Is it true that certificates requested with a specific CSR can only be used on the machine where the CSR was generated? Assume that I have created a CSR and I am going to buy an SSL certificate with it. Would I be able to use the SSL certificate on another machine than where the CSR was created?

Someone I know recently told me it wasn't, but I'm not entirely sure.

No, it is not true.

The CSR defines various parameters for the certificate that you are requesting, such as the Common Name, any Alternative Names, etc. However the CSR is, ultimately, just a file, and you can do all the usual file things with it -- such as copying or moving it to another server, if you wanted to.

Not that even that much is required. Your SSL certificate that you receive in response to your CSR (oftentimes with a key file and/or a "certificate chain") is all that you need. And you can put it on as many machines as you want, even if none of them ever saw the CSR in the first place, let alone were the originating machines for it.

Case in point: I manage a cluster of 5 (soon-to-be-deprecated) email servers, another cluster of 9 (soon-to-replace-the-former) email servers, a pair of BigIp load balancers, a cluster of 5 web servers, and more -- and all 20+ of them use exactly the same certificate, key, and chain files, but not the CSR (heck, the load balancers don't even have an option in their GUI to upload the CSR at all!). The CSR that was used to get this certificate in the first place? The machine that generated it was decommissioned a while ago, taking the sole copy of the CSR with it.

What you can't do, however (well, not without provoking errors anyway) is use your certificate on a domain other than that named on the certificate; e.g. if you have a certificate for example.com, with an alternative name of example.net, you could not use it on example.org. (Well, technically you could, but you'd get "invalid certificate" errors any time you visited it.) You also could not use it on sub.example.com. This has nothing to do with the CSR other than that's where you put those names in the first place, though.


SQL injection with UNION and two queries with same input Say there are two queries, which are called after each other: one to get the amount datasets in the table, one to get the result of the actual query:

select count(*) as total from table_a where someCol='abc' and someOtherCol= 'someVariable'
select * from table_a where someCol='abc' and someOtherCol= 'someVariable'

someVariable comes directly from userInput (which should not be trusted) and is identical in both queries and is concatenated into the querystring.

This is the approach one of our developers took and he thinks it's completely safe and there is no problem with SQL injection whatsoever.

I injected the following string for someVariable def' UNION select * from table_a where someCol='abc' and someOtherCol= 'someVariable.

The injection doesn't work for the first query, since it has only one column, but does work for the second query (table_a has more than 1 column). This isn't exactly what I call protection against sql injection.... More like two wrongs give one right...

Is there a possibility to make the injection with UNION work in this scenario? I didn't want to drop all tables, that seemed a bit harsh.

Your intuition is correct that this does not provide sufficient protection against SQL injection.  You may need to treat this it as a blind SQL injection
have a couple of options for explaining how to exploit this:

Attack the first SQL with a union returning one column - you can get information out of  if there's different behavior between failure of the first and second SQL
Leverage another attack besides the UNION attack.  There are many other techniques for getting information out via blind SQL injection - timing based or out of band being the most common.  Although specific techniques will depend on the database.

There are a variety of tools (Burp Suite, Sqlmap...) which will automate the process for you if you need to actually generate an exploit for the developer.  Make sure, in any case, you use this as a "teachable moment" to explain about blind SQL injection, and that any kind of untrusted data in a SQL statement is going to be exploitable.


On an "uncritical" site, is there any reason to NOT trust a self-signed certificate? There are many sites that have self-signed ("untrusted" in Firefox) certificates. I then have the option to trust them or not. If I not trust them I can either leave the site or only visit the site fully unencrypted.

I know, there are cases where I should not use the site at all if there's the smallest risk of "being watched" (online banking, shopping, and so on). So, the question is more like: On non-critical websites, e.g. sites I only read (news or blogs for example), is there any reason to not trust a self-signed certificate? In the worst case "I'm watched", which I could be anyways if I used unencrypted HTTP.

Firefox had once a bug, where the trust was not applied to site+certificate, but to the certificate only. E.g. if you had a self-signed certificate with a common name of example.org but a subject alternative name of paypal.com and the user visited your site example.org and accepted the self-signed certificate, then this certificate could be used to transparently intercept paypal.com, e.g. no more questions asked or warnings issued.

Bugs like these tend to resurface from time to time (especially when somebody writes a new TLS stack) so accepting self-signed certificates can lead to serious problems.

Apart from that,  using self-signed certificates just teaches people to ignore these security warnings (which most don't understand anyway).


Should I use rainbow tables or bruteforce (NTLM)? As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?).

I have found NTLM rainbow tables (1,5 TB total), that covers all password length less or equals 8 (full ASCII), length 9 (mix-alphanumeric), length 10 (lower-alphanumeric)

http://project-rainbowcrack.com/table.htm

Should I use these tables, or is using direct bruteforcing faster since NTLM is a fast hashing algorithm and I only have around 200 hashes to crack?

I know it depends on hardware, but some insights would be appreciated.

I am not allowed to use online services.

Here is how I would approach this. Given, that you will encounter real-life passwords. I would start with a dictionary attack, given that NTLM is real fast on modern hardware you should be able to go through this quickly.

Then, as suggested in the comments by Royce Williams, use rules, combinators and mask attack. This may take some time to set up but should yield some results.

Brute-force is next. According to a hashcat forum post, it is practical to brute force at least up to 8 character mixed-alpha/numeric. You can try going above but will find that the keyspace is growing exponentially and brute-force will become less practical.

As a last resort, I would go with the rainbow tables. The link you posted has tables for up to 10 characters. The site also has performance data so you can estimate how long it would take to crack the rest of the hashes.


Detecting Tor proxy by reading request headers I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header that is sent by our system to its server. According to the website, by examining the Via or X-Forwarded-For header, one can conclude whether the client is using a proxy or not. When I visited the website without using any proxy, it showed both of these headers as not present (which was expected). But, when I visited this website again, this time using the Tor Browser, still the two headers were not present! No sign of proxy at all.

I have a very vague idea about the working of Tor, but I am not sure why the headers are unable to detect the proxy when using the Tor Browser! Can anyone explain the reason for the same in layman's terms? Also, if Tor offers this level of anonymity, is there any other way to detect a Tor proxy?

Tor simply repeats requests as an anonymous transparent HTTP proxy, meaning it does not attach typical proxy headers (such as Via or X-Forwarded-For), or in any other way  modify HTTP requests or responses (besides being "onion routed, encrypted and decrypted" through the Tor network).

As for identifying clients connecting through Tor network, the easiest to detect such clients on the web server end is to query the public TorDNSEL service that publishes Tor exit nodes:

  TorDNSEL is an active testing, DNS-based list of Tor exit nodes. Since
  Tor supports exit policies, a network service's Tor exit list is a
  function of its IP address and port. Unlike with traditional DNSxLs,
  services need to provide that information in their queries.

  Previous DNSELs scraped Tor's network directory for exit node IP
  addresses, but this method fails to list nodes that don't advertise
  their exit address in the directory. TorDNSEL actively tests through
  these nodes to provide a more accurate list.

This TorDNSEL querying can be automated e.g. in your web application, and example code in many programming languages can be found on the Internet. For example, here is some sample code demonstrating how to do that in PHP.

If you're going to implement this Tor checking in your web application, then I recommend you cache query results locally for some time it's reasonable to expect the exit nodes didn't change in the meantime, not to constantly repeat same queries and add an additional lag to your responses.

Edit to add: One more way to optimize this Tor exit node querying and avoid using TorDNSEL all the time is to do a reverse DNS lookup beforehand, and try and match it against a list of major known Tor exit node hosts. This can be actually quite effective, as a lot of major exit node hosts never change and they can operate a large number of exit nodes all using same or similar rDNS names. For example, you could try matching rDNS names to your list using regular expressions, LIKE SQL operator, or similar. Some of the known Tor exit node hosts (real examples) will match these names:

tor[0-9].*
tor-exit*
*.torservers.*
*.torland.is

This is the list that I'm using. As you see, it's far from being complete, but it is a start and you can always add more entries as you detect them to follow an easily matched pattern. As it is meant to merely optimize querying, it doesn't really need to be complete, but each match will most certainly speed things up. Hope this helps!


Shellshock used in CUPS Some days ago I read about the Shellshock bug and I wanted to test a CUPS server for it and readed some example codes to build this code:

() { test;};echo /"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd' "http://anything.xy:631/printers/jobs.cgi?ORDER=asc&QUERY=123&x=0&y=0

I've inserted it to a custom Firefox User Agent String and visited the cgi script.

Now something should happen but it doesn't. Does it mean, it's secure or does it mean that I
made a mistake with it?

Do I have to use curl?

Thanks in advance guys :-)

Shellshock is a vulnerability in the Bash command line interpreter. You may be vulnerable to Shellshock depending on your version of bash.

You can use bashcheck to check if your version of Bash is vulnerable to shellshock:
https://github.com/hannob/bashcheck

To test whether you version of Bash or your system services are vulnerable to Shellshock manually, check out mubix's writeup:
https://github.com/mubix/shellshocker-pocs

Regarding exploiting CUPS; you're doing it wrong. The CUPS HTTP server does not export HTTP headers (such as 'User-Agent' and 'Content-Type') to environment variables in the same way Apache mod_cgi does. Refer to the CUPS exploit at the link above to test if your version of CUPS is vulnerable. Note that CUPS runs on the local loopback interface 127.0.0.1 by default and is not vulnerable to remote command execution unless remote access is enabled.


Is it secure for a site to serve the login page with HTTPS from a trusted CA but have HTTP for non-login pages I've never encountered this scenario but would the security implications be to such a website?

Not really. If the user is on a HTTP non-login page, and clicks on a 'login' button, unlikely he/she is going to notice if the login is now using HTTPs or HTTP.

Best to have the entire site on HTTPs.


What security concerns are there for a fully client-side JS/HTML5 app? I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework.  I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) and began to wonder if any such thing would be important for code that's entirely client-side.  I'd apply some basic CSP if I could, mainly the ban on inline code exec, but it looks like that can only be specified in an HTTP header which I don't control in this case (I think -- there's no transfer happening in my game, but github pages hosts the HTML and JS so HTTP is in use  and is presumably controlled by github)

This question addresses a similar concern, but is a simpler context since it will be running locally on that OP's machine.  My context will be as follows:

Where is the HTML and JS hosted: my github pages account.  It's not actually up there yet, but a different one implemented in Inform 6 and run on a JS Inform interpreter (Quixe) is here and I don't see an obvious CSP in the HTTP headers
Where do dependencies come from: local JS files, jquery and undum library only
What operations are involved: clicking generated links within the page, generating/rendering HTML from local JS (no arbitrary text user input), writing to/reading from HTML5 window.localStorage object if available to support game save/load
Protocol: HTTPS

What security concerns might be relevant to a kinda sorta web app like this?  There's no sensitive data involved; I'm mostly concerned with any sort of malicious script injection that might be possible.

When you say that the JS and HTML is hosted on GitHub, I am assuming you mean that the code is hosted there for download only and that your interactive story does not reach out to GitHub while running to fetch assets. If this were the case, then this external connection to GitHub could potentially be used for malicious actions. If someone can gain access to the code hosted on GitHub they can change it to run whatever they want on clients. This isn't necessarily injection, but it's worth bringing attention to.

However, it seems your app is not fetching code from GitHub while running. If this app this truly is only using local resources on the machine (no data fetching from elsewhere, no external links, etc) then your app should be safe from an external attacker. You should always be wary of displaying any user content, as this could potentially open the door to injection attacks if not properly sanitized, however in this case it seems the clients have no way of contacting other clients or uploading to a server. So realistically if a user could inject code into their client, the only person they could affect is themselves.

Another thing to be aware of: If you are building a framework in which users can create stories to distribute (for example allowing other people to play a story I create), this is also a vector of attack. This is because ultimately the story files are created by arbitrary users (like me) and are later interpreted by the client web app of the users who import them (Alice/Bob).


a mysterious & pointless long-term hacking attempt? It seems that I am the target of a mysterious ongoing hacking attempt.

I have several domain names, most of which are currently parked & pointed at a single ‘main’ website.  For the last couple months, at least a few hours per day, I’ve had a perplexing (yet seemingly harmless) issue with what appears to be useless, garbage traffic directed at my sites. I’m not sure why/if I need to bother doing anything about it.

The rate of "attack" varies but is usually around 5 hits/min, although twice over the weekend there were over 100,000 hits within 2 minutes.  My web host isn’t concerned, presumably since their system stops an attack if it becomes a problem - which it did once before for my site, a few weeks ago.

The majority of the traffic is coming from one country but a third of it is spread out across the world, some ranges of IPs return no geolocation data from the free API.

As far as I can tell, I only see this traffic doing two things:

Most times, it's just “visiting pages” on my tiny site, as well spamming gibberish through a contact form . . . somehow defeating the reCaptcha, but this isn't causing much more than a “minor annoyance” solved by hitting “Select All+Delete” in a mail folder once a week.
Mostly just during the "big attacks”, it almost exclusive hits a single static page that contains only a single Google Map - the uncomplicated php adapted from one of Google’s online code demos.

The traffic generates an error on the page which is logged as an “Undefined variable” – oddly, I can’t reproduce the error.  There were 2 "major attempts" like this in the last 2 days and a third a few weeks ago (though I'm not sure of the target in that case).

Although the page loads the location data from a table, the calculations are done server-side so the only data sent to the client is an "adjusted" marker location (skewed at a random factor) and the name of the city.  The simple page takes no user input, and is non-interactive (other than the map controls that are built-in to Google’s map.)

The geo-location data (from a free API) is of questionable accuracy to start with, but even if it was a list of home addresses I still can't imagine why it would be of value to anyone, or worth this much effort.

I figure it obvious from looking at the map that the data is skewed, so perhaps that's irrelevant to this person's goal?  - especially knowing that literally 99.99% of the pins locations of the traffic itself. (Also the main source of traffic is intentionally excluded from the sections shown.)

I'm a new very small business (no sales yet) with nothing of value on the server or elsewhere. Since my web host isn’t concerned about it, and it doesn’t really affect me (beyond my time in writing this question) – is this of any concern?

What do you suppose this party is trying to accomplish?  Could they be practicing for something?  Waiting for something on my site so they can jump to action and steal . . . the rest of my google code demo’s?  Did I make an anonymous enemy who’s planning to ever-so-gradually “annoy me to death”?

Someone’s definitely either very persistent or patient as I estimate the total’s approaching a million visits and/or errors, in 2+ months.

Thoughts?

It's almost certainly an automated scan of bots looking for low hanging fruits to attack. I would not spend any considerable time investigating it further. Consider something like fail2ban instead, and block gelocation's IP address to rid yourself of the nuisance.

It's probably targeting the .php page more because it's a php and is dynamic content or input (and therefore could allow RCE, SQL injection, PHP command injection, etc) and less because it's Google Maps.


What is "Your Phone" in Windows 10 Advanced Firewall? I have an Outbound Rule in my firewall called "Your Phone".
Settings:

All programs.
In Customize Application Package Settings, it has "Apply to app package..." set with a long identifier starting with "S-1-15-2-1726375552-1729233799- etc. A search of my C-Drive and Registry found nothing.
Apply to all programs and services.
No restrictions on computers.
Any protocol.
All Local Ports.
All Remote Ports.
Any Local IP Address.
Any Remote IP address.
Profiles: all three of Domain, Private, Public.
No restrictions on users.

I'm thinking this is a pretty powerful Rule. Well, the default for Advanced Firewall is to allow all outbound traffic, so its not so bad right?
There is also a "Your Phone" in the Inbound Rules. Same settings, except Public is not checked. I'm guessing it must be something that allows a cell phone to communicate via Windows 10 but I would really like to know what app or service its going through.
Can anyone explain what this is, and in particular that "Application Package" thingy?

It's a Windows Store app, installed by default with at least some Windows editions, that is literally called "Your Phone". I don't know why it needs such a wide hole in the firewall, that seems excessive, but at least that access is specific only to the one app package. It's a handy app, by the way; lets you do things like see phone notifications on your PC and send SMS from a real keyboard.
The long identifier (starting with "S-1-15-") is a text representation of a SID (Security IDentifier), specifically one for an "AppContainer" sandbox (all Windows Store apps, plus a bunch of built-in apps, run in AppContainers and have since Windows 8). Every app on the Store (or built in) has a unique AppContainer SID that is the same for all copies of that app, no matter where they are or whether the app is deleted and re-installed.
SIDs are in the registry but in a part that Regedit cannot read by default unless you change the ACLs or run it as SYSTEM (it's not readable, by default, even to Administrators). Every running process on Windows has a security "Token" and the token contains (among other things) a set of SIDs (for the user, for the user's groups, for the desktop session, for the mandatory integrity level, and potentially for any sandboxes such as AppContainers). Limiting the firewall rule to that SID, rather than to a specific executable, means that if the app ("Your Phone" in this case) has multiple processes running in the sandbox, they are all allowed through the firewall without creating multiple rules.
You can also use the firewall's Block rules to prevent apps from reaching some (or all) of the network / Internet, incidentally, without doing something as brittle as blocking by port or executable name.


SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? (Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been searching online & stack forum last couple days but cannot seem to find a satisfactory answer.)

Example:
I am surfing on open wifi and I browse to  for the 1st time. Server sends back its SSL certificate. My browser does its thing and verifies that the cert is signed by a CA that it trusts and all is well. I click around on the website. BUT!

Question:
Can someone actually please explain to me in a simple way how does my browser actually verify that the server certificate is legitimate? Yeah okay so on the certificate itself it says it is issued by, say "Verisign" but what is the actual cryptographic magic happens behind the scene to validate that it isn't a bogus certificate? I have heard people explain "SSL certificates are verified using the signing CA's public key" but that doesn't make sense to me. I thought public key is to encrypt data, not to decrypt data.

So confused... appreciate it if someone could enlighten me. Thanks in advance!

You are correct that SSL uses an asymmetric key pair.  One public and one private key is generated which also known as public key infrastructure (PKI).  The public key is what is distributed to the world, and is used to encrypt the data.  Only the private key can actually decrypt the data though. Here is an example:

  Say we both go to walmart.com and buy stuff.  Each of us get a copy of
  Walmart's public key to sign our transaction with.  Once the
  transaction is signed by Walmart's public key, only Walmart's private
  key can decrypt the transaction.  If I use my copy of Walmart's public
  key, it will not decrypt your transaction.  Walmart must keep
  their private key very private and secure, else anyone who gets it can
  decrypt transactions to Walmart.  This is why the DigiNotar breach was such a big deal

Now that you get the idea of the private and public key pairs, it's important to know who actually issues the cert and why certs are trusted.  I'm oversimplifying this, but there are specific root certificate authorities (CA) such as Verisign who sign certs, but also sign for intermediary CA's.  This follows what is called Chain of Trust, which is a chain of systems that trust each other.  See the image linked below to get a better idea (note the root CA is at the bottom).

Organizations often purchase either wildcard certs or get registered as a intermediate CA themselves who is authorized to sign for their domain alone.  This prevents Google from signing certs for Microsoft.

Because of this chain of trust, a certificate can be verified all the way to the root CA.  To show this, DigiCert (and many others) have tools to verify this trust.  DigiCert's tool is linked here.  I did a validation on gmail.com and when you scroll down it shows this:

This shows that the cert for gmail.com is issued by Google Internet Authority G2, who is in turn issued a cert from GeoTrust Global, who is in turn issued a cert from Equifax.

Now when you go to gmail.com, your browser doesn't just get a blob of a hash and goes on it's way.  No, it gets a whole host of details along with the cert:

These details are what your browser uses to help identify the validity of the cert.  For example, if the expiration date has passed, your browser will throw a cert error.  If all the basic details of the cert check out, it will verify all the way to the root CA, that the cert is valid.

Now that you have a better idea as to the cert details, this expanded image similar to the first one above will hopefully make more sense:

This is why your browser can verify one cert against the next, all the way to the root CA, which your browser inherently trusts.

Hope this helps you understand a bit better!


How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC? I just got my Yubikey 5 NFC, and would like to use it for

Linux desktop login
Linux KeePassXC (which only supports hmac-sha1 challenge-response)
online accounts

When reading about U2F it seams to be the preferred protocol, but TOPT is often only supported on online accounts.

Right now I got Linux login to work with Yubico OTP.

Question

Is it correct understood that in my correct case, I would need to one more YubiKey?

2 slots seams very limited, when just U2F and TOTP would take up those two slots leaving no room for Yuboco OTP and hmac-sha1 challenge-response.

Are there some corners that could be cut?

For Linux desktop login, this guide worked for me: InfoSec handbook

For KeePassXC, read KeePassXC doc

For online accounts, this heavily depends on the website how they implemented it. Usually, there should be a setting somewhere. Then, you need to insert your YubiKey and press a button to register it.

Keep in mind that U2F is considered "a second factor". So you still need a strong password in addition to your U2F key.

You need more than one YubiKey (or any other U2F token) for backup purposes. If you lose your single YubiKey, you may lose access to your accounts.

U2F doesn't take any slots, so you can use one single YubiKey for an unlimited number of U2F websites, etc. TOTP and HMAC CR are limited though.


Strong password for GPG key or encrypt password database with GPG key? I have a password database, that can be secured by a passphrase or by providing a GPG key.

I have a GPG key that can be secured via a good password that I can remember, or via a great password that I need to store in a database to remember.

I can obviously not secure the GPG key via a passphrase stored in the database if I encrypt the database with the key.

What makes more sense?

1. Protect the database with the GPG key which in turn has a good password or

2. Use a great passphrase to secure the GPG key, but the passphrase is stored in the database which is protected only by a good passphrase.

Security-wise, the weakest path to the data - in this case the passwords - is the relevant one.

As it seems that you are not able to remember a passphrase that is really good (and there are questions and answers here that cover how to generate ones that can be remembered very well), it does not really matter which of your options you choose.

I would propose to secure the password database with the GPG key and have that locked with a very good passphrase.

This approach has several benefits, one of it being that you probably use the key more often than other passwords in the database and by remembering that passphrase, you increase overall usability. Additionally, most operating systems allow to unlock a GPG keyring for all of a users session if that is acceptable security-wise, you can improve usability even more.


How to keep an origin / referer check for CSRF prevention from blocking URLs that are typed in? I'm trying to set up CSRF prevention by checking the Origin and Referer headers, and also blocking any action if neither are set.

However, if the URL is simply typed or pasted into the browser, such a check will cause the action to be blocked since the Origin and Referer headers won't be set.

I thought perhaps making sure HTTP_HOST is equal to SERVER_NAME, but seems that may weaken the check.

What is the best way to have a secure Origin / Referer check and yet let typed in URLs pass the check?

If you follow the often cited best practice of not mutating data or other application state on HTTP Get requests, the referrer check on the Get request becomes a non-issue. You can just use the referrer check on all your HTTP Posts (or other methods if you're using them).

CSRF exploitation is essentially blind (barring massive CORS misconfigurations), so as long as Get requests only ever return data/JSON/HTML/etc. and don't change anything, you're fine not enforcing anti-CSRF on them. They're simply not sensitive to this kind of attack.

Posts (Puts, etc) are presumably only expected to come from a known app, therefore should have the correct referrer unless they're being stripped by a proxy or some other software or device "in the middle".


Is it safe to backup programming projects from a possibly infected computer? Is is safe to backup programming projects (for example websites that where made using HTML/CSS/JS with the help of some frameworks and libraries (Bootstrap, jQuery, etc.), C# projects made with the .NET framework or websites with backend made with PHP) from a possibly infected computer? What messures can I take to backup those programming projects and making sure they are not infected?

If you're concerned enough about it to wipe the machine, and you don't already have an online repository for your code somewhere like Github, then I'd suggest getting a live boot CD/USB for a Linux distribution of your choice and use that to copy the files off to external storage or cloud storage. I don't know of any way other than manually inspecting your code for changes to check for malicious modifications, however I would deem that incredibly unlikely for personal code projects unless they are widely in use by others.

Then get a real version control system with online hosting. This should be as simple as "download latest version from online repository, compare with local" in the worst case but that only works if you have said online repository.


Why am I getting fake virus alert pop-ups on Facebook? This happens quite often. When I am browsing through safe websites suddenly a scary virus alert comes with a toll free number to call and it hijacks the browser. Sometimes I have to end the browser process from task manager to close the browser and get rid of that pop-up. I have not installed any malicious software on my computer.

This is probably malvertisement, i.e. malware or scareware (like in your case) delivered inside the sites advertisement. Or you have some malicious ad-injecting browser extension installed or some ad-injection software like Superfish. Hard to tell what exactly is the case.

In the first case it might get fixed by installing an ad-blocking software, at least unless the site in question currently tries to work around ad-blocking software. In the other cases check your system for browser extension or some strange software. Note that browser extension turned malicious in the past and that ad-injecting software often comes bundled with some free software.


Restrict access to a specific directory on Linux I want to limit access to a single directory on the hard disk (log files) to few processes (log files for a single process for example). All processes run under the same user, so file system access restrictions are not an option.

What are my options? AppArmor? SELinux?

I don't want to restrict single processes, I want to restrict all processes from accessing a directory except a few select ones. Seems AppArmor can't do that.

The upside -- yes, you can do this with SELinux. The downside -- you have to know SELinux. :)

You can execute these processes in different SELinux domains. E.g. let's call two processes "privapp" and "unprivapp" -- privapp is able to access /var/lib/app/log and unprivapp cannot access /var/lib/app/log, despite running as the same user.

So, you create two domains privapp_t and unprivapp_t and label the executables as privapp_exec_t and unprivapp_exec_t. You then label /var/lib/app/log as var_lib_privapp_rw_t and indicate that only a process running as privapp_t is able to access it.

This is the easy part -- the hard part is expressing the above in the policy language, which is the bit known to drive grown men and women to tears. :)


What does Encryption at REST and HTTPS mean? What does it mean when apps claim they encrypt at REST and HTTPS? I find this a little difficult to understand how different they are from the rest of the encryption-based Apps.

HTTPS is one form of "encryption in transit", which means that data passing over the network to or from the application is encrypted. "Encryption at rest" means that the data the application stores on its local storage is encrypted, so that an attacker who can access the storage but not the application itself can’t read the data.


Authorization/authentication strategy for micro service apps How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective?

E.g: Assume a shopping site which has many micro services. Once a user is authenticated in one micro service app, then that user should be able to access other microservice apps on that site seamlessly.
Like the cart app, suggestion/recommendation app, search app etc.

How to implement this kind of authorization/authentication ?
Will Oauth, SAML fit into these scenario ?

This sounds different from what I've heard about previously. My understanding of a typical microservice architecture is that you'd have a variety of fine-grained microservices, composited together into one or more coarse-grained applications.

In that view, you would probably have a single E-Commerce Web App, which utilizes a variety of microservices in the backend (the cart service, suggestion service, search service, etc.).

If that's the case, then there's only one "App" that the user interacts with: the Web App. The user would sign into the Web App, and then the user's ID would be delivered to the various back-end microservices.

If the Web App talks to the backend services using a private interface, then you can just pass the user ID directly - it's not really any different from passing, e.g., a user ID into a database query. If you've got a public interface that you're using, then you might need to pass something like a session key around - although, that would depend on exactly what sort of public interface you have.

Note: all of this assumes that you're talking about a server-side microservice architecture, since you cite list "rails" as a related technology, but not anything specifically client-side. Using web APIs over Ajax is something that I'd consider to be a separate topic.


MS08-067.c fails at WNetAddConnection2() I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB.

The section:
WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't know why.

I'm using the correct IP as the argument for the program, against an XP SP2 VM which is vulnerable to MS08-067 (I've exploited it with Metasploit).

Has anyone used this code before and come across this? Any help would be appreciated.

*Extended Code:

server = argv[1];
_snprintf_s(unc, sizeof(unc), "\\\\%s\\pipe", server);
unc[sizeof(unc) -1] = 0;
nr.dwType = RESOURCETYPE_ANY;
nr.lpLocalName = NULL;
nr.lpRemoteName = unc;
nr.lpProvider = NULL;

printf("connect %s ipc$ .... ", server);

DWORD error;
if ((error = WNetAddConnection2(&nr, "", "", 0)) != 0)
{
    printf( "failed\n" );
    return 0;
}

Well if your goal is just to exploit MS08-67 (and not make this code you found work) have you tried using this:
https://www.exploit-db.com/exploits/7132/

Unfortunatley, you may not be able to just update the return address with the one here, as its for WinXPsp0/1:
https://www.exploit-db.com/exploits/40279/

Last, disassemble the netapi32.dll on your WinXPsp2 yourself to determine an appropriate return address.


Are exposed php class files a security vulnerability? I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although indexes are turned off). Browsing to them just gives a blank page, since they don't have any output and aren't even initializing any objects, just declaring classes.

Is this a security issue, and how large of one? My gut feeling is that it's a terrible idea, but other than giving an attacker information into the server setup I don't have any particular reason to think so.

Fundamentally, whether something is a security risk depends on whether or not they can find and exploit a vulnerability, whether it be in the code, in the system, or in the people.

In your case, your users may be able to guess file names of class files, but cannot see their contents. Let's assume the worst case and they manage to guess the names of every file so now they have an entire index.

If the file names tell them that you're using some library that has a hole in it, then that's a risk.

If the file names themselves give information that can lead to a risk, then that's a risk too.

If the file names match some file names which have some esoteric bug in Apache or something, then that could be a risk too.

If the knowledge of the file names allows them to call up some of your staff and convince them to give them the contents of the file or modify the file, then that's a risk.

But no, knowing the names of the files isn't inherently a risk; it's only a risk if that tells them something about how the system works and clues them into a vulnerability.


Symmetric Encryption Algorithm I'm trying to learn more about cryptography and have devised an algorithm below for symmetric encryption. I know that we shouldn't use self devised algorithms but this one seems incredibly simple and based on SHA-256.

1) Take an input and a numeric key, k.
2) Pad i with 0s until its length has 256 as a factor.
3) Generate pseudo random bits using SHA-256(k), incrementing k each time.
4) XOR the input with the pseudo random bits.

Why I think this is as unbreakable as SHA-256:

XOR encryption with truly random numbers that aren't re-used at all is perfectly secure
The SHA-256 algorithm hasn't been broken yet but there's no mathematical proof that it's unbreakable, therefore my algorithm is at least as strong as SHA-256

Are there any issues at all with this algorithm and encrypting things like this?

I see a couple problems here.

There's no IV

That means that if you encrypt two identical messages with the same key, the cyphertext is the same. If even part of the message is the same, it's possible to determine the content of the other messages, and even the key. Read about crib-dragging and you will see why.

As strong as SHA-256

Not really. It's as strong as the key. You are using a numeric key, but how long? It's 4 bytes long, 16 bytes long, 512 bytes long? That makes all the difference.

Numeric key and SHA-256

A numeric, auto-incrementing key is bad. SHA-256 bruteforcing rigs are plentiful, usually they are sold as Bitcoin Miners. They are cheap, they are efficient, and very, very powerful. Use one to generate Terahashes per second, apply your very, very fast XOR calculation, calculate the entropy of the message, and an attacker can bruteforce your secret message in minutes, maybe less.

XOR encryption with truly random numbers

They are not random, they are deterministic. Bruteforce the first block, and all your data is broken. If the first bytes of the message are deterministic (like a request header, or file type header, or Greetings dear user  kind of message), and attacker can use the crib-dragging attack to infer part of the hash and feed it to the bruteforcer.

Vulnerable to Know Plaintext Attack

If any attacker knows the plaintext-cyphertext pair, he knows the XOR-key, because plaintext XOR cyphertext = KEY. That information goes to the bruteforcer and you know what happens.

Vulnerable to frequency analysis

256 bytes of data is enough to reconstruct part of the message using frequency analysis. Reconstructing the rest of the first 256 bytes is trivial, and results on a pair plaintext-cyphertext. This enables the know plaintext attack on the first 256 bytes, allowing the XOR-key to be discovered and bruteforced.

I know you are trying to learn, but trying to learn crypto by doing it is like making a gun by trial and error. You will shot yourself in the foot, or head. Wikipedia have a nice article on symmetric encryption, with a list of algorithms, the principles behind them, and the shortcomings.


Using cookies for cross domain authentication I have an web app 1 which would do the authentication of the user. After that I want to forward the request to another web app 2.
Now web app 1 will generate some hashcode which I can authenticate in app 2 and be sure the user is authenticated. I thought of 2 approaches for this use case.

App 1 will generate the hash and redirect to app 2 . This new URL for app 2 would have hash in the URL .
App 1 would generate the hash and put it in the cookie. App 2 would access the same cookie and authenticate the user. But whatever I have read, I understand its very difficult to access cookie cross domain.

Could anyone please suggest which approach is better and if there is any better approach?

Yes, there is a better option, and it's called OAuth.  It's specifically designed to support secure cross-domain authorization, and if you want more than bare authentication, there's a supporting standard called OpenID Connect that is built on top of the OAuth 2.0 framework that provides some richer standard data around users.


what is the scope of google drive's OAuth credentials? I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive account. But I was wondering what else could be done to my google drive account, using those OAuth Credentials, like could it also be used for deleting stuff over there.

And Could those credentials be used to gain access to other google services, like gmail, youtube, etc in any way?

And what is the longevity of these  OAuth credentials, will they be of any use if password of my id has been changed?

Credentials

The credential that allows you to access Google Drive resources for your account is actually the access token you obtain after user-consent. See this documentation listing all the steps to set up OAuth, culminating with obtaining an access token to call APIs.

What can you do with an access token for Drive?

This depends on what OAuth scopes you requested. Your python scripts should have some OAuth scopes encoded in them that allows you to make the API call. You can further use the Google Discovery API to learn which methods can be called for a particular API. For example, file upload is a method.

Longevity of credentials

The access tokens are short lived and typically are valid for an hour. If you obtained a refresh token, you can read this documentation about expiration of long term credentials.

If you would like to keep track of events like password changes and expire your tokens and/or sessions, consider integration with Google's Cross Account Protection APIs to subscribe to account security events.


Https certificate change effects on established secure channels I've a question regarding https certificate changes.
Does anyone know any side-effects to changing the certificate, one signed with RSASHA1 to one signed with RSASHA256 for ex, while users already have established secure channels with the old certificate?

I imagine new users, that are just establishing their secure channels, would just pickup the new certificate, and perform key exchange using its public key, but what about users that already have their SSL handshake and key exchange performed with the old one, and for some reason their secure channel needs to be re-established, and the new one is picked up. During the re-establishment is it practically a whole new SSL handshake, with no dependency on the old one?

Also, I've a smaller question regarding certificate pinning. If the new certificate is signed with a different algorithm (RSASHA256 in my example), is the certificate pinning process the same on all clients (browsers)? What I'm, particularly curious is, will the pinning of the root certificate, which I'm assuming is new and hasn't been pinned out-of-band, ask for any user involvement? Or will it always be done automatically, with no awareness from the user of the browser? And how much of risk is this, if the certificate pinning process is tainted with a man-in-the-middle attack?

The change of a certificate in a web-server is not just a basic configuration setting. For example, changing a certificate for a website on apache requires a full restart.

This means that the established connections will be cut off by the restart anyway. Suppose you do this fast enough, subsequent request from user that were using your website will have to renegotiate their sessions (since the server will have forgotten them). So they will be served the new certificate from now on.

Certificate pinning is by definition a client-side action (see What is certificate pinning?) change of certificate will require a change of the pin (unless you pinned the signing certificate that issues your keys).


Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked? For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this?
Something like:

This looks like my bank. If I mistype the password, they warn me that my card will be blocked if I don't get it correct in the next 2 trials. And that increases my stress. I don't like that message.
I would not add that kind of message because it does not helps the user remember its password. If the user mistyped the password, they will hopefully get it correct on the next try, and if they forgot it they will get it wrong again on the next try.
For an attacker, it won't change much. Assuming they can create a user on your site, they can test themselves how many passwords they can try until they get blocked.


Which is the Best Cipher Mode and Padding Mode for AES Encryption? As per PCI-DSS 3.4 requirement:

For storing Credit Card Data Strong Cryptography should be used.

I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting Credit Card Details.

I saw that AES has Cipher Mode and Padding Mode in it.

When I searched i found that according to NIST Special Publication 800-38A, it specifies five confidentiality modes of operation for symmetric key cipher algorithm.

So I'm totally confused whether can I use anyone of the five cipher modes or is there best one among the five as listed below:

  Cipher Modes:

ECB
CBC
OFB
CFB
CTR

Which is the best Cipher mode among the five?

Also which is the best Padding Mode for AES Ecryption?

"Best" is rather subjective - it depends on your requirements. That said, I'll give you a general overview of each mode.

ECB - Electronic Code Book. This mode is the simplest, and transforms each block separately. It just needs a key and some data, with no added extras. Unfortunately it sucks - for a start, identical plaintext blocks get encrypted into identical ciphertext blocks when encrypted with the same key. Wikipedia's article has a great graphic representation of this failure.

Good points: Very simple, encryption and decryption can be run in parallel.

Bad points: Horribly insecure.

CBC - Cipher Block Chianing. This mode is very common, and is considered to be reasonably secure. Each block of plaintext is xor'ed with the previous block of ciphertext before being transformed, ensuring that identical plaintext blocks don't result in identical ciphertext blocks when in sequence. For the first block of plaintext (which doesn't have a preceding block) we use an initialisation vector instead. This value should be unique per message per key, to ensure that identical messages don't result in identical ciphertexts. CBC is used in many of the SSL/TLS cipher suites.

Unfortunately, there are attacks against CBC when it is not implemented alongside a set of strong integrity and authenticity checks. One property it has is block-level malleability, which means that an attacker can alter the plaintext of the message in a meaningful way without knowing the key, if he can mess with the ciphertext. As such, implementations usually include a HMAC-based authenticity record. This is a tricky subject though, because even the order in which you perform the HMAC and encryption can lead to problems - look up "MAC then encrypt" for gory details on the subject.

Good points: Secure when used properly, parallel decryption.

Bad points: No parallel encryption, susceptible to malleability attacks when authenticity checks are bad / missing. But when done right, it's very good.

OFB - Output Feedback. In this mode you essentially create a stream cipher. The IV (a unique, random value) is encrypted to form the first block of keystream, then that output is xor'ed with the plaintext to form the ciphertext. To get the next block of keystream the previous block of keystream is encrypted again, with the same key. This is repeated until enough keystream is generated for the entire length of the message. This is fine in theory, but in practice there are questions about its safety. Block transforms are designed to be secure when performed once, but there is no guarantee that E(E(m,k),k) is secure for every independently secure block cipher - there may be strange interactions between internal primitives that haven't been studied properly. If implemented in a way that provides partial block feedback (i.e. only part of the previous block is bought forward, with some static or weakly random value for the other half) then other problems emerge, such as a short key stream cycle. In general you should avoid OFB.

Good points: Keystream can be computed in advance, fast hardware implementations available

Bad points: Security model is questionable, some configurations lead to short keystream cycles

CFB - Cipher Feedback. Another stream cipher mode, quite similar to CBC performed backwards. Its major advantage is that you only need the encryption transform, not the decryption transform, which saves space when writing code for small devices. It's a bit of an oddball and I don't see it mentioned frequently.

Good points: Small footprint, parallel decryption.

Bad points: Not commonly implemented or used.

CTR - Counter Mode. This essentially involves encrypting a sequence of incrementing numbers prefixed with a nonce (number used once) to produce a keystream, and again is a stream cipher mode. This mode does away with the problems of repeatedly running transforms over each other, like we saw in OFB mode. It's generally considered a good mode.

Good points: Secure when done right, parallel encryption and decryption.

Bad points: Not many. Some question the security of the "related plaintext" model but it's generally considered to be safe.

Padding modes can be tricky, but in general I would always suggest PKCS#7 padding, which involves adding bytes that each represent the length of the padding, e.g. 04 04 04 04 for four padding bytes, or 03 03 03 for three. The benefit over some other padding mechanisms is that it's easy to tell if the padding is corrupted - the longer the padding, the higher the chance of random data corruption, but it also increases the number of copies of the padding length you have. It's also trivial to validate and remove, with no real chance of broken padding somehow validating as correct.

In general, stick with CBC or CTR, with PKCS#7 where necessary (you don't need padding on stream cipher modes) and use an authenticity check (HMAC-SHA256 for example) on the ciphertext. Both CBC and CTR come recommended by Niels Ferguson and Bruce Schneier, both of whom are respected cryptographers.

That being said, there are new modes! EAX and GCM have recently been given a lot of attention. GCM was put into the TLS 1.2 suite and fixes a lot of problems that existed in CBC and stream ciphers. The primary benefit is that both are authenticated modes, in that they build the authenticity checks into the cipher mode itself, rather than having to apply one separately. This fixes some problems with padding oracle attacks and various other trickery. These modes aren't quite as simple to explain (let alone implement) but they are considered to be very strong.


Will A SOC 2 Audit Typically Require Penetration Testing? I work for a small firm beginning to explore having a SOC 2 (Security, Availability, Confidentiality) audit performed. The auditor we're working with believes we will need to have penetration testing performed annually to satisfy some of the trust services criteria.

We're concerned about the cost of having these tests performed annually (in addition to the audit costs). Is a penetration test typically required annually to satisfy a SOC 2? Is it possible to do pen testing in house?

Having gone through this myself, the answer is truly up to the audit agency performing the audit. It is an easy-to-understand third party assurance function that is quite typical in this kind of audit.

You might be able to negotiate with the auditor to not require it this time around, but you will need to be able to compensate for the loss of assurance in some other way.

In the Management Response, the Business can explain why the penetration test was not performed.


Iframe inheriting parent's Content Security Policy I have a parent page that has a Content Security Policy on it. The main purpose of CSP is not to prevent XSS, but to prevent network access. This page has to run some user generated/submitted HTML/CSS/JS. I am running this user content in an iframe by using document.write to write the user content into this iframe.

NOTE: The user content that I have is not uploaded or present on a server but is available dynamically - say using some form.

I also want the user content to inherit the CSP of the parent page and any iframes created by the child iframe as well.

The policy applied on iframes according to the spec:

  The policy of the embedding resource controls what may be embedded. The embedded resource, however, is controlled by the policy delivered with the resource, or the policy of the embedding resource if the embedded resource is a globally unique identifier (or a srcdoc frame).

So, the standard says that the policy will not be inherited, because the parent page is not a globally unique identifier. I don't want to use srcdoc iframe because of the following reasons

The html can be very large
The html needs to be escaped to use srcdoc which seems unreliable and unclean.
Browser Support (Edge - under consideration)

But there is a twist:

When I went on to test this inheritance thing on browsers, the csp was actually being inherited on Chrome, Safari, Firefox but not Edge. This to me seems quite logical and correct.

Here is the sample test I performed:

    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'"/>

Parent Content

        The image here will be blocked due to CSP (default-src directive).
        However the iframe's image will not be blocked on Edge since the CSP is not inherited.

So, finally my questions are:

Can I depend on this inheritance of CSP to child iframe on Chrome, Firefox, and Safari? - I can't find this documented anywhere.
Is there a clean and reliable way to be able to use srcdoc with escaping and everything? What are the performance impacts of using srcdoc?
Is there any other method to do this?

More thought:

The spec's (and Edge) handling of CSP applying to the iframe further adds to the risk of allowing 'unsafe-inline' for scripts to prevent XSS. Because then the attacker can even use document.write like this to trigger creation of iframe to his own malicious site even. Even child-src/frame-src 'none', doesn't stop creation of iframe using document.write. Isn't this very bad for security?

For 3, it seems there might be, and one that should allow you to set a tighter CSP on your other pages/content.

According to https://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/, you can provide specific rights to your iframe (or remove them).

It seems that iframe sandbox is supporter by all your targetted browsers: http://caniuse.com/#feat=iframe-sandbox

So I might create the iframe with the appropriate sandboxing, rather than rely purely on the parent page's CSP policy.

The one unknown (to me) is what happens if/when someone manages to modify the iframe's sandbox


Cracking a JWT signature I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own JWTs. How can I crack the secret key of a JWT signature?

I tried using jumbo john which does seem to have JWT support, but I can't get it to work:

$ ./john jwt.txt
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

There is no JWT option in john --list=format.

I ended up writing a little Python script that uses PyJWT to parse the JWT and check the signature.

There is also jwtbrute. I haven't tested it, but it seems to be a bit more efficient than my script because it does much work such as base64-decoding outside of the loop.

If you want to crack JWTs using John the Ripper, you need to convert their format to something like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjEyMzQ1Njc4OTAsIm5hbWUiOiJKb2huIERvZSIsImFkbWluIjp0cnVlfQ#7a86835464c295175fc5465788fb377fc16624390313f5424055ea2b1a4bb2db

As you can see the first two parts are the same, but the signature is now hex instead of base64. Also, it is separated from the data with a # instead of .. I wrote a little script to do the conversion.

You also need a recent version of john. The version that comes with Kali didn't work for me, but the version on GitHub did.

$ ./john ~/dev/crackjwt/jwt.john
Using default input encoding: UTF-8
Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 256/256 AVX2 8x])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
secret           (?)
1g 0:00:00:00 DONE 2/3 (2016-08-24 15:58) 6.666g/s 218453p/s 218453c/s 218453C/s 123456..skyline!
Use the "--show" option to display all of the cracked passwords reliably
Session completed


Docker X11 Forwarding Security I am currently running a Docker container with a program with a GUI forwarded over SSH (using X forwarding over OpenSSH). The virtualized server has X11Forwarding enabled and I can connect to it from my host machine and open up an application from it without much of a problem.

Is this secure? Does this give the sandboxed system/application access to the host in any way? How am I exposing my system to the possibly untrustworthy application? Is the system that is connecting over SSH exposing its entire X display session to the virtual machine?

I'm aware it's able to pick up keystrokes and other things even whilst tucked away into the background (minimized to KDE taskbar/tray), as applications such as Skype proved, but I would like to know if this extends beyond that, such as direct system access in any form.

On a general basis, you should not forward X11 display from untrusted environments to your local environment. X11 is an old technology which was not conceived with security in mind from the beginning, on the contrary it was designed to allow every application to communicate with each other.

Was does "communicate" mean? As you said, it could grasp you keystrokes. It could also take screenshots. It could interact with other windows, inject keystrokes, mouse moves, etc., etc., etc.. Well, I guess you got it: allowing an untrusted system to export X11 display to your local server is a bit like passing your screen, keyboard and mouse to this untrusted system. You are right in the sense it may not be able to access your local files directly, but it will be nearly equivalent.

Some work has been done in order to mitigate the risk though. X11 indeed include a distinction between a trusted and untrusted clients. An untrusted client should be confined in a subset of actions designed to prevent most of the nefarious actions described above.

SSH integrates this mode, even if some Linux distribution disable it and consider all X11 client as trusted for the end-user convenience (!). You may want to check the ForwardX11 and ForwardX11Trusted parameters in your SSH client configuration files:

ForwardX11 tells if X11 is enabled by default when you establish an SSH connection (you must use the -x (lower-case 'x') command-line parameter to disable it on-demand),
ForwardX11Trusted tells if, when you enable X11 forwarding, the client will be automatically considered as trusted. I strongly recommend you to put this one to no.

When ForwardX11Trusted is set to no, the ssh command will offer you to select the trust level for your session:

The -X command-line parameter will consider the client as unsecure, this is recommended way to go.
The -Y command-line parameter will consider the client as secure, this is only needed for very specific use-cases and should be used with care since you must consider that the remote applications will have a full access to your system.

However, as I stated above, you should not rely on the security feeling provided by the -X "secure" mode to export display from untrusted environment to your local X server. But this should be sane enough if you consider this Docker environment as a trusted environment.

GUI application isolation is a domain under heavy study currently. While every other of the Linux system has went through large hardening measures until now, I have the impression that X was nearly always left appart, too large and complex to really evolve and be adapted to current needs, but leaving now a nasty weakness.

Secure platforms like Qubes OS which is precisely relying on a set of isolated Xen VM exporting X display to a Dom0 domain went through the pain to develop their own X protocol "reverse-proxy" between the X clients and server to ensure the server's security. I do not know any standalone equivalent of such technology, but you may find interesting ideas here: Best method to sandbox X applications in ubuntu. X server is leaving his last times and ought to be replaced by a more modern and secure alternative as soon as such alternatives become ready (see Wayland and Mir for instance), but until then at least check to who you entrust your desktop!


Why is Spotify using my webcam (AppleCamera) I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam.

lsof | grep "AppleCamera"

Google and Spotify showed up:

Spotify 668 salmon  txt REG 1,4 345968 16727731 /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

Google 39415 salmon txt REG 1,4 345968 16727731 /Library/CoreMediaIO/Plug-Ins/DAL/AppleCamera.plugin/Contents/MacOS/AppleCamera

I assume Google Chrome has access to my camera for sites that may require it. But I have no idea why Spotify would need access? Is this something to be worried about?

I noticed the same thing.
It turned to be the audio driver that enabled some shady/unuseful thing to track your face for audio spatialization. Try to disable this or restore previous driver's version.


Is HTTPS secure when using an online web browser? When I connect to an HTTPS website on an online web browser such as https://www.browserling.com/, is my connection still secure, or will the online web browser I use be able to see my traffic? I am aware that HTTPS guarantees that there are no eavesdroppers between the client and the server, but wouldn't the server see the online browser instead of my actual browser as the client? Wouldn't my data be decrypted on their online browser and re-encrypted and sent back to my actual browser via the online browsers HTTPS, thus allowing them access to my encrypted data?

I know no one between me and the online browser would be able to see my traffic (as long as it has HTTPS), but what about the web browser itself seeing the HTTPS data received using it?

In the worst case "online browser" is a bunch of figures and a label https:// in the URL bar means nothing.

There is no computational security scheme which addresses your use case. The security of connection between you and the site which you open in the so called "online browser" reduces to how much you trust the "online browser" operating site.

  Wouldn't my data be decrypted on their online browser

As I said there is no computational security in this use case. An "online browser" cannot be implemented in a way which secures the traffic between you and the website you want to access. An "online browser" cannot work without getting unencrypted data as no existing program can.

Summary:

"online browser" operator has all the data which would be secured with HTTPS otherwise
whether "online browser" uses HTTPS to communicate with target website or not is not computationally recognisable

  will the online web browser I use be able to see my traffic?

Yes.

  wouldn't the server see the online browser instead of my actual browser as the client?

It would. (the online browser may imitate your browser if it "wants")

  Wouldn't my data be decrypted on their online browser and re-encrypted and sent back to my actual browser via the online browsers HTTPS, thus allowing them access to my encrypted data?

Your data is not encrypted end-to-end, it only gets encrypted with "online website" before it reaches the target (if it ever is).


can a x.509 certificate alone be used for user authentication? we have a scenario for implementing SSO using x.509 certificates. A secure client will download a x.509 certificate (only certificate...no private key is available) upon user logs into the windows machine. Henceforth for all web applications, we would like read this certificate for authenticating the user. when we tried for reading the browser certificates(by configuring tomcat to request client certificate), able to read only certificates with private key. not able to read the x.509 certificate put up by the secure client.

Can somebody help me to read the x.509 certificate from server side? Or only certificates with private key alone could be used for this purpose?

What you describe is unworkable.

Without rewriting the SSL implementation on the client and the server, the client must have the private key for the exchange. The authentication comes from using CN as the identifier for the user - hence for webservers it contain the IP name of the server. For authenticating email addreses, the CN contains the ADDR_SPEC. What you put in your CN is up to you.

There is a further complication in your proposed method - the user must install the certificate, although this is not terribly complex.

You can't prevent a third party website from dreading the details of the client certificate if the user browses to that site (ISR that it is possible to restrict use of client certificates to specific sites, but don't remember the specifics). But they don't get to see the private key (via the SSL/TLS connections).

Your insistence on not providing the private key to the client makes any use of client certificates impossible.


Is it safe to expose bcrypt password hashes? I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users.

The basic flow:

Primary users logs in while web app is online, hitting the server
Server returns a list of other users within the same company, including their bcrypt hashes (hash cost of 10)
Other user is allowed to create a record while the web app is offline by entering their own password, compared to those returned earlier using a JS bcrypt library

The application itself is fairly low-risk and there aren't many scenarios where a user would have incentive to impersonate a co-worker, but I would like to get this right.

Thanks in advance for any insight.

(A follow up question is: when syncing with the server, how to prove to the server that the other user actually did the offline authentication before creating their record, but that might be better as its own post.)

No, it's not ok, but that's not a matter of the bcrypt hashes, but because you moved authentication from the server you trust (because it's your server) to the user's device (which you can't trust). It now takes a simple debugger to change the result of the "is this password valid?" check from "no" to "yes".

Also, it gives an attacker a persistent access to a list of hashes. So, the attacker can brute-force that list for as long as they want on any computer that they want to use.

Simply put, that is a very bad idea.

The right thing to do would be to cache the actions of the user who claims to be a coworker of your authenticated user, and let that coworker properly authenticate with your server as soon as they are back online to actually commit whatever they did to the server. One way to do that is simply to store the password the user entered and then send it to the server, in whatever shape you use during a "normal" log in. If that works, fine, the user has authenticated itself, and the stored actions can be carried out. If not, well, tell the user that he entered a wrong password and his actions cannot be committed unless he enters the right one.


How is executable shellcode inserted? How is shellcode (the payload) added to an executable file? Assume it is close source.

How does the hacker then get the address of where it is? They need this for when they overwrite the return address...

After the above is clarified, an example of how ASLR helps to prevent this would be appreciated.

This question is for native code.

I recommend reading Smashing The Stack For Fun And Profit by Aleph One, which includes some examples of how it is done.

  How does the hacker then get the address of where it is?

By using a debugger and disassembly of the program, examining assembly instructions. One of the particular things of interest, as in the referenced article, is Stack Pointer:

  The CPU has special instructions for pushing values onto the stack and popping them back from the stack. Each push stores the value at the current location of the stack pointer and decreases the stack pointer. A pop retrieves the value pointed to by the stack pointer and then increases the stack pointer (don't be confused by the fact that adding a value to the stack decreases the stack pointer and removing a value increases it.

If layout randomization is not enabled, stack pointer is predictable, which means hacker can know how to overflow buffers or where to inject shellcode. In fact, to answer the ASLR part of the question, an example of how can that be useful can be seen in How to find stack pointer for overflow bug?

  How is shellcode (the payload) added to an executable file?

From untrusted input. One example of that is via command-line parameters. It can be combined with other exploits.


How is my employer accessing my router when employer's laptop is wirelessly connected to my home network I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home (allowed by employer), when laptop is wirelessly (isolated) connected to my home network through the employer's vpn over my personal vpn, the employer is able to turn off my wireless network, mess up the router that it takes me hours to get it back and running. Usually, I have to erase ram and reboot. uninstall and re-install the vpn applet.

How do I know it is my employer? During the time I have been with this employer (several years), it never happened when I am off work during weekdays or weekends. It happens when I am connected to my employer's network. This doesn't happen every time. It happens during political situations at work.

Even if I assume that the employer's laptop is rigged, how is it possible to get through an AP Isolated wireless network with dedicated ip, and get to the router so as to turn off my router's wireless network and internet. When I say turn off, I don't mean go into the configuration page and turn off the wireless radios. I mean the wireless radios are not functioning and I also loose internet connection

As far as I understand you are connected through the employers VPN to the employers network. This means, there is a direct tunnel between the laptop and the employers network.

This tunnel can be used by you to access the employers network. But it goes in both direction and thus can also be used to access the laptop from the employers network. It does not matter what kind of additional protection you have  below this tunnel at all, all what matters is that this bidirectional tunnel (i.e. the VPN) exists.

And, once your employer can access the laptop from remote he can also access any systems connected to this laptop (like the router), the same as you do when you are sitting in front of the laptop.


CVE-2020-5250 php vulnerability analysis I am exploring the vulnerability (CVE-2020-5250) found in PrestaShop software versions <1.7.6.4. Could somebody explain how (with which method) was the program exactly exploitable? And why is the patch provided adequate? Is this a common mistake made when developing software in php? Could not find any information on this topic and thought it would help other developers to learn from this mistake.

Thank you in advance!

Without doing an in-depth analysis, it looks like a case of IDOR (Insecure Direct Object References). This means that the server does not properly enforce access controls; simply knowing a value (in this case, id_address or id_customer) is enough to gain access to the object. By changing these values in a form field, a user could manipulate other accounts that they should not have access to.

The patch seems logical; instead of trusting user-provided form input to determine which user the data belongs to, it now appears to check the user's session data, which cannot be forged by the user.


NodeJs app files integrity security check What are the recommended methods or approaches to check NodeJs application (hosted on Linux server) files integrity check for security check?

There are usually huge number of files in node_modules/, so what approach should be followed to perform the required security check?

What you're probably looking for is a Host Intrusion Detection System, or HIDS for short. These monitor the filesystem for changes and allow you to send alerts when something is modified, often either by email or by logging into a centralised system like Nagios.

The most common open-source HIDS I come across is OSSEC, and on the commercial side is Tripwire. There's also Verisys. As far as I know all three of these are cross-platform.


I need ideas for blocking a single malevolent user Let me throw out this problem I'm having to some of my technical peeps and see if you guys have any new suggestions:

We have a website that sends text messages and voice mails for our clients. Clients can buy credits and use those credits when sending SMS and voice calls.

We have this Nigerian scammer who has decided that he wants to mess with us and continues to set up accounts, charge other people's cards and send messages. He appears to have full card data, including CVV2, address and expiry. (Harvested from some non-PCI compliant site, I'm sure) He isn't failing any of those checks. Sometimes he charges the card and sends messages, sometimes he just charges the card. (Probably to test validity, though we now automatically block an account that fails a card check three times in a week, so we get 90% valid cards now)

We are furiously developing a method to validate the charge card by charging them a couple of sub-dollar charges and they have to enter the amounts to validate the card. But that's currently slow to program and it's going to be a real barrier to entry for a lot of our more casual users. We are also considering a SMS based validation, but that's less secure as I'm sure he has access to at least 5 or 6 phones as well, or Skype SMS or something.

Plus, if we get too many of these charges backed out by the consumer, we stand to lose our merchant account. We are working to void them before they go through, but that's a painful manual process.

So, while we are working on adding solid card validation, what can we do? Near term and/or long term? This guy creates 5 or 10 accounts a day using all kinds of names, addresses, IP sources (usually in Nigeria, but not always, he also proxies from elsewhere), etc.

In short, everything we do to stop this guy right now is going to stop legitimate users from accessing their accounts or giving us money.

What other kind of defenses can we erect to prevent a single, reasonably technically  involved malevolent user? Some kind of evil detecting Turing test?

I hate to admit it, but I'm running out of brainstorming ideas. So I came here.

@logicalscope raises some good suggestions, but overall you still have to deal with one cold hard fact:

  Technically speaking, even this Nigerian prince guy is a perfectly valid user.

The only problem with him, is that he does not own the credit cards which he is providing - notwithstanding the fact that he provided all the validation necessary.
This is actually a failing of the credit card system itself - treating what you know (the CC numbers) as something you have (the credit card itself).
And, since these numbers are nearly in public domain (i.e. you give them to many sites, you hand the physical card to the checkout girl in your supermarket and the attendant at the gas station, etc), knowledge of them should not be treated as proof of card ownership.

Bottom line, formally you should be able to rely on the proof given, unfortunately there is the little issue of chargebacks. So, basically, the credit card companies are doing what they do best - screwing you from both directions :).

Ranting aside, what can you realistically do, to avoid charging a card that is not owned by someone who provided the CHD?
Well, not much (and I am thrilled noone suggested CAPTCHA....) However, your idea of minimal charges as a form of proof of ownership is a very good one.

It is very similar to Paypal's method, and I would in fact suggest modifying your scheme slightly in their direction. When signing up (IIRC), a single small charge is made. The amount is not the secret, as there are only so many sums that can be made in the sub-dollar range... instead, they ask you for the transaction number, that shows up on your credit card report. The only way to get access to that, is either to receive the card-owner's mail, or to have access to the CC provider's consumer portal. For the record, they also refund that dollar after you signed up.

Perhaps you want to implement this only for potentially risky accounts, as @logicalscope suggested - such as by IP geolocation.

One other possibility I think you should look into, is outsourcing card validation. Either by accepting only Paypal accounts, or using a 3rd party validation system. This transfers the responsibility to someone else, by having someone else accept the payment directly for you (ala VBV/3Dsecure).


How to redirect someone packets connected over the same wifi into my computer using Wireshark? I am using Windows 10. I just installed Wireshark 2.2.1. I am connected over a wifi network with security type WPA2-Personal. Many people are connected on this same network.
I have the password of this wifi. I would like to be informed about 3 things:

What is the step by step approach to redirect other people's packets into my computer using Wireshark?
How to prevent the man in the middle to capture packets from my computer?
Is it illegal to sniff other people's packets?

Thank you

What is the step by step approach to redirect other people's packets
  into my computer using Wireshark?

For this you need to poison the arp cache of target machine , as you are on windows you can use a very powerful tool CAIN for that , that you will be able to watch traffic

you need to add your PSK in wireshark 802.11 setting in preference list

WPA/WPA2 Enterprise/Rekeys

As long as you can somehow extract the PMK from either the client or the Radius Server and configure the key (as PSK) all supported Wireshark versions will decode the traffic just fine up to the first eapol rekey.

Eapol rekey is often enabled for WPA/WPA2 enterprise and will change the used encryption key similar to the procedure for the initial connect, but it can also be configured and used for pre-shared (personal) mode. Wireshark 2.0 (v1.99.6rc0-454-g1439eb6 or newer) is needed if you want decode packets after a rekey. that as you mentioned you have

  How to prevent the man in the middle to capture packets from my
  computer?

Add a static arp entry of your Local network gateway  in your arp table , it will prevent you from arp MIMT for your outbound traffic

But with Client isolation and tempory keys poisoning is that that easy , you need to use a packet craft to posion other client  by broadcasting arp using AP mac and gtk key for your broadcast encryption

  Is it illegal to sniff other people's packets?

yes , it not a legal deed


What is WebRTC and how can I protect myself against leaking information that doesn't need to be shared? What is WebRTC and what is it intended to be used for?

According to this Browser Leaks Test for WebRTC and IP Leaks, I am currently leaking IP information for IP addresses that I do not believe anybody on the internet needs to know, ever.

I installed a plugin for Google Chrome (WebRTC Block) which apparently disables WebRTC - the Browser Leaks page reports that WebRTC is disabled but the IP Leaks link still lists IPv4 IP addresses in the 192.168.x range.

How can I protect myself against WebRTC leaking information that doesn't need to be shared? Is it possible to keep WebRTC enabled for the purposes it was designed for without revealing IP information?

WebRTC stands for Web Real Time Communication.  It's used for most web related voice, video, or file sharing capabilities.  Specifically instances of communication where you are directly connecting to your peer through your browser.  Some examples could be web-games that let you play tic-tac-toe with a friend.  Sharing files directly through a browser to another peer.  Most browsers have native support for WebRTC except for Internet Explorer and Safari.  It uses encryption for all its communications, but as you've found there's a huge vulnerability.

It seems that Windows and FreeBSD are the vulnerable operating systems.  I'm currently running a Debian based distro, and it does not seem to be vulnerable based on the two links you've provided.

It does not appear that you can only block the leaked IP vulnerability and use WebRTC for its intended use.

Mitigations

I'm not sure which plugin you've installed to disable WebRTC.  This article states that both WebRTC Block and ScriptSafe extensions for Chrome will stop the vulnerability.  For Chrome make sure that all Chrome processes have been closed after you've installed the extension.  Sometimes the Chrome sandboxes aren't properly closed when the browser window is.  This will ensure the new extension has taken effect properly.

For FireFox the NoScript add-on should block the request.  You can also disable some settings with the following steps:

Type about:config in the address bar
Find the setting media.peerconnection.enabled and set it to false
Find the setting media.navigator.enabled and set it to false

I would not suggest using Internet Explorer as a mitigation... a leaked IP would probably be the least of your worries.  Switching OSs is an option, but probably a tedious one.


Security Conferences in United Kingdom I have already read the post of best security conferences, but am not able to find any academic security conferences, even through Microsoft Academic Search.

I admit this question is quite localized, but still hope to find an answer. Any list, source (of both security specific and general computing) will be greatly appreciated. In addition please describe how you learned about this conference or list

I will be collecting the answers in a unified Google Spreadsheet for community use.

SECURECOMM 2011 will be in London in September 2011.


Steganography - JPEGsnoop I am trying to overcome a CTF steganography challenge. I tried different methods to unhide the hidden data in the file without luck. I used JPEGsnoop on the image and I got this output:

*** Decoding SCAN Data ***
  OFFSET: 0x0000026F
  Scan Decode Mode: Full IDCT (AC + DC)
  Scan Data encountered marker   0xFFD9 @ 0x0001DF10.0
*** NOTE: YCC Clipped. MCU=(  15,  10) YCC=(  256,  132,  130) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  15,  10) YCC=(  256,  123,  121) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  256,  131,  126) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  258,  127,  127) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  256,  126,  126) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  256,  129,  122) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  258,  129,  124) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  16,  10) YCC=(  258,  126,  129) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  17,  10) YCC=(  256,  120,  137) Y Overflow @ Offset 0x0001DF0F.3
*** NOTE: YCC Clipped. MCU=(  17,  10) YCC=(  258,  124,  126) Y Overflow @ Offset 0x0001DF0F.3
    Only reported first 10 instances of this message...
  Compression stats:
    Compression Ratio: 31.12:1
    Bits per pixel:     0.77:1

Can these notes indicate on a hidden data segment?

Update

The image is well formed. There are no double FFD9. the file ends with FFD9 without gap between the end of data and the FFD9. I tried to find the "overshooting" luma (Y) values using python:

#!/usr/bin/python

from PIL import Image

def main():
    im = Image.open("l0v3m3.jpg")
    im = im.convert("YCbCr")
    y, cb, cr = im.split()
    seq = y.getdata()
    for x in seq:
        if x > 255:
            print x

if __name__ == '__main__':
    main()

But, as it seems, the Y values are clipped. If someone knows a way to get the Y value without clipping I would be very thankful. btw: here is the file

I don't think you're looking at a hidden data segment. The FFD9 is an EOI marker and data following it should be ignored, so I wouldn't expect JPEGSnoop to try to actually decode it. The fact that it does seems to indicate the error isn't related to the EOI.

An illegal YCC value could indicate that an out-of-range value is actually used to code information. Several possible schemes are possible. For example you might be looking at a double-bit scheme in which violation either do not occur, or occur in singlets or in pairs:

OK OK    = it was not possible to code a bit in this pixel
FAIL OK  = this pixel codes a zero (or a one)
FAIL FAIL= this pixel codes a one (or a zero)

Since most JPEG decoders silently clip values out of range, this kind of encoding is not immediately visible, and does not greatly impact on image size (i.e., there is no high frequency noise superimposed on the image).

Another scheme possible with JPEG specifically is to abuse ITU-R BT.601 encoding, which has legal YCC values between 16 and 235 (but in a byte you can store values 0-255). Whenever you find a pixel that is very black (16) or very white (235), that is suitable for embedding four extra bits in its least significant nibble. Output 12 instead of 16, and ITU decoders will translate it as "black", while your steganography decoder will read "1100b".

Also, when YCC is denormal, the values for the Cb and Cr components should be insignificant (I think). Black color has no hue, so whatever hue you specify will always decode to black. This means that you can use these values to store additional information.

On the other hand, everything above might be wrong and those data might actually be after the End-Of-Image marker. What it is, I couldn't say; you can try and view it through a hex editor and see whether it makes sense. It could be, say, an ASCII sequence, and the reason it throws YCC clipping error is because "SQUEAMISH OSSIFRAGE" is not actually a valid DCT decomposition after all, so it vanishes to zero (or to 1), and once converted to YCC it naturally falls outside the range.

Update

Okay, the file ends with FFD9 (EOI), so provided it hasn't got two EOIs:

 ....legitimate image.... FFD9 EXTRA DATA ...FFD9

then the YCC "errors" reported by JPEGSnoop must refer to the "legitimate image" data.

These bytes are correctly DCT decoded, but they decode to a triplet (Y, Cb, Cr) where the Y value is out of range, and is therefore clipped. You see in the JPEGsnoop debug that you have values of 256 and 258, which are (obviously) not 8 bit.

This can be used to carry information by mapping denormal YCbCr values to single bits:

         JPEG    Stego
255 ...  white   00
256 ...  white   01
257 ...  white   10
258 ...  white   11

This way, every pixel with full luma might encode two bits of hidden information (or you might encode only 0 as 256 and 1 as 258, if by some chance the integer algorithm never outputs 257).

To decode it, you need to recover all those samples (you need some JPEG decoder that does not clip values), and dump out the "extra" bits. Then figure out what those bits mean.


How to defend against invalid UTF7/8 that hides a  tag? I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute arbitrary code.

I have never seen such a sequence myself and I am curious what it looks like, so that I can do a simple strstr call to locate them.

Thanks for any help.

Your first line of defence should be input sanitization. In other words, make sure that you only accept valid UTF-8 or whatever other format you are expecting.

Going the route of string replacement is based on black-listing. Black-listing is always one step behind and, because of this, won't work. Your second line of defence (after sanitizing) should be White-listing instead.


How secure is a mobile e-banking authentication app that requires an NFC card plus a pin to authenticate the user? Many banks these days offer online banking (in a web browser). To increase security, most banks require a standard login with a username (account number) and password, plus a code that is sent to your mobile phone to two-factor authenticate the login and/or any transaction.

I am thinking of switching to a bank that uses a different scheme: In order to login online (say from your home computer), it just requires your account number (no password needed). The bank then provides a challenge (a few digits), which you must then enter into a dedicated mobile phone app. To increase security, the app requires you to hold a physical card (with a chip) to your phone (which I am guessing will use NFC) and to "unlock" the card with a pin (known only to you), which you type into your phone. If the pin is correct (matches the pin of the card), the phone will hash the challenge digits into a passcode, which you then type into your web browser. This then gives you access to the online banking platform. The same procedure is used when trying to issue a transaction.

I found a press release from when this technology was developed here. The article doesn't say much about the security, though.

I am wondering how secure this is. Let us assume we have an attacker that was able to completely compromise my phone to the root level (some exploits pop up from time to time that allow this, so it's not unheard of). So, we assume the attacker can intercept everything I type on the phone and can monitor everything that every app on the phone does (including memory accesses). We will further assume that the attacker knows the bank account number and who it belongs to, but does not have physical access to the card or the chip on it.

If I now used this app and activated the card's NFC and typed in the pin, would the attacker be able to copy everything he needs from the card to phone, thus allowing him to authenticate himself (in the future without the card) and gain complete access to my bank account?

Or am I wrong in worrying and does reading from the card change its state in a way that is unpredictable to the reading device, ensuring that even if I authenticate myself multiple times on a compromised phone, the attacker would still need physical access to the card itself before he can do any damage?

Usually NFC cards, as with EMV tap card payments use asymmetric encryption for an authentication challenge and response, and the card has a unique private key that is never output anywhere. Assuming this is how it works in your situation, and the bank doesn't authorize all phones when only one provides a the correct response it should be fine. To illustrate:

The attacker steals your phone and not the nfc card. You then get a new phone and install the same app. Lets say worst case scenario the code that the bank sends out is to your email and the attacker has access to your email. With your new phone you request a login. The attacker sees the email and attempts to log in. The bank then request both devices to use the NFC card to respond to a challenge. You succeed and the attacker does not. The bank authorizes only your session on your phone.

This should be secure as long as the bank clearly keeps its sessions correctly. And assuming that the NFC card does in fact use a secure scheme to generate and load private keys, the nfc card cannot be duplicated (short of gaining physical access and dissembling the IC's, or performing a successful DPA which I think is unlikely on an NFC chip because EM interference).

I personally would use this scheme accept I keep my cards and cell phone together!


When brute-forcing a private-key stored as binary how do you know you found a solution? Given the following scenario:

the user has a password and a symmetric key is derived from it by PBKDF2 or bcrypt
a private RSA key is protected by the above symmetric key
the encrypted private key in binary format is available to the attacker
all the details of the KDF algorithm are available to the attacker (salt, no of iterations, source code)

My understanding is that an attacker who wants to decrypt the private key can perform a brute-force attack by guessing passwords and applying the KDF.

How would the attacker know if a guess is successful?

Besides the brute force, are there other approaches to decrypt the private key given the above information?

Are there significant differences between PBKDF2 and bcrypt in this scenario?

Thanks!

How would the attacker know if a guess is successful?

There are only so many formats in which private keys are stored. As an attacker, if I could assume that you didn't store your private key in your own, home-grown format, I'd just see if my brute-force guess decrypted the private key to any one of the formats I'd expect a private key to be in.

For example, if I assumed that your private key was an ASCII-armored PGP key, I'd simply check whether the first few bytes decrypted to

-----BEGIN PGP PRIVATE KEY BLOCK-----

and vice versa for other formats.

If the attacker had a list of possible public key candidates for the private key, he could also compare the modulus of the resulting decrypted private key against the modulus of the public keys and if one matched, he'd know he had a correct decryption.

  Besides the brute force, are there other approaches to decrypt the private key given the above information?

None I know of, as long as you use a strong symmetric cipher. Other avenues of attack would mean there were serious weaknesses in the symmetric cipher you use to encrypt the private key.

  Are there significant differences between PBKDF2 and bcrypt in this scenario?

Probably not. Both are considered strong for key derivation, even though opinions differ on the exact advantages and disadvantages. One disadvantage they both share is that they don't use very much memory to derive keys, so they can be implemented on very fast, highly parallel processors (think GPUs and FPGAs).

(edit: added the part about comparing with the public key modulus to confirm a correct decryption)