DNSSec (Comcast) vs DNSCurve (OpenDNS) I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.

I've done a little research on DNSSec and its benefits. I understand the basics of DNSSec. Pretty much DNSSec signs your DNS request so you won't have man-in-the middle situation happen to your DNS queries. Does a lot of malware use DNS man-in-the middle attacks?

So then I found out OpenDNS doesn't think DNSSec is the ideal solution: OpenDNS opinion on DNSSec. They use something I've never heard before called DNSCurve. Sounds pretty similar to DNSSec. With Comcast's solution you seem to be automatically protected if you use their DNS Servers. Not sure if this is true with OpenDNS or not. They also have a cool tool which I would love to use: DNSCrypt which encrypts your DNS requests. Unfortunately right now it's only for MACS.

So the overall question is: should I make the switch or is OpenDNS with its technology just as secure as DNSSec on Comcast?

DNSSEC and DNSCurve address completely different aspects of DNS security.

First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects the resolver from receiving bad data, but does nothing to prevent MITM or snooping between you and the resolver.

DNSCurve, on the other hand, encrypts communications between recursive resolvers and authoritative servers and allows authoritative servers to sign their data against forgery, but does nothing to protect an end-user client from a bad recursive resolver.  OpenDNS's DNSCrypt solution is based on the same technology as DNSCurve, but protects the last-mile between a trusted 3rd party recursive resolver like OpenDNS and the end-client.

As for which is more secure, neither is. They are both secure, however the security is applied in different areas. In either case you are picking which aspect of DNS security is more important, rather than which security tool is stronger.

As for what you should do, that is something only you can decide, but do please consider the following:

You could use Comcast's DNSSEC resolvers and hope no one snoops and MITMs the connection between your machine's and Comcast's resolvers.
You could use OpenDNS's resolvers, connect to them using DNSCurve, and hope that no one feeds bad data to those resolvers, as they do not use DNSSEC. (To be fair, OpenDNS has a very good track record of preventing such attacks.)
You could run your own resolver using freely available open source software such as BIND, PowerDNS, or Unbound; enable DNSSEC on said resolver; and keep the queries on your local network—or better yet, run a resolver on each machine.  (This is the best option IMHO, as it addresses the weaknesses of both of the other two options)


Risks of giving a hacker my WPA key for my router? What are the risks when someone (maybe a hacker), that through Social Engineering gets the WPA or WEP key of my router and (obviously) can navigate through internet.

At this point, what can this hacker do?
Can he do some kind of work in my router if my router is blocked through User and password?

If the attacker is sufficiently close to the access point and can connect to it, he can view all unencrypted network traffic that goes past your router by using a packet capture utility like Wireshark. Although WEP adds a slight barrier, its still easily decipherable even by unauthenticated users.

On a side note: WEP has been shown to be completely broken. Any attacker close enough to your WEP secured access point can extract the key just by packet captures - typically within minutes (without any social engineering). Thats why its important to use at least WPA2 to secure your network.

To answer your other question: Once the attacker is on your network, he can launch a brute force attack on the router login credentials (no such attack needed if your router uses default authentication credentials - a comprehensive list of default router passwords can be found here). Once successful, he has effectively "owned" your router and can even lock you out by changing the password. A comprehensive list of attacks on wireless networks and their users can be found here


Why does openssl writes EC parameters when generating private key? When I'm generating a private key with openssl, it writes the curve's parameters, and the actual private key:

❯ openssl ecparam  -name secp256k1 -genkey
-----BEGIN EC PARAMETERS-----
BgUrgQQACg==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHQCAQEEIKYV1xoz6smkpdMksfgI8/3465V02UZdaKj4JSH30bBhoAcGBSuBBAAK
oUQDQgAEO1O+/xRGEVJgBEAOQorBveXPTQS3c7MA+9R+HEMP7TkscI9FONPclcRb
5sXZJjYHNYWhvxuXdGl8QrFVRIVBYg==
-----END EC PRIVATE KEY-----

Note that the parameters does not contain real data, just reference to the standard used:

❯ openssl ecparam  -name secp256k1 | openssl asn1parse
    0:d=0  hl=2 l=   5 prim: OBJECT            :secp256k1

However when I look at the private key, I can see that it contains the curve type used! Look at the line starting with 41:d

❯ openssl ecparam  -name secp256k1 -genkey -noout | openssl asn1parse
    0:d=0  hl=2 l= 116 cons: SEQUENCE
    2:d=1  hl=2 l=   1 prim: INTEGER           :01
    5:d=1  hl=2 l=  32 prim: OCTET STRING      [HEX DUMP]:872F67D0B852C6FE9BD1F5B93AF54B7555D21267200DA2F8ED735729BF32730A
   39:d=1  hl=2 l=   7 cons: cont [ 0 ]
   41:d=2  hl=2 l=   5 prim: OBJECT            :secp256k1
   48:d=1  hl=2 l=  68 cons: cont [ 1 ]
   50:d=2  hl=2 l=  66 prim: BIT STRING

Is there a reason I need the EC parameters? Why does it produce them by default?

(The only reason I can think of needing those EC parameters, are to use them as an input when generating a private key, but aren't you better off give their name in the command line?)

It is a quirk of OpenSSL. The ecparam command is meant for handling EC parameters -- namely, the definition of a curve to play on -- and allows the generation of a private key as a secondary feature. You can use the -noout command-line argument to suppress the production of the encoded EC parameters themselves:

$ openssl ecparam -name secp256k1 -genkey -noout
-----BEGIN EC PRIVATE KEY-----
MHQCAQEEIHyx/m9I6/ZbvqN5XJ/fZSM6P7PIuvNDnWdp8STjlGqQoAcGBSuBBAAK
oUQDQgAEVGRwTHlFRgxmhnJNO4Vfdojmg2pni44U4SMFEziNM8YVhd62UzwB5L0+
n8EXsvTIv5Uj7COQd/1cTsdL9kin4w==
-----END EC PRIVATE KEY-----

Also, the existence of an "EC parameters" stand-alone structure is justified by the fact that the private key encoding could lack the information; see RFC 5915 which gives the following ASN.1 type:

ECPrivateKey ::= SEQUENCE {
  version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
  privateKey     OCTET STRING,
  parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
  publicKey  [1] BIT STRING OPTIONAL
}

where the parameters and publicKey fields are duly marked as "optional".

As for the internal representation of the parameters (either stand-alone or as part of the private key structure), the use of a simple OID is rather normal. Generating your own elliptic curve is substantially harder than producing new DSA parameters; also, sticking to a few standard curves makes implementation of EC cryptography both easier and faster. Therefore, most implementations out there are restricted to a few standard curves, often the P-256 and P-384 from NIST (actually from SEC, then "annexed" by NIST). Implementations which support all 15 standard NIST curves are a rarity; implementations which support "arbitrary" curves (where the full curve values are encoded in the parameters structure) are mythical (I never stumbled on one, although I got close to writing one at some point).


Exposing IP address via img tags As we all know, many forums allow users to set profile pictures, post images, or put images in signatures.

Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture?

Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture?

Yes.

  Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Well, you can't force the website to do anything, and hosting images on different servers is standard practice (and if it's just a cdn).

What you can do is to set your browser up to only load images from the original domain you are visiting. In firefox this would eg be done via permissions.default.image=3.

There are likely plugins for your favorite browser that make this a bit easier to manage (eg that allow additional image loading with your permission, that let you whitelist some URLs, etc), but that's more of a product recommendation and off-topic.


Where can I find a list of frowned upon usernames for web sites? There are some usernames that shouldn't be allowed to register on online services, for example:

administrator,
admin,
root,
system,
owner,
hostmaster,
webmaster,
sitename or
sitenameadmin

As far as I know, those shouldn't be allowed because they might cause a security risk, due to users registering those usernames might be able to impersonate a website official, and some users might be fooled by this.

http://example.com/administrator
administrator@example.com

Where can I find a list of all those usernames that shouldn't be allowed to register by anonymous users?

This is really the wrong solution to the problem: trying to prohibit "administrator"-like names will become a constant game of whack-a-mole with increasingly creative impersonators.

A blacklist of official-sounding names can be a starting point, but you should also provide an easy way to positively identify admins, such as a unique naming pattern (only admins can register a username ending in "(admin)"), or displaying their names or messages in a unique color.


buffer overflow in python script I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through my python script.

When I inject my payload from the commandline:

 user@ubuntu:~/Documents/$ /home/user/Documents/easy $(python -c 'print"AAAAAAAAAAAAAA"\xa0\xf4\xff\xbf"')
 $ exit  //I get the shell....

The return address

\xa0\xf4\xff\xbf

Is the address of my NOP sled in an environment variable.

Now, I run the complete same command through my python script:

 path = "/home/dvddaver/Documents/easy AAAAAAAAAAAAAA\xa0\xf4\xff\xbf"
 os.system(path);

However, when I run my python script, I get a segmentation fault:

 user@ubuntu:~/Documents$ python bruteforcer.py
 Segmentation fault (core dumped)

I understand it is a bit late for your assignment ;) but for other students who may be groping in the dark with similar problem, here goes...

Python is written in C, and the C executable is throwing the segmentation fault error. To understand segmentation fault you need to run Python itself in gdb (GNU Debugger assuming you are on Linux/Unix) and then pass in your script as the parameter and then step through the C code written for Python.

It is quite possible that you have have caused a buffer-overflow within the python interpreter to have caused a segmentation fault (so that's good!). Though I cannot say for sure in the case you are executing here.

I have studied one of the vulnerabilities of Python in detail and blogged about it. It affects older versions of Python 2 and 3. I downloaded the Python source and built the source with debugging on.

Next I figured out how Python works and executed Python scripts on the built interpreter and stepped through them in GDB.

I have uploaded my work on my Blog (http://yazadk.wordpress.com/2014/12/10/remotely-exploitable-buffer-overflow-in-python/) - though mind it we were specifically looking for C programs that had buffer overflow available in the wild and I happened to choose Python which is written in C.

I hope this gives you some basic insight in what you or anyone else is trying to achieve.


Why is the SSL message red? The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification?

I sometimes use a proxy. Can that be the reason?

Some parts of the webpage (for example images) are loaded using a insecure connection. This parts could be changed by a MitM attacker without you noticing it.
You can use a service like whynopadlock.com or the developer tools of your browser to find out what exactly causes this!

In this specific case, three images are included using a unencrypted http connection!


Good reading about windows architecture/reversing I have a feeling that I need to get more knowledge about system programming and winapi/windows architecture in particular to be able to understand how lots of exploits work (like those exploiting buffer overflows and other bugs in system services or regular apps) as well as to be able to debug and reverse the apps I am interested in.

I am not that scared to get my hands dirty but for the last few years I was doing programming mostly on high level and it is been a while since I dug on low/system level programming.

So, my question is - is there any good reading you could recommend that can provide an overview of windows architecture/internals and how things usually work on this platform on the edge of system and application layers (it would also be great if the security means/issues were highlighted too)?

Reversing: Secrets of Reverse Engineering (2005)
Disassembling Code: IDA Pro & SoftICE Book/CD Package: IDA Pro and SoftICE (2006)
Hacking: The Art of Exploitation Book/CD Package 2nd Edition (2007)
Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code (2008)

Personally I really liked the Reversing: Secrets of..

A must read for any reverser is obviously AoA (Art of Assembly) which is free and can be downloaded.


Encryption Using 7z or Zip File I'm wondering which encrypted 7-Zip file format has better encryption: 7z with 256 AES or zip file with 256 AES? Assume that a strong password is used, then which encrypted 7zip file format has stronger encryption to encrypt info in a text file?

7-zip uses AES-256 for 7z archives, the strongest version of AES.

WinZip offers two kinds of encryption: AES encryption (It's good, but windows doesn't support it.) and weak Zip 2.0 (Legacy) encryption, which is the old method. Windows supports it. But that method provides low security level. Do not rely on Zip 2.0 encryption to provide strong data security.

Using WinZIP with AES defeats the initial .zip purpose, since Windows by itself will not be able to extract it.

When using AES WinZIP can use both 128-bit and 256-bit. If 128-bit is used, it's less secure, but a little faster.

It also slightly simpler to check passwords for zip, since many tools are focused on that compared to 7z. Basically, there is some software that can search passwords for zip, and it's more difficult to find such software for 7z-AES.

Standard .zip also has more code execution vulnerabilities compared to 7Z.

So the strongest format is 7Z, followed by ZIP-AES-256.

Conclusion: in the case of encrypted files, there is no sane reason to still use standard zip.


Get Screenshot URLs crawled by Shodan When shodan crawls an IP, it takes a screenshot based on some technique(?)
Nevertheless, most of screenshots that shodan takes are from IP Cameras.
Is there any way to access the URLs the crawler found the image on?
E.g. Crawler found "rtsp://blargh.com/1/stream" and took a screenshot of that stream. Can I somehow access this exact URL? In the API response there is seems to be no information about this other than the data key, which purpose I havent found out yet.

No, it's not currently possible to get the URL of the image as Shodan doesn't store that information. Not all images are collected from services that have URLs (ex. RDP). Note that the actual screenshot image is stored in the data property. Here's a sample screenshot JSON object stored in the opts.screenshot property on the banner:
{
    "data": "/9j/4AAQSkZJRgABAQIAJwAnAAD/2wBDAAYEBQYFBAYGBQYHBwYIChAKCgkJChQO...",
    "hash": 29478602,
    "labels": ["windows", "login", "desktop"],
    "mime": "image/jpeg",
    "text": "am Windows Server 2012R2"
}

The data property is a base64-encoded string of the image. The hash is a numeric hash of the data property (useful for finding duplicate images). The labels are high-level classifications of the image based on machine learning. The mime is the MIME-type of the image (we mostly use JPEG at the moment but it could change). And text is the text in the image that was extracted using OCR.
And most images are actually of remote desktops. Around 75% of images on Shodan at the moment are of remote desktops. Webcams on HTTP are a comparatively small at ~8% and RTSP takes most of the remainder. We also look at X11 and VNC but those are a tiny fraction of the images.


What information is embedded in a photo taken by camera or print screen? I was told that it is possible to tell the coordinates where a photo was taken and the date and time it was taken. It is somehow embedded in the photo. I have three questions about this which are as follows:

Where is this information stored?
Can the data be deleted?
Is it the same for screenshots?

the coordinates where a photo was taken and the date and time it was taken

It's called EXIF metadata. It depends on the camera, or phone, or application.  Digital cameras usually save the image parameters (f-stops, ISO, shutter speed, etc) on that area. Cell phones can be configured to store coordinates too.

  Where is this information stored? Can it be deleted?

This data is stored on a special section of the file, and it does not change the image in any way. It's just a special text section that can be read/written by special software. It can be edited and deleted as well, and even contain fake/falsified data.

Deleting this data is trivial. There are a couple programs that removes that data in batch. Exifpurge is one, exiftool is another one.

  is it the same for print screen images?

It is the same, as EXIF headers are part of the JPEG specification. As most of the EXIF fields are not relevant for a screenshot application, most of the fields will be empty. You can test your screenshot application by saving a file and submitting to a EXIF metadata viewer, like this.

I am not aware of any image editor software that embeds coordinates on the EXIF headers by default.


Where can I find Google Backup Codes? I am traveling long term and I don't want to put my SIM card in the phone every month to receive the SMS code when signing-in to Google (I always recieve 10+ other text messages which costs me a lot).

I know you can sign-in using backup codes but I just can't find them anywhere. I checked https://myaccount.google.com/u/1/security thorougly.

Is this option now obsolete? Google's answer on how to obtain them is definately obsolete.

On the help page you link to it states to go to https://myaccount.google.com/security/signinoptions/two-step-verification

When I go to that page under "Your second step" there is a section called Backup Codes with a big "Show Codes" button.


Google Account collecting browser history and cookies? I am using some random site in Microsoft Edge. There are no account associate neither with the site nor the browser. Now,

What will happen if I login in Google Account and keep it logged in. Will it collect my browsing history and cookies?
What will happen if I logged out after successful login in Google Account. Will it be able to collect my browsing history and cookies, or something else?

Browsers generally implement a level of isolation between the websites and the browser. So a website may not be able to directly fetch the browser history or cookies created by other sites. Services like Google, Facebook, Twitter etc are ubiquitous due to ads, like buttons etc.

It is possible for these services to fetch your browsing history by indirect ways. They won't be able to get all the cookies on your browser though as the cookies are bound to the url that created them.

  What will happen if I login in Google Account and keep it logged in. Will it collect my browsing history and cookies?

Browsing history via browser? No. Google ads can create cookies saying you connected to this website that uses Google ad. This data can then be used by Google to build your browsing history

  What will happen if I logged out after successful login in Google
  Account. Will it be able to collect my browsing history and cookies,
  or something else?

Logging out temporarily stops the Google service from being able to link the browsing to your account. When you log back in, Google can look at the cookies that it stored to get an idea about the browsing history on that macine and possibly link it to you. Of course, it won't always be able to link that browsing history specifically to you. For example, if you are sharing a browser with multiple people, Google may not know who was particularly browsing the computer if nobody is logged in.


Is it possible someone uses my cell number to make calls for my cell phone company to create a record? My old cell phone number had made lots of calls I am not familiar with.  I was confronted with a list of calls I know I did not call.  I was also told that I was using Skype.  I have never used skype, I do not know how to work that program.  But, the cell phone company submitted a history of calls made.  I called several of these numbers and I do not know the party on the other line.  I even asked them if they have ever spoke with me or even recognized my voice, and they said they didn't know me or recognized my voice.
So my question is, is it possible that the cell phone company or someone close to me could have rigged (for better lack of word) my phone to create such a long list?

The term is "phone number spoofing". It is quite easy to make calls from a phone number other than your own, this is usually done with VoIP software, although I don´t use skype either and I don´t know if skype has this capability. In other words I doubt your phone or the company is the problem.


Catch enough IV to be in the FMS attack I am doing WEP attack test using FMS method (Fluhrer, Mantin and Shamir), but not capturing enough 4,000,000 to 6,000,000 IV.
Please show me how to catch enough IV.

A classical way to catch enough packet (hence enough IVs) is to artificially generate traffic using ARP: it is a link layer protocol, so ARP packets are not
restricted by any kind of filters or rate limiting rules.
Most importantly, it is possible to re-inject a captured ARP request in order to generate a response, and repeat the operation until you have enough packets.
In practice, it is only a matter of time to gather enough packets, and it can be done quickly with a de-authenticate message send to a client. There are plenty of software (e.g. airplay) which does it very well.


Weird table names in SQLite database This is the first time I'm using sqlmap against SQLite.

When I run:
sqlmap -u www.site.com:80/index.php?vulnParametr=p --dump-all --keep-alive --dbms=sqlite

It gives me this:

What is that? Is SQLite using some sort of encrypting?

I could decipher the characters using ASCII code, I got the following result:

[BEL] K [LF] [LF] [LF] [FF] NULL ceuQ \n CI <&NG [SI] [BEL] [BS] [ESC] ( [SO] & " \n E [FS] #' [DC2] [DC4] K [DC1]

[BEL], [LF], [FF], [SI], [BS], [ESC], [SO], [FS], [DC2], [DC4], [DC1] are control characters, then it isn't a encrypted text, it's text in hexadecimal. I think that sqlmap inject control characters to know if it is possible to execute specific actions, for example, [BEL] is a device control code to execute a warning.

You can know more about control characters in the following link.

https://en.wikipedia.org/wiki/Control_character

I hope this information helps you.


Are self-signed certificates actually more secure than CA signed certificates now? Are self-signed certificates actually more secure than CA signed certificates now?

I ask this because recent leaks about the NSA spy programs and the secret FISA courts mean that the US government can force Certificate Authorities in the US to secretly hand over their root certificates and the CAs can't do anything about it because of a secret gag order. Given the US's communication intercepts in all the ISPs and gateways, it would be simple for them to MITM each HTTPS connection coming in and give out their own public key signed with that same root certificate instead, thereby allowing them to intercept the private keys used in the TLS session and forward a copy of all the data back to their Utah data centre for analysis and permanent storage. It seems they've had this capability for a while and there's no telling what information has been stolen. This basically undermines trust in the whole internet.

Knowing this information, would it be technically more secure for a private organisation to generate a self-signed certificate for a server, then manually copy that certificate and give it to their users on a CD/USB drive, then their users would manually load the certificate as trusted into their web browsers? That way if the connection was MITM'd by the US then it would not match the one in their browser.

However because there are already "trusted" CA certificates pre-loaded from Verisign, Comodo et all into the browser, as the US is performing a MITM attack on the connection couldn't they just initiate a request to the real server, copy the public certificate information, then create a new certificate based on that information for that domain being requested, sign it with any of the root CA's certificates they have which are trusted by the browser, thus allowing them to intercept the data? Nobody really bothers to look at these things to see if the certificate was signed by the correct company Verisign, Comodo or another one. Users are just looking at the padlock. It would only look suspicious to the administrator who remembered they created a self-signed certificate, not a certificate signed by Verisign or some other company.

This just made me realize the US only needs one dodgy CA certificate pre-loaded and trusted into most browsers to be able to perform MITM attacks on anything, they simply swap out a site's real certificate for a new one where they signed it with any of the root CA certificates that are trusted by the browser. If that was the case, then you would need a new browser profile, remove ALL the trusted certificates, load in your own organisation's trusted certificate and use that browser solely for communicating within your organisation. Any MITM attempts would throw up a big warning in the browser.

There is a subtle point here. In the envisioned situation, there is one (or several) rogue CA who may emit fake certificates for man-in-the-middle attacks. The vulnerability here is not about a server who uses a (genuine) certificate from that rogue CA; it is about the client potentially accepting a certificate from that CA. To protect yourself (as a client) against the rogue CA, you must un-trust that CA (i.e. remove it from your "trusted roots" certificate store). This merely implies that servers that you still wish to talk to should use some other, distinct CA, for their certificates.

In a corporation, producing self-signed certificates and pushing them to all the clients really is a special case of maintaining your own PKI: the corporation produces one or several roots, which have to be installed in all the clients. This is doable; some corporations do just that. But for MitM as discussed here, nothing is gained until the "trusted roots" store of all clients is cleansed from all other, potentially evil CA.

Unfortunately, you cannot necessarily do that. If your operating system is Windows, then there are a lot of signatures used for various components, in particular for updates from Microsoft. You do want to install security fixes, don't you ? You can get away with removing most of the root CA from your "trusted roots", but not all, otherwise to many things will break in your OS.

The conceptual problem is that some OS (in particular Windows) use a centralized mechanism for certificate validation, in which there is one trust store which is deemed appropriate for everything which deals with certificate validation on the machine (in details, there is one "local machine" trust store, common to all users, and one extra trust store per user, but a user cannot "opt out" of the common local machine trust store). You may have better luck with other operating systems such as Linux, which traditionally don't use X.509 certificates for their internal needs, but OpenPGP keys, with a much more decentralized trust system.

The Firefox Web browser, though, uses its own SSL implementation and trust store, separated from that of the base OS. Moreover, Firefox supports profiles, meaning that a user can have several "personas" with Firefox, each with its own settings, including the set of trusted roots. Therefore, a corporation who fears for its data confidentiality could do the following: it could instruct its employees, when they deal with corporate servers, to always use Firefox, with a specific profile which contains only the corporation's own root (or set of self-signed certificates) as "trusted roots".

It is unclear whether the said employees would like it, but it is feasible.

Remember, though, that a powerful attacker is powerful. If that attacker may control "official CA" then it could push a fake update, purportedly signed by Microsoft, which installs a backdoor in every system. Or they could simply ask Microsoft to plant the backdoor themselves. In any case, you don't have much choice: by construction, you must trust the OS and the hardware for not playing foul games on you.


Real life examples of web site attacks I've been put in charge of educating developers on web application security. One way I will be doing this is through an explanation of various web attacks (e.g., OWASP top ten).

In addition to an explanation of the attack and possible mitigations, I would like to give a real life example describing what sort of damage the attack can cause with details on how the attack occurred.

The best example I've found of this is the Apache.org attack, but I doubt others would be as detailed. Otherwise, the best I can find are news articles stating the a site was attacked, but without mentioning what the attack was.

Are there any resources keeping track of the details of attacks like this?

Spend a little time browsing through the archives of a mailing list like Full Disclosure. You'll find real life examples of various kinds of web site attacks, e.g.:

SQL Injection in WikLink
PayPal Send Money Cross-Site Scripting Vulnerability

Or browse through the CVE database. Not every entry will have full details, but you can often find a link back to Full Disclosure or some similar site with the details you're looking for. (Or, in the case of open source products, you could take a look at the source to see what was patched.) Just a search on phpmyadmin will give you a rich set of examples which have the benefit of being open source and all coming from the same code base:

XSS
directory traversal
PHP code injection
failure to partition users?
installation information leakage
authentication bypass

It looks like there have been 17 advisories for phpmyadmin so far this year, so it's feasible that your staff could find a couple more if you assign this as a task during your training exercise.

Another category of helpful resources are wargames websites like hACME game and Hack This Site!.


Impact of sharing the private key with a third party for snooping SSL traffic I am trying to understand the impact of sharing the private key with a third party for snooping SSL traffic. Below are my thoughts, please correct and add if some more impacts are there:

One clear impact is that I will not be able to use the key exchange algorithms like DH, DHE and ECDHE because they generated a new key each time and hence if I use them then my designated third party will not be able to decrypt the SSL traffic.
Since algorithms like DH, DHE and ECDHE will not used, so it means that I will not be able to get benefit of Perfect Forward Secrecy.
I will not be able to upgrade to the ECDSA based certificates, again because a new key would be used each time and hence decryption by third party will not be possible.
Since DH based ciphers are faster in computation than RSA so I think there could be little performance impact. But could it be significant?

I know basically I would be weakening my cipher suite so that third party can snoop. I don't see any other impact.

If you can really trust the third party that it keeps your private key secret and uses it only for passively sniffing and decoding the encrypted traffic (like within an IDS) then you are probably right about the impact.

But of course this third party can also use this private key for active interceptions (i.e. modify traffic) or for impersonating your site, because the private key and the public certificate together is all what is needed to do this. And you probably might not detect when their are doing this or when they give your private key away (voluntarily or not, i.e. if they get hacked) so that others can do it.

Also note that weakening the cipher suite might have some unintended side effect because browsers like chrome will complain about it (but still connect) but some applications (like iOS9 apps) will fail to connect at all because they expect ciphers with forward secrecy.

  Since DH based ciphers are faster in computation than RSA so I think there could be little performance impact.

I don't know where you got this from. DH key exchange is much slower than RSA and while ECDH is much faster than DH it is still slower than RSA. See the benchmarks at the SSL/TLS & Perfect Forward Secrecy article from Vincent Bernat.


Is it a good idea to have a "master" password? Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to choose one of them according to how much I trust the application and how sensitive it is. I usually renew my password within 6 months to 2 years.

The idea I just got is to make a script that generates a password from a master over-strong password and the name of an application. I already see both assets and drawbacks.

Assets

Just one password to remember
A different password for each application

Drawbacks

If the master password is lost, so are the others.
If somebody ever find the master password... Finding the others would be a cakewalk.

I also wonder if the algorithm would be reversible (i.e finding the master from the name of an application and the related password).

So I improved my idea : What if the script generates a random password and stores it with the others, on a file, next to the name of the related application. This file would then be encrypted with a 4096-bits RSA key, itself protected by a password that could be renewed on a month base.

Briefly, I'd like to know if the latter is a good idea or if my current method is still better.

Safely deriving site-specific passwords from a master password is possible. It requires, namely, a deterministic one-way function: "deterministic" so that the site password can be recomputed, "one-way" so that it is not feasible to recompute the master password from a site-specific password. As first order approximation, a cryptographic hash function does the trick.

The system can be enhanced by making the password derivation (from master to site-specific) configurably slow, to avoid an efficient dictionary attack (an evil site could "try" potential master passwords, to see if it gets the one you used). A "slow hash" is a hash with many iterations. You may also add a salt: a piece of data which is not secret, but yet chosen randomly so that two distinct users of your master-to-site-password software do not end up with the same site password if they happen to use the master password. Salts can be stored in a file (they are not secret) but this would prevent you from rebuilding all your site-specific passwords from your knowledge of the master password alone (i.e. to the problem of remembering, you are adding the problem of data backup).

This is very similar to the question of storing server-side password hashes (for which the usual solutions are bcrypt and PBKDF2). The problem is made easier by the master password being "master". Since you have to remember only one password, you may as well make it a big, fat, random, high-entropy password. Generate a sequence of 17 random lowercase letters, learn it, and you will be fine (because 2617 is about 280, and invoking 280 times a hash function is beyond what is feasible with current technology). An all-lowercase letter password is easy to type, especially on smartphones.

Others have given pointers to existing software which does just that.

Your idea of using a RSA key and encrypted random passwords also works. However, it means storage. If you are traveling and someone steals your laptop (an unfortunate but alas not utterly implausible event), then not only are you deprived from your machine, but you also lost your passwords, until you buy a new machine and retrieve your backup of the encrypted file full of passwords. This can be inconvenient. Deriving the passwords deterministically from the master password means that you will not lose them while you remember the master password.

Also, any new password (for a new site) requires fiddling with the file and its backups, there again something which might be difficult while traveling.

Using an intermediary storage allows for password renewal, but why would you do that anyway ? Password renewal is useful when you manage a big organization with hundreds of passwords and you assume that some passwords will be weak, and some will be broken. It is a way of containing damage and makes sense only if there is a non-zero proportion of broken passwords at all times. Password renewal is a field army thing. It does not scale down: when you get down to a single master password (your case), that password is either fully not broken or fully broken. In the former case, there is no need to renew the master password; in the latter, you have more urgent issues to deal with, including changing all your previous site-specific passwords.

To state it briefly: if your master password needs renewal, then it was broken; which means then all your site passwords are toast. Thus, master password renewal without changing the site passwords is useless.


Key generation: Differences between GnuPG classic, stable, modern? I plan to create a 4096 bit RSA&RSA key pair:

gpg --gen-key --personal-digest-preferences SHA512 --cert-digest-algo SHA512

Is there any difference in generated key quality between versions 1.4 (classic), 2.0 (stable), and 2.1 (modern)?

Background: I consider creating the key on a cleanly booted Debian stable live system, and that comes with GnuPG version 1.4.12.

Different versions of GnuPG

All versions of GnuPG mentioned are (as of 2015) still maintained and updated. Differences are mainly of architectural kind; classic (1.4) is proposed to be used within for server and embedded platforms (from man gpg2), while stable and modern are recommended for desktop use (having more dependencies, but being more modular and flexible). GnuPG 2.1 heavily relies on the gpg-agent for all operations requiring the secret key, which delegates the most risky operations to a much smaller piece of software with less exposure to vulnerabilities.

Keys created with all of those versions are equally secure, and can be arbitrarily interchanged with the other versions (by importing/exporting). There are no known vulnerabilities regarding key generation within all those versions.

GnuPG 1.4.12 (Seemingly) Outdated

Also, while 1.4.12 is seemingly outdated as 1.4.14 resolving critical issues is published, Debian backports relevant security patches to older versions to keep the packages stable. You might also have GnuPG 2 available (as gpg2, otherwise install using apt-get update && apt-get upgrade gnupg2). GnuPG 2.1 would require adding the experimental repositories (which might change in future, I'd guess for Debian 9). You can look up which GnuPG 2 version is available in which repository in Debian's package tracker.

Entropy with Live CDs

If you're using a live CD, be aware the entropy pool is reinitialized each time you're booting it. It might take slightly longer until the kernel decides having enough entropy for GnuPG, and key generation might take a little bit longer than usual (just longer, not less secure).


Drive-by downlad VS buffer and stack overflow attacks Today malware is mainly spread thanks to vulnerabilities exploited in browsers and their plugins. The attackers use JavaScript to target those vulnerabilities. Two examples of such attacks are drive-by download and buffer and stack overflow attacks. What is the difference between these 2 attacks ? They seem to be similar to me according to what I read by now.

"Drive-by-download" refers to the behaviour of the malware: it will (attempt to) infect the user during normal interaction with a web page.

Buffer and stack overflow, on the other hand, are two technics used to attack a vulnerable application. They are not limited to the web in any way. (any software that takes some form of input - i.e. all software - is potentially vulnerable).

So a malware might spread through drive-by-download by leveraging a stack overflow in a vulnerable component.


Which password policy is more secure: one password of length 9 vs. two passwords each of length 8? What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?

As John Deters has noted, 2x8 is almost certainly worse - but the reasons why take a little explaining.

There were a couple of problems with LANMAN hashes (the classic case of breaking a password in half, gone awry):

Since passwords tend to be human-generated and somewhat short, if a single password was only a little longer than the first half (say, 8 characters), then cracking the second half would take dramatically less time - and could even give away what the first half was likely to be
LANMAN was just so darned fast (for the attacker to attempt, in hash operations per second)
LANMAN cut the passwords in two at an unfortunate length (7), that was quite susceptible to full exhaustion (and even moreso on modern GPUs)

However, your question is a little different from the LANMAN case:

It does not state that the 2x8 passwords are actually a single password broken in half (they could be independently generated, and random)
It explicitly states that the two passwords are of length 8 (rather than, say, one of length 8 and the other of length 1, the famous LANMAN worst case)
Unless your salts are trivially small, building rainbow tables would be infeasible - which is the purpose of salting (unlike LANMAN hashes, which were entirely unsalted)

So it's an interesting question - one that's largely answered by looking at the associated math.

Let's make some assumptions:

Both the 9x1 and 8x2 approaches are salted and hashed using the same
salt lengths and algorithms
Worst case for the attacker - the passwords are randomly generated from the printable ASCII character set (95 chars), with reasonably long salts. (The question would be less interesting if the passwords were human-generated, because in practice they would usually fall to easy attacks long before the attacker would have to resort to brute force)
Modern hardware and speeds are fair game
The hash algorithm may or may not be parallelism-friendly

Given all of the above, I'd roughly expect:

The 1x9 hash would be 100% exhausted in 95^9 (6.302 × 10^17) hashing operations (which might be parallelized well or poorly).
The 2x8 hashes would be jointly 100% exhausted in (95^8)x2 (1.326 × 10^16) hashing operations (and no matter the algorithm, could easily be naively parallelized simply by cracking each hash on a different system - but can often be parallelized very efficiently on a single system as well, depending on the algorithm).

In other words:

That 9th character adds 95 times the work to exhaust, and might be hard to parallelize
Two 8-character passwords only doubles the amount of work needed, and can be trivially parallelized

Another way to think about it is that adding one more character roughly creates the same work as having to crack 95 eight-character passwords! (If this isn't intuitive, start with simple cases comparing smaller cases like 1x1 vs 1x2, until you understand it).

So all other things being equal, 1x9 should almost always be better than 2x8.

And really, this is not only a simple illustration of the power of parallelization, it should also make it obvious why allowing longer password lengths is so crucial. Each additional character in the model above adds 95 times work to the overall keyspace. So adding two characters adds 95^2 - or 9025 times - the work. Brute force quickly becomes infeasible, even for very fast and unsalted hashes.

This would make an excellent homework question. ;)


Does FTPS (FTP+S) offer better security than SFTP on the server side? I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers.

I suggested using SFTP because our application has good support for it. My interlocutor absolutely wants FTP+S (FTP+TLS) which we currently don't support and would need to develop.

I argued that I did not see any real benefit in FTP+S over SFTP since both offer solid traffic encryption. SFTP is readily available and can be made even more secure with public key authentification. Last but not least, its single connection mode makes it much nicer to use behind corporate firewalls.

The sysadmin almost called me an idiot, stating that SFTP works on top of SSH which is a protocol designed for administration purpose, and that opening a SSH port for any other use than administration is clearly a bad idea because it opens a broad attack vector against the host system.

I am wondering if this argument is valid. There seem to be various ways to restrict a SSH session to only allow SFTP file transfer. There is the internal-sftp subsystem that comes with openSSH, where you can easily set up a chroot and disable TCP forwarding. I even heard about solutions that presumably allow users to connect via SFTP without requiring an entry in the passwd file... I do not see any clear problem with SFTP that you would not have with FTP+S, but I could be missing something?

So, despite of the restrictions that you can apply to SSH, is FTP+S a better option for file transfers, security wise?

From the security they provide in theory FTPS and SFTP are similar.
In practice you have the following advantages and disadvantages:

With FTPS client applications often fail to validate the certificates properly, which effectively means man in the middle is possible. With SFTP instead users simply skip information about the host key and accept anything, so the result is the same.
But users and admins with more knowledge could make use of SSH keys properly and use these also for authentication which then makes SFTP much easier to use compared to using passwords. And if passwords are forbidden at all then this is also more secure because brute force password attacks are no longer possible.
FTP uses dynamic ports for data connections and information about these ports is transferred in-band. This makes already plain FTP (without TLS) a nightmare when firewalls, NAT or similar is involved. With FTPS (FTP+TLS) this gets even worse because due to the encryption of the control connection helper applications on the firewall can no longer find out which ports need to be opened. This means that to pass FTPS you would need to open a wide range of ports which is bad for security(*). SFTP is much better because it uses only a single connection for control and data.
FTP(S) servers often provide anonymous access and SFTP servers usually don't. Several FTP(S) servers also offer pseudo users, i.e. users taken from same database or similar which are not real users on the system.  If you have proper users only anyway this does not matter.
SFTP uses the SSH protocol and you have to configure the system properly to only allow SFTP access and not also SSH (terminal) access or even SSH forwarding. With FTP this is easier because FTP can do only file transfer anyway.

(*) Several comments do not really believe that having a wide range of ports open is bad for security. Thus let me explain this in more detail:

FTP uses separate TCP connections for data transfer. Which ports are used for these connection are dynamic and information about these gets exchanged inside the control connection. A firewall which does not know which ports are in use currently can only allow a wide port range which maybe will be used sometimes FTP.
These ports need to allow access from outside to inside because in FTP passive mode the client connects to some dynamic port on the server (i.e. relevant for server side firewall) and for FTP active mode the server connects to some dynamic port on the client (relevant for client side firewall).
Having a wide range of ports open for unrestricted access from outside to inside is not what somebody usually considers a restrictive firewall which protects the inside. This is more similar to having a big hole in the door where a burglar might come into the house.
To work around this problem most firewalls employ "helpers" for FTP which look into the FTP control connection to figure out which ports need to be opened for the next data connection. One example is ip_conntrack_ftp for iptables. Unfortunately with FTPS the control connection is (usually) encrypted so these helpers are blind and cannot dynamically open the required ports. This means either FTP does not work or a wide range of ports need to be open all the time.


Servers for penetration testing I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest or similar things. I have heard that in order the payloads to work the target-victim should run its PC as server. I have tried to set up a server in to the same machine (through Virtualbox) and make it as target but it failed. So, do you know if there is a server or something similar to allow me practice (legally, against test systems)?

http://www.irongeek.com/i.php?page=security/wargames

WebGoat. WebGoat is a set of deliberately insecure Java server pages

http://www.hackthissite.org/

http://www.smashthestack.org/wargames

from their FAQ:

  The Smash the Stack Wargaming Network hosts several Wargames. A Wargame in our context can be described as an ethical hacking environment that supports the simulation of real world software vulnerability theories or concepts and allows for the legal execution of exploitation techniques. Software can be an Operating System, network protocol, or any userland application.

http://www.astalavista.com/page/wargames.html

http://www.governmentsecurity.org/forum/index.php?showtopic=15442

http://www.overthewire.org/wargames/

the list is long... some are up, some not...

Update 26 Feb 2011, i found a nice post from http://r00tsec.blogspot.com/2011/02/pentest-lab-vulnerable-servers.html . Some links might be broken. I copy from there:

Holynix
Similar to the de-ice Cd’s and pWnOS, holynix is an ubuntu server vmware image that was deliberately built to have security holes for the purposes of penetration testing. More of an obstacle course than a real world example.
http://pynstrom.net/index.php?page=holynix.php

WackoPicko
WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners found: http://cs.ucsb.edu/~adoupe/static/black-box-scanners-dimva2010.pdf
https://github.com/adamdoupe/WackoPicko

De-ICE PenTest LiveCDs
The PenTest LiveCDs are the creation of Thomas Wilhelm, who was transferred to a penetration test team at the company he worked for. Needing to learn as much about penetration testing as quickly as possible, Thomas began looking for both tools and targets. He found a number of tools, but no usable targets to practice against. Eventually, in an attempt to narrow the learning gap, Thomas created PenTest scenarios using LiveCDs.
http://de-ice.net/hackerpedia/index.php/De-ICE.net_PenTest_Disks

Metasploitable
Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql.
http://blog.metasploit.com/2010/05/introducing-metasploitable.html

Owaspbwa
Open Web Application Security Project (OWASP) Broken Web Applications Project, a collection of vulnerable web applications.
http://code.google.com/p/owaspbwa/

Web Security Dojo
A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo
http://www.mavensecurity.com/web_security_dojo/

Lampsecurity
LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach linux,apache,php,mysql security.
http://sourceforge.net/projects/lampsecurity/files/

Damn Vulnerable Web App (DVWA)
Damn Vulnerable Web App is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
www.dvwa.co.uk

Hacking-Lab
This is the Hacking-Lab LiveCD project. It is currently in beta stadium. The live-cd is a standardized client environment for solving our Hacking-Lab wargame challenges from remote.
http://www.hacking-lab.com/hl_livecd/

Moth
Moth is a VMware image with a set of vulnerable Web Applications and scripts, that you may use for:
http://www.bonsai-sec.com/en/research/moth.php

Damn Vulnerable Linux (DVL)
Damn Vulnerable Linux  is everything a good Linux distribution isn’t. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn’t built to run on your desktop – it’s a learning tool for security students.
http://www.damnvulnerablelinux.org

pWnOS
pWnOS is on a "VM Image", that creates a target on which to practice penetration testing; with the “end goal” is to get root. It was designed to practice using exploits, with multiple entry points
http://www.backtrack-linux.org/forums/backtrack-videos/2748-%5Bvideo%5D-attacking-pwnos.html
http://www.krash.in/bond00/pWnOS%20v1.0.zip

Virtual Hacking Lab
A mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats.
http://sourceforge.net/projects/virtualhacking/files/

Badstore
Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure.
http://www.badstore.net/

Katana
Katana is a portable multi-boot security suite which brings together many of today’s best security distributions and portable applications to run off a single Flash Drive. It includes distributions which focus on Pen-Testing, Auditing, Forensics, System Recovery, Network Analysis, and Malware Removal. Katana also comes with over 100 portable Windows applications; such as Wireshark, Metasploit, NMAP, Cain & Able, and many more.
www.hackfromacave.com/katana.html


Why shouldn't I run other applications on a Firewall? If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?

The only opened port to the world (wan port) would be SSH on a non-default port+pubkey auth only+restricted ip subnets where could people log on, etc..

I'm just not getting the true reasons why does it could affect the "security" of a Firewall if I have GUI on it.

p.s.: "GUI" is just needed because I want to use this machine as a "Movie player/connected to a projector" - that's all. - it would be expensive (power consuption) to use the pc as only a firewall, so I'm using it for playing videos too (not using webbrowser on it).

p.s.2: It would NAT the "internet" through an USB wifi dongle (wpa2/aes/64 char random pass.).

UPDATE:
so to clarify:
Why (or HOW Exactly) would an installed XFCE affect the e.g.: SSHD regarding security? (I'm saying that because that's the only server/having open port to the world/wan)

The codebase required to run a firewall is tiny.  E.g. stripped down Linux kernel, busybox, ssh and not much else.  I don't have numbers, but I'm guessing it is a tenth the size or less than any GUI movie-playing option you'd be likely to be happy with.  You can easily do GUI management of a firewall without putting a GUI on the firewall itself - just run the GUI elsewhere to design the ruleset and upload it to the firewall.  Or run a minimal web server and management software and use a browser as the GUI.

The larger codebase presents a larger attack surface.  E.g. a nasty attack on any of the packages used in the GUI could be used to get at the whole box.  Many of those attacks don't require an open port.  They could come via viruses in media files, trojans in any of the packages, etc.

In your case you may just not worry about such attacks, which certainly would be harder than a normal open port attack.  But the principle of limiting the attack surface applies for many reasons.

See also

ServerGUI - Community Ubuntu Documentation for more background and details.
Passive and active attacks via X11. Is Wayland any better?
Secure Linux Desktop


Sniffing WiFi with tcpdump on an iPad I have tcpdump installed on my iPad which is connected to WiFi (WPA2). How do I capture packets sent/received by other devices on same network?
UPD: iPad 1st gen, latest (5.1.x) iOS available.

In order to capture network traffic for other hosts you need to put your wireless device into monitor mode.

I would check out the following project on github - MonMob. If you update your question with some more specifics on your iOS/iPad and jailbreak information I will try to provide some more specific resources.


Storing email adress encrypted but deterministically As part of an application I am developing, I am required to store user email adresses on a cloud DB.
The email address is not required to be in plain text for the normal operation of the application.

So, to provide security, the email address is being encrypted and then stored in the database.
The email address in the encrypted form will be the primary means of identifying users (it is the primary key).

Given these facts, which of the following encryption methods makes sense if the database server is vulnerable to attacks.

Method 1:

Encrypted-Email-Address = Asymmetric Cipher(Pub-Key2,
               Asymmetric Cipher(Pub-Key1, Plain-text-Email-address))

No random padding will be used to allow for deterministic mapping between plain and cipher email addresses, hence encryption twice

OR

Method 2:

Encrypted-Email-Address = Symmetric Cipher(Key, Plain-text-Email-address)

Note that because decryption is not required for the normal operation, the private Keys in method 1 will be stored offline in the physical world. The encryption will need to be deterministic though because the email address is the primary key.

I did go through https://stackoverflow.com/questions/6980044/using-asymmetric-encryption-to-secure-passwords. But there the OP is looking to store a non primary key field, so I am unable to use it.

Are you aware of any better methodologies which solve this use case?

Email addresses are subject to enumeration. There are not so many email addresses. Any deterministic scheme which uses no secret (i.e. no key that a possible attacker knows of) will do nothing against that. I don't know what you suppose that the "double asymmetric encryption" with two public keys achieves; but I know that it does not fix that core problem. Public keys are public.

Symmetric encryption, with a key that the attacker does not have, can be deterministic and yet safe (if done properly) but this hardly applies to your situation, since while you don't need decryption, you do need to encrypt a lot, because the user's email address is what the user types in.

An additional problem with email addresses is that they are not always reproducible: users may employ different casings (case is not significant in the domain part, after the '@', but it may be significant in the local part), use variants (many people have 'login@domain.com' and 'firstname.lastname@domain.com' as valid addresses) and include "comments" (as in 'bob+emailForSpammers@domain.com') with a site-specific notion of what constitutes a "comment". As @Stephen suggests, it is better to simply allocate an ID to each user and use that ID as primary key.


Can someone perform DDoS on my VPS even if it is only accessible through SSH? Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the public. Am I right? It can only be accessed via SSH.

DDOS means Distributed Denial of Service. If no service is provided by your VPS then no service can be denied. If SSH is provided then SSH can be denied. This means a DDOS can actually work against your system too: if all the bandwidth is taken by the attack or your system is busy trying to process connection attempts to SSH then you will not be able to login anymore yourself, i.e. the service is denied for you.

Additionally your VPS shares the hardware with other VPS which all share the same bandwidth and CPU. Due to this if any of the other VPS gets attacked it might affect your VPS too.


How are alternative operating systems even possible to load on a mobile device? The whole idea of a signed boot image is to prevent replacing the boot image with something customized or malicious.  However, the entire process seems to be reliant on a single point of failure: the verification of the image signature. The boot loader will need to verify that the signed image has been signed by the private key which requires the public key to be stored... somewhere.

Maybe it is stored in a non-volatile memory chip (eg. ROM chip). Maybe it is stored in a super-secret sector in the built-in storage device. (What other alternatives are there?)

Isn't a ROM chip (truly read-only) the only way -- barring soldering a new chip in place -- to ensure the boot process cannot be altered?  If so, why aren't mobile devices concerned with maintaining a strong-hold on the boot image using these chips?  Is there some technical reason or is it more a cost/benefit reason?

Assuming device manufacturers want to maintain some flexibility to alter the boot process in the event bugs are discovered, how do they (try) to protect this read/write boot code and/or set of public keys?

For a trusted boot (or authenticated boot or secure boot or however you want to call it), you need a root of trust that's protected for integrity. It doesn't need to be a “super-secret” sector, it needs to be a “super-shielded” sector. ROM fits the bill.

In practice, device manufacturers like to put as little code as possible in the ROM, because they don't want to stop updating the code a few months before the device ships. So that code typically does nothing more than initialize a few core devices (e.g. put the MMU into shape), load the first few sectors from a storage medium, verify their cryptographic signature against a public key stored in ROM, and transfer execution to that code. If the signature doesn't match, the ROM code may allow the user to upload an alternate boot image (typically over USB).

That first non-ROM boot code is often considerably more complex than the ROM code: it usually needs to know how to manage memory, access various storage devices, perhaps read filesystems, have at least a rudimentary user interface and so on. So, in practice, all that code buggy, and that (or later in the boot chain) is how iPhones get jailbroken. Some manufacturers, such as Apple, are indeed deeply concerned with controlling the boot image; that doesn't mean they succeed against a determined community.

Furthermore, even if the signed boot image has held, the operating system itself is far too complex to withstand attacks for very long. Signing the whole OS is not practical as users of all but the most basic mobile phones and PDAs expect to be able to install their own applications (and OSes tend to have root holes). The OS can typically do pretty much what it wants, except that if it naively overwrites the boot image, the device won't boot. If you want to run a different operating system, you may be able to use the original OS as a jumping point from which you boot your real operating system.

Speed is another factor: verifying the authenticity of a 100kB bootloader is just a blip on a modern smartphone, but verifying the authenticity or the integrity of a multi-GB operating system is too slow to do at once. Incremental verification also slows down disk reads, and requires filesystem support that isn't widely available at this time.


How to completely prevent bufferoverflows in networking software? Is that possible to make software which is not vulnerable to any type of buffer overflow? For example, a software that receives data packets and transfers it to destination after data analysis.

It depends on what you call buffer overflow.

It is possible and easy to make software which never writes outside of a buffer. All it takes is a programming language which checks array bounds, e.g. Python, Java, C#, VB, Pascal, Ruby... in fact almost any language except C, C++, Forth and Assembly. In a language which checks array bounds, any attempt at overflowing a buffer triggers an error condition (e.g. an exception is thrown) which prevents the unwanted memory write.

It is difficult to make software which never attempts at writing outside a buffer. The bounds checking prevents the buffer from truly overflowing, but the code is still trying to do something which does not make sense, and that's a bug. Not allowing the write to happen is good, but the thread/process still crashes (it turns a remote shell exploit into a denial of service, which is better, but not good). Writing bug-free code is theoretically feasible, but it never happens in practice (the only application which is reputed truly bug-free is Knuth's Metafont).

There are a lot of people who work on the concept of proving correctness of code. In a rather strong sense (see the halting problem), it is not possible to make a generic correctness prover, but one can hope that a few hints added in the source code could help an automatic prover. This means using some specific languages which allow for this sort of things to happen (e.g. Esterel or Eiffel). As far as I know, a programmer who thinks a lot is still needed in the process. It has been said that NASA pays quite a lot for having software without bugs (I heard around 20000$ per line of code !) and yet this is not guaranteed (when Apollo 11 landed on the Moon, the on-board computer crashed, and Armstrong had to do the landing manually, in true Hollywood fashion).


Unknown manufacturer of services in windows system configuration I would like to ask if I can trust unknown manufacturer detected by windows system configuration.

As you can see in the screenshot, all of the other services is known manufacturer but there is one service that using asus name but their manufacturer is unknown.

And after that how do I analysis it to check if it is really a malware ?
doing static analysis ? dynamic analysis ?

That service is created by the ASUS PTP driver, which for Intel 7th and 8th CPU units/devices, is the official replacement of the "Smart Gesture" touch-pad driver.

For the new systems, it comes pre-installed and is update-able to the latest driver version by running the standard Windows Update.

The manufacturer tag will probably get and update and show correctly in future versions.

So if you use a 7th or 8th gen CPU it should be entirely legit. There's also no reason for a malware to name itself like that, as it would have a very limited coverage; a malware will most likely use a more universal name. Nothing prevents you though from running some anti-malware scans on your system.


How should I report a security vulnerability? I've found an SQL injection vulnerability in a website and I want to go reporting it. I do have contact email, but I'm afraid that they'll sue me because I found a way to hack into their site. (No, I didn't run any SQL commands).

So... aside from staying anonymous, how should I go about reporting this one?

Any domain has an abuse address. Try contacting them there. If you are uncertain of their reaction, use an "anonymous" mailing service through a VPN and/or proxy.


Preventing phishing of few critical websites Suppose $S$ is a set of known websites which are very important. Assume there is an anti-phishing tool company $A$ which is aware of such websites. Can the company A reliably develop an anti-phishing tool just to distinguish the websites of set $S$ from its complement $S'$? In other words is it possible for the anti-phishing tool to notify its users if the currently visited website is from set $S$ or set $S'$?

I think this problem is relatively easy as the anti-phishing tool has to distinguish between set $S$ of known websites from the complement set $S'$. Or can such anti-phishing tool can be fooled?

Another related question:
Assume that the number of websites over the internet remains same over the time (static) and anti-phishing tool company A knows the set of legitimate websites $S$ and illegitimate websites $S'$. Is it possible to prevent phishing by distinguishing the set $S$ from the set $S'$, for example by blacklisting the sites in $S'$ or by allowing connection only to sites in $S$?

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website.

One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$.

Unfortunately there is a problem with this: A phishing website only needs to be almost identical. Comparing data for exact equality is trivial for computer programs, but detecting almost equality  is a far more difficult problem. The tool would require a complex heuristic algorithm to rate the similarity of two website. Such algorithms could be gamed: It would be easy for the phisher make subtle changes which are invisible to the user but causes the program to mistake it for an unrelated website.

There is, however, also the opposite approach which is far easier: Notify the user when the website they visit is legitimate and do nothing on illegitimate websites. This is already built into most modern web browsers in form of certificate notification icons in the navigation bar. This mechanism requires https to be used, so it won't work when you regularly use the http version of said websites. Training users to only enter login credentials when they see the green lock-icon with the name of the website in the address bar (extended certificate) is very reasonable.

The browser plugin HTTPS Everywhere by the Electronic Frontier Foundation automatically redirects the user to the https version of many popular websites. It is highly recommendable for security-conscious internet users (and even more recommendable for those who are not).


How to obtain trusted certificates for use with OpenSSL in C (on a Mac)? I asked a more specific question yesterday on SO but haven't had any luck with responses. Basically I am trying to get OpenSSL wired up in low-level C with minimal dependencies. In that link I referenced some GitHub gist/repo examples of of OpenSSL C usage, but they are all incomplete.

What I'm stuck on right now is figuring out how to actually "secure" OpenSSL, haha. Surprising it doesn't default to being secure. So what I'm looking at code-wise is this:

if(! SSL_CTX_load_verify_locations(ctx, "/path/to/TrustStore.pem", NULL))
{
    / Handle failed load here /
}

The SSL_CTX_load_verify_locations function documentation doesn't explain exactly (a) where to get the "trusted certificate store" or whatever, and (b) if not getting it then how to generate one using the openssl CLI tool.

What am I supposed to do here? How do I actually get to "securing" the thing? It seems that I need to obtain these trusted certificates somehow. (This is for an HTTPS client, not a server. I just want to make HTTPS requests). Am I supposed to hunt them down somewhere? (I am on a Mac). Or am I supposed to generate them with the OpenSSL cli? Or can the parameter to SSL_CTX_load_verify_locations be null, and it just somehow picks it up from the source code somewhere automatically? Or is that what this is? (ssl_init(0,0), which goes to here, to here at if (SSL_CTX_use_certificate_file(ctx, certfile,  SSL_FILETYPE_PEM) != 1), essentially passing 0 to SSL_CTX_use_certificate_file, but then again SSL_CTX_use_certificate_file is a different method from SSL_CTX_load_verify_locations, so not sure if it's related).

Since OpenSSL traditionally cannot easily access the native trust store on Windows and Mac the common way for OpenSSL based applications on these platforms is to use the same set of trusted certificates as Firefox does, which also comes with its own trust store on all platforms and does not use the native one. This set can be downloaded at CA certificates extracted from Mozilla. It then gets set with SSL_CTX_load_verify_locations for the specific SSL context as you already figured out (SSL_CTX_use_certificate_file and related is for loading client certificates and not the  trust store).


Issuing and managing large numbers of certificates for client authentication I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a central server. While this works well for our small trials where I issue and install the certs manually, I have a few questions before preparing to scale up for production:

1) Is there any benefit to using a "real" CA to issue my server cert and generate my client certs for me? The few I've found that do this are pricey, and while I'm no security expert, if I'm installing the client certs on the devices themselves, having a 3rd party doesn't really seem to provide any added benefit,

2) Is there some standard piece of software on the server-end that can capably handle authenticating tens of thousands of devices using an equally large number of certs? Can I simply stick each client cert in /etc/ssl/certificates and expect nginx, haproxy or something similar to be able to handle that? (we deploy between 30-50k "things" per year)

If you want to keep your budget down, I would recommend you look into EJBCA which is open-source and free to use, though a lot of the fancy enterprise functionality is in their pay version. They make the following claims about throughput:

  Since EJBCA uses standard relational databases, suitable for large scale and high performance you can easily scale EJBCA to hundreds of millions issued certificates, and with some care even billions. Depending on the architecture and interfaces chosen you can reach very low latency (sub 100ms) and very high throughput (>100 certs/sec). [source]

Though independent testing has found that this drops off pretty quickly when you get above 1 million certs issued.

Addressing the second part of your question:

  Is there any benefit to using a "real" CA to issue my server cert and generate my client certs for me?

It really depends what you are using the certs for. I know that a lot of Internet of Things (IoT) manufacturing processes use client certificates to allow the devices to authenticate to the corporate network during manufacturing to do things like first-time config, firmware download, and other things that you want to do securely. At the end of manufacturing, those certs are destroyed / never used again. In the case it's perfectly ok to use a private internal CA that is hidden from the outside internet.

If, on the other hand, the certs you issue during fab will remain on the device into production and need to be publicly verifiable, then that's a different story. [For example, if you make lightbulbs, and you need users' iPhones to be able to verify that they are talking to an authentic IPBulb, Inc lightbulb, or the bulbs need to be able to authenticate to a IPBulb, Inc server to periodically retrieve updates.] In this case you will need to have a public-facing CA that does all the key-update and revocation status checking stuff. This gets complicated fast and it may be worth your while to partner with a commercial CA just to avoid the hassle.

EDIT: Pulling in the comments bellow to make the Answer self-contained.

My reason for advocating to outsource your certificate issuance is mainly due to server load and response times when you have to deal with revocation and certificate updates. For most small-medium companies, it's cheaper to outsource this to a specialist than to hire top-notch datacenter engineers.

Revocation: The tricky part is that the server that's verifying the certs needs to be able to ask the CA "is this cert still valid?" and get a response back very quickly (like < 25 ms). This is called the Online Certificate Status Protocol (OCSP). As your infrastructure grows, a single OCSP server won't be able to handle the traffic, so you now you need live database replication, and load-ballancers, and good datacenter engineers to keep the response times low. This is beyond the scope of most small-medium companies, and cheaper to outsource.

For certificate update / re-issue: There's no problem with the client dowloading its new/re-issued cert before the old one expires, but you have to have servers that are actively managing this, that have certificate management ports open to the public internet (potential attack surface / hacking point). Also, for ~30k certificates all expiring in a short time-period of each other, the server load will be huge. Again, how good are your company's datacenter engineers?


Vault 8: which consequences does the release have? It seems like Wikileaks have opted to release previously not released source code from vault 7 projects under the name vault 8.

Most vendors already assessed vault 7 and searched for possibly used exploits based on the already available information - and all vendors that did release press releases did say they fixed vulns - and Wikileaks themselves said they were holding back on sources until the vulns are patched.

What is the point of releasing (and reading) the sources when the vulnerabilities are probably already fixed?

Is it just for more detailed IoCs or is it likely to contain additional vulnerabilities and be reused like for example eternal blue?

Wikileaks especially says

  Digital certificates for the authentication of implants are generated
  by the CIA impersonating existing entities. The three examples
  included in the source code build a fake certificate for the
  anti-virus company Kaspersky Laboratory, Moscow pretending to be
  signed by Thawte Premium Server CA, Cape Town. In this way, if the
  target organization looks at the network traffic coming out of its
  network, it is likely to misattribute the CIA exfiltration of data to
  uninvolved entities whose identities have been impersonated.

Should that CA be considered untrustworthy now?

This shows exactly how much access the CIA had. Knowing something was vulnerable and knowing how it was vulnerable are different things.
The exploits may rely on assumptions that turn out to be false. I.e. to be useable the exploit might need access to something previously viewed not feasible - similar to Google having to encrypt its internal connections after the Snowden leaks.
This may show new approaches which may in turn be applicable to other software.
The vendors patching the software doesn't mean all clients have updated their running version.


Detect a server supporting SPDY? With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY?

My research lead me to believe only that the response header "X-Firefox-SPDY" can help. Is there another way?

The answer to your question would depend on the context in which you're interested.

If you're interested in detecting SPDY servers while browsing the web you'll first need a browser that supports SPDY (e.g. Firefox 11+ or Chrome). In this scenario the best way to detect SPDY is browser dependant.

For Chrome there are a couple of ways:

You can browse to chrome://net-internals/#spdy for a list of all currently open SPDY connections (because SPDY connections are persistent - every tab that contains a document from a server which supports SPDY should be present).
If you're interested only in the current tab you might examine the window.chrome.loadTimes().wasFetchedViaSpdy DOM property.

For Firefox, the only way I'm aware of is to look for the presence of X-Firefox-Spdy response header. Do note that for this to work, you must enable SPDY support (it is on by default as of Firefox 13, otherwise - set network.http.spdy.enabled to true.

All this depends on using a SPDY enabled browser, and manually checking servers. If you'll want to automate this, use a browser that doesn't support SPDY, or just plainly skip the browser - you'll need another strategy. As I see you have two options in this case:

SPDY servers can be configured to advertise their support of SPDY when sending HTTP responses. This would require you to inspect the presence of the appropriate Alternative-Protocol headers (outlined in the SPDY draft).
Simply establish a TCP connection to the server an send it a SETTIGNS (HELLO) or a SYN_STREAM frame and see if it responds according to the SPDY protocol.


How to sniff email with https on Windows? I am working now on Windows 7 and I want to see if I can sniff an email content on it with Wireshark.  So all right with http but with https I can't at this moment and I don't understand how.  You think I need Kali Linux? Or I need something to do to realize it on Windows

The HTTPS traffic is encrypted, you can trick a computer into not using HTTPS but for this you'll need to setup a man in the middle attack. Then use something like sslstrip to trick the client into not using HTTPS. Kali linux has all these tools build in, so that would be a good OS to start with.


Is CN/Hostname verification against SSL certificate required for non browser software using openssl & why? In presence of 'trust certificates' & other attributes .. how important is this?

Does OpenSSL implement it now & If not why does OpenSSL not implement?

This is between non browser client & server.

When you connect to a server and the server returns a valid certificate, then you "know" (subject to the vagaries of PKI) that you have connected to a "valid" server, whose identity is contained in the certificate. However, there is more than one SSL server on this planet. You still have to decide whether the server you contacted is the one you wanted to talk to. That's what the name check means.

This is the distinction between authentication (verifying who you are talking to) and authorization (deciding whether who you are talking to is indeed who you should be talking to). You need both. If you remove the name check then you must implement some other mechanism which allows your client to distinguish between the genuine server, and some other server with another name.


Website login desktop program instead of sharing passwords Brainstorming ways to share passwords without the users being able to see the passwords. In Windows we can watch/control when/what users do on corporate computers. There are some web services multiple users need access to that have shared credentials. Rather than continuing to share credentials for services where it is not practical for us to have multiple user/logins for a site, is there a desktop application that can be setup on Windows that can be used to populate login forms and login to websites without showing the passwords with the user?

Since we can easily monitor when/what users do on the corporate computers, the goal is to be able to setup a users desktop with buttons that log them into websites that have shared credentials. To know who logged in and when, we can review desktop session history. With shared usernames/passwords, we aren’t able to prevent users from logging into websites with shared credentials from personal computers and if the credentials are leaked, we don’t know who leaked it.

I’ve considered using:

Quickmacros and building custom task.
RoboForm and building custom task.
KeePassX with some custom scripting.

Are there any other security tools/methods for handling this?

The easiest solution would be to refactor applications where possible, but if you cannot edit the source there are a few strategies:

"Middleman" password/account management solutions.

In this class of solutions, the actual password management is delegated to another service. The better solutions will be able to login to an application and change the password, then the password is changed by the application/service before each user logs in and is changed when the user logs out or time expires. In this way a password is produced for each individual and it has no value after the session because it has changed. If you want to research tools look for the class of "Privileged Identity Management" (PIM) tools.

Similar to a PIM solution, is a Privileged Access Management (PAM). Sometimes these tools are considered similar or a product may do both, but my definition of PAM is where the tool brokers the access for you. This article from Thycotic gives a brief look at terminology (warning from a Vendor)

Most of these services are designed for the OS level and are not always easy to configure with some type of cloud / SaaS service which has a workflow or 2FA.

Jump Box Solution

You may want to restrict access to authenticate to the service to a specific host. You then have strong authentication and logging on that host (maybe even record the screen). This may be sufficient for your needs depending on the apps and if you only need to do simple correlations to who was on the jump box to the application's logs. At the very least you can record all the activity. Some jumpbox+PAM solution may offer this through a web interface.

The weakness here is that you are not putting the control on the app, but at a lower level.

Proxy the authentication

If you are working with a popular cloud application, you may be able to find a CASB that you can put in front of your application and will enable the logging. The CASB may have the capability to do some form of PIM, pass a token, etc.

You may be able to setup some type of reverse proxy solution. OpenIAM describes such a setup for legacy applications - I have read about this before but we never got around to trying to implement it for a legacy application to which we had wanted to add SSO.

Note:

In your original post you talk about auto-filling forms. This still means the password could be intercepted or that two users could be authenticated at the same time if the web app does not prevent concurrent sessions. I would avoid anything that is like a end user password manager that just syncs the password files.

The ideal solution will make it so only one user can be on at a time and where an individual user either never sees the password of his version of the password becomes "one time" use.


How to prove a false positive I was notified by my university's infosec team that one of my lab's computers had been infected by ransomware.  They shut down the computer's network connections using Crowdstrike and are insisting that the hard drive needs to be reimaged.

The computer was only just put on the network on Friday, it runs Windows 7 Professional, Service Pack 1.  IT did not even have time to update Windows before the network connection was blocked on Monday morning.

The computer has been behaving as expected.  No erratic behavior has been noticed.

Infosec cited the computer's lsass.exe file as a concern (SHA256: 620638756a5ee6ea933a7a4c94e7dd2537e2a7345bbeff72d28271c0174d10a2)
They stated that this lsass.exe file is "associated" with mssecsvc.exe__ (SHA256:74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0)

Searching the computer's hard disk shows that there is an lsass.exe file.
There is no mssecsvc file.
Full scans with Norton antivirus show 0 threats (not even a tracking cookie)
The computer is expressly not used for web browsing or e-mail.  The network connection only exists to provide access to local network files.

Reimaging the computer is excessively expensive, as doing so requires full recalibration of attached lab equipment.  I'm convinced that this was a false positive.

My question is: Am I correct?  Is this computer infected?
Secondarily: How do I convince an infosec professional that they are wrong about a file being malware?

Thanks in advance!

Edit for additional requested information:

A screenshot of the following Crowdstrike message was shared:

lsass.exe
ASSOCIATED BEHAVIOR: High Severity Intel Detection
A hash matched a CrowdStrike Intelligence indicator that has previously been used in targeted attacks.
Associated IOC (SHA256 on file write): 74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0
FILE PATH: \Device\HarddiskVolume2\Windows\System32\lsass.exe
SHA256: 620638756a5ee6ea933a7a4c94e7dd2537e2a7345bbeff72d28271c0174d10a2
COMMAND LINE: C:\Windows\system32\lsass.exe
USER NAME: [redacted]
START / END TIME: Feb 5., 2018 08:33:03

The following link was then shared:
https://www.virustotal.com/en/file/74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0/analysis/74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0

There's actually a few red flags here that stand out to me.

The computer was only just put on the network on Friday, it runs Windows 7 Professional, Service Pack 1. IT did not even have time to update Windows before the network connection was blocked on Monday morning.

Reads: You attached a computer running an outdated, unpatched version of Windows to a university network. It has no immune system and you just exposed it to whatever pathogens are floating around on the network-- and given it's a university, there will be many.

The computer has been behaving as expected. No erratic behavior has been noticed.

Reads: The ransomware is doing its job as designed. You're not supposed to notice anything erratic.

Infosec cited the computer's lsass.exe file as a concern (SHA256: 620638756a5ee6ea933a7a4c94e7dd2537e2a7345bbeff72d28271c0174d10a2) They stated that this lsass.exe file is "associated" with mssecsvc.exe__ (SHA256:74d72f5f488bd3c2e28322c8997d44ac61ee3ccc49b7c42220472633af95c0c0)
Searching the computer's hard disk shows that there is an lsass.exe file. There is no mssecsvc file.

Malware can be dynamic in nature. Just because a compromised lsass.exe took advantage of mssecsvc in cases we know about doesn't mean it's not abusing some other executable in your case.
Obviously you have lsass.exe on your box; all Windows computers do. They're telling you you're pwned because your lsass hash matches that of known compromised versions. Have you hashed your copy of it to verify or disavow their claim?

Full scans with Norton antivirus show 0 threats (not even a tracking cookie)

Reads: Your local AV is possibly compromised.

The computer is expressly not used for web browsing or e-mail. The network connection only exists to provide access to local network files.

A lot of ransomware explicitly uses local network shares to spread itself once it worms its way into your network. That is not a substitute for protection.
Unfortunately this may not be a false positive. I understand the stakes but try to work with them to remediate this situation.  Even if you are in the right, it's likely they saw you had an unpatched, exploitable version of lsass on your machine based on the hash, which has been previously leveraged in other attacks. You might see if they'd be willing to give you DMZ internet access so you can get it patched, update your AV signatures and see if they'd re-evaluate your machine.


Secure browser storage Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not?

Thinking was along the lines of web history, bookmarks, built in password manager & cache.

Edit:

Secure: HttpOnly Cookie as below is an option, but unless a User uses an addon (firebug), they cant easily access the data although access is technically possible.

Insecure: Web history doesn't appear to be a valid store as JavaScript has access to it.

Unsure: Browser bookmark

Clarification on use case:

User registers for a web app (Username, Password), server only stores username & resulting passphrase encoded key.
User redirected to a confirmation page, with their resulting passphrase encoded key. (Secure storage applies here.)
User logs in with their Username, Password & Passphrase encoded key. Password decodes key which is used for encryption.

Assumptions:

Password is hardended using a password strengthing algorithm into a passphrase.
Storage should be optional and use should have a way to opt in/out. (Using Bookmark, this could be as simple as click here to bookmark the passphrase.)
No server side logging on the login & confirmation pages. (Caching will be disabled)
All communication over SSL/TLS

The only thing that fits your requirements is HttpOnly cookies. They can be normally exchanged in the HTTP headers, can be easily accessed by the user (you know, being client-side), but it is enforced by all major browsers that these cookies cannot be accessed by normal JavaScript running in the page (for example, document.cookie).

A closer look at your question shows that you already understand that if something is in the browser, it will be accessed by the user and there's nothing you can do about it. In the case of HttpOnly cookies, the browser itself regulates access to them and it imposes strict security rules preventing normal JavaScript code from accessing them. Addons and plugins have normal unregulated access to these cookies because they run on a higher "security clearance level".


Could my computer have downloaded some sort of virus or malware after clicking this button? I went to the website: katsokos.com, and was shown this page:

I stupidly clicked on the verification button and was redirected to the chrome store page for some chrome plugin, as well as the website page itself redirecting to something else. Could this have infected my computer somehow?

Short answer yes it could (doesn't mean it did).  I haven't taken the time to investigate the webpage or the button etc but as it apparently did what it said it would do on the page I wouldn't be too worried.

To learn more you could use a clean virtual machine (that is fully patched) and go poke around and see what it tries to do.  If you don't want to do that at least run a virus scan.


How does Firefox encrypt passwords without selecting Master Password? I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db file is used also if I didn't select Master Password?

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64:

if (token.needsUserInit) {
  this.log("Initializing key3.db with default blank password.");
  token.initPassword("");
}

Additionally, based on the import method in toolkit/components/passwordmgr/LoginImport.jsm on line 68, the encrypted passwords are imported into logins.json from key3.db without modification. Therefore, they will be using the same default password.