:

    Server IP
    Server Port (80)
    Client IP
    Client High-Port  (Dynamic)

The server listens on 80 and talks on the client defined High Port, the Client does the reverse.

There’s a whole bunch of handlers and threads involved for efficiency, but this is the essence.


help developer choose correct path to go down for security certifications Sorry if this is a duplicate however I felt it was a little more unique than the answers I found. Basically I am a software developer and I have moved recently into an architecture role. Throughout my short career I have worked with PCI auditors etc and found PCI a little off track for what I need so I want to focus on ISO27001 etc

I am thinking about doing some formal training to help my organisation and career within information security, I found the following image which kinda sums up what I want to do minus PCI and business continuity

Has anyone got any experience with these and what should I maybe and / remove from my learning path

Most security folks are rather cynical about certifications. We get sold a LOT of certs, and we also validate that many of cert holding folks of the world aren't paying very close attention. (CCNA, you know default creds are bad!)

My advice:

Only get certs your employer pays for
If compliance is a concern, go that route first
Try not to go vendor specific unless you are absolutely married to that vendor
Realize that you'll have to do a lot of real training at home or on the side. Lots of folks with certs miss silly stuff like bad crypto and sql injection.

Besides that, you just want to ask yourself what's good for my career/what's best to do with my time?

Personally, from my perspective as a pen tester, the list looks a little bonkers.

"Cyber security" is a buzzword. I wouldn't pick a training course with that name.
Do you want to be a PCI auditor? Do you like doing PCI auditing? Is there a management role in it for you? If you don't like auditing I wouldn't train myself to do it.
Same goes for business cont.

From a pen tester role I like these certs:

OSCP
OSCE

But I understand that's not exactly what your organization needs or is asking you to do.


What's the meaning of the term "ad-hoc MAC" (Message Authentication Code)? In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean?

Note: With MAC, I mean Message Authentication Code (as used in SSLv3), not Media Access Control !

Ad-Hoc Communication is the process by which participating Nodes(Machines) can transfer data between them directly without a centralized server. MAC can refer to Medium Acces Control

MAC Code is a unique identification code assigned to devices communicating in adhoc mode to identify each other.
MAC can also refer to Message Authentication Code  which is used to authenticate messages as well as to preserve integrity.Hashing and Encryption is used to achieve this.

So Adhoc MAC Means the Code used to authenticate messages between Nodes in an Adhoc network.


Rotating storage encryption keys If I can change the key for my encrypted storage without taking the system offline to re-encrypt the storage or seeing any sign of a background rebuild occurring, it rather implies that what I described as the key is actually used to retrieve the clear text of the real key used to encrypt the storage.

If this is the case, then as long as the key I know is as strong as the real encrpytion key, is there any benefit to rotating the key I know?

Is this just a tick box exercise?

Usually full disk encryption is a two step process:

A symmetric key is generated, and used to encrypt the data.
The symmetric key is encrypted using a passphrase or similar mechanism, and stored in a predictable place on disk.
When you change your passphrase, you change the encryption of the key, but not the key itself.

The key can additionally be stored inside the TPM (bitlocker), or you can have multiple ways to decrypt the key. It can also be stored on a separate drive, or on the network.

You may notice that the key actually used to encrypt the data does not change. If that is to change, all the data has to be read, decrypted, encrypted with the new key and written to disk. It also means that if an attacker gets access to the actual key, and not merely your passphrase, changing your passphrase will not matter.


Why do websites use less effective hash functions? When releasing, say, ISO files, the websites usually provide the supposed hash of the ISO to compare with, to verify its integrity. Or, to prove that it at least probably wasn't tampered with.

But on these sites, they always use a smaller hash algorithm/function (sorry if I'm butchering the terminology) than they could.

For example, why don't ALL sites just stick to SHA512 as opposed to the somewhat standard SHA256?

It's easier (visually) to match a shorter hash for a user. It's also more likely that an end user will go through the effort of checking the hash if it's shorter and easier to do.

SHA256 provides enough entropy and security that there is no reason to bump it up to SHA512 in this case.


Is CKN in MACsec considered as secret value? I know Connectivity that the Connectivity Association key(CAK) should be kept secret. What about the Connectivity Association name(CKN)? Is it considered a secret?

No, the CKN is not considered secret; it's public information. It's openly (unencrypted) transported as part of the MACsec Key Agreement (MKA) packets as identification for the secure Connection Association (CA). See IEEE 802.1X for more details.


Passwords via unsecure network Can the password that one type be compromised if mobile is connected to a compromised router since everything has to go through the router?

Under most circumstances, if you connect to the site by HTTPS, and you're sure that the URL is correct (i.e., you're not connecting to a phishing site, like gm4il.com instead of gmail.com), and your browser is not showing you any certificate warnings, then most likely it's safe to login to the site using your password.  If you use a password manager, all the better, as this offers the added protection of detecting phishing sites.
However, this answer would not be complete without adding the caveat of fake SSL certificates.  There have been cases where CA's have been breached, and attackers were able to get CA-signed certificates for popular sites such as Gmail.com, etc.  In this case, all of the above indicators would seem to indicate that everything is copacetic, yet an attacker on the network between your browser and the site would be able to intercept your password.  See What are the risks of a Certificate Authority hack for 'the average user'? for more information.  Fortunately, these cases are rare, but it would be remiss to not mention these cases.


Is the connection to Tor hidden services encrypted? It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol.

Can the exit node sniff/modify the traffic?

Tor exit nodes aren't involved in the connection to hidden services. Exit nodes are only needed when you want to exit the Tor network in order to connect to some website outside of it. In the case of connecting to hidden services, all the traffic stays inside the Tor network.

In the following illustration, you can see how Bob (a normal user) is trying to connect to Alice (hosting a hidden service). As you can see, the connection happens through a Rendezvous point (RP) inside the Tor network.

[image from torproject.org]

All traffic inside the Tor network are encrypted and secured with TLS tunnels.


Why does WhatsApp not encrypt Google Drive backups? WhatsApp has end-to-end encryption, promising privacy to users.

However, it becomes useless if backups to Google Drive are unencrypted. Our supposedly private data goes to the control of Google.

No problem, I can disable the backup. But, what about all the people I talk to? Google still holds most of my conversations, unencrypted.

This seems to be a useless/tricking/lying design, done in purpose to ensure they keep control of the users. (and keep in mind that Whatsapp reminds me MANY times to enable the Backup)

I understand that as soon as I send a message to another person, they can take screenshots, show to other people, etc. I understand that risk.
However, not encrypting backups just makes it way easier for the messages to be even more exposed.

Question is - I'm sure WhatsApp could encrypt backups to Google if they wanted (e.g. require a passphrase to users, or at least have that option and recommend users to use it). Why does WhatsApp not do that?

"Messages and media backed up in Google Drive are not protected by WhatsApp end-to-end encryption."

EDIT - This is not a duplicate of Does backing up WhatsApp on Google Drive expose messages?

I'm asking WHY WhatsApp doesn't implement backup encryption. I already know that backing up to Google Drive exposes messages, so it's not the same question.

'Why does Google not encrypt your Whatsapp messages'?

As mentioned briefly in the comment above, it is something that we will never really know, unless privy to the agreements between FB and Google.

We can speculate though:

Google makes it's money from data and information. The more information it gathers, the more opportunities it has to make money. Very similar business model to FB in that respect.

Google can also comply with court orders to turn over information if asked. If they used zero-knowledge encryption, they would not be able to do that. I imagine that would make LE very unhappy.

An actual answer is impossible, I'm afraid. If you want to be sure your messages are not copied, or used for marketing or whatever, install Signal and encourage all of your friends to do so. Good luck. It's an uphill battle to fight the inertia of WhatsApp!


Advantage of group signing over single signing As I know, signing is used to ensure integrity and authenticity of sender. What is the advantage of group digital signing over individual signing? Can anyone explain this using a scenario?

A digital signature binds a message to a private key in a way that ensures that no one without the private key can create a signature for any message that they didn't just get a signature for from the real signer, even if they have the public key needed to verify it. The key is that it binds things to keys, not individuals.

When should you use a group signature? When the signature should associate it with the group, and don't care about linking a message to a person in the group. Why do this? That's not actually a question information security can answer; the discipline is about helping you better express your security goals and finding a way to achieve them, but infosec isn't about "what are your security goals in the first place?"

Companies have a security goal -- only authorized company personnel should be able to get something signed. So they establish a corporate key and give access to only people who should be able to do it. Or a group of friends (say, Alexander, John, and James) without some formal association want to write a series of things in the same persona. They want things to be associated with the group of them, and are not interested in showing who wrote an individual message, so they create a key and share it to sign things for the persona.


Make SERVER_NAME trustworthy in IIS I am trying to correct a host header vulnerability from the server side as much as possible.  The vulnerability is an HTTP host header attack. What I would like to do is only allow valid host headers to be passed through running applications. This way a host header that should be example.com doesn't get passed down as evil.com. There is a decent explanation of this vulnerability here: http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html.

I think URL Rewrite could assist with this, but I don't have a lot of experience with it so I am not sure.  Has anyone hardened up their servers against this attack?

The server is setup with header bindings for allowed domains, though this will not stop a request containing a different host header value.

If I do figure out a way to filter, detect that the host header is incorrect, what type of response should be returned?

In short, don't use wildcard bindings.

Only bind applicable host names to websites and be specific. For example, only allowing www.website.com will only allow requests with that host header value. Any others will not get processed by the website so you're essentially white-listing the acceptable host names.

By taking the URL Rewrite (or similar) approach, a new rule needs to be added for each "bad" request. This is not a good support model (i.e. whack-a-mole) for there is no way to keep up with the possible combinations. As an example, I could register mysite.foo to your IP and now you need to add a rule. By taking the recommended approach and not using wildcard bindings the request won't even go to IIS for there isn't a website configured to process the request.

The vulnerability mentioned is from websites being configured to accept any host name. In doing so it allows that value to populate the variable which is no longer trustworthy as it could be anything. By taking the approach of only binding specific host names you're ensuring that only those values will populate the variable and are therefore trustworthy.


Wireshark / TCPdump captures only part of HTTP request packets I wanted to do some in-house research and check how many and what kind of packets I can capture from/to my in-house open Wi-Fi router.

I had Kali Linux installed on Windows 10 machine (Virtualbox) and I use TP-Link TL-WN722N Wi-Fi adapter to capture traffic in monitor mode. I can put it in monitor mode, and I can see captured packets.

However, only small amount of traffic is captured, particularly HTTP packets. I did some test requests from my phone/tablet/laptop and I sometimes get pretty reasonable count of packets captured, but sometimes I can't see any of them or just part of request (for example some script is loaded from CDN, but no original request is captured).

As my knowledge about networking is really basic, I'm interested what can cause that?

P.S.: Wi-Fi card is set to correct channel - same as my Wi-Fi router is broadcasting.

UPDATE (2019)

If some of you are experiencing same this answer helped me, so data was transfered in different rates, and  TL-WN722N was not able to catch thos packets. Removing 802.11n (leaving only b/g) fixed the issue.

My first guess would be the strength of the wifi signal, are you close enough from both router AND target computer? Maybe you're close to one but far from other, meaning that you will not properly capture packets from both.

Check using airodump if you have at least -67dBm of signal for both router and target. Also, remember that the signal is in a logarithm scale, the higher the number, better. If you get a signal around -50dBm would be good.

If you have good signal from both router and target machine, try to do the capture using airodump-ng [ airodump-ng wlan0mon -c CHANNEL --bssid ROUTER_MAC -w CAPTURE_FILE ] and then open the saved capture on wireshark. From my experience, airodump is more reliable (and you can see in real time the signal strength)


Reuse an email address with a leaked password I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of using it again.

How dangerous is it to use the leaked password to login and then of course change it? What are the security risks ?

You can take your email back if you can pass the "lost password" methods provided, after that you must verify if some unintended user has changed the recovery methods in such a way that he could have it back at any time. After that the only real problem is that it's likely that your email address leaked and you'll be receiving lots of spam email, much more than before. Maybe also he registered in some site (porn/games sites for example) using your email so the spamming goes to you.


Trust among the root-CAs The system of CAs with the root-CAs and their subordinate CAs are IMHO in principle
akin to the system of banks with their main sites and subsidiries. In the case of banks,
a customer of a bank commonly has trust for that bank but not necessarily trust for the other
banks of the world. Anything from the other banks can thus be trustworthy for him only through an corresponding action of his bank that provides him the required trust. This implies that the root-CAs must somehow manange to trust one another in order that certificates from the region of one root-CA could be used in the region of other root-CAs. How is that trust among the root-CAs actually being established in practice?

Root CA don't trust each other and don't actually talk to each other. Each root CA lives in its own world, alone. Root CA don't trust anybody; it goes the other way round. That's also where the bank analogy breaks down: banks have to talk to each other, while root CA totally ignore each other.

You (or your OS or browser) trusts one or several root CA for asserting things about identities and public keys. The various roots don't have to assume or even be aware that you are trusting several of them simultaneously. It is your problem, not theirs. In practice, your OS or browser vendor has chosen for you that you will trust about one hundred root CA, which you can see by inspecting your browser configuration menus.

Cross-trust between CA is a rare event, which typically happens in the wild as an aftermath of mergers: two businesses, each with its own internal CA, decide to fuse into a single entity. But deployed desktop systems in what formerly was business A only trust rootA, while deployed systems from business B only trust rootB. The ideal solution would be to modify all systems so that they all trust both rootA and rootB, but that's hard work (depending on how computers are managed in the organization, they may have to send sysadmins in front of each of the thousands of PC, to do the few needed operations) and it may take time. So, in the meantime, something can be done at the CA level: make rootA emit a certificate (an intermediate CA certificate) for rootB (and vice-versa). This means that rootA asserts that whoever trust rootA may also trust that which comes from rootB (and vice-versa).

Some people have invested a lot of thought into coming up with terminology for the various cases of cross-trust; see RFC 5217 for (a lot of) details. However, I insist, this does not happen often in the "real world".


Is C a good choice for security-related software any longer? C is a rock-solid and widespread programming language that is very popular especially in the FOSS community.

Many security-related software (such as encryption libraries) are written in C and will probably be written in C also in the future. One of the main reasons for it is the great performance and portability of C programs.
But the point is that even very experienced software developers can't prevent bugs like buffer overflows. Every year quite a lot security bugs related to memory management are found in even very popular and reviewed software.

So my question to you: Is it still a good idea to write security-related software in C nowadays? Or isn't it "security by design" to choose modern languages like Rust, Go or more high-level languages like Python?

The main and almost unique reason why most software in the Linux ecosystem is written in C is Tradition. Developers see software written in C, libraries with a C-based API, and thus they use C, because that's convenient. Compilers are already there, and work well because the whole OS is written in C.

None of this says that C is good for developing robust software. In fact, C is quite terrible at it. With C, the developer must remain wary of many things at all times. C has many traps ready to be sprung on the smallest mistakes, including:

Unchecked array accesses, thus allowing for overflows.
Manual memory management, leading to use-after-free or double-free errors, and memory leaks.
The dreaded "undefined behaviour" that makes seemingly reasonable expressions run amok (in particular, signed operations that exceed the representable range).
Portability issues when going to architectures with different lengths for integer types and pointers.

What C is real good at is the following:

Interacting with an existing set of libraries that offer a C API. C is the lingua franca that allows interoperability between software components on many platforms.

What C is passably good at is:

Writing very low-level code (e.g. crypto code resistant to timing attacks through fixed memory access patterns) while trying to keep some level of portability.

My conclusion is that C is not a good idea for writing security-related software in general, and has not been so for quite some time already (at least a decade). C is still justified in some specific contexts, in particular if you target embedded platforms (not embedded as in "smartphone", rather embedded as in "smart card"). Instead of looking for reasons to move away from C, it would be more justified to look for specific reasons to keep using C.


Does OpenPGP key expiration add to security? I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

tl;dr: the expiry date is no reasonable mechanism to protect the primary key, and you should have a revocation certificate at hand.

The slightly longer version is, that the effect of the expiration date differs between primary and subkeys, and also what you aim to prevent.

Subkeys

For subkeys, the effect is rather simple: after a given time frame, the subkey will expire. This expiry date can only be changed using the primary key. If an attacker gets hold of your subkey (and only this), it will automatically be inactivated after the expiry date.

The expiry date of a subkey is a great tool to announce you switch your subkeys on a regular base, and that it's time for others to update your key after a given time.

Primary Keys

For primary keys, the situation is different. If you have access to the private key, you can change the expiry date as you wish. This means, if an attacker gets access to your private key, he can extend the validity period arbitrarily. Worst case, you lose access to the private key at the same time, then even you cannot revoke the public key any more (you do have a printed or otherwise offline and safely stored revocation certificate, do you?). An expiry date might help in the case you just lose control over the key (while no attacker has control over it). The key will automatically expire after a given time, so there wouldn't be an unusable key with your name on it sitting forever on the key servers.

Recovering Weak Unrevoked Keys

Even worse, expiry dates might provide a false sense of security. The key on the key servers expired, so why bother to revoke it? There is a large number of well-connected RSA 512 bit keys on the key server network, and probably a comparabily large number of weak DSA keys (because of the Debian RNG problems). With faster processors and possibly new knowledge on algorithm weaknesses, an attacker might in future be able to crack the expired, but non-revoked key and use it!

Keeping a Revocation Certificate Safe Instead

If you've got a revocation certificate and are sure you never might lose access to both your private key and revocation certificate at the same time (consider fire, (physical) theft, official institutions searching your house), there is absolutely no use in setting an expiry date apart from possible confusion and more work extending it.


How does one tighten up their git repo security for Powershell? Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after check out.
But that's pretty language specific to Java, how would one do this in a Powershell script?  Is there a way to store files in git that will be local to your own repo or your own global local machine, so that none of that stuff gets stored or shared in the repo?

But that's pretty language specific to Java

NO.
This has nothing to do with Java. This is how developers working on the project decided to do that. Also what you are asking about Powershell has nothing specific to the Powershell. There is no difference in the approach, if you use it for Java, of for Powershell, of for anything else.
There are different approaches. One of them is following. Configuration files in the repository refer some files with predefined locations. For instance:

Files with fixed names in the user home directory or some of its subdirectories. Every developer creates such a file in his home directory and puts needed credentials there.
Files in a directory that is defined via environment variable. Every developer creates a directory where he wants, defines path to it via environment variable defined in the script, like ABC_HOME=C:\..., then puts files with credentials in that directory.

User home directory is known at any time via environment variable USER_HOME. Thus you can build the path to your file. To Powershell: Depending how complex is your script, credentials can be put to a properties file (then you need to load them as such) or can be put to another script file (then you need just to call it from your script).
With such approach you can have not only credentials common for the whole team, but also credentials specific to every developer.
Such approach is good for cross-platform applications, when some developers use Windows, some use Linux, some use Mac. In case o Powershell you may want to use Windows specific tools like Windows Credential Manager. Here there are some examples how can one use it. This tool is a matter of taste. Some developers consider as advantage that there is a GUI. The other find it as disadvantage because it is implicit and because it cannot be easily searched, copied or edited.
Thus, what approach you prefer is a matter of taste.


How can I encrypt my print jobs? I often print confidential documents over a large intranet to various printers based on where I am in the building. However, since the building is so large, it is highly likely there is a malicious device connected somewhere in the network, and I wish to reduce the risk of these private documents being intercepted by an attacker.

To prevent unsuspecting man-in-the-middle attacks across a large network, I would like to encrypt my print jobs as they travel across the network to the printer of my choice. The printers in question are already physically secure and kept in restricted areas.

Is there any secure protocol (SSL/TLS) I can use for sending print jobs to give me any protection at all? Would it be best to simply switch those secure printers to a different VLAN and then switch my device to the printers' VLAN when I must use them? Are there any printers at all that support secure printing?

Many printers, especially those used in businesses, support IPP over HTTPS. If you have access to the printer's control panel, you can enable HTTPS and install a certificate that you trust. On your computer, set up a printer manually and specify https://printer-domain or printer-domain:443 as the printer's address, depending on what operating system you are using.

You can usually find documentation for your specific printer model about how to enable HTTPS.


Are SSL certificates from a CA necessary for secure communication? Am I right in thinking that SSL certificates from a CA are purely for identification purposes and serve no purpose in the actual encryption of data? In other words if I were to create a self signed certificate, would https communication be just as secure as using a certificate from a trusted CA even though the user would not be able to confirm the identity of the certificate owner?

Well, technically, if the user cannot confirm the identity of the certificate owner, then the communication cannot be really secure, because a villain may impersonate the server; he may even relay the data to the right server transparently (that's the man-in-the-middle attack model). Making sure that you talk to the right server IS an integral part of the security.


Looking for a CIS Bechmark Tool to run against Amazon Linux 2016.09 I have been tasked with ensuring the CIS Bechmark on Amazon Linux 2016.09.

Does anyone know of an examination tool that will output the difference between the current and the benchmark?

Unfortunately I cannot use one of the existing marketplace AMI's.

Lynis is the open source alternative which not only does CIS but few other compliance tests as well.

The ability to modify the code to generate custom reports is handy for large number of systems.


What problem does PKI fix; how would someone "lie about their identity"? What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do you know it is actually from Alice?" in comes the PKI...

what I don't understand is the problem "how do you know the public key came from Alice"?

You contacted the resource, whether it with a host name or IP address. Let me know if my question doesn't make sense and I'll try to reword it. What I'm asking is basic: what's the need of a certificate: you always know the IP address of the person your sending to. Does this have something to do with if someone sends you the public key then the person may be an attacker and give you a bogus public key? But you would still be sending packets to the actual intended recipient so they would likely return an error message saying there's something wrong with the way your messages are encrypted.

you always know the IP address of the person your sending to

Oh, do you? Personally I have no clue under which IP addresses I can find my favourite web services. Usually I type in a domain and my computer contacts some third party to ask about the corresponding IP. This is known as Domain Name Service (DNS). You'll see in a second why I mention this.

A classic example of a potential man-in-the-middle (MITM) attacker is the person controlling the router you are connected to. Without PKI in place, they can easily pretend to be someone else.

Let's say you go to a public cafe and want to access your Gmail inbox. You type 'gmail.com' into your browser's address bar, and you are presented with a page that asks for your Gmail account name and password. How do you know that page is in fact the one hosted by Google, and not, say, served from a local machine in the back room of the cafe? One issue here is that your computer will have sent a request to a remote DNS to ask for the IP required, but this request goes through the router, so without additional security measures in place, the MITM can return an arbitrary IP. Second, the router might have left your DNS request and answer unchanged but then served up the fake page regardless of what IP you were actually trying to reach. After all, you relied on them to relay your request and Gmail's answer.

And this is where transport-layer encryption and the public-key infrastructure come into play. When you try to contact a server that runs HTTPS, it will present you with a public key to encrypt further communications, and that key will usually be signed by a trusted CA. Thus, without access to the server's private key, an intermediary can not read or manipulate the exchanged data (hence the name end-to-end encryption for this kind of mechanism). What the CA does is ensure that the public key originally presented cannot be spoofed without you noticing it.

Similarly, DNSSEC (DNS Security Extensions) relies on PKI to detect a MITM who is manipulating DNS requests/responses.


Debit Card was used fraduentely, Should I report an incident to the websites that stored my card? Here is my situation. I had a debit card where I could transfer funds to it for limited use. I usually kept a low amount on this card just for little purchases. It was recently used in a fraudulent purchase online and now it is blocked and cancelled by my bank but the kicker is I have only used this debit card on 3 different websites.

I have never used this card in person at a store and I did not keep this card on my person either. It was only used for 3 online purchases. So can it be confidently assumed that one of these 3 websites were compromised and should I report the incident to each of those websites?

The three websites that this card was used on were:

GoDaddy
Playstation Network
St. Jude Children's Hospital

I am trying to think of any other possibilities of how this card could have been stolen and used in a fraudulent online purchased. The card was kept in a safe until I needed it and did not touch any other websites or stores outside of the 3 listed. My only conclusion is that one of these 3 websites have been compromised. Should I report this incident to these 3 websites or any other organizations or people?

Keep in mind this is how many companies find out they were breached so please do report it even though you are not sure which of the three it was. Companies do occasionally get calls like this, they are rare but generally very well received.

Reporting the information may be very helpful to the timing of their incident response team. Some companies may choose to ignore individual reports by themselves but if they more than one report within a short period of time it may cause them to trigger an internal investigation. Some companies are more proactive to this type of reporting than others.

The key here is timeliness. The faster you let them know the faster their incident response team will be engaged and in theory the faster other cards can be deactivated to reduce overall damage. It's also helpful to give them all the details you have of the fraudulent transaction.

Additionally, this is helpful because the faster compromised cards can be deactivated the less money will go towards funding the criminal organization behind it. So you're act of reporting this may help protect others from damage short-term and long-term.

Side Note: Don't sign an NDA or anything if they ask you to. Ninety-nine percent of companies won't ask this but if it comes up simply say no, it's not to your advantage especially when you are simply trying to be helpful.


Why would the session ID entropy only be half of the length of the session ID? On this page on the OWASP website, there is a sentence about session id entropy I find quite strange:

  The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this value is estimated to be half the length of the session ID).

What I understand is that if your session id is made of 128 random bits (given by a good PNRG), then what you get is only 64 bits of entropy.

I thought that if you get 128 random bits from a good PNRG, you could expect to get something very close to 128 bits of entropy. Did I understand something wrong?

This bit "if your session id is made of 128 random bits" is the misunderstanding.

If your session id is 128 bits long, then that is not 128 random bits - it is probably only about 64 random bits, encoded as a 128 bit string.

Remember, your session id is not a number - it is a string identifier, that might be representing a number.
If the session id is constructed as a hexadecimal number, represented in string form - then each random byte would take up TWO characters in the session id string. This is where that "half the length" comes from in that quote.
However note the previous section on that page - there are other implementations (such as ASP.NET), where the random bits are not represented directly in string-hexadecimal, but are instead base-64 encoded - which results in only 1/3 size increase (or 25% of bits are not random). In which case, 160-bit session id actually gives 120 random bits.

TL;DR: if your session id is 128 bits long, not all of those are random.


Is OpenSSL generating Diffie-Hellman parameters that are safe for use in TLS or SSH servers? I would like to generate Diffie-Hellman parameters on a Debian GNU/Linux "Jessie" 8 with OpenSSL. Lets assume the system CSPRNG was seeded with some real random data.

On such a system, is the result of openssl dhparam 4096 safe for production use? Are there any further tests I am supposed to run to make sure it is safe? I would like to use them for TLS in an HTTPS server or for OpenSSH servers.

I know that some people recommend not generating Diffie-Hellman parameters because things might go wrong. This question is exactly about avoiding the things that might go wrong, by knowing about them specifically.

Checking manual page for ssh-keygen gives hints about generating and verifying the parameters (moduli file):

ssh-keygen -G moduli-2048.candidates -b 2048
ssh-keygen -T moduli-2048 -f moduli-2048.candidates

which sounds for me like a proven way of doing this. But I also discourage you from doing that. The examples what can go wrong are answered in related question, but basically it is really hard to verify that the generated prime is prime. Usually you can be sure that the divisor is "large enough".


Ressources for Windows forensic analysis? I am looking for a free handbook (Beginner-Intermediate level) to delve into Windows forensic analysis with a specific focus on malware discovery. I haven't found anything which can get me started, does anyone have any recommendations?

I think "Malware Forensics Investigating and Analyzing Malicious Code" would be a good place to start.

I'd highly recommend Russinovich's tools you can download here

Also, there are some practical challenges online to get you started here
 and here


Any disadvantages to long-lived self-signed certificates for personal use? I run my own IMAP server on my own machine, and am the only user of it.  The server uses a self-signed certificate that I generated with OpenSSL.  I don't use the certificate for any other purpose.  I connect to the server only from the local machine, and from my laptop when travelling, and I make sure to validate the certificate's information and fingerprint when prompted by the e-mail clients.  (Normally this happens only when I first configure my e-mail client to connect to the IMAP server, or when the certificate gets changed.)
There are plenty of guides on the Internet urging administrators to limit the duration of their self-signed certificates to no more than 12 months.  But I would rather not have to remember to periodically issue a new certificate every year.  (It can be a pain if the certificate expires while I'm travelling and whatever Internet connection I'm using blocks SSH connections.)  For my specific scenario, is there any reason why I couldn't set the expiration of my self-signed certificates for much farther in the future (say, 5 or 10 years)?  What specific security risks might this entail in my case?
I suppose the key might get stolen by a third party, who would then have much longer than 12 months to misuse it.  But even in that case it's not clear to me what damage they could do to me or to others, particularly if I had created the certificate with fictitious personal information.
I'm aware that I could instead use a CA like Let's Encrypt and set things up to automatically get a new certificate on expiry.  But before I go to the trouble of setting this up, I just want to know what the risks are, if any, in using long-lived self-signed certificates.  Also note that I'm not asking about the disadvantages of using self-signed certificates in general; my question is specifically about their length of validity for a setup like mine, where I'm the only user of the certificate.

There are a number of arguments for a shorter lifespan of certificates. You already mentioned the possibility of a compromised certificate.
Other reasons may be that, as domain names can change ownership, it is possible to own a valid certificate for some period of time for a domain you no longer control.
But that has little to do with your set-up with self-signed certificate. Basically, as long as your private key is not compromised, your set-up should be secure enough for private use.
What you should also note is, that Apple and Google have limited the validity lifetime of the certificates that their browsers accept. I don't know how you read your email, but it may just be that a new version of the email-reader will also no longer accept certificates that are older than a year.


Is Android anti-virus software necessary and helpful? Is Android anti-virus software necessary and helpful? Can it actually prevent malware attacks on my system? Are there other good opportunities to block malicious software attacks?

At home, I am running a so called Pi-Hole but what about outside my home?

According to the Android security chief you don't need a anti-malware or anti-virus applications on your device.

Applications on Android are sandboxed, so it is much more safe. You don't have to worry about anything if you are installing apps only from the Google Play store and update them. If there are any suspicious apps, people get to notify it and the Play store removes it.

Play store had removed 700,000 malicious Android apps found in Google Play store last year

In most cases when you install an anti-virus or anti-malware, your phone gets another process to run throughout the day consuming your processor, memory and battery.

If you keep away from rooted device, third party applications, fake download links, and phishing websites your device will be safe.

Some anti-virus applications helps you filter out the phishing sites and spam messages, which is great but at the cost of performance and battery life.

Pi-Hole is a good choice. There are some applications for Android devices which block the ads too. What I personally use requires a rooted device and I would not recommend doing that. It filters out most of the adds which pop up while using the applications or while browsing.


Man in the middle attack theory Me and my colleague are trying to come up with a way around preventing a theoretical man in the middle attack.

The scenario is:

Communication is only through one channel and either sides isn't aware of what is going to be said.

Alice and Bob want to communicate with each other.

Eve is the "man in the middle". All communication from the start goes through her first.

If Alice publishes her public key Eve can intercept this and send her own public key to Bob. When Eve intercepts a message from Bob she uses her private key and decrypts the message, does what she wants with it and encrypts it with Alice's public key and sends it to Alice.

As Eve has intercepted the first message and the two unknowing parties haven't pre exchanged any keys or certificates is there any way that they can communicate without Eve reading the messages?

I cannot see any conceivable way as Eve has intercepted Alice's public key first so Bob has no genuine way of checking to see if the message is from Alice at all.

The presented case is the prime example why a self-signed certificate provides almost no security at all: it can encrypt the data but is impossible to authenticate it. Anyone can create any certificate in name of anything and have it encrypt data.

That's why there is the certification chains in HTTPS and key signing on PGP keys, for example.

In this case, Alice and Bob cannot make sure they are talking to each other. If both know a certain trustworthy John, and John signs their keys, Bob and Alice can know for sure that the key is valid.


Best way to trace possible root cause of card fraud? I recently had a fraudulent transaction on my debit card (in the UK, where I am based).  Having blocked the card, my main concern is to determine how much information has been stolen and how?
As this was an online transaction, the fraudster may have needed only superficial information regarding my card to complete the transaction e.g., expiry date, long card number and security code. These details could, theoretically, have been stolen while I used my card in person (at an ATM or while paying for goods) or they could have been stolen via hacking or phishing of myself or someone who has my details, which I would view as a lot more nefarious.
When I reported the transaction to my bank, I didn’t ask whether other auxiliary details were used in the transaction e.g.  my DoB, telephone number, security questions which may have been indicative of a wider problem.
I have no reason to believe that I am personally the victim of a hack or phishing. I use anti-virus and am careful with online transactions.
My questions are:
(1) Is it normal for banks to be able to give more information about a specific fraudulent transaction to their customers to help them understand how much information has been compromised?
(2) What is the best way to approach finding how much information may have been stolen and how?

Your personal data is probably safe. Card theft happens all the time, and usually the thieves are after your card and nothing else. They usually sell cards wholesale (something called dumps) and don't care about monetizing your email, your passwords or anything unrelated to the card. That means your name, phone, and address could have been leaked, and little else.

No.

Banks usually don't give any information to you because doing so would disclose their investigation methods.

You cannot be sure.

Usually data is stolen when someone have your card in their hands, or copied when entered online. And you don't have any way to know how long it was between the time of the leak and time of usage.


Malware infections from visiting or using YouTube Is it possible to be infected by viruses or other malware while visiting YouTube?

What kind of measures do the YouTube staff take to prevent viruses and malware?

Yes, as you are browsing to a website, the same risks apply:

if the website is compromised, then you could download malware onto your machine
if you click on a malicious link in the user submitted comments, bad things may happen
if you click on a malicious advert (can happen, see Danny's comment below), bad things may happen

None of these are really about YouTube or Google - they are general website risks.

That said, google are generally good at finding and fixing vulnerabilities and flaws. They even pay people who point out bugs. So YouTube may be a lower risk than some other sites. It is a nice target, though, as attackers will see the number of visitors as a potential goldmine.

You can protect yourself by keeping your browser up to date, and using valid codecs (ie don't install custom video codecs that may have come from a dodgy site - they could subvert the video stream into doing something malicious)


VPN through port 443 plus https more secure? My vpn allows me to use TCP 443. I heard that using VPN through port 443 is more secure.

If I use VPN on port 443 it means that vpn tunnel will run through port 443 and the traffic would appear as if it is SSL traffic.

Can I use vpn on TCP port 443 and at the same time use SSL version of the website?

I have a doubt that if I use VPN on port 443 and open an https website will the traffic run through the VPN tunnel inside port 443 or there is no benefit to use https version of the site and vpn on port 443 simultaneously or does it mean 3x times more security first traffic running through port 443, second encrypted vpn tunnel and third https encrypted version of the site inside the tunnel ?

Let me start with a diagram!

You <------> Internet <-------> VPN <--------> Website (with HTTPS)

So the idea behind using a VPN is to securely transmit data to and fro on a public network.

So let me answer your questions:

Yes, your traffic will be tunneled through 443. So it is a secure tunnel.
Yes, you can use both your secure tunnel and the secure version of the website (HTTPS version). The HTTPS is basically between the website and the VPN endpoint.
It is definitely not an issue if you use the secure (HTTPS) version of the site through your secure tunnel. It doesn't really mean 3x more security. But it's definitely not a bad idea.

Hope this helps!


HTTP Content-Security-Policy Nonce and Caching Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript?

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

See example 4 here for details.

If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. Varnish, Cloudfront, etc) caching on the pages that use <script nonce="XXXXX">. Correct?

Yes. You always have to disable caching on anything that is dynamically generated (i.e. comes from a script). Since you can't serve unique and unpredictable random values statically, it must be done from a script.


Segregating a Printer in my Enterprise Network I have a EAP-TLS network at home which I've managed for some time now. I just got a new Brother HL-5470 printer so I can finally print things at home, which is really nice.

The only problem is that printers are notoriously good at being huge security holes.

The printer is connected to my EAP-TLS network, which allows hosts to talk with one another, provided that they're in that network or connected directly to ethernet. (ie: both my EAP-TLS WiFi and ethernet share the same LAN) It has to be in the same LAN as the other computers so that they can access it. I've succeeded in getting the Brother printer onto the EAP-TLS network, but what steps can I take now to protect myself?

The network is firewalled so that there aren't any open ports accepting connections from the WAN. Any device inside will be able to "speak" with any other device inside. The printer also features Google Cloud Print, though I haven't done anything to configure it yet.

What can I do to further harden and lock down the printer from a networking point of view? I've configured the login password for the printer so that other users of my network won't be able to change things willy-nilly, but login is over HTTP and there's no way to turn that off. If someone has gotten into my EAP-TLS network, generally they should be there, but I greatly fear the security hell that this printer could possibly unleash in my network. What can I do?

You could consider putting the printer on a dedicated subnet in its own VLAN. In lots of enterprise networks there are dedicated 'Device' VLANs.

Because all traffic will then need to traverse a router (and therefore probably a firewall) to get to the subnet the users are on you have the option to put some firewall rules in to make sure:

The printer cannot make any outbound connections
Users can only reach it via the ports and protocols they need (TCP/9100 maybe) rather than the HTTP admin (TCP/80 probably) etc.

You can make exceptions to #2 to allow management access from either the IP address assigned to you on the Users subnet or from another Management subnet which you could create just for your use.


What is the format of SSL certificate that begins with BEGIN PKCS7? I applied for an SSL certificate and after the application process I got a file containing base 64 encoded data between following lines.

-----BEGIN PKCS7-----
-----END PKCS7-----

When I try to install SSL on my website I got invalid certificate format.

Does this file contain private key? How can I convert this file to obtain standard .crt file?

Your certificate authority should not be giving you your private key. You should have generated it before making a CSR and including the public key (corresponding to the private one) in the CSR. The CA then signed the public key, without ever knowing your private key. Therefore, the private key should be in your PC and the CA can not give it to you. It should not have it.

What they should give you is a certificate, that confirms the public key (and by extension the private key) really belong to you and are not some random keys generated by an attacker.


Is the src of an iframe safe for user input? <iframe sandbox="allow-scripts allow-same-origin"
  src="javascript:alert(1)">

I would like to know if the src attribute of an iframe is safe for user input ?
I found this question, but my doubt is that I tried the code provided in  the answer and it doesn't do anything with the sandbox="allow-scripts allow-same-origin" attribute.

I'm allowing user to post videos, doing so when the user post a link on the backend a get request is made to get the correct value in meta tag.
However nothing is stopping OP to post a link to www.my-site-with-fake-meta-tag.com and try to do something funny.

So I could white list some domains, but it's an annoying process. Beside every site I checked uses an iframe src for user submitted content.

No, a user-supplied <iframe src=...> is not safe.

The alert() in your example doesn't fire because the sandbox property automatically blocks modal dialogs (alert boxes). But since you have set allow-scripts, the JS code is still executed in the background. And because allow-same-origin is set, it is even executed on the same domain as the embedding page. Using these settings together makes the sandbox attribute useless because you're giving the sandbox full privileges.

As a proof of concept, just use another function, e.g. document.write():

<iframe sandbox="allow-scripts allow-same-origin" src="javascript:document.write(document.domain)">

Or add the allow-modals directive (which interestingly isn't currently documented):

<iframe sandbox="allow-scripts allow-same-origin allow-modals" src="javascript:alert(1)">

Be aware that instead of the javascript: scheme an attacker could also inject a data: URI:

<iframe sandbox="allow-scripts allow-same-origin allow-modals" src="data:text/html,<script>alert(1)</script>">

If your plan was to give the embedded page as few permissions as possible, you could have just left the sandbox attribute empty:

<iframe sandbox src="...">


Building list of vulnerabilities that should be verified during pentest I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices.

People often mention that it is a good idea to gather intelligence and enumerate all vulnerabilities you are going to verify before moving to exploitation.

I've already done some recon/banner grabbing for the services running on the server, and thinking about building list of vulnerabilities so I cold have some kind of checklist containing vulnerabilities I should try to exploit.

My idea at the moment is to manage this:

by running vulnerability scanners like openvas and nexpose
by doing manual search using services that runs on server in public databases like exploit-db.com and 1337day.com

[1] should give me CVE numbers/other references regarding to the ways I can exploit found vulnerabilities manually. I also should be able to import reports them into metasploit and use metasploit for their exploitation later.

[2] seems to be more effort taking point since I'll have to check multiple databases and grab all they have for all the services I've discovered and then merge this list with vulnerabilities discovered using [1]

After that I am going to try to exploit everything I've found.

So, my questions are:
Is the described scenario is a good idea?
Maybe I am missing something and there is something I should change in my plan? Maybe there are any other tips you can give me (I am especially interested in ways to ease [2] as much as possible)?

Every vulnerablity listed on the CWE-2000 database and the CAPEC-2000 database is a good place to start.   This is by no means complete, and these databases are expanding.  Sometimes there are vulnerabilities that are clearly a problem that needs to be addressed,  but doesn't really fit neatly into the CWE database.

Automation and already discovered vulnerabilities should be looked at,  but this probably makes up about 1% of what I do as a pentester.

Burp, grep, Firefox, vi, python, these are the tools you need.  (And god damn MS-Word for reporting)


Securing connection between redirect from A to B domain I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A.
The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site to the credit card payment web interface and then redirected back.
Both domains are secured with SSL/TLS. User registers only on site A. Site B needs to know only users mobile number.

I came with one solution:
Page A encodes users data and common secret into hash. Data and hash are posted to B.
Page B receives data and hash. Then it makes its own hash out of data and common secret and compares it with hash from post request.

Flaws with this idea. Any better idea. Cookies ?

Edit:
I'm trying to prevent that someone could address domain B from elsewhere.
Site B provides some reservation process (mobile number as reference, sending check-in codes via sms). Someone bad could do the reservation and make our system run out of empty slots or spam us and other users - bad for buisness .

What you have proposed is essentially a hash-based message authentication code, or HMAC.  As long as the shared secret remains secret, no one will be able to pass data to site B other than from site A.

There are some nuances to using a hash for message authentication, including the length extension attack, but depending upon the language you're using, there's probably an HMAC library function already available.

{time passes}  After I've thought about this for a bit, you should include a timestamp in the data.  (And so the timestamp will be passed to the HMAC function as well.)  This is to prevent replay attacks, where an attacker captures a valid message (which would be hard if the connections are TLS/SSL) and sends it again later.  Both servers have to have a good notion of what time it is, which you can do with NTP.  You will also want to establish a timeout period, after which a message expires.  To prevent a replay attack during the timeout period, you will need to cache the messages and reject duplicates.

You may want to just rely on TLS/SSL to prevent replay attacks depending on how much damage such an attack could do.  If it were I, I'd include the timestamp anyway and check for anomalously "old" messages if nothing else.


Downloading a video without website noticing that you're not just watching it? I want to download video, but I want to download it in a way that you can't see that the video hasn't been just watched, but downloaded. Is there a a way to do that?

The only thing I can think of is streaming the video (e.g. in VLC) and recording the screen but that seems pretty dumb to be honest. I read that the problem why it can be traced whether the video has been downloaded or not is that streams are requested in chunks, but video download programs often download the whole thing at once. It's about rather short videos (5-20 mins), not movies or something like that.

You are asking the wrong question.  The right question is:

  How a website knows if a video has been watched or downloaded?

And the simple answer is: It cannot know for sure.

The example I'll use for this argument is the way how most Linux users watch videos.  The backend of video display on Linux is today ffmpeg (which is used by mpv and vlc as well).  The backend supports youtube URLs by means of youtube-dl (and youtube-dl is/can be used in VLC).

When a user types (or I do it, since I just typed this to make a test):

mpv https://www.youtube.com/watch?v=B3NcgOs0LYo

The video is downloaded to my machine before playing.

Browser note

But wait, when I watch a video through a browser is isn't being downloaded right?  Wrong.  When you watch a video through a browser the video is downloaded to your machine alright before being displayed.  The video need to reach your machine's memory at some point to be played.

Therefore there is (almost) no difference between using a streaming player (vlc or mpv) and watching from a browser.  There are just a couple of differences.  When you watch through a browser you also see the rest of the website, the banners are fetched, the JS is executed.  If someone on the streaming website can look at the webserver logs he can conlude whether you saw the page through a browser or not (stream players do not have JS engines).

Conclusion

A website maintainer can tell if you looked at a webpage or not when you were watching the video.  He can, therefore, tell is you used the browser interface to his website or a streaming player.  But he cannot tell the difference between a streming player and a download, because the steaming player already performs the download anyway.

Can a website claim that stream players are the same as downloads of a video?  Not really, the number of people using stream players is big, notably VLC.

One of the biggest reasons that people started using streaming players was to escape from using the Flash Plugin (which is famous for being particularly buggy in terms of security).  This is less of a problem today (with HTML5 streaming implemented widely), but still a reason why so many streaming players are used.

Disclaimer: When DRM comes into play things change.  Unfortunately (fortunately?) I have almost no experience with DRM


Removing weak cipher support from TLS We've run an audit on our public servers with SSL and had a few warnings for weak ciphers and potential SWEET32 vulnerabilities.

It's our intention to remove every cipher that's secured with 3DES, namely:

TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

and

TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)

I understand this will effectively kill support for very old browsers such as IE7/8 running on XP, but are there any other potential negative impacts of this action?

Utimately it's down to your client environment. If you're talking about a typical web site, with a typical set of modern clients, then no, you probably won't see any significant issues.

If, however, you serve a large population of users in developing countries using very old mobile devices, or your clients are embedded devices that don't receive updates, you could indeed have issues.

You probably have a good idea already, but if you do have concerns, the way to get a high fidelity estimate of whether disabling 3DES suites will cause your system issues is to monitor for awhile, capturing the client hellos being sent to your system and parsing them to determine what ciphersuites actual clients of your system claim to be able to negotiate.


How to rate CVSS when PR is low but UI of admin user is required I have a situation where an attacker with low privileges can perform an attack. However, in order to complete the attack, the system has to be restarted, which can only be done by the admin account.

In this case , the  UI is required. But I am confused with PR value. Should I rate it as low or high?

That a low. From the spec re Privileges Required:

  This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Emphasis on the attacker's privileges, not anyone else's.

However, you should also indicate that user interaction is required.


What are the most common infection vectors for personal computers? We have OWASP to tell us about common security vulnerabilities in webapps and such, but what are the most common infection vectors for personal computers?

A few example vectors:

Social engineering (trojans)
Browser exploits
Document / application exploits (e.g. PDF, Office, etc)
Remote code execution in OS services

I'm particularly interested in any academic papers, preferably relatively new (last 3-4 years), and any decent statistical analyses of attacks and infections.

If there's anything out there on the geographic distribution of these types of attacks, I'd be interested in that too.

The Verizon Data Breaches report is useful here ( http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf)

I can't view it right now but I seem to recall that the top routes in were social engineering, flash, document macros and pdf functionality.

Very few these days are in the OS.


Stealing user cookies with flash/actionscript I know I am asking a dumb question here, but pardon me, I am learning.

I found two questions viz, How do I access cookies within Flash? and
How to Make a button send an email using AS3 automatically. My question is, If I create a flash file with the above functionalities and upload that flash to some web applications like facebook or twitter, ideally I would be able to grab the cookies of other users in mailbox. What security feature is implemented in such cases to prevent this?

Looking at your first link, flash is using javascript to read the cookie. Assuming that's the way you implement it, you are back to the usual cookie security restrictions:

Same domain restrictions - the browser will only send cookies in the same domain, so *.foo.com cookies will only ever be sent to *.foo.com URLs. You would not be able to read a *.facebook.com cookie from foo.com
HttpOnly flag - the cookie will only be sent over http/https connection and is not available to javascript. This would prevent your flash app reading any cookie with this flag.


Is it possible to issue a certificate with different attributes than in .csr? Is it possible to issue a certificate with different attributes than in certificate siging request? I have a keypair and I generated a cert. request with extra attributes. Can the CA/RA or anybody modify the request wo my keypair when it is signed?

The certificate request is just a container to transport your public key and some information you like to have included in the certificate. The only thing the CA really needs from this is your public key. Everything else can be ignored by the CA and will often be ignored and instead the CA will create a new certificate request which includes your public key and the information the CA likes to include into the certificate. This new certificate request then gets signed, i.e. usually not your original certificate request.


Any tool for scanning vulnerabilities in browser extensions? I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?

There is one for Chrome, released mid-last year, called XSS ChEF.  Based on some earlier work finding vulnerabilities in Chrome extensions.  Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one.

I haven't used it myself but based on the way it works (it's just a web server), I imagine it's possible to use it to exploit Firefox extensions too or at least to extend it to be able to access Firefox internal state once you have found a vulnerable extension.

BeEF might be a good place to start looking too.


Who is the special OpenID Connect URL "self-issued.me" issued to, and is it a risk? OpenID Connect defines a special use case for self-issued.me and it's registered overseas to what I assume is a fictional name.

What is the risk of someone owning this domain w.r.t. OpenID Connect?

self-issued.me
Domain Name: SELF-ISSUED.ME
Registry Domain ID: D108500000002096888-AGRS
Registrar WHOIS Server:
Registrar URL: http://www.tucows.com
Updated Date: 2016-06-26T04:02:26Z
Creation Date: 2011-07-25T15:57:46Z
Registry Expiry Date: 2017-07-25T15:57:46Z
Registrar: Tucows Domains Inc.
Registrar IANA ID: 69
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Domain Status: ok https://icann.org/epp#ok
Registry Registrant ID: tuzK33SBHcrUhtLa
Registrant Name: John Bradley
Registrant Organization:
Registrant Street: Casilla 177
Registrant Street: Sucursal Talagante
Registrant City: Talagante
Registrant State/Province: Santiago RM
Registrant Postal Code: 9670447
Registrant Country: CL
Registrant Phone: +56.28559161
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: jbradley@mac.com
Registry Admin ID: tubOb46ov59QzL0V
Admin Name: John Bradley
Admin Organization:
Admin Street: Casilla 177
Admin Street: Sucursal Talagante
Admin City: Talagante
Admin State/Province: Santiago RM
Admin Postal Code: 9670447
Admin Country: CL
Admin Phone: +56.28559161
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: jbradley@mac.com
Registry Tech ID: tuXVh6iHDxmY8Tcn
Tech Name: John Bradley
Tech Organization:
Tech Street: Casilla 177
Tech Street: Sucursal Talagante
Tech City: Talagante
Tech State/Province: Santiago RM
Tech Postal Code: 9670447
Tech Country: CL
Tech Phone: +56.28559161
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: jbradley@mac.com
Name Server: NS1.SYSTEMDNS.COM
Name Server: NS2.SYSTEMDNS.COM
Name Server: NS3.SYSTEMDNS.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2017-02-07T21:08:10Z

According to https://openid.net/foundation/leadership/, John Bradley is the OpenID Foundation's Treasurer.

  John Bradley

  Treasurer

  Ping Identity

  Mr. Bradley is an Identity Management subject matter expert and IT professional with a diverse background. Mr. Bradley has over 15 years experience in the information technology and identity management field. Mr. Bradley advises Government Agencies and commercial organizations on the policy and technical requirements of Identity Management, Federated Identity, PKI and smart card solutions. Mr. Bradley communicates effectively with clients, vendors, staff and standards organizations to brief them on complex state-of-the-art identity management concepts, best practices, and technical requirements. He is also Chair of the Federation Interoperability WG at Kantara. He is treasurer of the openID Foundation, on the advisory board for OIX, and an active contributor to SAML and other OASIS specifications at OASIS. . Mr. Bradley is one of the leaders of OSIS, and the Kantara Interoperability Review Board, forums that vendors use for industry interoperability testing, and thus has an in-depth understanding not only of the factors that contribute to success, but of upcoming trends that affect whether strategic planning will ensure optimal effectiveness for future operability. Recently John has been co-authoring the ICAM protocol profiles at Protiviti Government Services on behalf of GSA, and continues to support the FICAM interoperability Lab. Current projects include co-authoring the next version of the openID specification and related standards.

You also see John's name as one of the author of the OpenID standard.

There is a LinkedIn page that indicates that John Bradley's does live in Chile (CL).

So the name does not appear to be fictional. Whether the registration detail is forged by a third party pretending to be John though, it's probably hard to tell unless you contact John directly. However, the email address used in the registration (jbradley@mac.com) does match the email address used by John on his OpenID works, as mentioned in http://wiki.openid.net/w/page/12995215/OpenID%20Authentication%202-1, and many of his email correspondences on public mailing lists.

In terms of security, any good implementation of OpenID should not trust unrecognized issuers, and self-issued identity and https://self-issued.me should both be considered unrecognized issuer by default. Anyone can be an OpenID issuer, not everyone should be in the list of trusted issuer for your applications. A rogue having control of https://self-issued.me shouldn't risk the security of libraries that doesn't special case https://self-issued.me, as long as the library has not been misconfigured to trust https://self-issued.me.


Techniques to make a login page safe without using SSL I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is to program a log in form without SSL and also allow people to log in with Facebook if they prefer. The page will load completely only if JavaScript is enabled.

My first problem is making sure that nobody can steal the user credential by acting like a man in the middle. I thought of solving it with a first hashing on client side with JavaScript and then on the server side, if I receive hashed values(in case someone deletes some JavaScript), a second hashing and store those hashed values in the user database. Is it a safe way to implement it? Also, are there any chances that some data get lost? If so how can I know if the received data is not compromised?
Protect from dictionary and brute force attacks. I would solve it by counting the number of failed log in attempts associated to that user account and if it is more than 8-10 in row show a CAPTCHA at each of the next log in and also implement a time delay between successive log in attempts. I think in this way IP changes are not going to be a problem because I am counting the number of failed log ins on the server side (I would set a user variable in PHP).
The Log In form. I implemented it in this way (without the hashing for now):

<input id="username" name="userName" placeholder="Username" type="text">
<input id="password" name="pass" placeholder="Password" type="password">

But when the form is sent on the URL I can read the password like: /LogIn.php?userName=user&pass=pass How can I hide the password?

What could be other good advices, to achieve as much security as I can without using SSL?

Why are you refusing to use TLS? It works, it has a good track record (some minor exceptions aside). Refusing to use good tools without a compelling reason does not engender confidence and does not immediately suggest professionalism.

Additionally, do not roll your own authentication system. That is silly, and you will make mistakes. Instead, since you expect your users to have a facebook account, use OAuth2 to consume federated identity and authentication. Even better, outsource this to a federation service who has mastered it and even provides code-snippets (https://oauth.io/ comes to mind).

Don't make your life difficult.


Where can I get information on unfixed security holes in an OS I have been assigned (as the youngest, hence the IT specialist, of the team [none of us have any IT background at all])  the task to check out our industrial computers.

It turns out the situation is dire, with key machines running stuff as old as Windows NT 4.0 or Windows Server 2003.

As always in this situation, is a question of buck for my bang, and no money is getting spend on upgrading if there is no added value.

In order to give an accurate recommendation, I'd like to find a list of security holes for a given OS, with, in an ideal world, an indication of damage and likelyhood, so I can build a damage probability matrix.

The National Institute of Standards and Technology (NIST) provides a very well maintained database of vulnerabilities.

You can find it here: https://nvd.nist.gov/vuln/search

Also in the recent past a lot of national Computer Emergency Response Teams (CERT) have been established, that provide these kind of information to interested people that are maybe not as - how shall I put this - "experienced" as others. Just google for "< your country here > + CERT". The german CERT for instance, has a great service called "Bürger CERT" that provides information about IT-security to the main street.

BUT - and this is very important - if you don't have any IT background at all, your machines run OS this old, I can tell you right now, that the likelihood of a risk occuring is preeeeetty high. If these are key machines, hire someone to do this and upgrade them ASAP.


Is it possible data which was generated with JavaScript in Google Chrome could exist in my Mac'sRAM? I generated a private key using this website: https://www.stellar.org/account-viewer/#!/

I was supposed to write down the private key but I didn't and I lost it. I have since unplugged the internet from my Mac and kept Google Chrome open (but the tab is closed) and have not used the Mac any further.

Is it possible the private key I generated on that website could still exist in my computer's RAM??

EDIT: I found it!!! To anyone who comes to this post and finds this, I closed the tab and dumped 4-5 hours later and I still found it. The computer was kept on and Google Chrome was not closed. Do not give up hope!

Very unlikely. The memory used by that page will have been freed and will almost certainly have been decommitted from the process, which means the OS will have scrubbed it by now.

At best you could try taking a memory dump of the process using Volatility, which can also carve out useful structures and look for sensitive information (probably including certificates and RSA private keys, although I haven't looked into that) but I'd imagine that the data is completely gone by now.


How to prepare for hacking competitions I know that there are several hacking competitions, but I would like to know how to prepare for hacking competitions.

I know that there are several hacking courses, online and offline, but they only seem to prepare for basic stuffs.. Would taking OSCE/CTP courses provide sufficient preparation?

I wouldn't consider any certification or course to be sufficient preparation for a hacking competition, assuming you're talking about the kind of Capture the Flag competitions that tend to run at conferences. They usually don't focus on any particular aspect of information security, but rather a broad range of technical skills.

At the last conference I attended, their CTF covered the following stuff:

Network capture analysis.
Web application penetration testing.
Reverse engineering.
Remote service vulnerability discovery.
Custom exploit development.
IPS evasion (only trivial rules, though)
Basic cryptanalysis.

This isn't the kind of stuff you can learn in a week (or a month, for that matter) at a course. Whilst the focus is on testing the technical skills of participants, a huge part of the success factor is intuition and experience. It's about having a breadth of experience in a variety of topics, with sufficient depth in some to craft complex solutions to problems.


Small, Vulnerable apps for exploit training I'm looking for some really small apps on Ubuntu for some bufferoverflow exploitation training.

I don't want to start off with some huge apps.

I know some sites like http://www.oldversion.com.de/ where i could start but most of the apps are just to big or too hard to exploit for a beginner or just not available for linux. Most of the tutorial on the Internet or windows based.

Do you know any app where i could start playing around?
Which debugger do usually people use on ubuntu?

As a .NET dev i already have the theoretical knowledge for exploits, but I need to do it myself to understand it better.

Try going through the extensive list on OWASP Vulnerable Web Applications Directory Project.

Some of them I know and have played with:

Google Gruyere
Damn Vunerable App

But some of ASP.NET specific ones include SPI Dynamics (live), Watchfire (live), Acunetix 2 and 3 (live), HackmeBank, and OWASP SiteGenerator.
Hope this helps!


Retrieve auto saved Skype password from Ubuntu 12.04 LTS The email address I used to create Skype profile has been disabled and I can't get it back.

Unfortunately, I don't remember the Skype password now.
As the password is auto saved in my local machine I am able to log in to Skype account in only this particular Ubuntu[12.04 LTS] machine.

I need to retrieve the password, searched in ".Skype" directory for possible password hash but could not get any clue.

Any pointers to the required tools and methods are highly appreciated.

According to Vanilla Skype Part 2 [page 67], when you ask Skype to save your password, it takes a hash md5(username\nskyper\npassword) then it encrypts it using AES-256 and it stores it /home/USER/.Skype/SKYPE_USER/config.xml (config->Lib->Account->Credentials3).

I have just tried to copy config->Lib->Account->Credentials3 to a config.xml file on a different machine (same Skype account) and I was able to automatically login.
That can be a temporary solution while you try to solve the problem with Skype customer service.

If the password itself is of high importance to you, there are some tools (commercial) that can help you brute-force it, so if your password isn't very strong there's a decent chance of recovery (since Skype is using a fast hashing algorithm, MD5).


Is it good practice to mandate input action on the password field in a webapp? I am of the school of thought that says you should never have the browser "remember your password" because if you use it often enough, you will be able to retain that piece of information. I now want to enforce this in the web application software we're building.
Regardless of whether the browser remembers and/or auto-fills it or not, I still think it is conducive to web application security if any user would still have to type the password. This way it is almost guranteed that the user sitting at the terminal is the user logging in.

I am now wondering why this isn't a standard as of yet.

If you want to ensure (or at least make more probable) the fact that your user is indeed sitting on the other side of the browser, you should implement multifactor authentication.

As @Jay mentioned (and I fully agree, per my comment) disabling the ability to fill in a password is a terrible thing to do. It is not user friendly and does not help security.

UPDATE: incidently, I just stumbled upon an interesting article right about the same subject (from 2014).


How is using an endpoint for public keys secure? OpenID Connect has discovery endpoints containing a JKWS endpoint to get public keys to validate Identity and Access tokens.

So for example:

I have a desktop application which gets an Identity token from the STS
the application gets the jwks_uri from the Discovery document
the application gets the public keys from this uri and validates the Identity token

So a man-in-the-middle attacker (like malware on a PC) can:

intercept an Identity token from the STS, modify it and sign it with its own private key
intercept the jwks_uri request and return its own public key(s)

Now the attacker can send anything he likes without the application knowing it?

You cannot defend against this. What you have described is a totally pwned computer. The only thing to do is wipe and reformat. In general, you cannot do anything sensitive on a compromised or potentially compromised computer.

So don't worry about this. Make your app secure from network attacks and let the user determine whether their computer is secure.


Security implications of packets with an invalid state (iptables) I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m state --state NEW, ESTABLISHED, RELATED at all. However, seeking for information I found that there is a fourth state:

INVALID:

  A packet which could not be identified for some reason: this includes
  running out of memory and ICMP errors which don't correspond to any
  known connection. Generally these packets should be dropped.

I'm wondering whether or not packets with such state are harmful from a security perspective. According to that quote, they should be dropped, but the document didn't explain why.

The main reason those invalid packets must be dropped is because they are often used for OS fingerprinting.

As each of the major OSes respond to those packets in different ways, it's easy to find that you are running Linux if you don't drop them.


Are deleted files more or less likely to be overwritten than blank space? Let's say that I have some files on a hard drive (the data for each file is represented by a different letter):

xxxoooozzzz--------------------

Now let's say that I delete file Z without securely wiping it. The file will still be on the hard drive until something overwrites it:

xxxoooozzzz--------------------

Now let's say that I decide to create a new file (b). This will take up some of the remaining space on the hard drive. My question is, does the hard drive or operating system take the deleted files into account when deciding where to put  the data for the new files?

From a convenience perspective, it seems like it would be best for the hard drive/OS to intentionally avoid overwriting deleted files, like this:

xxxoooozzzz---------------bbbbb

By doing that, I would have a higher chance of recovering File Z if I later realized that I wanted it back.

From a security perspective, it seems like it would be best to do the opposite and instead prioritize overwriting old files, to help prevent deleted data from being recovered by a malicious third party. For example, like this:

xxxoooobbbbb-------------------

My question is, are either of these things actually taken into account when writing new data? Or is the new write location essentially just random?

Yes, I take them into account.

On HDDs it's more like o be overwritten compared to being stored into free space, because the tendency is to put the data into the faster portion of the drive which is at the beginning of it.

For SSDs, in theory, the data should be allocated to the less used sectors, which means there's a higher chance data will land into the free space compared to reusable one.