On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks? I'm looking for an helping hand with my https nginx setup.
I require my application to be exposed through an nginx frontend, offloading TLS. Easy !
The thing is, I need to have Certificate-based client authentication, and my application cannot be advertising a list of CAs it accepts as it will disclose information about my clients.

As a result I am building up a solution based on the optional_no_ca parameter of nginx.

Sadly, this workflow is not discussed on the TLS RFC, and I'm willing to confirm that the CertificateVerify is still part of the verifications done by Nginx/OpenSSL .

I'm willing to do my authentication in 2 phases :
1- ClientCertificate & TLS validation - On Nginx ( to avoid replay and certificate forgery )
2- Certificate validity, CAs and CN validation on Application.

This can only be secure if the CertificateVerify is done properly on Nginx side, as it will be impossible for my application to do it, since it's not terminating TLS itself ( and cannot ).

Would anyone have confirmations ? Or ideas on how to test this without falling down to scappy ?

... this workflow is not discussed on the TLS RFC

The details of the certificate validation are not part of the TLS standard. Part of TLS is only if a certificate gets requested or not.

Apart from that your use can can actually be implemented by nginx. According to the documentation if ssl_client_certificate is set it will be used to a) provide the client with a list of accepted CA and b) verify the client certificate against these CA's. If instead ssl_client_certificate is kept undefined (default) it will not send a list of CA certificates but use ssl_trusted_certificate to verify the client certificate. To cite:

  Syntax:   ssl_client_certificate file;
  Default:  —
  Context:  http, server

  Specifies a file with trusted CA certificates in the PEM format used
  to verify client certificates and OCSP responses if ssl_stapling is
  enabled.

  The list of certificates will be sent to clients. If this is not
  desired, the ssl_trusted_certificate directive can be used.

  as it will be impossible for my application to do it, since it's not terminating TLS itself

nginx can actually provide the client certificate as HTTP header or similar so that the web application can get access to it and verify it or extract information from it.


Public key for sensitive data I'm curious about a setup that involves downloading sensitive information from an SFTP server over the internet. The current approach is for the clients to connect to the SFTP server with a private key.

The vendor (who hosts the SFTP server) is now suggesting to switch to a model where the clients receive public keys to connect to their accounts.

Is there any downside in flipping around the authentication from previously private keys to a public key model?

My understanding is that in both scenarios the client is not proving his identity but in the private key solution at least the private key can be protected with a password to add an extra layer of security.

No. It is not possible. The public/private key cryptography is (for a reason) called asymmetric, therefore it works only one way round:

the user has a private key to prove its identity
the server has a public key to verify the users identity

You can't switch that over. Though, the clients should also have the public key of the server, but it is not used for authentication and is part of different story.


Redirect a user to a trap page using evil twin The company where I work gave my team a "Security Information" training today and at the end they presented a video that exemplifies how vulnerable an open wireless network is.

In this video the "hacker" went to a bar and set up a network with the same name of the bar network. When users connected to it and visited websites like Facebook, they got "redirected" to a trap website and the input credentials were stolen.

I searched for this "network with the same name" technique and got Evil Twin.

After the user has connected, how could the hacker redirect him to his trap page? Will the URL look different or can it show https://www.facebook.com and still be an other page?

Because the victim is running through the attacker's network, the attacker can dictate the network settings, like what DNS is used or redirecting traffic.

So, yes, it is possible for the attacker to redirect DNS queries to Facebook to their own laptop's web server, and while the URL looks legitimate, the victim is actually using the attacker's web page.

Alternatively, the attack could simply record and replay all the traffic going through using a proxy, and the victim actually visits Facebook, but the attacker sees everything the victim sends, like usernames, passwords, files, pictures, etc.


XSS - double quote and backslash escaping I'm currently testing my own XSS filter and don't know if I thought everything through, so I need some advice.

Let's say my code looks like this:

<script>
var test = {src: "test", layer: {"input": "USER INPUT", "event": "ready"}};
</script>

In this specific case, if I replace \ with \\ and " with \" is it possible to trick my filter? Of course the user input would be where USER INPUT is in my code.

In this specific case, if I replace \ with \\ and " with \" is it possible to trick my filter?

That's not sufficient, your filter is insecure.

E.g., one valid XSS attack vector would be </script><svg onload=alert(1)>, ending up with:

<script>
var test = {src: "test", layer: {"input": "</script><svg onload=alert(1)>", "event": "ready"}};
</script>

Since the XML (HTML) tree is parsed before any JS is evaluated, the closing script tag (</script>) will terminate the script despite being placed within a JS string.

Another problem with your filter are line breaks. If an attacker can insert a 0x0a byte, they can break your script by causing a syntax error (since a double quoted string can't span multiple lines):

<script>
var test = {src: "test", layer: {"input": "
", "event": "ready"}};
</script>

If you're using PHP, a convenient filter function to work safely with user input inside JS is json_encode(). From this answer:

  With plain PHP a common and safe approach is to use
  json_encode() as explained here. E.g.:

var foo = <?php echo json_encode($foo, JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS); ?>

  json_encode() returns the JSON representation of a value, hence it's
  guaranteed to evaulate to a valid object in your JS code and you can
  just assign it to a variable as shown. But don't omit the additional
  flags. Depending on the context, an attacker could otherwise use
  payloads like </script> to break out of the entire script tag.


Encrypted traffic analysis If i tunnel any tcp traffic true ssh  or any ssl encrypted protocol will some one capturing the traffic capable of do some kind of offline decrypting using the capture file ?? What technic they use to do that !?

In my company we had to call a network provider to analyze our network traffic because of some suspicious activities in our network, they connect some snort like system..., and i don't think the procedure is valid to find a smart ore experienced   Attacker

Short Answer: Mostly Likely Not. Your Traffic will be encrypted.
However, it is possible to read the data by other means.

If the sniffer is some type of malware on either your machine or the receiving end as it could view the data before the payload is encrypted or after its de-capsulated.

If the attacker obtained the SSL certificate and is performing some kind of MiTM attack.

If the encryption key was obtained by other means.

If there is a zero day exploit that can be used against SSL, TLS to obtain sensitive traffic.

Edit:
In addition to your added comment, you would be somewhat correct. Snort is an opensource IDS/IPS and if the data being inspected by the system was encrypted snort would be unable to read any signatures off the traffic. However if there was any suspicious/malicious traffic that could be emanating from the network that could be related to an attacker obtaining the data snort would probably identify the exploit signatures coming and going.


Is there such a cryptographic algorithm? Is there such a cryptographic algorithm that will encrypt any file with a password. But when decrypting, if the password is incorrect, the file will be decrypted, but instead of relevant data there will be "garbage". It is important to note that I'm not talking about the ability to generate a file with garbage if the password is incorrect. I mean, that would be as if built into the algorithm itself. Is there something similar that I described? And if not, which way can I dig?

Standard cryptographic algorithms will do this.  If you use the wrong key in a standard symmetric cipher (like AES) it will decrypt the data into a random series of bytes that will look like nonsensical garbage with overwhelming probability.

A symmetric encryption/decryption function is best thought of as a pseudorandom permutation.  For any given key K and any fixed block-sized input (typically block size like 128-bits or 256 bits), your Encrypt function will map each n-bit block to another n-bit block and the Decrypt function will do the reverse mapping.  For a slightly different key, you'll get a completely different mapping.

That said, this inherent property is usually undesired.

So often times there's an extra check to ensure the key was correct (and if not indicate that decryption failed) -- that is they'll either make sure the padding is valid (which should rarely happen for an incorrect key -- though this will occassionally happen) or they'll check against a Message Authentication Code that verifies the key was valid.


Private Key and Public Key Serial Number and Thumbprints Are the private key Serial numbers and thumbprints the same as the corresponding public key Serial numbers and thumbprints for certificates (X509Certificates, Base64-encoded X.509), and are these good fields to compare on?

I am wanting to use this information as part of a validation process for a WCF web service, but want to be sure that both public and private keys hold the same hash or base64 values for comparison.

If these can be different, is there a better certificate field to use to validate?

The client will be signing their messages with their private key and I would be using their public key for the validation.

Keys and serial numbers are all properties of x509 certificates. Neither private keys not public keys have serial numbers.

However, matching a public key against a private key is surprisingly simple, since the private key contains the public key.

Specifically, both the private key contain a "public Exponent" (usually 0x10001 [65537]) and a "modulus" (a 2048-bit number for 2048-bit keys, typically written as a string of hex bytes).

Since the public exponent is the same for just about all rsa keys, what matters is the modulus. If the modulus on the public key is the same as the modulus on the private key, then the keys match.

In fact, you can take the private key alone and construct the public key just by saving out the modulus and public exponent; that's all there is to a public key. Since the x509 certificate always contains the public key, you're guaranteed that the x509 cert will therefore contain the appropriate modulus and exponent, which you just need to to match with your private key to verify that you have the right one.


Odd url showing up in my pubsub stream, should I be concerned? Background: Yesterday I started working on a simple metrics dashboard.  I have a VBScript on my internal network that queries a database over a VPN from our Vendor.  I then do a simple HTTP post to a node.js server listening on port 8000.  I have zero security.  All my script sends is a URL formatted like http://myserver.com:8000/name1,value2.  The server then takes these and creates a new timeseries based on the first value, if it doesn't exist, and plots a point based on the second value.  I pushed this to my public server yesterday about 2:00 PM.

This morning when I came in, there was a new time-series with the following URL as the name: http://testp2.czar.bielawa.pl/testproxy.php

Obviously I need to do some sort of validation that the data is coming from my network, but should I be concerned about this in general?  What other steps should I take?  The node.js server only parses the URL.  It does not even try to process a payload.  This data is not sensitive, it's just numbers of transactions for our customers and the customer names (which are publicly available).

The URL they requested explains everything. Your Node.js server is open to the public Internet, listens on a port commonly used by HTTP proxies, and a service that scans the internet for proxies stumbled upon it and decided to test it by requesting an URL and seeing whether your Node.js would return the contents of that URL (if it does, then it's an open proxy and would get listed as such in their database).

This particular attempt doesn't seem malicious. Sure, if they discover you're running an open proxy they'll most likely use it for malicious purposes (spamming, etc) but their scan is merely requesting an URL and isn't trying to exploit a bug or DoS your server. That doesn't mean someone else wouldn't try to attack and compromise your server, DoS your app by filling up its DB with garbage data or exhausting the bandwidth of the server so the legitimate HTTP requests no longer reach it.

Now, you should still think about security and whether you actually need this Node server to be reachable from the entire Internet... you say the data you care about is coming from your internal network, then why don't you put the Node server on that same network ? That way you avoid unnecessarily leaking data to the Internet and your company network's edge firewall will protect you from scanning attempts since there's no valid reason for that Node server to be accessible from the Internet, and you're no longer vulnerable to DoS attacks from the entire Internet.

If putting the Node server on the private network isn't possible, consider requiring TLS client certificates to authenticate the legitimate data source so that a client needs to have a valid certificate before even being able to establish the TLS tunnel and issue HTTP requests. Also make sure to follow security best practices such as firewalling, hardening SSH (key authentication only, and change the port to avoid scanners filling up your logs), etc for the server itself. Your Node app may be the most secure app in the world, but it won't help if someone can become root by SSH'ing in with a bruteforced password or by exploiting some other app running as root.


AES-CTR for local encryption How much sense does it make to use AES-CTR when you are encrypting local offline data? I always saw it in networking in action.

And it's not one time, so imagine you encrypt many times every day.

The performance is not an issue because the data is very small, but what security measures shall be taken?

I think the counter of the AES-CTR must be randomly generated every time and kept along the encrypted data in clear text, right?

How much sense does it make to use AES-CTR when you are encrypting local offline data?

Compared to CBC, it is easy to do bit flip attacks on CTR. So it makes the most sense when you are also checking a MAC when decrypting.

  I think the counter of the AES-CTR must be randomly generated every time and kept along the encrypted data in clear text, right?

If you change the AES key for each file, you could start counting at 0 (or a fixed IV). If you are not changing keys between files, you need to be absolutely sure you are choosing non-overlapping counter regions for your files or you will leak the XOR of plaintexts which is fairly catastrophic. Note that if you choose the IV randomly, it will almost certainly be non-overlapping at the block size of AES.


Will digital signature prevent tempering, or at least harden the cracking, of my Windows applications? I intend to buy my first digital signature intended for signing EXE files. In particular Certum Standard Code Signing caught my eye.

It is SHA-2 based with up to 4096 RSA.

Is it worth my money if I need to prevent cracking of the application. Well I am sure one could still crack it, but I hope it will be harder for some?

Code signing is just that - you add a signature to the file with your private key. This signature shows whoever downloads your file that it was signed in it's current form by the person holding the private key. If an application is popular, there is always the danger that someone alters the file to be malevolent. If the file is digitally signed, the user now knows that it was not altered after the people with access to the private key signed it.

This is all it does. It does not add any other form of security or prevent cracking of your application.


How to test the validity of DNSSEC from a command line interface? I am doing a research project on The Domain Name System Security Extensions (DNSSEC).

I have a SOA, Stub resolver and a client as well as a attack machine.

My question is this. Is there a way to test the validity of the record, after a DNS poisoning attack on a Linux client. This check needs to be done from a command line interface.

I verified that the DNSSEC records are set.

According to http://backreference.org/2010/11/17/dnssec-verification-with-dig/:

Obtain root keys.  You can do this with dig on an unpoisoned machine:

dig . DNSKEY | grep -Ev '^($|;)' > root.keys

Verify your target dns record:

dig +sigchase +trusted-key=./root.keys www.eurid.eu. A | cat -n

The other alternative is to set up a validating DNS resolver like unbound.  I use it to provide DNSSEC security on desktop machines.  It's easily available in Fedora 17.  Or BIND in Debian 7.0.  I forget whether there are debian packages which set up unbound for you, but it's not hard to do manually either.

Then run dig against your secure resolver, and it will show a flat error (SERVFAIL, I think) if there are invalid results.  You can also configure unbound to log details about each validation failure.


What can I do about TLS 1.0 javascript injection vulnerability on my server? The recent article featured on slashdot http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/ says that connections secured with TLS 1.0 are susceptible to man-in-the-middle decryption (the BEAST exploit).  I have an app hosted on Google Appengine, which seems to use TLS 1.0.  It relies heavily on javascript, so I can't advise my users to turn it off.  What can I do?

Theory of the BEAST Attack

SSL uses various combinations of public and symmetric key algorithms. (OpenSSL's list) When the symmetric algorithm is a block algorithm (as opposed to stream), cipher block chaining is used -- the previous block is part of the input to the new block.

The problems we're seeing right now are implementation-based, and they've been talked at least as far back as 2002. This CBC discussion notes that it's generally really hard to construct chosen plaintext in most protocols. HTTP with Javascript is allowing this to happen.

Why are we still suffering from this

We should be getting away from TLS 1.0 and moving on to 1.2. But of course, we still live in a world with SSL 2. More to the point, even where you can switch to newer TLS versions on your server, the ubiquitous NSS library doesn't support it. That means you wouldn't get Firefox or Chrome visitors.

You can use stream ciphers (RC4), and that will prevent the attack. I don't know if the empty opening message from my first link is used at all, or how that would affect various client implementations.

Your personal reaction

Help write TLS 1.2 into the NSS library. Make others know that you consider security a priority. If you have the time, do some research, testing which non-standard SSL configurations will work and what platforms they negatively affect. If you find out that RC4 works with everything, publish that so we know it has been tested.

If you don't have the time or capacity for that... wait it out. That happens too often, but at least a few folks are being squeaky about it.


Please define "Carpet Bombing" I saw a 2008 article about a certain vulnerability in WebKit which referred to "Carpet Bombing": https://www.cert.org/blogs/certcc/2008/09/carpet_bombing_and_directory_p.html (This vulnerability is now resolved using a blacklist - DLLs, JAR, and some other files are no longer downloaded without prompt)

What struck me was that the term "Carpet Bombing" seemed to exist nowhere else except for these Safari and Chrome items.

Was the term really coined just for this vulnerability in these browsers? Can you shed some light on why there is no Wikipedia article, or any other reference, except for this one particular case which I refer to?

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area.

Wikipedia says:

  Carpet bombing is a large aerial bombing done in a progressive manner
  to inflict damage in every part of a selected area of land.
  The phrase evokes the image of explosions completely covering an area,
  in the same way that a carpet covers a floor.

This ZDNet article shows what your Windows desktop looks like after the Safari "carpet bombing"
vulnerability has run.  The image from the article is shown below.

I suspect that someone called this "carpet bombing" because your desktop looks like a carpet has been applied to your desktop as each of the malware files on your desktop appear like a carpet pattern.  Each file could also be thought of as a "bomb" because when executed the malware will infect your machine.

Also, the vulnerability is "dropping" many copies of the malware indiscriminately onto the desktop in the hope that one will cause the malware to get executed.  This is much like the carpet bombing performed during war as described in the Wikipedia article.


Which algorithm for login throttling I'm about to add a throttle to a login page to stop it being brute forced easily.

I was going to use the leaky bucket algorithm to implement the throttle on a per user/IP basis. Is this considered OK or is there a different algorithm that is considered best practice for this situation?

I believe it should be more advanced and it should take into account origin of the requests to prevent DOS.
Most common is a lockout after a number of attempts but this requires a good unlock procedure that is secure. A lot of sites require a captcha or second factor after a certain amount of attempts.

Always combine lockout or throttling with a strong password policy. How often will an attacker need to guess based on that policy? That is an important factor in designing a lockout/throttling mechanism.

A good approach to protect a login could be:

Strong password policy
Captcha after 5 failed attempts for a certain user from a certain IP within 10 minutes.
Blacklist IP or trigger an alert after 100 failed attempts from a certain IP.


How a provider can tap an internet line even for SSL encrypted connection I heard once from someone I trust, that the French governement is about to buy and certify a software to put on tap an internet line even for HTTPS connection.
I don't really care about the legal issues it brings because  this product will be use anyway by law enforcment, but I'm quite interested in how it is possible.

In the case of HTTPS for example how a software on the provider level can decrypt your connection between you and a server without breaking some security of the HTTPS protocol like the fact that the certificate used for this connection is not valid? Or having no more HTTPS connection to any website (something I will notice for sure and any cautious person would to).

Did you ever heard of such a software or appliance (I don't know how it works at all)?
And if you do so, do you know how it works ?

Edit 1: Well maybe some of you misunderstand my question, I'm not asking if the MITM is possible with SSL or not because I know it is, as long as you manage one of the trust authority, which can be the case in a company for several reasons (I work on that once).
The point here is to put you Internet line on tap and being able to read any information you receive. This is not a problem on http/ftp/and other not encrypted protocol

But my question is more on the encrypted protocol with trust authority like SSL/TLS and the ISP point of view, is it doable or not?
ISP do not own trust authority in most case and they can't fake every certificate on the fly.

In my understanding of the SSL protocol that would mean to also hack into the tapped computer to add to it a fake trust authority, but that doesn't sound either legal nor realistic with the multiplication of device.
Again the person who told me that is someone I trust and I'm really curious about the truth of that statement.

One idea for example:
the ISP setting a DNS Poisonning on the internet line to redirect any trust authority request to it's own authority , does it sounds possible to you ?

PS: I'm not working for anything I don't support those kind of solution but I'm really curious about how it's even possible.

There are organizations that have "legitimate" reasons to tap your encrypted communications.  Your workplace, for example, might record your internet traffic to make sure you aren't using the company computers for illegal activities. Or they may be providing malware filtering services.   They can tap https traffic by using a proxy that injects itself as a man-in-the-middle.  The workplace computers are first given a trusted root certificate issued by the proxy (on a Windows network, these are often pushed via Group Policy.)  When your browser attempts to connect to https://www.google.com, the proxy creates a new certificate that authenticates your connection to the proxy, and sends it back to your browser.  Because it's signed by the trusted root, your browser accepts the connection.  The proxy then establishes an https connection with google on your behalf, and sends the communications through the proxy, logged and filtered as the company requires.

BlueCoat (now owned by Symantec) makes such a product, if you're interested.

This won't simply work if the client doesn't trust the MITM proxy.  The client will get "invalid certificate" warnings about every encrypted site they attempt to connect to.  Some people will simply check the box and surf anyway, unaware that they have been attacked.

You can also test this out for yourself using BurpSuite (the free edition can do this.)  Configure BurpSuite to proxy https sites, use it to generate your own certificate, and then configure your browser to use Burp as your proxy.  When you visit an https site, you'll see the "wrong certificate" warning messages.  If you then add your generated certificate to your browser's Trusted Root certificate store, you'll see that the warnings go away, while you still intercept all the traffic in Burp.  Here's a tutorial you can follow to do this:  https://portswigger.net/burp/help/proxy_using.html

Another way to tap an encrypted connection is used by the NSA.  They have a system called QUANTUM that is located at key sites in the backbone, and can respond faster to a request than the legitimate site.  They can then redirect the traffic to a FOXACID server, which will attempt to exploit the computer sending the request.  If they can inject a root certificate (or if they have already compromised a root certificate that your computer already trusts,) then they can inject a man-in-the-middle proxy just like the BlueCoat system above.

EDIT:  Since you're asking about the ISP performing a MITM attack, know that in the past some ISPs have distributed software to their customers on "installation setup disks" that were included with the rental modem.  If you install their disk, you run the risk of installing their certificate in your machine.  I don't know if any Western country's ISPs have (legally) done that, but I wouldn't be surprised if certain countries with tightly monitored communications already do this.


Trouble trying to understand SET protocol This is the first class I'm having on security and one of the concepts discussed is the SET protocol. I've read about it in many different sources and although I came into many unknown terms, after looking into them one by one I think I now have a basic understanding of the protocol.

One of the things I don't get is related to the dual signature. I realized that the dual signature came about in order to prevent merchants from altering order information and charging a customer for different items.

I think I've worked out why the dual signature prevents this from happening. However, I can't see how the dual signature prevents the customer from altering the information. I'm sure I'm missing something.

Here is my point of view.

The customer sends the dual signature to the merchant. The dual signature consists of the order information and the purchase information. There is some decryption and hashing going on but the point is the merchant can only see the order information and the 'bank' is only able to see the purchase information.

However, in every source I've found it is stated that the order information doesn't contain anything about the items or the cost of the order. So, what prevents the customer from including  a different price in the purchase information?

The only thing that is common is the transaction ID. From what I've read , this ID is included in both PI and OI. I think that this ID is what tackles the problem. But again, this ID is just a number. It could be the same ID in the OI and PI but the information  could still be different in each one.

I think there is more to the transaction ID than I'm aware of. Something that guarantees that the transaction ID refers to a specific order, items, price etc. Who creates this ID?

I hope my 'gap' is clear the way I described it.

The dual signature is encrypted with the customer's private key, so the banks can use the public key to decrypt it. The contents of the dual signature is a hash of the digest of the purchase order and the payment info, and anyone with both digests can reproduce that value.

The merchant gets the purchase order and the digest of the payment information, so the merchant can produce the PO digest. Thus they can take that and the PI digest, hash them together, and verify whether or not it matches the decrypted dual signature.

Your bank gets the payment info and the digest of the purchase order, so your bank can produce the PI digest, and hash that with the PO digest. They can then verify that matches the decrypted dual signature.  In your scenario, they're the ones that find out you've lied to them because the hash they get of the PO digest and the digest they make from the PI doesn't match your dual signature.

If the two sides don't get the same signatures, they can tell there's a difference when they talk by comparing them. If there's a difference in the documents you gave each party and the digest you gave the other party, then one of the sides won't get a match between their hash of the two digests and what was in your dual signature.

They could also just compare the digest they were given with the digest of what the other party was given, because they're allowed to talk with each other. They're just not allowed to give the unhashed documents to the other.

The transaction ID is only necessary for them to compare notes on what they're talking about.


SQL injection with AND 1=1 Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university.
E.g.

select * from user where id = 'smith'' AND 1=1;--  and birthdate = 1970;

or

select * from user where id = 'smith' and birthdate = 1970 AND 1=1;--;

The specific question is SQL injection with AND 1=1 and not OR 1=1. There is a big difference here in what the OP is asking about. If I were your teacher and you provided me with JonathanMueller's answer you would get a lousy grade as you dont understand the question.

AND 1=1 is usally used in blind SQL injections. This is when you have to determine between a true or false state from the result of the application to make out what the actual result is. You don't get data listed out in the result, the only thing returned is a state of change.

If you try to exploit a Blind SQL injection with OR 1=1 you will fail because the primary use of OR 1=1 is to create an always true statement in order to get the most data out of the database or to force a true statement in the case of a login script being exploited.

A practical blind SQL exploit example:

  We use our example: http://www.site.com/news.php?id=7
  Let’s test it:
  http://www.site.com/news.php?id=7 and 1=1 <--- this is always true and the
  page loads normally, that's ok.

  http://www.site.com/news.php?id=7 and 1=2 <--- this is false, so if some
  text, picture or some content is missing on returned page then that site is
  vulnerable to blind sql injection.

Another example where you try to figure out MySQL version:

  http://www.site.com/news.php?id=7 and substring(@@version,1,1)=4
  This should return TRUE if the version of MySQL is 4. Replace 4 with 5,
  and if query return TRUE then the version is 5.

Examples taken from: http://www.exploit-db.com/download_pdf/14475


Mitigate resend confimartion email flooding While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration emails (of course, as long as the user exists and hasn't confirmed their email).

My first idea was to limit request per-session, however, this can be bypassed very easily. Per-IP limit is too much trouble too implement and can be bypassed too (i.e. using several proxies), so I'm confident there must be something simple enough to mitigate this sort of exploit.

Rate-limit on a per-user or per-email-address basis.  Since re-sending confirmation emails is rare, setting the limit absurdly low (say, two re-sends per day) should be sufficient to keep from flooding a user.


I have one Friend that said he is getting texts from me but its not me A friend of mine is getting a text asking him to click on a link to view a video.  The name is my first and last name.  Most people do not spell their first name as mine but there is no phone number and the email address shows up under "other".  I googled the email address and the email address belongs to a teacher in Texas.  I only have one friend that notified me of this.  So who is hacked? Him, Me or the Teacher?

It is possible to send a text message to a phone via almost any Email service.
There are email to SMS gateways for each provider, and there is a specific email suffix for each provider. For example, to text a number 1234567890 that happened to be an ATT number, you would send an email to 1234567890@txt.att.net.
People can change their name in email services to whatever they wish, so it appears they are simply sending an email with your name entered in the email service configuration. The phone takes that name information and displays it along with the text message. It appears that this is simply an email to SMS message, and not an SMS spoof which would display an actual phone number and not an email address.


Why can Oauth2 redirect_uri be a non-https URI? I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is really awesome right now)

Upon reviewing the OAuth2 spec, I can't wrap my head around the possibility of exchanging a token via plaintext as not being prone to vulnerabilities. I know this is a basic question, as I'm pretty new to the crypto world. And of course I know that such an obvious vulnerability (if existent) has been already addressed.

The question is: how? How does the spec deal with the token being sent to the user agent in plain-text and redirected to the client in a potentially non-secure way?

The answer is pretty straightforward: it doesn't. If the token is sent over cleartext then you're hosed. The spec doesn't provide mitigations for security issues that arise from not following the spec's recommendations.

Alternatively there is some relief in using the code flow because you're passing a nonce of sorts (the 'code') over cleartext instead. You have to exchange the code for a proper token through a backchannel service, which should be over SSL. This way the token itself is requested over a secure channel.


Are VPNs that expose device ID a security risk? This is the first time I am using a VPN on my stock Android device. I bought VPN Unlimited mainly because it was on sale and without evaluating competitor products

I was playing around with it and it does mask the external IP well on any location I choose. But my concern is with Device IP/Local IP. That does not get masked as you can see from snapshots below (Open VPN Protocol).

This is from the device IP as shown in the app:

These are from webkay and Browser leaks. As you can see Device IP/Local IP are not masked and are clearly visible.

I have read these (and understood at a high level since I am not familiar with VPN security aspects):

How can you be caught using Private VPN when there's no logs about who you are?
How can meta data be used to identify users through chained VPNs?

Questions

Is this expected behavior of VPNs?
Is it a concern or risk? (The 2nd question above seems to indicate that it is indeed so.)
Should I be concerned, considering my usage pattern (which is occasional banking, shopping and maybe in the future visiting restricted sites if need be)?

I have written to VPN Unlimited and so far they have not given a clear reply. This makes me more suspicious and hence thought of asking here

You mention different threat models: does it matter if a banking/shopping website can use this information to identify you? Probably not, because you are likely logging in with an account that is already tied to your identity, payment information, home address etc. However, regarding "restricted sites", where you might be trying to hide your identity, this leaked information could reduce your anonymity.

The information leak is not characteristic of VPNs—the VPN is operating on a different/lower layer; it does not control or affect what code you allow to run on your device (unless the VPN provider is actively modifying your traffic—bad). Code that runs on your device, JavaScript, WebRTC-related, or otherwise, can access device APIs that provide information such as location, interface IP addresses, browser/OS information, battery state etc. So VPN or no VPN, this information can be accessed. This leak can only be resolved by changing browsers or browser settings, and there are certain web browsers and browser extensions that are designed to help with this, usually by disabling the features or providing false information.

In the webkay screenshot you posted, there is information that may help you disable these forms of tracking; disabling JavaScript and WebRTC is a good start. However, VPNs aren't truly designed to provide anonymity, although they may help to a degree. Solutions such as the Tor network and the Tor browser bundle are designed for anonymity and privacy and may be a better choice in this case.


Inspecting code elements in browser when logging in When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?

Yes, this is normal.

The networking tab in the Chrome developer tools show network operations for the website you are on, but all this traffic would be encrypted over the wire if the site uses SSL/TLS.

For example, here's a login captured on a website with SSL/TLS:

General
    Request URL: https://www.w3schools.com/action_page.php
    Request Method: POST
    Status Code: 200

Form Data
    uname: someUsername
    psw: somePassword
    remember: on

And if Wireshark is used to capture the post request, all you can see is some encrypted data.


Is GNU shred relevant for SSDs? The Gutmann method,  which apparently is used by GNU shred, has appeared in 1996, which focused on finding random 5 to 31 patterns and taking into account particular magnetic encoding. Considering that now we have SSDs, I'm guessing that Gutmann method isn't relevant for that storage architecture, as SSDs use NAND memory rather than magnetic encoding. Does this then make shred obsolete/overkill as far as SSDs are concerned ?

The Gutmann method is not useful for any modern device, whether a hard drive or a solid state drive. The fact that you cannot safely wipe a solid state drive due to wear leveling is irrelevant. For any modern hard drive, the best way to erase data on it is to wipe it once with a random pattern. For modern solid state drives, there is no effective way to wipe it without using SED or TRIM.


Can I trust the SSL certificate on the client side? I want to make sure that I am connecting to the right server with my client side (it's an encrypted chat, irrelevant) I am using SSL3.
Can someone just fake a certificate? Can I really trust that the connection is to the right server?

TL,DR: Yes, you can trust the certificate.

Long version:

You browser have a list of trustworthy entities, named Certificate Authorities (or CA, for short). They have the task of signing SSL certificates along the way. They must comply to a lot of rules, and if they mess up, they can be axed from this list, and all certificates they emitted got invalid overnight.

(That happened with DigiNotar)

When anyone wants a SSL certificate( e.g John Doe), he goes to one of those companies, and ask for one. Usually the issuer have some kind of verification to determine if you owns the certificate you are asking a certificate for. If so, you get the certificate (it's just a text file) and put it on your webserver.

The certificate can be changed if you are under a corporate proxy that performs SSL traffic inspection (an intercepting proxy). They intercept the connection, decrypts the traffic, analyses, creates another certificate, and sends back. In this case, a certificate appearing to be from Google.com was not issued for Google, but instead issued from your proxy.

Sometimes, people can get a certificate for a domain they don't own. That usually happens when those people intend to perform a phishing attack against the users of the legitimate domain.

If someone issued a certificate without using the services of the CA, your browser will complain. Depending on how the certificate was created, it will say the certificate is self-signed, or the certificate chain is invalid. In this cases, you obviously cannot trust it.

So, except in almost negligible situations, you can trust the certificate.


What are security problems with hole punching technique in the context of IoT? Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented by some connected IP cameras to allow users to control their devices remotely through an intermediary cloud server (figure).

Source of the figure.

Question: What are flaws or vulnerabilities in this technique that a hacker may exploit to remotely attack an IoT deployment (e.g., Smart Home)

Cloud based team viewer or similar solutions to remotely control a camera have risk of

how do you decipher a legitimate remote user and a malicious hacker with a stolen password logging in?
the cloud provider themselves could be comprised or have a vulnerability that gives an attacker access to your internal network.

More important thoughts are

do you have logging of every time it's remotely accessed?
is your camera segmented off so that even if an attacker remotely logs in they can't do damage to the core part of your network?
do you have 2FA/MFA required in the remote access cloud account so you can't be breached by a simple stolen password?


Uniqueness of name in cryptography If I publish my public key (I think I understand how this works, I'm still learning encryption) and I have a common name, could this leas to problems at all? OR does the email part guarantee that this will work fine? Does this not make it extremely easy for someone to compromise my identity?

In retrospect, this seems like an extremely stupid question.

I'm not sure I entirely understand your question, but I'm going to make some assumptions... I'm assuming your taking about PGP encryption and sharing your public key. Let's say your name is "John Smith", now just doing a quick search on John Smith comes up with hundreds of results so lets look at two I picked at random[1] let's call them John Smith A0xA414B7C7 and John Smith B0xB82A4EAA

Let's say you are John Smith A. If I understand your question correctly you are asking if there is a chance that John Smith B could send a file and because it's PGP signed/encrypted someone thinks it's from you?

PGP protects against this allowing people to Sign keys. Your friends could sign your key to say this really is John Smith A. Similarly the person your sending the file to could download your public key and then they could check the key used to encrypt / sign the file matches the key they expect and is not some other John Smith.

You could also use some Out-of-band method to send someone your key's finger print (like printing it an mailing it to them) so that even if J. Random Hacker created a key and said his email was the same as yours it wouldn't match because your keys fingerprint would be different to his.

Decrypting a file that was encrypted with a key you don't trust should give you a warning message.

[1] Ok, to be fair it wasn't truly random, I picked them because their finger prints started with A and B but I don't know who they are.


Spam link sets cookie(s) then redirects to google.com - what would be the point of this? Should I be concerned? Received a spam link about "a package soon to be delivered" via an SMS message. Didn't click it in my phone, but couldn't help myself but to go to the URL in a browser on my laptop :grimace: (not great, I realize, spare me the lectures).

There were no response bodies - seems the only thing it did was set headers and of course possibly log any information it could get about me from the initial request.

Wondering if anyone can speculate intelligently about the possible purpose of this and if I appear at a high risk of having been compromised in any way? I have cleared the cookies and other browser data and restarted the browser.

Here's the gist of it:

This is an attempt to defeat mail security filters that check links contained in mails whether they lead to a malicious site.
The link in the mail goes to a redirection under the control of the attacker.
When the mail is delivered the redirection goes to a harmless site so the filter lets it pass.
Later when the mail has been delivered but not yet read, they arm it by switching the redirection to a malicious site.


XXE - Encode file content In my current assessment, I came across an XXE. Unfortunately, I cannot retrieve a bunch of files that would let me progress further (such as .bash_history and any other .xml/config files) because the xml parser just hangs if it encounters any special chars in the file (such as <, ", etc...)

Is there a way to force the xml parser to encode the file's content (in b64 for example) first and only then return it?

You should wrap your data in CDATA. It's a bit tricky but the technique is well explained here.


is it possible to bypass cookie protection to perform a CSRF on HUAWEI HG531 v1 router? the AJAX login script

var xhr1 = new XMLHttpRequest();
xhr1.open("post", 'https://192.168.1.1/index/login.cgi', false);
xhr1.send("Username=admin&Password=6836394be82df057e085fc344c6179d1b50b30224ad0SJ0GQrNWmpsXCSk5so7o73f93282&challange=SJ0GQrNWmpsXCSk5so7o");

the problem is it gives me this error

  Login Failure: Browser did not support Cookie. Please enable Cookie

and i can't send a cookie header cause it's a Forbidden header name ..... the page after i press login it sets the required cookies to perform a login . is there any way around this ?

some lines from the page source code that i think are important

var strCookie = document.cookie;

document.cookie = cookie;

var cookie = "Language=en" + expires + ";

var results = document.cookie.match ( '(^|;) ?' + cookie_name + '=([^;]*)(;|$)' );

By default, XMLHttpRequest does not include cookies. Use withCredentials to send cookies along.

As an alternative, you can create a HTML form and submit that with JavaScript. This sends cookies along by default.


HTML login form without a CSRF protection We've recently got a vulnerability report saying that one of our HTML forms in one of the internal applications is not CSRF protected. At first, we could not immediately reproduce it manually using the developer tools looking at the headers and cookies finding the XSRF-TOKEN present in the headers.

But then, we reproduced the problem in the incognito tab or a "clean" browser. The problem was in the very first login attempt only. It appears that at the moment the first login request is posted, the client does not yet have the XSRF token since this is the very first interaction between the client and the server.

Is it still a vulnerability and should be addressed if only reproduced on the very first login request? How is this kind of problem generally addressed? There probably needs to be some sort of client-server interaction before the login form submission so that the client would get the XSRF token beforehand.

This is called "Login CSRF" and is indeed a real problem that you should address.
While an attacker couldn't fool a victim to log in to their own account since the attacker doesn't know the user's credentials, an attacker could fool the victim into logging in to the attacker's account. This can be used to trick a victim into giving up information to the attacker as the victim believes that they are signed in as themselves.
This is indeed something that has been used to malicious ends. From Detectify:

PayPal was once vulnerable to login CSRF and the attacker could make a user log in to the attacker’s PayPal account. When the user later on paid for something online, they unknowingly added their credit card to the attacker's account.
Another, less obvious, example is a login CSRF that once existed in Google, which made it possible for the attacker to make the user log in to the attacker’s account and later retrieve all the searches the user had made while logged in.

Even if you can't think of any way this could be leveraged on your site, a clever attacker might. There is no reason to allow it.
So how do you block it? Even if the first action the user take is to log in, the first interaction they have with the server is to fetch the login page. Thats an opportunity to assign a CSRF-token. Then check for it on all requests that change the state of the server, including the login.
(A tangentially related vulnerability is session fixation. Having CSRF-tokens that persist past login can expose you to that, so read up on that before you start implementing a solution.)


What security measures can stop an attacker to obtain reverse shell even if a victim clicks and downloads a malicious exe file? I am doing some hands-on training with Kali linux and one of the exercise I came across was to make an exe file containing malicious payload(say to obtain reverse shell), send it to a victim and hope for the victim to download the exe file. If he/she downloads it, it is fairly easy after that.

Now this isn't tricky at all, assuming the fact that many users aren't aware of security. But in real world, to carry out this attack, there must be more hurdles that an attacker needs to cross for exploitation?

What are those security measures that stops attempt to exploit users? For example I can think of firewall which tries to detect malicious looking requests.

Please answer the question for both internal and external attacks.

There are a number of ways that people attempt to mitigate these attacks.

External

Prevent spam filter from allowing MIME types frequently associated with malware (it's highly unlikely there is a business relevant reason to send .exe or .bat files for instance)
Use Anti-Virus as .exe's can be detected even after several rounds of encoding. Preferably you'd want "behavioural based" anti-virus which block applications based on actions they attempt to take.
Educate your staff on how to spot threats and what to do should they encounter them.
If you're IT department is big enough and you want to pull your hair out figuring it out, software restriction policies can be implemented to only allow known .exe's from running
Disable the ability for executables to run from the temp directory / directories
Implement firewall egress filtering. Set up a proxy with deep packet inspection that intercepts SSL / TLS connections and blocks outbound traffic that seems suspicious.

Internal

Do not give local admin access to end users. Just don't. If they need to raise privileges assign them a special account that they have to use the "Run As..." functionality to use, but end users should not have administrative privileges on their workstations.
Software restrictions / egress filtering / AV / Education / disabling executables from temp directory all still apply for internal
Segregate your network to prevent lateral movement in the instance there is compromise


Generate digital certificates for employees using the organization's certificate I live in Peru and we have a small problem in the organization where I work. Dozens of documents are physically signed daily but this is a waste of time since there are documents that must be signed by more than one person and these people are in different geographical locations.

I am thinking of using digital certificates to sign PDFs but this causes me another problem. Certificates are issued in the name of the Organization, not of the employee who signs. Buying (and processing) the generation of a certificate with legal validity for each employee will take time and money so my question is the following:

Is it possible to generate new certificates for each employee (with legal validity) using our institutional certificate as root certificate?

No, you can't use your purchased signing certificate to sign other certificates. It is not allowed. Although, you can try, but signature will be untrusted. The ability to sign other certificates is governed by Basic Constratins and Key Usage certificate extensions and values of these extensions in your certificate don't meet criteria. For more details about Basic Constraints in action you can check my blog post: Basic Constraints certificate extension.


Should I trust Teamviewer? One of my colleagues asked me to install TeamViewer so he can help me at work. Should I trust TeamViewer? I mean, will they be able to spy on me?
Do I have full control of what they see of my computer and when?

We cannot know what Teamviewer does with your data but there are some security risks you should watch out for:

Don't share your private details on a public screen. Some people use Teamviewer to get to screens that are placed far away or high up off the ground (advertising boards and etc) which are available to the public to see. If the Teamviewer details are displayed any user can login to that PC.
After using it renew the private code or uninstall it if not needed anymore so no one can login with the same code again.

If you really do not trust it you can try other programs such as standard RDP.

You can also read a little more about the Teamviewer connection in this question.


Any Security Risks for using mailto:? I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format

mailto:example@test.com?subject=SEARCHED_QUERY_HERE

The SEARCHED_QUERY_HERE is replaced with the search team that user searched which returned no result, Can anyone exploit it? (i encode SEARCHED_QUERY_HERE)

You need to URL-encode SEARCHED_QUERY_HERE, otherwise if a user searches for &body=something, the body of the e-mail message will be set to something. Also, if you don't URL-encode it, if the user searches for a literal %20 (or similar) it will appear as a space in the message instead.
This is not a security risk, though.
The other, obvious risk is that if you don't properly HTML-encode the SEARCHED_QUERY_HERE, it will lead to XSS. But it appears you're already doing so, so you're covered.
Some programming languages, such as PHP, require you to explicitly specify that quotes must be encoded as well, so make sure you pass the correct arguments to your HTML-encoding function.
Example (PHP)

echo 'Link';


password cracking: time vs cost I often see people refer to arguments like: A (hashed) password will be cracked in 1.000 years if you use a normal desktop computer, but if you use 100.000 computers (botnet) it will be cracked in under 4 days. The "1.000 years" password seems fine, but the 4 days not. I think the "time" model is misleading.

Shouldn't we find a better model for how strong passwords are? We could estimate the cost in dollars?

What is a good metric for password security?

The technical definition of password strength already exists in terms of bits of entropy.  Essentially, it's the number of guesses required to arrive at a given password.  A password that is 4 digits long has 10,000 possible values, so only 10,000 guesses or less would be required to guess it.  These are expressed in powers of 2; 10,000 is approximately 2^14, so we would say it has 14 bits of entropy.

14 bits of entropy isn't a lot; a password that short can be brute forced in javascript in a browser in just a few moments.  It's generally true that attacks up to 2^48 are easily achievable by a modern desktop computer; more if the attacker has customized hardware.  In 2012 someone housed 25 graphics cards in a PC and was able to sustain 348 billion hash computations per second.  For safety, we must assume the attackers get better over time as their hardware improves.

But computing hashes isn't the whole story.  Beyond that, there are ways system owners improve security by using a better hashing algorithm, a better protocol such as PBDKF2 or bcrypt, applying salt, throttling guesses, custom hardware, etc.  Rate limiting is very effective if you control the hardware: an iPhone passcode has only 2^14 bits of strength, but the custom chip built inside the machine will destroy its secret embedded encryption keys if the wrong passcode is entered 10 times.

On the other end of the scale, 2^80 bits of entropy are approaching the limits of imaginable attacks.  It seems unlikely today that anyone could brute force crack an 80 bit password at home; it seems almost unthinkable that any entity ever could brute force crack a 128 bit key.  The iPhone being studied by the FBI uses encryption keys that have 256 bits of entropy, and at this we know of no way to brute force those.  Yet advances in mathematics and cryptographic research, and advances in hardware (such as quantum computing), have proven time and again that nothing should be declared uncrackable.

And defense is only half the picture.  There are ways attackers can improve their attacks besides the custom parallelization mentioned above: they can use wordlists and tools like John the Ripper to prioritize guessing passwords based on the language of the user, rainbow tables are easily downloaded, collisions, malware, research on the target, zombies in a captive botnet, and other techniques can all reduce the search space.  These all depend on the capabilities and dedication of your envisioned adversary.

Given that both offense and defense are not statically defined, each combination of implementation and threat model are specific, and are not really comparable to any other installation.  That makes it hard to assign a fixed estimate of cost or time on a basis that is comparable between different password implementations.  The most accurate things we can say are "this algorithm has x bits of strength", "this implementation multiplies attacker effort by 60,000", etc.


Why can I sign but not encrypt? -edit- After following a chain of links from this question I see this is similar/duplicate of Why should one not use the same asymmetric key for encryption as they do for signing?  but this question is asking if there is a technical reason why we shouldn't and the linked is less technical and not exclusively to rsa

I may have the wrong understanding. GPG lets you generate a RSA key that is sign only. From my understanding an RSA key is a public and key pair. Signature works by hashing the message and encrypting it with the private key and others decrypts it using the public key. From my understanding if the hash matches what is decrypted than the message is signed.

How can GPG generate a key and sign it but not let me encrypt messages? I believe in another app it suggested you have one key for signing and one key for encryption but there was no reason why. Wouldn't that be confusing because an encrypted message and a signed cleartext would be using different keys and appear to be from a different user?

Please don't use the "explanation" of signatures as "encryption with the private key" because it is a flawed analogy that does not actually work.

RSA is really two algorithms, one for asymmetric encryption, and one for signatures. It so happens that the two algorithms have some common mathematical elements, and, in particular, use the same kind of key (which is why we call it a "RSA key", not a "RSA encryption key" or "RSA signature key"). Thus, it is conceivable that a given RSA key pair may be used for both encryption and signatures.

However, there are good reasons why you would like to keep encryption and signature keys separate. The OpenPGP format acknowledges that, and thus "tags" keys with an indication of their intended usage. Therefore, your signature-only RSA key is a RSA key that OpenPGP tagged with a label that mostly says "please don't use that key for encryption".


How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?

My goal is to allow my application to support a variety of key stores, and should the administrator decide they want the Private key to reside on those devices, I want to be able to support that.

Is there a consistent, or universal way to access these devices?  Is there a way through C#?

In the Windows world, cryptography with special hardware goes through the "Cryptographic Service Providers" (CSP). A CSP is a module registered in the OS, which offers access to such a kind of hardware.

From C#, you can look at RSACryptoServiceProvider, which can be created with some parameters which designate a specific CSP.

The non-Windows world tends to use PKCS#11 for that. Google finds some software packages which can apparently use a PKCS#11 DLL (i.e. the driver for the crypto hardware) from C#; e.g. pkcs11.net and NCryptoki (the former seems to be open source, not the latter).


Do I need to purchase a PCI DSS certificate? I'm creating an e-commerce website and I was wondering, do I need to purchase a PCI DSS certificate or do I just need to comply with the standards?

It's likely that PCI-DSS doesn't really apply to you. Most e-commerce sites outsource their payment to a payment processing company, e.g. PayPal or Google Checkout. This means that you never store financial information about your customers.

But, if you want to do it yourself, and you'll be directly storing and accepting card payments, then you should read the PCI-DSS guidelines and understand fully what's required before going ahead. PCI-DSS isn't just a certification - it becomes part of the contract you have with the bank that accepts your funds.

If you're not experienced in security, you'll need to get training. Same goes for any developers you hire. You may also be legally required to follow certain government laws related to data storage (e.g. Data Protection Act in the UK), which will require further study. You might need to consult a lawyer.

Once your system design is complete, it's worth paying a security consultant to identify any security problems that you might face. From there, you can move to implementation. You'll need to follow strict code security guidelines, as well as take careful consideration in chosing your hardware and hosting platforms. You may need to invest in a HSM or a similar system to store credit card details, depending on applicable laws and regulations. Once you've completed the development, you'll need a security review by a company certified to provide PCI-DSS compliance tests. These tests usually involve normal penetration testing, as well as checking for complaince in all areas of the standard.

Once that's all done, you're (probably) PCI-DSS compliant. Your bank may ask you to perform periodic re-testing of your site.

All in all, it's not cheap or easy to comply to PCI-DSS. It may be wiser to let the payment processing companies handle this burden, and focus on making a better online experience for your customers.


Volatility Plugins Directory Using Windows I'm trying to use a plugin (not built-in) with volatility 2.4 but am having trouble with the syntax. I know that at least for the native python (vol.py) the plugins option must be specified directly after vol.py. I've tried specifying the plugins directory as an absolute path and a relative path.

Command example:

volatility.exe --plugins=C:\volatility\plugins -f=memImage.mem --profile=Win7SP1x86 usnparser > usnparser.txt

Inside the plugins directory is:

usnparser.py

The error message I get is:

ERROR   : volatility.debug    : You must specify something to do (try -h)

This is the error I get anytime I specify a plugin that doesn't exist. I've tried this with a few plugins that don't come with volatility. I get the same results every time. Will probably move to using the default python version, but I'm curious why I can't get this working with the Windows executable.

As mentioned, this may be off topic, but I will go ahead and describe the solution I found. My issue was that the plugin I was using was corrupted. Nothing else was wrong. However, it is important with Volatility that when an external plugin directory is used, the --plugins option must be the first option specified after the executable or it will not work and no error indicating why will be given.


Can you access Google Drive documents if you have the absolute path to the file? I have been digging into Google Drive while I am trying to investigate a proper way to protect files on a site. In my experience if a user has the URL to a file they can access it without any protection, like Facebook images for example.

However, Google Drive has a different method. For example an image has the path
src='blob:https://drive.google.com/cbdb6dfeSOMEBINGHASH----a3c121353655.

So how is Google Drive protecting these files? And if I could guess the URL to a file, would I be able to access it?

The answer to the main question is NO. Each individual file has its own permissions.

  Choose an appropriate sharing setting — Private, Anyone with the link, or Public — for your files, folders and Google documents.

Source: Google

Google generates an ID based on the sharing permissions and just authorized sessions (to the Google IaaS) are able to retrieve the file.

  Downloading the file requires the user to have at least read access.

Source: Google


Is there a benefit in measuring randomness? How would it be done? Is there any benefit in determining how random a given file, stream, signal is?

I guess this would be useful to determine

If something is (poorly) encrypted
To verify the proper encryption of a file, data  (GCM, SALSA20, or unknown cipher)
To detect that a covert signal is being sent

Assuming I'm the role of either "Bob" or "Mallory", how would I measure how random a given stream of 1's and 0's are? (using any cipher method)

Oh boy, philosophy time. What is randomness? Can randomness be measured? What is a signal anyway?

Intuitively we can say that Thing A is more random than Thing B if it has more higher entropy. Entropy is one of those concepts that's easy to define and talk about, but actually measuring it from a data set is a statistician's nightmare. If your RNG outputs aaaaaaa... either your RNG sucks lemons, or you hit the one in a 10-n chance. With only one data point, it's impossible to tell.

For any statistical analysis of randomness to be at all meaningful you need at least a million samples generated in a lab environment where you can prove that your RNG was properly seeded for each sample. And even then you have to be very careful about which statistical tests you use because they all have a bias towards certain types of patterns. Trying to draw any conclusions about the quality of the randomness with less rigor than this will be ... inconclusive at best.

Bottom line: measuring cryptographic entropy in practice is hard and best left to researchers.

So that's the theoretical answer. In practice you can get a very rough idea of the amount of randomness in a string or file using the methods mentioned in comments / other answers: run it through a compression tool (which is a sub-category of Kolmogorov complexity tests), or one of the entropy-estimating stats tests mentioned in @EdwardBarnard's answer.

This type of thing is probably good enough for distinguishing an encrypted file from a plaintext file, but probably couldn't tell the difference between a compressed file and and encrypted file, or for that matter between a properly encrypted file and a badly encrypted file.

As for detecting covert signals, you're kinda out of luck if you're looking for a general solution. Tell me which off-the-shelf statistical tests you're using, and I'll design a steganography method that fools it. To have any hope of detecting this, you need to know a fair amount about the statistical properties of both the carrier signal, and the expected hidden signal, and design a detection algorithm around this. And of course the more noise naturally occurring in the carrier signal, the more places for covert signals to hide.


XSS Technique - & JavaScript Include I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me:

  & JavaScript includes

I tried out the following HTML:

        <title>test</title>

on Firefox 31.0 and it didn't seem to work (i.e. no alert box). Did I miss anything, or is this technique only applicable to older browsers?

JavaScript, the Definitive Guide, 4th Edition - published in 2001 - mentions these in a bit more detail. The relevant section appears to be freely available. It's right at the bottom of that link. Here's the excerpt:

12.2.5. JavaScript in Nonstandard Contexts
Both Netscape and Microsoft have implemented proprietary extensions in their browsers, and you may occasionally see JavaScript code in a context other than those described here. For example, Internet Explorer allows you to define event handlers in a <script> tag that uses special for and event attributes. Netscape 4 allows you to use JavaScript as an alternative syntax for defining CSS style sheets within a <style> tag. Netscape 4 also extends the HTML entity syntax and allows JavaScript to appear within entities (but only within the values of HTML attributes). This can result in HTML that looks like this:
<table border="&{getBorderWidth( )};">

Finally, Netscape 4 also supports a form of conditional comment based on this JavaScript entity syntax. Note that Netscape 6 and the Mozilla browser on which it is based no longer support these nonstandard uses of JavaScript.

So it's an abuse of the typical HTML entity syntax - the kind where we use &amp; to produce an ampersand. Instead of writing amp, I write {alert('oh no')}.
However, the book mentions that Netscape 6 - released in 2000, around the time of IE6 - and the very early Mozilla browser were already taking action to eliminate this exploit. It's fairly unlikely it exists in recent browser versions.
If it ever affected Internet Explorer (which isn't mentioned as even permitting this in the first place), I have no information on at what version it ceased being a viable IE exploit.


Deriving an authentication password from an encryption password I'm building an application with the following requirements:

A client logs in with email and password. On the server, bcrypt(password) is computed and compared to what is stored in the database.
If authentication is successful, the server sends a block of encrypted data that will later be decrypted on the client. (At some point in the past, the data was encrypted by the client and sent to the server.)
The password for the encrypted data must never be sent to the server, so I can't use the same password for authentication and encryption/decryption.

One solution that would fulfill these requirements is to just use two passwords: one for authentication and one for encryption/decryption of the data. However, users will need to remember two passwords and could mix them up, accidentally sending the decryption password to the server and violating the third requirement.

An alternative that requires only one password: use the password for encryption/decryption and bcrypt(password) for authentication. That way, the database would store bcrypt(bcrypt(password)) and the server would never handle the encryption/decryption password.

Is that a reasonable thing to do or am I overlooking a security issue? The additional computation/login time caused by computing two hashes wouldn't be a problem.

The more appropriate solution for this kind of thing is a prefix.

For example:

Authentication key = bcrypt("AUTHENTICATION" + $password)
Encryption key = bcrypt("ENCRYPTION" + $password)

However, I should note that BCrypt isn't really designed to generate cryptographic keys. It is a password hashing function, not a key derivation function, and their properties are different. You could probably get away with it, but I would suggest using PBKDF2 or a similar KDF for generating the encryption key. At this point the use of a prefix is redundant, as you're using two entirely different algorithms.


How viable is MITM interception of email, really? In the press, I often read of the potential for state actors to intercept and record email via man-in-the-middle attacks. For example, the large data storage facility in Utah being built by the NSA right now is alleged to be stored "the complete contents of private emails" right in the wikipedia article (as linked).

However, I am wondering how true this really is. As I understand most email servers these days use SSL or TSL to send all their traffic encrypted, so if, say, Verizon or Comcast users are having their emails being transported routinely by SSL/TSL, how could the NSA be getting the clear text? It sounds kind of unbelievable or exaggerated to me. Sure, if somebody sends the email via telnet it can be recorded, but most emails are sent secured.

In fact, last year at SIGCOMM researchers presented a paper examining this exact question (see Durumeric, Adrian, et al, SIGCOMM 2015) and they report that in excess of 80% of email traffic is routinely sent via TSL or other secure protocol.

So, is the whole email surveillance thing exaggerated or is it for real?

There's a difference between confidentiality and authenticity.  Opportunistic TLS provides confidentiality against a passive MITM attack, but the NSA will create fake certificates.  So let's say there's a TLS connection from mail.verizon.com to mail.comcast.com.  Unless there's a certificate that asserts mail.comcast.com is run by Comcast, and unless mail.verizon checks that certificate was issued by a certificate authority it trusts, then the NSA could create a certificate for mail.comcast, intercept the connection, and everything would look ok to the mail servers.

So the answer is, it's completely viable, and it's not exaggerated.

See How to detect the NSA MITM attack on SSL?


CISecurity AMI EC2 Amazon We are moving to Amazon our on-premise infrastructure and I'm trying to follow this document to increase our security of the ec2 instances :
CISecurity Benchmark for Amazon Linux

In the document, it's asked to create 6 differents partitions for:
- /tmp
- /var
- /var/tmp
- /var/log
- /var/log/audit
- /home

I mean, the creation of those separate partitions does increase really the security ?
Because cost-wise for me it looks like increasing significantly the cost of each instances by adding 6 different EBS volumes for those partitions...

Thanks for your knowledge sharing.

This is a very low-risk threat and you could ignore it in most cases.

That being said, the document explains the rationale behind ensuring that separate partitions exist for each of the mountpoints you specified. Since they are world-writable, you run the risk of resource exhaustion without binding mount points to a separate partition. Additionally, separating partitions allow you to set a noexec flag on mounts that should not contain executables. Finally, it makes resizing on the cloud easier.

Finally, you don't need 6 separate EBS volumes; /tmp could be mounted using
ramdisk; you could have multiple partitions for the same physical volume.


Can an empty, but used, usb flash drive that has NO firmware within it be infected with malware? QUESTION: Can an empty, but used, usb flash drive that has NO firmware within it be infected with malware?
I have been told by a networking and security expert that malware will only attach to (write to) firmware on an empty microsd card or empty usb-flash drive; that there is no where else for it to write to in this case (empty).
PLEASE NOTE: SANDISK rep just told me that none of their usb-flash drives or microsd cards have any firmware; actually 2 of the reps, one being very knowledgeable about the inner workings of media. this is not the "expert" I referenced above.

Just to combine the several commented replies and add my own view:

There is NO usb device without Firmware (even if you call it something else).
There are usb devices where you can NOT update the firmware (it’s on a rom chip of worm memory chip).
-There are more ways than just firmware to hide code.
The firmware on the usb chip of the flash drive has to hold Atleast the following :manufacturer id. Device id. Device version. Usb version, device type is. It must also interact with the host controller in the computer (which means running a program which means there is a firmware)
there are several different type of malware and malware delivery mechanisms. You can not assume any of them in general.
data can even be stored in “empty space” (especially on solid state storage) since malware can ignore normal operation limitations.
the rep from SANDISK does not know what he’s/she’s talking about if he / she really think there is no firmware. There is no user upgradable firmware maybe but that is not the same as no firmware.

As a final note. We are not doubting the rep said those things to you. We are doubting the validity of what the rep said. (Because it’s wrong technically)
Thanks to the following people for there amazing responses in comments:

Coderxyz
CriticalSYS
schroeder
ThoriumBR


Java Applet AccessControlException I am doing a security course and a module on client side attacks, which is why this post might seem evil or outdated.

I have a Java applet fetching a malicious jar file and trying to then download and execute a malicious binary on a Windows 7 host.

When debugging the applet in Java Console I am getting the following error:

basic: Applet resized and added to parent container
basic: PERF: AppletExecutionRunnable - applet.init() BEGIN ; jvmLaunch dt 186710 us, pluginInit dt 8044964 us, TotalTime: 8231674 us
java.security.AccessControlException: access denied ("java.util.PropertyPermission" "java.io.tmpdir" "read")
    at java.security.AccessControlContext.checkPermission(Unknown Source)
    at java.security.AccessController.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkPermission(Unknown Source)
    at sun.plugin2.applet.AWTAppletSecurityManager.checkPermission(Unknown Source)
    at java.lang.SecurityManager.checkPropertyAccess(Unknown Source)
    at java.lang.System.getProperty(Unknown Source)
    at Java.init(Java.java:19)
    at com.sun.deploy.uitoolkit.impl.awt.AWTAppletAdapter.init(Unknown Source)
    at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
basic: Removed progress listener: sun.plugin.util.ProgressMonitorAdapter@1089de1
security: Reset deny session certificate store

I believe this corresponds with the below line of code:

String tmpdir = System.getProperty("java.io.tmpdir") + File.separator;

The applet has been compiled as below...

/opt/jdk1.7.0_80/bin/javac Java.java
echo "Permissions: all-permissions" > /root/manifest.txt
/opt/jdk1.7.0_80/bin/jar cvfm Java.jar /root/manifest.txt Java.class
keytool -genkey -alias signapplet -keystore mykeystore -keypass mykeypass -storepass password123
jarsigner -keystore mykeystore -storepass password123 -keypass password123 -signedjar SignedJava.jar Java.jar signapplet

I think the solution is something like that detailed here but I'm not sure what exactly to add to my code in order to bypass this restriction. I have all-permissions set in a manifest file on my local Kali box but I don't know enough about Java to know if this should or should not be fixing my error.

echo "Permissions: all-permissions" > /root/manifest.txt

What do I need to change to fix this exception and have my applet run?

This exploit is totally broken as of today and no updates to the course materials whatsoever...

At least the official offsec forums provide some hints on how to get this working.

Some people say, it'll work, using an older java version (prior 1.8.0_144).
Unfortunately this didn't work out for me.

So I had to try another "fix" to get it working:
Adding permission java.security.AllPermission; to the grant section in C:\Program Files\Java\jre7\lib\security\java.policy on the target box.

Unfortunately I totally dislike this workaround, as I feel the exploit to be worthless, when I have to modify the security settings on the target box in a way, I normally just can't do.

Hope this helps, anyway :-)


RSA: Do private keys have to be private? I was thinking about using RSA, but in reverse. Where everyone has the private key, and only the server has the public key, so that all the clients can decrypt a message from the server, and the only the server can encrypt messages. When I googled it, everything talked about that the private key must stay private, So I was wondering: Does having a private key instead of a public key compromise the encryption?

Context: clients are getting large server information from peers (kinda like a bit torrent) and I wanted make sure that the information was from the server, and not messed with by a malicious user. Also: Assume getting a hash of the data from the server is not possible.

RSA: Do private keys have to be private? [...]  Does having a private key instead of a public key compromise the encryption?

Yes. For the reason Mike (I upvoted.) gave: The private key and the public key are not alike and the pubkey can be derived from the privkey. (And AFAIK this inequality is mainly for performance reasons and can also only be this way around and not the other way around.)

  so that all the clients can decrypt a message from the server, and the only the server can encrypt messages.

What you're describing amounts to a signature scheme. Everybody can be a recipient of messages but only a few participants can compose valid messages. This is functionally the same as as sending the message in the clear but attaching a signature to it. And signatures you can do with the privkey and verify with the pubkey.

Note: While they are related and it's sometimes explained as such: signing is NOT the same as encrypting with the private key. And verifying is not  the same as decrypting with the public key.


Why should relatively-public personal identifying information be kept secret online if at all? I don't want to get hung up on technical terms, just laying out basics for this question: I understand personal identifying information (PII) as that info which is not apparent to people who cross paths with you day to day and which could be used to prove your identity. For example, my name and face are not really private because anyone I casually do business with could get that info. My birthdate and address are much less apparent and are considered PII. My social security number is a whole different tier of private, being sensitive personal information (SPI).

I grew up in the wild west internet (there's fringe PII - apx. age) and was advised never to reveal PII-type info. Basically conceal one's real identity as much as possible, for safety sake.

Knowing more now, I wonder if this precaution is warranted, especially in the context of persona persistence between platforms which could leak some PII. Most internet use, sure I don't want my name out there tied to it, but I don't feel like I need to cover my tracks in general. Conversely, I see some benefit in letting my actual or pseudonymous identities persist online, and I wouldn't be opposed to lightly-vetted or simply-determined users connecting dots between personas, i.e. friends or acquantances knowing two different profiles both represent me, including a PII-filled one like LinkedIn. I'm asking if my intuition here is right or more risky than I think.

The risks of revealing PII are I think:

Identity theft
Stalking
Planning crimes
Doxxing/slandering/harassing

For those reasons, I can see reason to use a pseudonym posting publicly. But I also don't see those threats as particularly concerning in general, like when meeting someone on a message board or a stranger on Facebook or LinkedIn. Someone finding my profile on LinkedIn already has a lot of information that could be used to harass me, just as it's useful for potential employers to vet me. It has to do with target incentive: why me among numerous others? And even if someone online pursued one of those malicious acts, how would it be any different or more likely than encountering that malevolence with a completely offline relationship? Is it that the internet is vaster (so greater chance of running into bad apples) and might have a deeper look in my life (so greater vulnerability when encountering bad apples)? An online criminal could choose from any number of other profiles to glean info from, so as long as I don't give away SPI, it seems like basic PII and my online activity is not any worse to reveal online than revealing my PII and 'in real life' activity day to day.

Why should relatively-public personal identifying information be kept secret online if at all?

It makes no sense to keep information secret if they are trivially and cheaply obtainable by others anyway.

For everything else somebody has to put some non-trivial effort and/or costs into collecting and associating such information. Due to this it will only be done if the expected return at least matches the efforts and costs needed to obtain such information. And due to limited resources a potential attacker can only target a limited number of victims this way.

By making such previously harder to obtain information easier to get one lowers the costs for obtaining the information. This means less efforts and costs are needed by a potential attacker to get the same return which makes it more likely that it is worth the effort. And due to the lower costs the attacker can also target more victims with the same resources. Both together increase the risk that these information gets misused.


How to improve as a security expert I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average developer. My problem is, that my knowledge is heavily focused on the theoretical part of web security - meaning, I've read lots of books, I follow blogs and mailing lists, but my practical experience is limited.

I know the root cause to vulnerabilities, I know how they work and how to stop them. What I'd like to do, is to take my knowledge to the next step - I want that practical experience. I know that I'll probably end up doing security related stuff at some point in my career, but not just yet - at least not full time. Meanwhile I'd like to build up my knowledge of web application security and get more experience, especially in fields such as penetration testing.

My question to you, my dear security experts, what advice do you have for me to get that practical experience I so desire? What resources could you recommend for learning about the different tools and techniques used in penetration testing?

One option could be, to install a vulnerable web application locally (I know there is at least one on google code, can't remember its name), and then use guides such as OWASP's Testing Guide to try out the different techniques. However, I'm probably looking for a more guided way of learning, meaning, I want to know in which order I should do stuff, make sure I'm doing stuff in the right way and in the right order - baby steps, so to say.

Any and all advice is more than welcome.

This is great that you are doing so much learning on your own.  You are on the right track.  Your enthusiasm to learn on your own will put you a step above a lot of your competition.  Kudos.

My main advice would be: don't worry too much about planning out a path through all the material you want to learn.  You don't need a carefully thought-out plan.  Instead, get your hands dirty, play around, don't be afraid to explore.  When you see something that looks cool, follow up on it opportunistically.  At first you might be overwhelmed but in the longer run I think you'll find it a valuable experience.

I think one good experience is to engage in a security evaluation of a software system.  This would be a fun experience for you.  You could pick an open-source web application or web programming framework and do a security evaluation of it: do an architectural risk assessment (what Microsoft calls "threat modeling", with STRIDE and the like), read the code and do security code review, try out some static analysis tools.  Then, write up your results and post a blog entry with your evaluation.  Do this a few times and I think the experience will be extremely helpful for you.

Another very good experience for you would be to build a non-trivial web application or two.  I like web2py as a web programming framework for its ease of learning curve, but alternatively picking something that's more popular (e.g., Ruby on Rails, PHP or one of its frameworks) might be good experience to see what the issues are with common frameworks.  Write a web application, with some client-side JavaScript code.  Play around learning how to use jQuery or the like.  Maybe experiment with Node.js.  I think this will be a fantastic way to get exposure to some of the challenges and mindset that web developers are likely to face.

Depending upon your personality, you might find it fun to create a blog and write down fun things you have learned, as you learn them.  For many people, the act of writing something out solidifies it in your brain and forces you to understand it better.

You mentioned practicing hacking a web application.  Learning how to hack a  web application is fun, and it is worthwhile up to a certain point.  It's good to have some hands-on experience hacking a web application, to help you think about the risks and to make the concepts concrete.  However, I wouldn't make it the primary focus of your learning.  Web penetration testing is a lower-end activity these days, with less promising career opportunities, so I wouldn't advise trying to focus your energy on learning to be a web pentester.  That's not how I'd advise you to position yourself, if you have the choice (and it sounds like you do).


Are hacked email addresses a local network or web server problem? I work at a small nonprofit and woke up to find that many of our email addresses have been sending spam asking recipients to open an attachment (doc file). We have a local network that all of our computers are connected by. I'm not sure about the security of it. We also have our website and emails managed by a third party.

Is this issue more likely to be caused by our local network being compromised or the web server?

Email addresses do not send spam.  Email servers do.

Anybody can forge your email address as the From address without hacking you at all.  That's how you get spam all the time that says it comes from you.  You can however tell from the email headers what servers it was sent through.

Best thing to do would be to contact the third party that is hosting your email.  Ideally, send them a copy of the headers from one of these spam emails.  They will be able to tell where the emails are coming from.

In fact, if they are coming from your website or a local computer sending email, they'll probably be contacting you eventually, since it will start getting their mail servers blacklisted eventually.


(Solved) Meterpreter over ASPX webshell I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/samratashok/nishang/tree/master/Antak-WebShell)  running with "iis apppool\defaultapppool" user rights. The victim server is behind NAT. Similary our ISP does not give us a dedicated IP for a given session of Internet use and we are also behind ISP's NAT (so dynamic DNS also would not work).Since we cannot afford a static IP or a private VPN Server because of the budget , technically reverse shell is also not possible in this situation with whatever I knowledge I have and googled.
So I was just thinking if there is any aspx based web shell whose url in the victim server can be used as a communication channel for a session aware shell and then finally upgrade it to a meterpreter session retaining the same url as a communication channel to integrate with the metasploit for further post exploitation excercises.

Summary:-

Constraints :-

No Dedicated Attacker Public IP.
Attacker Behind NAT.
Victim Behind NAT.
Non-Session Aware ASPX Web Shell in the Victim Server with Normal IIS Service Account Privilege with no access rights to registry and system drives.
Victim IIS Server without PHP support (so usage of weevely / meterpreter php shell not possible)

Requirement :-

An aspx web shell (to be uploaded to the victim server) acting as a communicating channel for a session aware shell in the victim server with a static URL which can be used for having an interactive terminal session from attacker's machine and finally upgrading to meterpreter for further post exploitation (having the same static url as a communicating channel without any other port's dependancy).

OR

Any other method that can be used to achieve a session aware shell satisfying these constraints.

Thanks in advance.

I know basically what you're saying, you need to tunnel your session.

try this:

https://github.com/SECFORCE/Tunna

It's designed to tunnel an installed meterpreter session, through a website. All you have to do is connect to the website with the tunna module.

Let me know if that is what you are looking for.


How does OTR's authentication using "Question and answer" protect against MiTM? I've read that the answer has something to do Socialist Millionaire, but I still don't understand how can the user be protected against malicious Man In The Middle, which would capture the question and answer by itself if it knows the answer. Could anyone explain that to me how can we authenticate someone getting his key from a secure channel?

A fairly readable reference is Social Millionaire's Protocol in OTR .

You can also read the much more easily understandable analogy in Explain it like I’m Five: The Socialist Millionaire Problem and Secure Multi-Party Computation.

The relevant section is as follows:

  Suppose Alice and Bob each might be making either 10, 20, 30, or 40 $/hour. We’ll arbitrarily say that Alice makes 30$/hour and Bob makes 20$/hour.

  Bob goes to an office supply store and buys four lockable suggestion boxes (with different matching keys). He labels the four boxes as 10$, 20$, 30$, and 40$.

  1    Bob discards all of the keys except the key for the 20$ box (because that’s how much he makes per hour).

  2    Bob discards all but the 20$ key

  3    Bob gives the locked suggestion boxes to Alice. In private, Alice puts a slip of paper saying ‘yes’ into the 30$ box (because that’s how much she makes per hour). She puts slips of paper saying ‘no’ into the other boxes.

  4    Alice gives the boxes back to Bob. In private, Bob uses his key to unlock the 20$ box and get the slip of paper inside.

  5    Bob sees that the slip of paper says ‘no’, meaning Alice doesn’t make 20$/hour like he does. He tells Alice they don’t make the same amount of money.

  6    Bob now knows that Alice doesn’t make 20$/hour, but hasn’t learned if she makes 10, 30, or 40 $/hour. Similarly, Alice now knows Bob doesn’t make 30$/hour, but hasn’t learned if he makes 10, 20, or 40 $/hour.

  The technical term for what Alice and Bob did in the previous example is oblivious transfer. Alice transferred many messages to Bob, but is oblivious to which single message Bob received. Alice sent an answer for every possible amount of money Bob might make, but Bob only received the answer corresponding to how much money he actually makes.