What is the potential impact of the alleged OpenBSD IPSEC attack? Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have.

For instance, does this mean that, since encryption on this layer may be compromised, we have vulnerabilities on various platforms of internet technology (for example, SSL)?

What does a working back-door here permit in terms of Eve and Mallory attacks?

I think the biggest impacts will be on the public relations side.

On the plus side (from OpenBSD maintainers point of view), the idea that the FBI deemed OpenBSD important enough, back in 2000, to warrant money-backed insertion of backdoors, is a sure ego inflater. This alone could be a motive for public allegations of backdoors, whether they exist or not. Also, the apparent immediate and full disclosure is a nice PR job.

On the minus side, OpenBSD communication has long been about how much more secure OpenBSD was than any other system, thanks to proactive security auditing and numerous internal code reviews. Finding a ten-year old backdoor right in the middle of cryptographic network code would kind of deflate the myth a bit.

Now, on the technical side...

There are many ways a subtle alteration of the code could constitute a "backdoor". If I were to implement a backdoor myself, I would try to rig the pseudo-random number generator. It is relatively easy to make a PRNG look like it produces cryptographic-quality output, but with, in reality, low internal entropy (e.g. 40 bits). This would make IPsec-protected communications vulnerable to decryption with common hardware and a passive-only attacker (thus undetectable). Also, a flawed PRNG can be attributed to incompetence (because making a bad PRNG is easy, but making a good one is not), opening the road to plausible deniability.

Another backdooring method is data leakage. For instance, whenever you have some random bits in some network packet, you can arrange for these bits to actually contain data about the internal system state. A good backdoor can thus leak secret encryption keys, to be picked up by anybody aware of the existence of the leakage.

Potential buffer overflows are crude backdoors, since they can be exploited only by active attackers, which is risky. Spy agencies usually abhor risks. If such bugs are found in OpenBSD code, I think it is safe to state that they are "true" bugs, not malicious holes.


How fast can a MD5 collision be found If I have a salt of 16bytes and 16bytes of data, how fast can one find another 16bytes of data so that MD5(salt + data) == MD5(salt + other data)?

I don't expect an answer accurate to the nanosecond, just an estimation like "a few seconds", "a few hours", "a few civilizations".

What you want is not a collision but a second preimage.

A collision is: find two distinct messages m and m' which hash to the same value.

A second preimage is: given a message m, find a distinct message m' such that both messages hash to the same value.

Second preimages are harder because the attacker does not get to choose both messages at will. MD5 is very broken against collisions (collisions can be generated in less than a second) but not against second preimages. For that, the best known attack is a generic preimage attack which is theoretical only, since it has cost 2123.4, i.e. much higher that what can be done in practice.

So the raw answer to your specific question is: it cannot be done (with existing technology and known attacks on MD5).

(I am here talking only about finding a second preimage on MD5, not about the security of using MD5(salt + data) in any specific context, whether 'salt' and 'data' are known or not. I suspect that anybody who uses MD5(salt + data) actually wants either a password hashing function, or HMAC.)


Is there any security risk allowing regular Linux users to run arbitrary code? I'd like to allow untrusted users to run arbitrary Node apps. If I use iptables to block everything except trusted servers, make each user's home folder only visible to them, and use runuser to start their server, is there any risk of them accessing each others' data?

Basically I'll just create a new user for the instance, copy the app into the home directory, chown/chmod it, and then do:

runuser -l their-user-name -c /usr/local/bin/node /users/their-user-name/server.js

I realize they can swamp the memory/cpu/io. And obviously they can chmod their own data open, but that aside... is there any security risk that I'm missing?

My plan is to use iptables to let each specific user open a server on a one specific port, which can only receive incoming connections from my nginx server. And then allow outgoing connections to a trusted database server.

There is always some risk and in this case if the system isn't hardened internally it might be trivial for a "user in the know" or a bad actor to access other users data in a matter of minutes if not seconds.

In this case you still have all the local privilege escalation issues and local security hardening issues which could allow local users to become root or run things as root or simply give them full access to the other users data. In many ways this is much harder to secure than trying to secure a system from the outside. That said it's not that you cannot add a lot of security controls to protect yourself from the users or that it can't be done but it requires much more work.

It may be wise to look into setting up a chrooted environment keeping in mind that you still need to harden the system from insider attacks. Likewise it would be wise to send all of your logs off to a remote system on the off chance a user does escalate privileges it will be harder for them to hide this.

Keep in mind there may be easier ways to solve your end goal and that sometimes it's worth taking a step back to look at where all the security trade-offs are and what you are actually trying to accomplish.

The following Linux Security Hardening guides may be helpful. You may also want to run a tool similar to Nessus to look at your local risks.

CIS Security Benchmarks
http://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.os.linux

NSA Operating systems security configuration guides
https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml#linux2

NIST sp800-123 Guide to General Server Security
http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf

Matt Brock Security Hardening on Ubuntu Server 14.04
http://blog.mattbrock.co.uk/hardening-the-security-on-ubuntu-server-14-04/

Hardening IPTables config with limit rates
https://petermolnar.eu/linux-tech-coding/hardening-iptables-config-with-limit-rates/

Linux Server hardening security tips
http://www.tecmint.com/linux-server-hardening-security-tips/

Hardening your TCP/IP Stack against SYN Floods
https://www.ndchost.com/wiki/server-administration/hardening-tcpip-syn-flood

IBM guide to hardening Linux
http://www.ibm.com/developerworks/linux/tutorials/l-harden-server/index.html


Digital signature without exposing the private key If the private key is used in the server for digital signature, once the server is hacked, the private key may be leaked. Is there a way to create a digital signature without exposing the private key?

The solution is to use cryptographic hardware like Hardware Security Module (HSM) or personal device is Cryptographic USB Token or Smartcard.  These devices store private key securely on board. Private key never comes out of the device but hash or content to be signed goes in the device and device provides (PKCS11) API to do the cryptographic operations using the key.


What's the minimal way of sharing your public PGP key in email signature? What's the minimal (not the entire public key) and secure enough way of sharing your PGP key in an email signature?

If you have your publick key on key servers you can only share fingerprint, a link for download your public key is good if you haven't key on key servers or even when you have on key servers because maybe not all people use same key servers.

I use fingerprint and also I have a link to my public key on my blog.

gpg --recv-key B76036EDCAF1C2806B54F51F134C62027E67BBA2

Maybe also you can use key ID and it's possible search on key servers by email and check ID, but it's better to use fingerprint.


XSS on an input element with style="display: none" Suppose only user-supplied double quotes are allowed in an input tag which has the style attribute set to display: none.

Something like this:

<input type="text" style="display: none;" value="aa" autofocus/onfocus="prompt(1)">

Since the injection point is behind the style attribute, is it still possible to get XSS by triggering an event handler?

You can always use the same approach which may be used for hidden input, but this requires quite a bit of social engineering as it's difficult to trigger.

You can however use a different event attribute which may be easier to trigger. oninvalid comes to mind as it doesn't require the element to be shown:

<form>
<input type="text" style="display: none;" value="aa" oninvalid="alert(1)" pattern="b">
<input type="submit" value="Submit">
</form>


Is it possible to decrypt a PGP encrypted file without private key? I had been using my own PGP key (RSA/1024) for more than 15 years. That key is my identify on the Internet for a long time, and also be used for encrypting a huge data.

Recently, my colleagues told me: "You should create a 2048-bit to getting better encryption, or 4096-bit to getting the best". I found no document that points the 4096-bit is better than 1024-bit, for a private PGP key. Am I wrong?

My private has no expiration time, and I don't want to switch the a new one if there is no security problem with the old. On the other hand, I always keep my private key in a safe place with a safe password. Is is possible to decrypt my data without my private key?

While it's recommended to use a key larger than 1024 bits, you could replace your encryption subkey with a larger one, keeping the same signing key (and by extent GPG identity). GPG keypair effectively consists of multiple separate keys (all signed with the same certification key, C in usage).

Note that this will make all data encrypted for the old key inaccessible. You could re-encrypt the data or keep the old encryption key around.

Here's an example of replacing a 2048-bit encryption subkey with 4096-bit key.

$ gpg --edit-key test@example.com
gpg> key 1

sec  rsa2048/10627915E34373B1
     created: 2019-12-27  expires: 2021-12-26  usage: SC
     trust: ultimate      validity: ultimate
ssb* rsa2048/520DD5D5DC5F1214
     created: 2019-12-27  expires: 2021-12-26  usage: E
[ultimate] (1). Test Test <test@example.com>

gpg> addkey
[snip]
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
[snip]
sec  rsa2048/10627915E34373B1
     created: 2019-12-27  expires: 2021-12-26  usage: SC
     trust: ultimate      validity: ultimate
ssb* rsa2048/520DD5D5DC5F1214
     created: 2019-12-27  expires: 2021-12-26  usage: E
ssb  rsa4096/29F957A70823378C
     created: 2019-12-27  expires: 2020-12-26  usage: E
[ultimate] (1). Test Test <test@example.com>

gpg> delkey
Do you really want to delete this key? (y/N) y

sec  rsa2048/10627915E34373B1
     created: 2019-12-27  expires: 2021-12-26  usage: SC
     trust: ultimate      validity: ultimate
ssb  rsa4096/29F957A70823378C
     created: 2019-12-27  expires: 2020-12-26  usage: E
[ultimate] (1). Test Test <test@example.com>


what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))? I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).

I have the salt and hash.

the password contains the symbols - a-zA-z0-9 the, length is of 7-8 charcters.

I'm going to run it on a windows platform (would like to use a freeware)

if you're asking why I'm doing it, I'm an owner of a big forum, a friend of mine changed his password for several accounts (mail, facebook, few forums\sites), he had forgotten his new password (he can't login to neither of the services), he's sure that he used the same password for all services (just copied\pasted).. and he's locked out (he can't do anything about it - for sure).

Thanks!

I do not have exactly the software you want. However:

You can use any existing MD5 implementation and write the code which invokes it twice for all the potential passwords. See for instance sphlib; on my PC (Core2 x86, 2.4 GHz), this code should be able to evaluate more than 6 millions MD5 hashes per second, so that's 3 millions per second passwords with your double-hash scheme. That's per core: my PC is a quad-core, so the full machine could go up to 12 million passwords per second.
Most x86 processors offer SSE2 opcodes: instructions which can compute four 32-bit operations simultaneously. By using the C compiler intrinsics (supported by Visual C, the Intel C compiler, and GCC), you can use them without getting your hands into hand-written assembly. Using these opcodes, you can compute four MD5 instances in parallel. I estimate that my PC should be able to try out 30 millions of passwords per second with such an implementation (I have tried with SHA-1, which is similar to MD5).
With a 9800 GTX+ Nvidia GPU, you should be able to try up to 100 millions of passwords per second (there again, an estimate -- I can do 160 millions SHA-1 per second on that machine, so 200 millions of MD5 is a reasonable figure). This is not a top-of-the-line GPU (I bought it in January 2009); with a more recent card, 500 millions of passwords per second are achievable.

With 500 millions of passwords per second, you could explore the whole space of passwords up to 8 characters (in the alphanumeric range that you quote) in about one week. That's doable.
It is also an interesting programming exercise.


Can 4 single quotes still be escaped producing a sql injection on sql server? I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't read this language and I'm not able to access the code in any way.

To illustrate the issue I added an example of a non harmful statement, the bold part is what the user can directly input

  SELECT '1
  ' SELECT 2--';

The single quote after 1 is causing the breakout in this scenario. This is what I've shown to the team.

They then did a detection in code that searches for single quotes and add three other single quotes after each single quote they find.
Thus the example would become this

  SELECT '1'''' SELECT 2--';

I don't like this solution at all, but I can't find a way to breakout any more.
The fields inside the database are stored treated as nvarchar characters. Is there still a possibility to bypass this practice in any kind?

the code is so old that they claim they can't use parameters to communicate with ms SQL server

That's a lousy excuse. It's like saying "your car is so old, we can't build in seatbelts". They might have to redo a lot of work with more modern techniques, but it can be done.

The fix they applied is escaping, which is a correct solution (second best to parameterised queries). To escape an apostrophe (or 'single quote') in MSSQL, you can prefix it with another apostrophe. Why did the developers add two more? The only explanation I can think of, is that the output is interpreted as SQL again, but honestly I don't know and it should create bugs if nothing else.

As for how to break out of it, that part of your question seems to be a duplicate of this one (though yours is specific for MSSQL):

How to defeat doubling up apostrophes to create SQLi attack?

The answer is basically:

  [...] you may be able to force various SQL databases to translate unicode to the local charset. For example, Ā could be converted to A. Even worse: U+02BC, or ʼ would be translated as ', which is U+0027. This is called Unicode-based Smuggling.


How to prove Bob has received Alice message I have read up on Digital signature and it is stated that it provides non-repudation.

Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to verify the signature hence Alice cannot deny sending the message.  This only proves that Alice is the sender of the message.

How can Alice have proof that Bob has received the message sent from Alice?

TL;DR Anyone can send a message and say it is from Alice if it is not signed; there is no way for Alice to prove that she didn't send those unsigned messages. However, Alice can prove she sent a message by signing it with a private key. Similarly, anyone can say Bob read a message, and Bob can't prove he didn't. But Bob can prove he read a message by signing it with his private key.

A small side point, I'm going to make a distinction here between having received and read a message. I can send an email to your mail server, (and the network will confirm that it was sent), but if your server is ignoring all incoming data, even though the network says it was received by your firewall, it doesn't mean the mail server actually read the message or has access to it in any way.

In good cryptography, it's assumed everyone can receive the message, but only the indented recipient can read it. Even though Alice here isn't actually encrypting specifically for Bob, we will assume that the message is posted in some public way that it guarantees that Bob could receive it if he wanted to, but encrypted so only Bob can read it (even though you might not technically encrypt it, just require Bob to log into Gmail with his username and password, but the same principle).

In such a case, there is no way for Bob to prove he hasn't received the message; after all, Bob could download (receive) the email from Alice from the mail server to his computer, but not actually open (read) it. If the message was encrypted, he could save the message and his private key to a non-networked computer and decrypt and read it there, burning the computer after he is done. No one could know if he successfully successfully decrypted and read the message or not.

However, at any time, Bob can prove that he has read the message by signing the decrypted message Alice sent, and sending back the signature. The only way he could have access to and sign the decrypted version (which would include having read the non-encrypted email from his Gmail account) was if he had read it.

Addendum: Ideally, Bob would sign the message with his own private key, but this isn't strictly necessary. As long as the message "encrypted" (or sent securely) in some way that only Bob can read it, the only one that could possibly have access to and sign the "decrypted" message is Bob*. If the message is not encrypted or sent securely, anyone could sign Alice's message with any key, claiming to be Bob that signed it.

* Technically, there is a second person who could sign the decrypted message: since Alice wrote the email to Bob, she has access to the unencrypted message and could sign it, claiming to be Bob. If she just wants to know if Bob read her message, this would be silly of her to do. However, if Alice wants to prove to the authorities that it was Bob that read her email, Bob would need to sign the decrypted message with his private key (which Alice would not have access to).


Can ECC be used without infringing on patents? Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?

I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned about patent infringement.

Are there open source ECC implementations which are patent-free?

The ECC implementation in OpenSSL has been contributed by Sun (now Oracle) and was, supposedly, written that way precisely to avoid any patented method. Otherwise, as AviD suggests, using an implementation which is already provided by the platform you use (Java, .NET...) is a neat way to avoid any patent trouble: if there was such trouble, it would first strike the platform provider (i.e. Oracle, Microsoft), not you.

To my knowledge (but I am not entitled, in any way, to give law-related advice), parts of ECC cryptography which may still be patented are:

implementation of curves over binary fields using normal bases;
point compression;
acceleration of Koblitz curves using the Frobenius endomorphism;
various optimization tricks on dedicated hardware architectures (FPGA, ASIC).

If you do not know what any of the above means, then do not worry, you are in the unpatented realm and things are fine.


XSS in custom, user-supplied CSS Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to improve it.
Basically, if the CSS contains some of these...

    "expression",
    "@import",
    "@charset",
    "javascript",
    "url(",
    "behavior",
    "data:",
    "http:",
    "https:",
    "//",
    "vbscript",
    "moz-binding",
    "\\"           //just one backslash (this one is escaped)

...the app declines it and asks user not to use any of these.
I also want to prevent them from inserting remote objects and stuff via data-URIs.

Would this be sufficient? Is it good approach or should I consider other options?

This approach does not seem ideal since it is common to find bypasses when it comes to blacklists.

There are some great resources out there such as "Scriptless Attacks – Stealing the Pie Without Touching the Sill" and LiveOverflow's recent video "The Curse of Cross-Origin Stylesheets" if you are interested in learning more on scriptless attacks that rely on CSS. These links might give you a better idea of what issues might arise as a result of user-supplied CSS.


Can installing Snort make me vulnerable? I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?

Any software you install on your machine that takes input from other machines you do not control makes you more vulnerable.

You must balance the additional risk you add by installing Snort against the costs of any treatment for that risk you might implement and the benefits of installing it.

We can't do that for you because we don't know your threat model or why you want to install Snort.


Https - why isn’t the initial connection encrypted / how to avoid initial suspicion? So with https, someone can still see what website I visited, but not which pages within that website I visited, correct?

why isn’t the whole process of connecting to a website - from when I start typing the website name on the browser - encrypted?

Is there a protocol/technology that actually provides encryption for that initial connection?
From what I understand a VPN can encrypt the websites I visit from the initial connection - but then someone can see that I logged onto a VPN and I’m back to square one, correct?
I’m trying to understand this from a layman’s POV : If I am trying to not rise my suspicion at all that I’m visiting websites I’m not allowed to - what is the process for that? I’m not talking about being secure after raising suspicion - more about avoiding initial suspicion.

You are confusing "confidentiality" with "anonymity". Encryption makes it so that the content of your communication cannot be known (confidentiality). But it does not hide who you are communicating with.
So, encryption is not the tool you need to use.
You are looking for some way for your traffic to be obscured. A VPN and Tor can do that, but then you say that you also want the fact that you are using an anonymising tool to be hidden. And that gets tricky since you need to rely on the Internet to pass your traffic to your destination. You have to expose your traffic to some degree.
That's when you use a proxy. And the best case is when the proxy is something innocuous, like a legitimate website that has a proxy backdoor. Then your traffic is going to this legitimate website, but it sends your traffic onwards to its final destination.


vulnerability scanning software I am working on a project to find vulnerabilities on desktop software. I would like to have a idea for tools I could use to scan the Firefox browser to find vulnerabilities in it, like buffer overflows, DoS, arbitrary code execution, etc. Either paid, or a free tool will be better that can do the job.

It's not that simple. You need to learn about fuzzing and debugging. There's no magic scanner that can find vulnerabilities. A good tool for fuzzing is Peach Fuzzer, but if you don't know about debugging, assembly, cpu registers, etc... you won't get very far.
A good book to get you started is "Hacking The Art of Exploitation"


Digitally signing a document with your public/private keypair without certificates? I have generated a private/public key pair using gpg.

Can I use this key pair to digitally sign a PDF without a digital certificate, but to still have the signature integrated into the PDF, instead of creating a separate signature file?

To clear things up, instead of using paper and written signatures, I want to use legally binding electronic documents, but am wondering if this can be done without resorting to certification by a CA or digital certificates altogether.

I understand that there is a difference between an electronic signature and a digital signature, but it seems to me that the EU law doesn't really recognize this difference.

Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures defines "electronic signature" as "data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication." The EU differentiates between an electronic signature and advanced electronic signature. However, it seems that electronic signatures still have legal strength:

  Member States shall ensure that an electronic signature is not denied legal effectiveness and admissibility as evidence in legal
  proceedings solely on the grounds that it is:

  in electronic form, or
  not based upon a qualified certificate, or
  not based upon a qualified certificate issued by an accredited certification-service-provider, or
  not created by a secure signature-creation device.

The first problem is that I'm not sure whether this means that a scan of a signed piece of paper has legal strength or if it refers to what I'm trying to accomplish. That is -- to sign a PDF with a private key with my name on it and attach my public key to it, but all within the PDF file.

Is latter even possible? Can I sign a PDF using my key pair without resorting to certification from CA? Would I need to create my own digital certificate or can it be done without certificates altogether? If I had to create a certificate, how would I create it using my existing key pair? You can create certificates using Microsoft Office, but it seems that this just generate another set of keys. You're never prompted to input your existing keys.

Furthermore, it seems to me that creating your own certificate could categorize you as a certificate-provider and thus subject to some stricter legal requirements, which is why I want to avoid certificates altogether.

You can generate your own certificate. The certificate is then used to digitally sign data, including signing a PDF. This type of certificate is a "self-signed" certificate.

Documents signed with a self-signed certificate are usually regarded with mistrust since there is no inherent trust relationship between the signer's certificate and the relying party (recipient).

Whether documents signed with a self-signed certificate are "legal" or not depends on the transaction, country, applicable laws and regulations.

DocuSign (my company) has an overview of the legal issues for eSignatures in each country.

Also remember that 99.99% of signed documents are never challenged in court. So the other way of looking at it is: if the recipient accepts the document signed in the way that you propose, then that's good enough.

Don't worry about being "catgorized as a certificate-provider" unless you start providing certificates to others.

Re: is a scan of a piece of paper that was wet-signed an electronic signature? Yes it is. That's called a "Basic Electronic Signature." It is fully legal in many jurisdictions for many types of transactions. It is also NOT legal in many jurisdictions for many types of transactions.


Could encoding messages into huge random-data balloons help frustrate/corrupt nosy intelligence/government activity? The Dutch government recently passed a new law: Sleepnet (EN: Dragnet) and got it through both parliament and senate mostly unchanged.

The Sleepnet-law allows government-entities like intelligence-agencies and law-enforcement to legally mass-intercept/-collect and -store ALL communications of entire populations (neighbourhoods/cities/country?), without the need for a specific target/suspect.

So to our government, we're now all, by default, regarded as suspects…

This inspired me to come up with an 'encryption scheme' that, in addition to hiding the contained message from unauthorized eyes, also attempts to exhaust all resources of any system that is required to make something like the Sleepnet law possible.

I'm thinking of hiding the encrypted message (e.g an email) inside a large (>100MB?) blob of random data, which is possibly itself encrypted again. So sending a 40KB encrypted email, becomes sending >100MB of bogus data, which possibly carries some encrypted message inside.

If such a scheme would be adopted by large numbers of people, any Sleepnet-like setup will quickly fall to its knees due to too much data and too few resources (storage/cpu). At least, that's what I'm hoping.

Would a scheme like this be feasible? Could it work at all? What would be required to make it work?

I'm aware of the impact such scheme would have on infrastructure, networks, ISP's and server-hosting companies, but please let's forget about that for now… Right now, I'm only interested in if it is possible at all and what is required technically to create something like this.

And of course, I'd also like to know of any already existing system that uses a similar approach.

EDIT

This idea is specifically not concerned with the gathering and correlating of metadata, which will not be affected by a strategy as described above. Also, in the Netherlands, ISP's and Telecom providers are already obliged to retain this metadata for (I believe) 3 years.

Sniffing all data as you envision they will do in a dragnet does not mean that there is a way to decrypt all data or that decrypting data is even needed to get useful information.

First, meta data already provide valuable information without the need to do decryption. Such meta data are for example who is the sender, who is the recipient, how many data get exchanged, how long do these party communicate, at which time, from which location, is the data encrypted etc. Connecting such meta data can for example be used to provide social graphs which are then used to find the most valuable targets who can then be attacked in a more targeted way.

Second, today's encryption algorithms can be considered fairly solid. It is currently expected that even secret services do not have the resources to decrypt properly encrypted data. This does not mean that this would be fully impossible in all cases but it just gets to expensive and even governments have limited time and money. It is far cheaper to compromise sender or recipient and thus gets direct access to the plain data. This might be done by exploiting some software bugs or even by silently breaking into the home and directly manipulating the hardware of the target or adding tiny cameras and microphones to listen and watch any communication.

Your proposal will not offer better protection against the attacks I've just described. It might in theory offer a better protection against some attacks which are kind of impossible already if existing encryption is properly used.


Securely storing username and password in conjunction with a mobile app The company I work for is building a mobile app that communicates with two APIs.

The first API is owned by us. Among other things, it manages OAuth2-style authorization and authentication.

The second API is not owned by us. It is a third party data source that only offers authorization via HTTPS Basic Auth headers. Every request to this API must include a username and password. The login credentials for the second API are different than the credentials for the first API.

We would like to store the users credentials for the second API so that the user need not re-enter their username and password every time they open our mobile app and make a request to the second API.

We've devised the following solution:

User opens our mobile app and authenticates with the first API (I am skipping the details of authentication with the first API because it is not relevant to the primary issue).
User enters their username and password for the second API.
Mobile app generates a PGP private key, public key and randomized passphrase for the private key.
The mobile app would then encrypt the username and password for the second API using the public key.
The mobile app uploads the private key, encrypted username and encrypted password to the first API. The first API stores those values on a users table.
The public key is discarded by the device. The passphrase for the private key is stored as securely as possible on the device (device keychain if available).
Any requests that were previously sent from the mobile app to the second API are now routed through the first API. The request will include the passphrase (stored only on the mobile device) so that the first API can use the private key to decrypt the username and password and send off the HTTP Basic Auth request to the second API.

In order to obtain the username and password in plain text, a hacker would need to compromise both the user's device (to get the passphrase) and our first API (to get the private key and encrypted login). Even if both the mobile device and our first API were compromised, the hacker would only get one password because each user generates their own PGP private key / passphrase combination.

This seems secure to us, but I wanted to make a post here to see if someone could point out any flaws or suggest improvements. We're curious if there's a way we can help protect against scenarios where the users mobile device is compromised. As it stands now, if the users device were compromised, the hacker would not learn the users password but they could use the private key passphrase to send off illegitimate requests and read sensitive data from the second API.

To my mind, the weak point here is that you are storing and decrypting user passwords to the second API on your platform.  If the endpoints of the first API are compromised, an attacker would gain access to both to the encrypted usernames/passwords, and any passphrase submitted by a user.

You've swapped the potential compromise of a single username/password on a device for the potential mass compromise of usernames and passwords on your platform.


wireless: Jamming or interference? I'm currently in a hotel trying to access the internet through the wireless offered by the hotel. WPA2-Personal network, password consisting of 16 numbers. Connecting to the wireless works fine, however the connection drops all the time, signal strength graph is here (I'm using the blue network). Ping gets replies about 3-9 consecutive times, then 1-2 times "request times out".

I'm not sure if somebody else is jamming (password known to all hotel guests) or if this is some kind of interference. Is there a way to detect (or refute) jamming ?

I suspect channel contention. It could be that a neighboring AP on the same frequency is transmitting or receiving large chunks of data on the same channel or channel group as the one your hotel AP is using. All I can suggest is using a different channel, which, as far as I know, is not an option if you don't control the AP. The AP you're using is probably set to the common default of channel 6, as are many other, possibly nearby APs.

There are 11 channels, each overlapping with adjacent channels by 5Mhz. According to Wikipedia, "There are 14 channels designated in the 2.4 GHz range spaced 5 MHz apart (with the exception of a 12 MHz spacing before Channel 14). As the protocol requires 25 MHz of channel separation, adjacent channels overlap and will interfere with each other. Consequently, using only channels 1, 6, 11 is recommended in the US to avoid interference."

The "jamming" you're seeing is probably unintentional, since radio transmissions by nature are RF interference to other devices on the same frequency, assuming those other devices are not "wanting" to receive that signal.

If you've got an ethernet cable, that might be better in this case.


Security code review recommendations I've been writing software for ~7 years and have been actively interested in security for ~2-3. This interest has been entirely self-motivated and primarily on the attack side; I've written several FOSS offensive security tools and taken deep dives in certain attack vectors like DNS rebinding. Because of this experience I've managed to land my first infosec job as an Application Security Engineer at a VPS/cloud compute company. One of my roles will be to conduct regular code reviews of all of the software we build. I'm no stranger to reading code, and making informal suggestions, but this will be my first time conducting systematic and formal reviews of other people's code on a regular basis. To be honest, I'm a bit intimidated. I have a passion for security that I've exercised on my own for years, but I've never been in charge of making high-risk authoritative recommendations on the subject, at least not at a code level.

Does anyone have any suggestions for ways to gain experience or comfortability with conducting security related code reviews? I've got two weeks before assuming the role and I'd love to get some experience with reviewing code and learning to recommend best practices before I appear at the company as some sort of authority figure. Any general advice, recommendations, or thoughts are much appreciated!

You could take OWASP ASVS as a baseline. It provides quite comprehensive coverage of software checks broken down into next categories:

Architecture
Authentication
Session Management
Access Control
Input validation and output encoding
Cryptography
Error Handling
Data Protection
Communications
Malicious Code
Business Logic Flaws
Files and Resources
Mobile
API
Configuration
Internet of Things

As you can see the field could be quite wide, so I'd recommend to build a threat model of reviewed application to prioritise your approach - basically, to review most critical parts first.

Going further, you can implement language-specific checks like those provided by CMU.


Prevent organization's code from being leaked or stolen I am wondering how I can control the organization's code from being leaked or stolen.

Currently we are using GitHub, in order to protect the code I am planing to use GitLab on a local server, so the code will be pulled and accessed only from the office.
My question is, even if I implement this, it will still be possible for the code to be leaked. If the the developer is using the machine in the office he/she can pull from the local server and send it somewhere from the machine he/she is using.

Is there anyway to solve this problem ?

Your developers will, by necessity, have access to the code. Implementing some system that, say, only allows them to edit code in a special application that doesn't allow copying into the system clipboard will annoy them, and they'll circumvent it, if only to be less annoyed.

The standard alternative approach is a legal one: employees sign contracts, and if there's a sniff that they've taken proprietary information elsewhere, your corporate lawyers get in contact and scare the pants off them. This will be cheaper and much more effective than a technical solution.


How can Microsoft Wi-Fi Sense share just the internet connection? According to the Wi‑Fi Sense FAQ

  When you share network access, your contacts get Internet access only.
  For example, if you share your home Wi-Fi network, your contacts won't
  have access to other computers, devices, or files stored on your home
  network. If you have a small business that has intranet sites, your
  contacts won’t be able to access them.

How does that work? Does the guest computer connect to the sharing computer directly?

MS Wi-Fi Sense is simply going to share your pre-shared key for your Wireless network with the contacts that you have stored (Outlook, Facebook, and Bing I think?) so that your (presumed) friend can use your network without having to manually tell them the pre-shared key.

Now - the reason Microsoft states that your guest won't be able to access other computers, devices, or files store on your home network is because Network Discovery is turned off by default once someone connects to your network using Wi-Fi Sense. So, it would be more difficult, but certainly not impossible or even that challenging for someone with average skill level to see other computers and devices on your network once they are connected up.

And also, no, the guest computer does not connect directly to the computer. It's going to connect to your wireless router just like normal.

Hope this helps.


How to implement a digital signature for 21 CFR Part 11 for non repudiation I would like to know what is the best way to implement a digital signature to achive Non-Repudation to acomplish 21-CFR-Part11-SubpartC-11.100.part-c. Anybody has implemented this for 21 CFR 11?

Non repudiation means that if a users sign the document. For him is impossible to say that he didn't sign that document. It should be equivalent to handwritten signature. see-here-for-more-info

Note that the problem is more of a legal than technical/implementation issue. Your links above to the FDA regulations and the other stackoverflow question How to achieve non-repudiation? emphasizes the legal aspect of it as well.

That means you will need to ensure compliance to laws of each country (e.g. ESIGN Act in the US). What is interesting about ESIGN is that it preserves the right of a person to NOT use electronic signatures. Might I suggest using a service such as https://www.docusign.com/ instead - see its section on legality.


How secure is Windows 8 email authentication? I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email based authentication?

Using the stolen laptop scenario; if you don't use whole disc encryption then all your data belongs to the thief.  All of it.  So what account you use is of little significance.  Keep in mind, however, that if you connect your OS credentials with your email credentials then you're exposing a wider attack surface by which a bad guy can get them.  Remember that email itself has no default assurance of security.  Different systems implement email security in different ways and with varying degrees of success, but email itself isn't something you can really put a whole lot of trust in.

Advantages:

convenience of single sign on

Disadvantages:

OS security bound to a non-secure system with non secure protocols.
Common credential gives total access
Windows :-P

If you have whole disc encryption enabled then you're better off but I would not trust any security features to email integration.  Yes it is convenient, but so is leaving the keys in the ignition.


Exploiting the delay when a festival ticket is scanned How a ticket system works
A ticket system - one you see at festivals - works like this: when a user pays for their ticket, a row is added to the database with a column named is_scanned, whose default value is set to false.
As soon as a guard at the festival scans the barcode (containing an ID, and unique hash) with their device, a request is sent to the database to check if:

the user matching the ID and hash has paid, and
if the value of column is_scanned is still set to false.

If both conditions are satisfied, it sets the value is_scanned to true, to prevent someone else copying the ticket/barcode from getting in.
The vulnerability problem
The problem here is the time between the request being sent by the scanning device, and the value is_scanned being toggled from false to true.
Consider this scenario: Alice has a valid ticket which she paid for, but then she lets Eve copy her barcode and changes the visible name on the false ticket from Alice to Eve. So now we have two tickets. One valid and one fraudulent, but both have the same barcode, the only difference is the name.
What if the ticket from Alice and Eve gets scanned at exactly the same time when they enter the festival? The ticket system wouldn't toggle is_scanned to true in time to make sure Eve couldn't enter with the same barcode as Alice. This results in both tickets (the valid and fraudulent) being shown as "valid" to the guards.
Possible solutions
Of course, this kind of exploit really depends on a lot of luck, and while it's possible in theory...in a real scenario, this would probably fail.
However, how can we defeat this kind of exploit also in theory?
Identification
I've already taken this exploit into account using the following method: When a barcode is scanned, I display not only if the ticket is valid (satisfies the conditions stated earlier), but also the name in the database. If the name doesn't match the one on the ticket, we know the ticket is manipulated in some way. Also, if the name which comes up on the scanning devic, doesn't match the name on the ID (which everyone needs to show anyways to prove age), entry is also disallowed.
The only way to bypass this solution is identity fraud, and that of course is beyond the responsibility of the ticket system to check.
Delay
Another way to solve this, in theory, is to add a random time of delay between each request made to the database/validation API. This way, no one would be able to scan their ticket at the same time...because the time of validation is delayed each time with a random amount of milliseconds.
I'm not a fan of this, because it:

makes everything slower at the entrance
isn't effective if it's not delayed hard enough. Because if it takes 50ms for the database to update is_scanned from false to true, the only solution would be to delay it with an interval of minimum 50ms each time.

Other solutions?
What other solutions do you think of to solve this exploit?

The vulnerability you're describing is a race condition.

There are several ways to deal with it, but I would go with a SELECT ... FOR UPDATE SQL query, which puts a lock on the selected rows to prevent new writes until the current transaction is committed.

Be sure to check your RDBMS documentation to check how to implement it correctly:

PostgreSQL
MySQL
MariaDB


How safe is Avast Bank Mode? If my computer is infected without me knowing it, how safe really is Avast Bank Mode (for Banking)?  Just curious as they sound pretty confidant when they say "Your banking transactions are safe."

Like mentioned above, it's only a way of marketing their products. Every computer can be hacked one way or another. The best way to stay safe is by logging in using a live cd(kali linux or anything else).


How to safely exchange functionality of a file between two computers? I have two computers and the goal is to move a functionality of a given file from computer A to computer B. The file is supposed to have a certain known functionality but it potentially could expose additional unwanted behavior. How to safely exchange the desired functionality of the file between the computers?

I believe that a question asked on such a general level might not have a single correct answer, therefore given the ambiguousness I would like to ask if there are perhaps some good practices and measures to be taken?

Aside from the general view, I would like to ask the same question in a very specific context.

I am thinking about doing some freelancing for small companies which most likely would mostly mean Excel VBA related programming. In such a case I would be developing spreadsheets on my computer and then I would need to transfer the files to a client. Whatever the measures I would take to keep my computers sterile I don't think it's a safe approach to assume that I can do that 100% of the time due to whatever reasons. Besides I can think of scenarios in which I am 100% sterile but a client's network is under a constant hacker's silent supervision and once the hacker discovers that there is a 3rd party sending files to the client, they may strike doing some damage and for at least initial time "framing" me into it.

So for example I have an Excel file with a procedure creating a "test.txt" file on a user's desktop. Is it possible to send the file (or functionality) safely to the client assuming that my computer is infected with an unknown malware?

The solution I thought of here is not sending a file, but instead a mail with a short instruction with a logic (of course more verbose) how to recreate the file:

Create an empty Excel file
Open Excel VBA IDE, add a module, paste the code
Save as .xlsm

Sadly, it seems very crude and perhaps repelling to potential clients. Also it does not really protect me from the “framing” scenario.

Question is strange, but here is an alternative approach. Sure you can keep your machine clean 100% of the time. Create a virtualized hardened host, take a snapshot, do your work, send your work, close virtualized host. Never use the host for ANYONE, not even connecting to the Internet, you could save your work on a USB send it from another machine. When you go back to do your work, revert the snapshot problem solved.

From a realistic perspective though, Steffen already laid out the risk based approach. If you cannot trust your own network, surfing habits, then you have more to worry about. In a sanitized environment (as mentioned above) there is no mechanism to introduce any risk if the virtualized host is never networked. You could go as far as mounting a shared folder to transfer data to a networked machine, but then you're back to square one train of thought: "then I am networked and vulnerable." From a virtualized/non-networked machine, I fail to see how anything could be introduced without any iota of networking (ethernet, wireless, bluetooth, etc)


After changing Microsoft password, one can still login to previously authenticated Windows devices with old password indefinitely. Why? Has anyone else noticed that if you are using a Microsoft account for Windows, after changing your password, the old password can still be used indefinitely on previously authenticated devices? I have one I changed a year ago and it still works to login. The change was done from Windows Settings.

I'm sure there is caching of credentials for login w/o network access, but it doesn't make sense to persist indefinitely. A secondary set of credentials for the local account bound to the Microsoft account may be static even after a password change (so the local account password is never updated). But this seems wrong, security-wise. Users would expect a password change to invalidate the old credentials.

Microsoft Account

Although it's harded to find official online documentation on this, it seems to work similarly as with the Active Directory domains described below. According to Microsoft Specialist Guide to Microsoft Windows 10 (Exam 70-697, Configuring Windows Devices) by Leon Plesniarski & Byron Wright:

  Cached credentials are also used when you selct to sign in with a
  Microsoft account in non-domain networks. Cached credentials for
  Microsoft accounts ensure that you can sign in when your computer does
  not hace access to the Internet.

Top Password Software, Inc. has this blog post that states (for Windows 8):

  The cached logon credentials will never expire itself. If you change
  your Microsoft account password online via https://login.live.com, the
  cached logon credentials won’t update until you successfully log in to
  Windows 8 with the new password. After you have successfully logged in
  to Windows 8 with the new password, you cached logon credentials are
  updated.

This seems quite reasonable: if the computer completely loses network connectivity (due to hardware failure or configuration error) and there's no local administrator accounts available, you'd completely lose your access to the operating system on password expiration. This also renders you unable to fix the network connection required for checking the new credentials over the Internet.

Despite the cache doesn't expire based on time limits it doesn't mean you can use all your previous passwords, as the new password will replace the previous during the first login with it. This way, a password change invalidates the old credentials; not just at the moment you expected it.

As, starting from Windows 8.1, Microsoft has disabled WDigest and enabled LSA Protection by default, it's less of a problem to store the credentials locally. More information e.g. on Preventing Mimikatz Attacks by Panagiotis Gkatziroulis.

Active Directory Domains

From Cached and Stored Credentials Technical Overview:

  Windows logon cached password verifiers

  These verifiers are not credentials because they cannot be presented
  to another computer for authentication, and they can only be used to
  locally verify a credential. They are stored in the registry on the
  local computer and provide credentials validation when a domain-joined
  computer cannot connect to AD DS during a user’s logon. These “cached
  logons” or more specifically, cached domain account information, can
  be managed using the security policy setting Interactive logon: Number
  of previous logons to cache (in case domain controller is not
  available).

A user can't use the old cached verifiers once

the domain-joined computer has been able to contact a DC during a logon for the user, caching the new domain account information
more users than specified in the "Number
of previous logons to cache" policy have logged in after the user.

However, there seems to be no time based limit for this cache to expire. You could set the number of users to zero, but then no-one would be able to login if there's no DC available. This would probably be ok for most in-office desktops, but not so good with laptops.


Please may I know why I am getting this Sshd log why I am getting this sshd log

Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980
ssh2
Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155
ssh2
Feb 1 13:09:57 sshd[6455]: Failed password for root from 93.34.22.163 port 28980
ssh2
Feb 1 13:10:26 sshd[6297]: Failed password for root from 89.205.165.15 port 48155
ssh2

With high probability someone try to login as root enumerating different password (from generator or list).

You should decide do you have business need to open ssh to internet. And if yes to take actions to avoid possibility of login. This can be done by using only ssh key to login as root and disable password for this user


Strange Email Validation request - should I worry about it? I have a domain in .name zone registered in Germany. A couple of days ago I received an email, here is the English part of it:

  Dear customer (the German text has my name instead of "customer" here),

  by the guidelines of the internet administrative organization ICANN we
  are obliged to verify the correctness of the owner contacts in the
  registrations of all generic TLD endings. We have to validate your
  email address as the domain owner.

  We would, therefore, like to ask you to confirm the correctness of your
  contact e-mail address by clicking on the following
  link:

  https: //www. domainvalidierung.de /AStringOfRandomAlphaNumericalCharacters/

  In your case this validation is done, inter alia, for the following
  domain: my-domain.name

  If you have additional domains with a generic domain ending with the
  same email address for the domain owner then these domains will also
  be automatically validated by the confirmation of the link above.

  Important Note: If you do not confirm your email address by 22.09.2018
  all new domain registrations using this email address will be
  disconnected in accordance with the ICANN policies until the email
  address is confirmed. Such domains remain registered but are no longer
  accessible. You can activate the domains by clicking the link above at
  any time. No further data or other personal information is needed for
  the validation.

  Contractual Basis: The validation of the registrant contact of a
  domain for all generic TLDs is part of the ongoing efforts of ICANN to
  improve the contact data quality of the domain owner. We are obliged
  to implement these requirements of ICANN to be able to offer
  registration services for all generic TLDs such as .COM, .INFO,
  .BERLIN, .KOELN, .CLUB and .BIZ

I did not start any domain transfer.
The email was sent to my email which was used for the domain registration, my real name is used (but I think both could be found in whois entry).

What seems suspicious to me:

"www.domainvalidierung.de/" is blank.
I have two other domains for which I didn't receive such an email.

Is this "validation" legit? Can I ignore it? Should I ignore it?

Under ICANN's Whois Data Reminder Policy accredited registrars will revalidate contact information yearly - did you by any chance register this domain on 22/09/2017?

Aside from this, it may be a routine validation to ensure the Whois data is correct or it may be in response to a complaint regarding the current data.

There are a number of ICANN policies which registrars are obliged to follow which would explain this. My only word of caution is to ensure this came from a trusted source.


Isn't the BBC being extremely irresponsible in describing how to authenticate an account-related email? On this webpage, the BBC says:

  I’ve received a ‘Changes to your BBC account’ email claiming to be from the BBC – is this a genuine email?

  At the end of September 2016, we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’, and as a result we had to sign everyone out of their ‘BBC iD’ account.

  If an email address was previously registered against a ‘BBC iD’ account, we’ve been sending emails to these email addresses (from ‘bbcaccount@e.bbcmail.co.uk’) advising users that we’ve signed them out of their account and asking them to sign back in.

  These are genuine emails from the BBC and not phishing emails or spam (below is a screenshot of the email content).

… and that's it.

I discovered this on a Facebook comment thread, where the above webpage was given as "proof" that an unexpected email was genuine and not a phish.

The email contains a link to "sign in" — this link will require users to input their credentials, by definition (due to the reason for sending the email in the first place).

Isn't all of this incredibly irresponsible? Isn't the BBC grossly mistraining its audience? The From field of an email has never been anywhere close to proof of the sender's identity, and providing a screenshot of the genuine content just makes it easier for fraudsters to reproduce it and con people.

Or am I missing something?

Very dangerous things could happen here, indeed. It would be laughably easy for a scammer to phish users.

A migration is an excuse many phishers already use:

  There was xyz problem in our user database [...] just "log in" or you won't be
  able to use our service.

So the legitimate reason

  we upgraded our ‘BBC iD’ sign-in system to ‘BBC Account’

aligns quite perfectly with these nefarious activities. Spammers could even put a "proof" with the website link. Users see that the email layout is the same, think oh, this is legit, click sign-in and send the credentials to the attackers.

Having access to a BBC account isn't much of a threat, as far as I know. However, for those users who have the same password in all sites (and no two-step verification), then you've got an easy way to access email, bank accounts, and the like.

The BBC dropped the ball hard. I'll be contacting them to fix the issue, I encourage you to do the same thing.


How much of a security problem is PHP's proc_open() on a shared host My company is developing a PHP system that needs to interact with Git on the server, which can currently most conveniently be done by allowing external calls via proc_open(), system() and the likes. The problem is that our clients typically use shared hosts and those hosts typically have these PHP functions disallowed. (Well, they also typically do not have Git installed on their servers but that is another issue; let's focus on proc_open() now.)

I'd like to fully understand what are the security implications of proc_open() being allowed, and under what circumstances.

Here is what I've gathered so far:

If the host uses Apache + mod_php allowing proc_open() is a no-go because the PHP script and in turn the executed shell command runs under the same user (Apache) for all users on the shared host. That is obviously too much of a risk (one user could access files of the others).
If the host uses CGI, FastCGI, PHP-FPM or similar, and if the file permissions are set properly, allowing proc_open() should be relatively fine. The reasoning here is that the PHP script itself can already do a lot of things, so adding the ability to run external commands (with proper permissions in place) doesn't make much of a difference. (It makes some difference in that it makes the surface area larger, but the difference shouldn't be huge.)

The question is, is the above correct? Or are there examples of attacks that would be only possible via proc_open() and not otherwise? Thanks.

It's correct that proc_open can be dangerous, if and only if there is user input going through it.

For affecting other users/websites on the server, it's a low risk nowadays since cagefs is being used, and the kernel's security is updated on the servers. So don't worry about other users: it's the hosting company's job.


Injecting data into the Windows entropy pool On Linux, it is possible for userspace to mix arbitrary data with the kernel entropy pool by writing to the /dev/urandom device. Is there any equivalent on Windows which does not require SYSTEM?

None that I know of, exactly. CryptGenRandom (the legacy CryptoAPI CSPRNG function) allows callers to supply additional entropy, but it's not even clear if this affects future calls to CryptGenRandom by the same process, and it's fairly clear it doesn't affect other processes.

BCryptGenRandom (the next-gen replacement for the old CryptGenRandom) used to allow the caller to supply addition entropy in much the same way, using the BCRYPT_RNG_USE_ENTROPY_IN_BUFFER flag, but that is no longer supported as of Win8. Even in Vista and Win7 (and Server 2008), though, it is unclear whether the data supplied with that flag only modified the data returned by that call, or that call and future results to calls from the same process, or future results for all callers.


Best options for SSL inspection while maintaining Perfect Forward Secrecy We are looking to monitor inbound HTTPS connections for performance issues as well as errors. HTTP requests we are able to gather this information just fine, but we don't have a way to do this while maintaining PFS via HTTPS. Our HTTPS decryption tool does not support DH ciphers at all, for instance.

What are people doing for this?

So you want to do some analysis on inbound HTTPS traffic. A common way is to use reverse proxies (commonly Apache or nginx) in front of the actual servers, install the server certificates on the reverse proxies and actually do the SSL/TLS decryption on the proxies. It gives:

client <-> Internet <-> [ router <-> { reverse proxies <-> actual servers } ]
                        |            |
                   corporate      security
                    network         zone
                     limit         limit

In this scenario, the reverse proxies shall be in the same security zone as the servers, that means that only admins should be able to spy them and the traffic between the proxies and the servers. So the traffic between the proxies and the server can safely be unencrypted (but should transport optionaly client certificates). As reverse proxies are normally simpler than application servers, it is easier to add filtering and traffic analyzis there.


Consequences of compromised /etc/ssh/moduli Hypothetically, what could an attacker achieve if they have a copy of of /etc/ssh/moduli?

Nothing. The attacker already has it: it is distributed with the OpenSSH source code. This file is used to define the group in which the Diffie-Hellman key exchange may run; the group description is public, it contains no secret value, and can be shared at will. OpenSSH includes several group definitions and selects one at random just because they are paranoid (which is not necessarily a bad thing, for a security product).


What if TLS is suddenly found to have a critical defect? I know that we've already had some defects in SSL/TLS, like Heartbleed, POODLE, FREAK and others, but all of these were rather localized problems:

Heartbleed was an easily exploitable bug in OpenSSL, a specific implementation;
POODLE was a timing attack on SSL3, which is outdated;
FREAK was an attack on export suites, a deliberate vulnerability caused by legislation.

However, suppose we had a defect with the following properties:

It was originally already present in TLS 1.0, but went undetected all this time and wasn't removed in 1.1 or 1.2.
The defect is in the spec and is not dependent on the implementation;
The defect is a fundamental shortcoming in the spec and a simple band-aid fix won't suffice.
The defect is easily exploitable by any attacker to enable listening in on an encrypted connection in real-time.

Now, I'm not familiar enough with the TLS spec to know if and where such a defect is possible (and I hope such a defect is not present), but even with all the scrutiny that the TLS spec has been subjected to, it is not 100% impossible.

In case a defect with the above properties were to be discovered before the end of the year, what would be the consequence for the internet?

Probably the same as all the others. There will be a brief panic, probably a lot of news coverage, and meanwhile browser vendors, TLS implementors, or both will find an approach to patch or mitigate the issue (e.g., BEAST) and do their best to get it distributed widely.


Is there any way to access the contents of a cross domain iframe I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the iframe tag and it starts working. However, is there any way to access the contents inside it? Or any other way to exploit this as an account takeover?

Is there any way to access the contents of a cross domain iframe

Not programmatically (see below for another approach), as the same origin policy will not allow this.  If it did, that would be cause for alarm, not just in your situation. An attacker could steal CSRF tokens and perform arbitrary actions, read all data the user has access to, etc.

  I found that a subdomain of a site leaks all cookies of the site due to improper error handling

This definitely violates best practices, but I wouldn't see it as a vulnerability. Preventing this is more a defense in depth issue (similar to httponly cookies).

  Or any other way to exploit this as an account takeover?

You can combine the clickjacking issue with the cookie disclosure issue to potentially get a user to disclose the cookies to you by presenting a fake captcha with pieces of the cookie.

Basically, you create a bunch of little iframes - each containing one character of the cookie -, which you can then rearrange and distort so they look like a captcha. You then get the session cookie when a user "solves" the captcha.

Depending on the length of the session ID, more than one captcha may be required.

See this paper for a detailed description and this article for a real-world example.


Public API with authorization token -- is it possible to protect the demo token? I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API.

The user adds their token to the query like this:

{
    authorization: 'my token',
    moreData: 51351,
    etc: 'etc'
}

Because the users of this API are usually not programmers, I have made a very simple web page demonstrating the API, with a live demo that can be run directly from the web page, demonstrating how it works and what is returned.

This demonstration has a fake authorization token, which is displayed in the example query. I have made a simple, hidden and partially obfuscated JavaScript function that intercepts this fake token and replaces it with an actual token before sending the request, which will probably trick most users. But a user that actually watches the request from the debug tool in the browser will easily see the actual token that is sent, and can use this token to send their own request.

Of course, I could rate limit the demo token, but then that would mean that users who are experimenting with the live demo could experience temporary lock-outs, which I would like to avoid.

Is there any way of protecting the demo authorization token from an API that needs to be easy to use, and needs a live demo?

As Steffen has said you cannot protect the token from users.

I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored data and just does calculations on input so this may not be a concern for you, but rather than having the demo token point to your real api, you could point it to a demo / sandbox version with meaningful, but not real data that could:

only have the demo token in it - no other users
be reset automatically on a daily basis
have a small amount of data in it rather than your full set (if you have data)
potentially not return valid results for all calculations as a way of requiring people get a real account from you rather than just using the demo token

This would feel safer to me as your live system would never be touched by anybody with the demo token, and in scenarios where you may have functionality you are selling etc, it allows developers to integrate and confirm they have integrated correctly, but doesn't give away the full set of functionality/data to the demo token.


OWASP ASVS asking for client-side validation? While perusing ASVS 3.0.1 I came across requirement V5.18:

  Verify that client side validation is used as a second line of defense, in addition to server side validation.

Umm... is client-side validation not said to have no security benefit whatsoever?

I mean, as a convenience function to alert users to undesired input, yes, but as a security requirement? Have I missed something?

All right then, answers to my question on the ASVS mailing list shed some light on the issue. Personally I find the following two to be the strongest arguments:

While client-side validation can be bypassed, it helps to detect attacks. Suppose for instance that there is an input field that length limited to 10 digits. If this is supposed to be client-side validated and the application receives something longer or a string containing non-digits, then it is (in a fuzzy sense) clear that something is going on.
Applications with a lot of JavaScript that modifies the DOM where the server actually never sees some of the input require this. I realized only then that ASVS lacks a dedicated section on client-side testing (as the Testing Guide has).


Security implication of disclosing composer.lock? What are the security implications in disclosing the composer.lock file for a remote, public known, web application?

As composer can describe the

  exact version numbers, and are useful to communicate the version you tested with to colleagues or when publishing an application

Reference #1

Revealing the version of the underlying library can be used against the application.

  composer.lock file also ensures consistency across clusters of servers

It will ensure that all the servers behind a Load balance will be evenly vulnerable which will make the exploit more stable against a target.

Reference #2


AppSec interview questions? I am preparing for a technical interview for an AppSec pen-testing position.  For those of you that have had AppSec positions, what sharp-shooter questions do you think I can expect?  What questions would you ask a candidate if you were doing the interview?  Thank you for your insight!

What are some strategies to detect and prevent vulnerabilities
introduced by third party libraries?
How would you demonstrate to a customer why it is important to fix
reflective cross-site scripting flaws?
How would you demonstrate to a customer why MD5 is not appropriate
algorithm to use when hashing passwords?
What scripts or tools have you written to assist you in pen-testing
applications?
How would you advise a customer to fix a CSRF issue that you found?
How would you get around a web application firewall that is blocking
your attacks against a vulnerable application?
Your customer hasn't noticed any of your intrusion attempts.  What
would you advise?


PCI scope for a Direct-Post e-commerce site (SAQ A-EP) An e-commerce site uses the Direct-Post method (see page 14 PCI e-commerce security).
Is the server for the e-commerce application and network it resides on in scope for PCI?  There are questions in the SAQ A-EP for servers and networking that appear to apply.

To quote the document you've provided, emphasis mine:

[When performing Direct Post] the payment form is provided by the
merchant; therefore, the merchant’s systems are in scope for
additional PCI DSS controls, which are necessary to protect the
merchant website against malicious individuals changing the form and
capturing cardholder data.

And SAQ A-EP is applicable to Direct Post merchants:

Your e-commerce website does not receive cardholder data but controls
how consumers, or their cardholder data, are redirected to a PCI DSS
validated third-party payment processor;

So, yes, your server that provides the checkout page is in-scope for PCI, even though the Direct Post sends card data directly to the payment processor.  You should fill out SAQ A-EP accordingly.


Next Microsoft Patch Tuesday include BEAST SSL fix http://thehackernews.com/2012/01/next-microsoft-patch-tuesday-include.html
I thought the vulnerability that BEAST uses is already fixed on "Microsoft" side, no? Can someone please clarify this?:
https://security.stackexchange.com/a/9952/2212

The TLS support for browsers right now is:

IE9 TLS 1.0, 1.1, 1.2 all supported via Schannel
IE8 TLS 1.0 supported by default, 1.1 and 1.2 can be configured
Opera - 10.x supports TLS 1.0, 1.1, 1.2

I don't count older versions of any of these browsers, since people really
should have auto-update on. if they don't they've probably got bigger
problems ( http://isc.sans.edu/diary.html?storyid=11527 )

Mozilla/Firefox - TLS 1.0 only
Chrome - TLS 1.0 only (though an update is rumoured)
Safari - TLS 1.0
Cell phones - various support levels (webkit has tls 1.2 since Nov 2010, but for
individual phone browser implementations your mileage may vary)

Since the patch has been released some time ago, we can now have more information. The security bulletin is quite devoid of technical information, but some clues can be gathered from reading the KB article about known issues. The patch does, basically, two things:

The patch activates TLS 1.1 support. This support was already included in Internet Explorer, but not enabled by default, because there were some buggy servers which did not tolerate it (in a SSL/TLS handshake, the client announces his maximum supported version, but some server implementations refuse to talk to clients who announce anything else than SSL 3.0 or TLS 1.0). Microsoft seems to have decided that fixing BEAST was more important than supporting faulty SSL servers.
The patch implements record splitting. In SSL/TLS, data is encoded as records, each record being encrypted by itself. The BEAST-related flaw is about records in SSL 3.0 and TLS 1.0 with CBC encryption, where the IV is extracted from the end of the previous record, thus predictable by an attacker eavesdropping on the line. Record splitting is about automatically splitting an n-byte records into two records, the first one being very small; this has mostly the same net effect as choosing a random IV for each record (which is what TLS 1.1+ does), and this fixes BEAST, with a small size overhead (not much). A 0/n split would be ideal (i.e. prefixing each data record with an empty record) but tends to break too many existing implementations, in particular the one in Internet Explorer 6.0; hence, a 1/n-1 split is often employed, and almost as good. This is probably what the Microsoft patch applies.

Record splitting is used when the server chooses SSL 3.0 or TLS 1.0, and a CBC-based cipher suite.

Note that practical application of BEAST also requires a rather flexible way to do cross-site requests, something which the BEAST designers (Duong and Rizzo) could achieve only by exploiting one of two weaknesses, which were in Javascript WebSockets (draft version) and in Java (Sun/Oracle implementation), respectively; both weaknesses were also fixed. The Microsoft patch we are discussing here addresses the underlying vulnerability of CBC encryption with predictable IV.


Should business logic attack be one of the testing methods during pentesting or vulnerability assessment project? Should business logic attack be one of the testing methods during pentesting or vulnerability assessment project?

Business logic attacks most of the time are left out during pentesting either it was not mentioned or are not aware about it.

Logic attacks is a manual process and most tools cannot examine logic.

Business logic attack is more like a "business logic testing" which is normally done before launching the application by the developer team (more preciously, the Quality Assurance team) of the application.

Before performing in a production level, an application must have gone through business logic testing. Though, there is still rooms for putting "Business logic attack" into vulnerability assessment checklist specially when the application is running for financial organization.


Preventing printed data interception using origami or other technique? Suppose I want to print a human readable 10 digit serial using ordinary day today printer but the printer is communal printer and manned. My intention is for the person manning the printer to not read the code.
Initial inputs that i know is that printer is not a copier and person manning does not have a camera or smartphone to make a copy. There is no message interception between the printer and the computer printing it.
My method to print is in such a way that the paper is to be folded which will make creases on the paper if an attempt was made by human to read the code thereby letting the end user know that the code secret is known by another human or an attempt was made to read the code. However before I go about programming the print function, I was wondering if there are any techniques or methods that may be already out there.
Added bonus would be if the print is not copyable.

I've never heard of a cryptographic operator that works like this—you could certainly design a page that looks a certain way (e.g. has certain numbers on it) when folded up, but I've never heard of an automated way to do that.
In part, this is because you have one whopper of an XY problem here. First of all, I sincerely doubt your threat model is accurate—everyone and their aunt has a smartphone nowadays. Second of all, there are much more effective and less finicky ways to do what you'd like—for example:

Print thousands of codes on one page. Remember that the (n)th (9th, 73rd, 50th, whichever you choose at the time) one from the bottom is the real code. You need to use a different (n) each time, or you become vulnerable to known-plaintext, whenever someone figures out one of the real codes, notes where it is, and can steal the real codes from all the other pages.
Print thousands of codes on one page, prefixed by various letter combinations. Remember which letter combination you put before the real one. You need to use a different letter sequence each time, or you become vulnerable to known-plaintext, whenever someone figures out one of the real codes, notes what letter sequence it started with, and can steal the real codes from all the other pages.
Bypass the printer and write it down on a piece of paper with your own hand, it's just a 10-digit code...


Sequential password updates Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.

What's to stop the user from changing the passwords (when they're required to) in some predictable sequence?

hammurabi1
hammurabi2
hammurabi3

or

winona2014Q3
winona2014Q4
winona2015Q1

or some other obvious permutation of a "base" password?

Obviously, I can't store the plaintext of a password to check sequences, and hammurabi3 by itself is innocuous. It might be a pattern or it might not.

Is the benefit to changing passwords invalidated because users have the opportunity to change them to almost-but-not-quite the same password?

Is there something I can do to improve that flaw (if it's a flaw)?

Further reading

Does Facebook store plain-text passwords?
Why does Facebook bother comparing old and new passwords?
Logging "password with counter" use
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

You cannot reasonably prevent "sequence passwords" unless you have a human administrator inspect them (which would have its own set of security issues, not even considering the expensiveness of human labour). You can try to automatically detect such patterns, but you cannot hope to find them all; besides, if you only keep hashes of the previous passwords, then pattern detection will have to be a guess-and-try process, which will be expensive.

Moreover, your users will find the pattern detection system inconvenient (since it prevents sequence passwords that they are quite fond of), so they will fight against it: they will be angry (not a good idea when users are customers), and they will be creative, finding new sequences that you did not thought of.

Benefit to changing passwords is not invalidated by sequence passwords. Benefit to changing passwords is invalidated by regular password changes being bloody useless (see this question for more discussions on that subject). The flaw is not in the "sequence passwords"; it is in the policies that mandate regular password changes for the sake of misunderstood very old traditions that don't make sense when the users wield computers and try to buy stuff from Web sites, instead of wielding rifles and trying to send enemy soldiers to the afterworld. These policies are the reason why users resort to sequence passwords in the first place.


Should I enter fake password to phishing site? Hope I have chosen correct forum to ask this question.

The other day it happened to me. I got e-mail from my admins requesting me to update my password. "Not again" I mouthed and clicked the link.

Luckily, I am always checking URLs, which saved me this time. I clicked phishing e-mail. The site looked really like Microsoft Office (we use Microsoft Outlook) and it wanted me to first enter my current password.

At that moment I already knew I have to be cautious about next steps and was investigating what I can do about my visit to the phishing site.

Being already angered, I was thinking about submitting here something really really offensive as my "current" password.

Obviously, I do not use swear words as my password, I follow usual guidelines in how to create passwords.

At the end of the day, I did nothing, but the question still pings in my head: Would posting fake password to phishing site help anything in regards of my personal security and/or my company security?

P.S: I notified IT department about the mail, so the company is aware about this phishing attempt

No, this probably isn't a good idea. Oftentimes, scammers who send emails like that don't actually try out every single password manually but instead use a script that inputs them automatically. In that case, they wouldn't see your message and so it would just be a waste of time.

On the other hand, some people enjoy messing with scammers. A somewhat audacious technique that I have seen tried in the past is to write your own script to repeatedly fill the password field on the phishing site with random data in hopes of drowning out the passwords of people who had fallen for the scam.

As @CoderPE mentioned in the comments, drive-by downloads and exploit kits can be used to compromise a computer just by visiting a website (usually on Windows, although other operating systems can also be affected).


How to track the usage of image We are running an image content system where we allow the option to download the image freely by any user.

Now I want to do the following things for those images:

Track down the usage of the image online and offline
Want control to delete the image remotely

Are these thing possible by any means?

The way to do everything you asked is if you developed a custom image type and your own image viewer. The viewer is the wrapper for the image that enables the functions you want. You could have end-user versions of the app as well as server versions of the app to be able to show the image online.

This is by no means foolproof, and you would also have to prevent screenscraping so that the image cannot be copied from the screen.

And this suggestion likely does not satisfy all the user experience requirements you likely have but have not disclosed.

DRM is very, very difficult to pull off and even the best in the world cannot do it perfectly. I would suggest that you revisit your need for control over these images and change your business need instead of trying to create a technical control for what cannot be controlled.


Encryption Key vs. One-Time Pad Brute Force How does an attacker know when they've cracked a traditional encryption key?

Wikipedia describes the one-time pad:

  A 140 character one-time-pad-encoded string subjected to a brute-force
  attack would eventually reveal every 140 character string possible,
  including the correct answer – but of all the answers given, there
  would be no way of knowing which was the correct one.

So if you don't know when you've solved OTP, what is a giveaway when a traditional encryption key is solved?

Encrypted data is (pseudo) random data, i.e. it has maximal entropy (near zero patterns).

A 140 character string which is e.g. English can be compressed to 108-110 characters with an off-the-shelf no-special compression algorithm. A wrongly decrypted 140 character string can be compressed to 138-140 characters.
(BTW the claim 108-110 is not randomly chosen, I actually tried this with 140 characters from a previous answer's paragraph. Longer texts will obviously compress significantly smaller than that, even. Text will usually be something around 1/4 of its original size, and other "useful, non-random data" such as executables or even images will have anywhere from 30-70% of their original size, depending on what it is.)

This makes it rather easy to identify the case where you have found the correct encryption key (actually finding it is a different matter, I invite you to try and brute force 128-bit key, let alone a 256-bit key -- good luck).

Now with an OTP the problem is that unlike with a block or stream cipher where there is some albeit obscure correlation, the transfer function could be (and should be, as the key should be random) totally random, basically anything.

Which means no more and no less than you can get every answer out of an OTP, provided that you fill in the corresponding key, and there's no way of knowing whether that's correct. Every permutation is equally likely, and no bit in the message is related to any other bit (in the message or the key).

Within limits one could allege the same about other encryption systems (since 2128 choices is a huge number, almost "infinite" for most purposes), but in practice it's not the case. The number of permutations is comparatively small (compared to, e.g. 21120), and the bits within the message are not independent of each other, or independent of other bits in the key. Mind you, flipping any bit in an OTP will flip one bit in one character. But flipping one bit in a block cipher will have a 50% chance to flip each and every bit. They're not independent!

Which means that despite there being a huge number of outputs, there is only a very small number (often just one) that actually make sense, and you can identify them by their entropy.


How does the use of Microsoft-branded Azure products affect my privacy policy? I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc).

Right now I have a privacy policy similar to DuckDuckGo.  I collect nothing.  Some products seem to collect data for a period of time in order to operate.  Examples include:

Azure Threat Detection for SQL
Azure Application Gateway
Azure AD "Risky Sign ins"
etc...

Question

How can I gather the appropriate information in order to update my privacy policy accordingly?

You are a data custodian of your customer's data. The fact that you are using Azure means they are also a partner with you in data custodianship. For you to accurately describe what that means you either need to

Include all the terms of the Azure privacy agreement into your agreement, understanding that these can change rapidly without notice.
or
You need to clarify that your policy is X and that your service runs on Azure who's policy is Y.

If it's an option the 2nd option will be the easiest way to resolve the problem with Azure's ever-changing privacy terms.

Do keep in mind that Azure's policy may also vary by jurisdiction and that you need to keep track of that and also which jurisdiction's laws apply to each of your customers.

Useful Reference: https://azure.microsoft.com/en-us/support/legal/


How can I prevent data scraping on my website? How can I prevent client software scraping data from my website?

Some examples of my URLs are:

http://example.com/products.php?q=1
http://example.com/products.php?q=2
http://example.com/products.php?q=3

It's very easy to run a loop and request the server with a changed query string. What are the security measures I can take? The information on my site is published weekly (huge data entry cost), and I don't want someone to run a script and get all of it in a few minutes.

You can't really prevent it if the data is publicly available.

But that doesn't mean that you have to make it extra easy to scrape the data either.

Preventing Enumeration

By exposing internal, ordered ids you make it extra easy to scrape all products.

If you changed it to either product name or a random id, an attacker couldn't retrieve all the data with a simple loop.

Throttling Requests

You could limit the amount of requests a user can make. This isn't all that easy though, because you can't really limit by IP address (you would restrict users using the same IP address , and attackers can just change their IP address). Here is a question about identifying users with some alternative ideas.

"Honeypot"

You could create fake products, which you never link to (or only in links hidden via CSS).

When someone views such a product, ban them.

Alternatively, you could add quite a lot of these products, and NOT ban a scraper, but just let them keep the wrong data, making their data less accurate (this may or may not make sense in your case).

Obscure Data

You could try to make it harder for a scraper to use your data. This may impact your users and may be quite a bit of work on your part (and as with all approaches, a determined attacker can still get the data):

Put part of the data in an image.
Change your HTML often (so an attacker has to change their HTML parser as well).
Mask/encrypt your data and use JavaScript to unmask/decrypt (change the method from time to time, so an attacker would need to change theirs as well).

Limit Access

You could put the content behind a login, and ban users that scrape data (probably not a good idea in your case, as you do want users that don't have an account to see products).

The Law

Everyone is free to scrape the data on your website (probably; it may depend on your jurisdiction). But re-publishing is likely in violation of the law, so you could sue them.


What are the performance differences (for client and server) between DHE and ECDHE in TLS? My question is about the client and server performance for (EC)DHE.
I am having difficulties in understanding this picture (which is based on numbers from Ivan Ristic' book "Bulletproof SSL and TLS").

Let's start with the third row "RSA 2048, DHE 2048". I can understand that client and server computation times differ because creating a signature is different from verifying it.

I understand that ECDHE is faster than DHE and therefore the numbers in the second row are smaller than the ones in the third row.

My questions are:

The effort for DHE and ECDHE is identical for client and server, isn't it?
Why is the client's computation time for "RSA 2048, ECDHE 256" smaller than the server's while for "RSA 2048, DHE 2048" it is the other way around?

DHE uses modular arithmetic to compute the shared secret.
ECDHE uses algebraic curves to generate the key, therefore it has lower computational, storage and memory requirements.

DHE is considerably slower than ECDHE. If you want some actual numbers here they are:

Key exchange    Parameters               Transactions/sec
DHE-RSA         1024-bit RSA key,
                1024-bit DH parameters        347.64

ECDHE-RSA       1024-bit RSA key,
                192-bit ECDH parameters       612.25

DHE-RSA         1776-bit RSA key,
                1776-bit DH parameters        97.62

ECDHE-RSA       1776-bit RSA key,
                192-bit ECDH parameters       349.53

As you can see, the performance penalty for DHE increases a lot more when increasing the number of bits. If you really want the best of both worlds, you could use ECDHE-ECDSA and you have both forward secrecy and efficiency.

Here you can find other independent results that should give you relevant info.

The effort is not at all identical. The client is never a problem. You will only notice the performance differences on the server (because there is one server and many possible negotiating clients - so only in the case of 1 client and 1 server the effort will be equal).

-EDIT-

So, to conclude: 1. Yes for one client. No for more concurrent clients, for obvious reasons. 2. Both assumptions are incorrect. On identical machines, the computation time will be similar in both cases.


Envelope formats to store (symmetric) encrypted text We have decided to use AES to cipher user data. So for every data chunk we have the crypted text along with the SALT. Now we have to store both of them in the database and we do not want to separate the SALT from crypted text in different columns.

So I'm searching for some standard (like PEM for keys or PKCS#7 for PKI envelope) to store the encrypted message (it is already in Base64 format) along with the SALT in a unique text field.

I think something like the following:

---- BEGIN ENVELOPE -----
salt: d23sda923uasd989s
FHb/UR2Vfut0hQ8IG+P3mXy0sIVxJUpmTp3xzxOhTsjefkH/EAnRn9FgIn5rjIt5CLfU7Ou2zLcL2Ldg
Ck2xHeYqNlNg6WobvJDs4iLxkfKdkoxGfDW3s/ImqxG3VecpzeXNhkbVwr+HxnUa3gRDNY71rN463/Sj
REYn7j0sFButndPCxIeqbtX0upMuHhKnEBEwRpkcGeLsbDAPUU74UuL+7UriC2LZFm1oDdi3j6zzZsNY
JwQAQ4dduzMqeOrmBsnj1KaRZgLJd0UbHLwFOUuV4pqgNP0iFOc0g137W/nsum37tCS8RTm41S8Wk6qb
daEXPfXtQYdQ8p1/nfLv18TxFPUVwW8owC0J9ol9cYMGzsN/cY8tLKWe3JG5lS4nVB0dOjFkKPugSBw6
owCM0yADQYtbkhWXGZHr7xiL+ytKUD9xA8r0BFn0EZCCChsMlXSSsJ2PohAT83jyIXQX10mW31fBCW68
nsETdjItEg3urjBVjOAve+p/Sb0oj8Y2rDuomEQOHrN+wjZZj/atRYHdwA5qlhOojmvVED5YxJUCI2YB
j9pMet1IiW340JCXWsK+8N4CwlNHy57YJTP94=
---- END ENVELOPE -----

thanks

The standard format for storing encrypted data is the Cryptographic Message Syntax (CMS), a.k.a. PKCS#7. Encrypted data contains a ContentEncryptionALgorithmIdentifier, which has to contain the type of encryption used (for instance AES-128-CBC) and all parameters neccesary to decrypt it (for instance an IV). The ASN.1 types for the AES-CBC encryption are defined in RFC 3565.