Faking IP address without being aware of returning response I read different articles on the subject (Spoofing IP address), someone said:

  Spoofing an IP is usually better suited to "fire-an-forget" scenarios
  like DDoS.

due to TCP two-way communication and its three-way handshake. That's okay but I've a scenario that I think is similar to this. Here it is:

A bug was recently found on my website in which a user could steal my paid contents by sending a POST request to one specific URL with an old and successful purchase information (user had to buy a product once/had to have a successful payment info) then he had access to content as system didn't check if current billing information is existed or not (It only checked if a purchase with that information was done successfully or not).

After finding this bug I restricted POST requests to get processed from a specific IP only (which is bank website IP) (and I didn't fix the logic of checking purchase information yet).

Now It came to my mind that if someone can fake his IP address as the bank IP address and gets access to my paid contents as before or not.

Is there any way that someone spoofs the request IP address here? if yes how?

The attacker can still spoof the IP address and use bank's IP address, but the response from your website will go to the spoofed IP address (bank's IP address) and not to the attacker's actual IP address.

Usually a TCP handshake is required to initiate a TCP connection. HTTP uses TCP. The attacker will send a SYN packet with spoofed IP(bank's IP), your website will then get this packet and send a ACK to the spoofed IP(bank's IP). The machine at bank will see that it has received a ACK packet and as it didn't send any SYN packet before, so it will normally drop the packet. Due to this a TCP handshake can't complete. So, the connection between your site and the bank is not established completely.

This is why in DDOS a spoofed IP is used. Because in DDOS the attacker's motive is to bring the target machine down, so that the legitimate users are not able to get the resources from the target machine. Hence the name Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack.

Spoofing an IP address: One method is that an attacker will use some packet crafting tools and create a packet that will contain a spoofed IP address. The link above shows most commonly used tools.


How much is known about who is responsible for all the database breaches? Troy Hunt claims that those responsible for data breaches are often just teenagers and there are reports that a lot of the breaches would appear to come from insiders. But we also hear a lot about the extent and sophistication of cybercrime. Also, companies seem to want to keep quiet about data breaches. So are there any reliable statistics about who is responsible for the majority of data breaches?

EDIT

I have amended the question so that it relates to database breaches rather than data breaches.

When I asked my original question I was coming from an interest in understanding who was behind the many database breaches – specifically the theft of password files – and hadn't appreciated that the term “data breach” had a broader reach (as explained in this Wiki definition). Troy Hunt's talk, “Lessons from a billion breached records”, was about this narrower concern.

In attacking the misattribution of such attacks in sensational press reports he made the point that often the perpetrators are youngsters with no criminal intent. Although he also recognised the involvement of organised crime, the impression I came away with was that it played a less significant role (though I appreciate that this might not be his actual position on the issue).

Having now read something about the extent and sophistication of organised crime I wondered if any other research into this area has made similar observations. I'm trying to reconcile Hunt's apparent assertion with reports about organised crime like:

“The increasing threat from organized cybercriminals and state-sponsored cyber espionage means companies need to forget about the idea of a lone hacker” Steve Ranger, ZDNet

“The growth of the as-a-service economy across all components of an attack (research, cybercrime tools, and infrastructure) continues to grow, and none more so than hacking-as-a-service” The Hidden Data Economy, Intel Security

Whilst it is going to be debatable about whether these sources are reliable, there are a fair number of sources of information about data breaches, which generally touch on who they think is responsible.

Verizon DBIR
Secureworks Cybersecurity Threat insight Report
EY Global Infomation Security Survey

Basically there's loads of these reports from companies who deal in this space, which can be read to try and derive a picture of who's responsible for what.


Trusted device web application I would like to build a web application which has a trusted device feature.

What is required to store for recognizing the machine securely?
Can I safely store an encryption key (private) on the machine, so the user, doesn't need to input it when uploading data etc.?

What I've thought is storing a cookie on the users machine containing a 64 digit hash, which is matches an entry in the database stored with the user.

Is a cookie safe enough to store this hash or a private key?
Is there other security measures that should be taken?

The application will be built in PHP.

What is required to store for recognizing the machine securely?

I assume you meant reasonably uniquely and reliably - in which case, this is a hard problem. Made harder by the fact that any web application does not have access to the underlying hardware - just transient information such as browser version and IP address. Yes - you can get a lot of information about a system, e.g. as panopticlick does, but that information is changeable on demand.

Moreover, any of these metrics can change. Using CPUID? What happens if the end-user upgrades their processor? Your "trusted device" status disappears. That might be acceptable, or it might not - think Windows Activation.

In any case, in order to protect against token interception, MITM, replay and all other nasties of this sort, you absolutely must use SSL for this channel which brings me to:

  He will still have to log in using password + username, however, he can ONLY log in from given machine.

This sounds like a use case for SSL client certificates, in my mind. The usual logic looks like this:

Ask the browser for a client certificate.
If you get one, check that cert, find the user DB etc and log the user in.
Otherwise display the user login page.

I think what you're asking for, however, is a variation, in which if you find the certificate you present a login form and otherwise you display a 403.

That deals with the authentication side of things quite nicely. It also alleviates the need to store unique machine IDs and all the problems of generating them - although you could do so alongside this if you wished - and allows the user to designate trusted devices just by installing the certificate.

  Can I safely store an encryption key (private) on the machine, so the user, doesn't need to input it when uploading data etc.?

Well, you've never got any guarantee of client side security on the web. You simply have to trust users are looking after their credentials.

The same goes for cookies. Remember, users may do all sorts of things to cookies, including clean them up unexpectedly. If you're building a web app and intend to do client-side crypto in JS, and you lose that key, the user is going to lose their data.

The alternatives are:

Encrypt the data on the server. As you've probably guessed, this means anyone with access to the server can get at that data - and no protection you put in place will help.
Encrypt the data on the client outside the browser, where storage is more reliable. When I say "outside the browser", I mean via a mechanism with proper persistent storage that is not cookies.
Wait for homomorphic encryption.
Design a way of extracting the key from the cookie and ensure your users can re-input it again as necessary.

Generally speaking, the standard advice for cookies (this includes your session cookies) over https is to use secure and httponly flags so that XSS does not work and the cookie does not leak.


How much privacy do domain whois privacy services really offer? I have a domain with my real name, address and contact info on the whois record. I am considering purchasing a privacy service to hide these details. Will that actually help, given that my record is already "out there", with many whois-history search services claiming to offer access to previous whois records?

Over a period of 2 years I received some spam mails (less than ten), having my contact info public. But my website was just a personal one (about my hobbies and such). If your website is a commercial one, I would recommend to hide your details.

And it would surely make it harder for people to find out your details, even if the details were public for a short while.


How can I intercept and modify HTTP requests? Are there any free tools available that let me intercept and modify HTTP requests for testing?

I am looking for tools which allow me to send custom HTTP headers.

I personally am partial to Fiddler, a free download from MS.
There are many other decent interactive http proxies, but that one serves me the best.


Where does a scope get defined? According to RFC 6749 the strings [scopes] are defined by the authorization server.
However isn't it really the resource server who defines the scopes? I mean scopes vary from resource server to resource server, no? Even if they are registered with the same authorization server.

After having thought about it for a while... it should be correct to say that the authorization server defines the scopes and the resource server implements them.
A client requests authorization for a scope which the user gives consent to (authorization grant). Then the client sends the authorization grant to the authorization server to get an access token in return.
That access token must contain the signed scope that the user has given consent to, which in turn means the authorization server needs to be aware of all the scopes that can be requested.
Then it's up to the resource server to:

Validate that token (via introspection endpoint or a cached public key)

Parse that token for scopes and grant/deny access.


Mathematically, how long would it take to crack a bcrypt password hash? So I'm currently using bcrypt to hash passwords with a randomly generated salt (as seen in the pip bcrypt module), with 12 rounds.

I have been looking around, but I cannot find a detailed and clear mathematical way to estimate how long it would take for a strong GPU (or even other methods of cracking) to crack my bcrypt hash.

I found this gist which descibes 8x Nvidia GTX 1080 Hashcat Benchmarks, but I can't seem to use the figures provided for bcrypt to apply to my implementation of the hashing algorithm.

Ok, so from the article you linked, we learn that the 8x Nvidia setup can calculate about 100 000 bcrypt hashes per second (H/s). The cost factor used for the bench mark is 5 - very low - if the comments are to be believed. For bcrypt, the number of rounds equals two to the power of the cost factor. So if yours is 12, your hash will be 212/25 = 27 = 128 times slower. So from 105 H/s you're down to 103 H/s.

Now all you need to know is that to crack a hash with n bits of entropy, on average you need to try 2n-1 times. So take a password consisting of 8 random lower case letters for instance. It has an entropy of n = log2(268) = 38 bits. To crack it you would need 238-1/1000 seconds = 4 years.

Note that the benchmark is from 2016. As time passes by, hardware gets faster. You will need to regularly reevaluate your cost factor to stay up to date.


How to check for cross-domain referrer leakage? I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web application?

Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP content from an HTTPS website, and refreshes).

Thus, the simplest way to automate testing is to crawl/spider/monkey your web application and log all requests to other websites. Then collect all the HTTP Referers and see if there is any sensitive information being disclosed.

What you should be looking for is any sensitive data in the GET parameter of these referers (e.g. session IDs, account numbers etc.). This is a bad practice anywhere, and not just because it allows cross-domain referrer leakage, since this means that users browser histories and shared URLs are tied directly to their session/account. I've heard about this being reported generally for things like password reset (on edx and on Mozilla), where the URL allowed social media plugins to initiate "reset password", effectively giving their owners the ability to take over accounts.

Simply avoid having sensitive data in GET fields, perform all actions using POST, and use a good one-time-token for generating links to critical actions.


Downloading suspect files into quarantine? Are there any tools out there or methods available to download a suspect file for analysis without having to worry about being infected?

Downloading into an AV-style quarantine usually implies that the file is encoded or encrypted in some way to completely disable any ability it might have to attack the OS through a metadata exploit or accidental execution. This, however, would negate your ability to analyse the file.

Virtual machines are probably your best bet. As long as you disable certain sharing mechanisms that are often bundled as default features with VM products (e.g. directory sharing) the isolation should be very good.

Here's my usual procedure, within a VM:

Ensure that any config tools (e.g. VMWare Tools) that are installed on the virtual machine have been removed. The malware may leverage these to enable certain sharing features.
Download the file to a directory using wget or an alternative, without having that directory open in any kind of browser (e.g. Windows Explorer). If such a window were open, metadata may be read from the file.
Go into the VM settings and disable the network card and all other unnecessary hardware.
Take a VM snapshot in case the malware trashes the machine.
Begin analysis, and write up your findings on the host OS so you don't have to break quarantine to export them. If you have to export something, it is significantly safer to enable clipboard sharing than it is to enable the network card and upload the file somewhere.

If you can use a dedicated machine for this work, it is always wise to do so. It allows you to configure a firewall on the host that limits outgoing traffic from the VM, without the danger of the malware disabling it. It also allows for easier containment should something bad happen.

Of course, the most secure solution would be to analyse any executables on a platform that doesn't support them, e.g. analyse Windows malware on Linux. However, it may be more difficult to find good analysis tools.


Is this the correct flow of the KRACK attack? I am not cryptography expert so please forgive this basic question. I am trying to understand how the flow of the KRACK attack takes place in order to better understand why the encryption protocol itself can be cracked.

Lets start from after step 3 of 4-way WPA handshake -:

The client has received message 3 and has installed the encryption
key and sends message 4 to acknowledge that the encryption is now
correctly set up, and it can begin transmitting packets.
Unbeknownst to the client the attacker has already stored a copy of
message 3.
After transmitting a few packets the client receives message 3 again.
Now it resets the nonce to the initial value and re installs the
encryption key. It does not realize that it had already received
message 3 before and everything was fine.
So now the keystream will literally repeat since it is using the same
nonce twice, am I correct ?

If the above flow is correct then I have a couple of questions,

What can you do to attack the encryption protocol if two cipher
texts are generated from the exact same keystream ?
Correct me if I am wrong, in Linux where the client is basically
tricked into installing a zero-encryption key, this means the access
point no longer verifies/cares what key the client is using to
encrypt the messages after message 4 is received. I mean should'nt
the AP have a way of verifying whether the message is actually
encrypted using the PMK/PTK ? Shouldn't the AP go like "wait this message is not encrypted using the key we agreed on" ? How does work ?

Please let me know if my intuition about the attack is correct or not.

Intro note to make general reader understanding easier: you do not need to actually connect to the respective network. You just wait for someone to connect with a password (that’s what the PSK stands for, pre-shared key). When he does, long before they access anything, a four-way handshake must happen. This checks that the password the user has provided is correct, and establishes the encrypted connection between the router and the user device. It is here the attacker interferes - in the initial handshake between your device and the router - in a way that allows the attacker to gain an ability to decrypt the traffic you exchange over WiFi. This means sufficient access without even being on the network. Listen to the data exchange between user and  access point is sufficient, while emitting attacker packets back to change things on user device and the router.

The key reinstallation attack works exactly because the retransmissions of message 3 is accepted, even when it is in the PTK-DONE state, which is a model flaw. That is why a  reinstallation of the PTK can be forced. More precisely, MitM is established between client and router. Then retransmissions of message 3 are triggered by preventing message 4 from arriving. As a result, retransmission of message 3 happens, which causes the router to reinstall an already-in-use PTK. In turn, this resets the nonce being used by the data-confidentiality protocol. Depending on which protocol is used, this allows an adversary to replay, decrypt, and/or forge packets.

The attacks do not practically breach the security properties, but highlight limitations of the models employed. The models do not specify when a key should be installed for usage by the data-confidentiality protocol. In there lies the problem and the fix. That is why specification of a protocol should be sufficiently precise and explicit. For example, the 802.11 standard is ambiguous
as to which replay values should be accepted.
Practically, it does not define when the negotiated session key should be installed. As a result, there was no guarantee that a session key is installed just once. A more precise model definition can prevent that.


Server protection measures from authorities I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics.

I am running a server with ESXi 6.7 hypervisor and has three CentOS 7.5 VMs FDE'd with LUKS.

I have placed a thick resin to JTAG ports, PCIe ports and RAMs, in case of a cold boot attack.
ESXi shuts down automatically when chasis intrusion is detected.
I have a CCTV installed in the server room and if it detects too much movement, it will cut power to the server.

What more can I do to be more safe?

The most important factor here is that seizure of the server does not result in your identity as the server's owner being revealed. This must be accomplished by both purchasing the server anonymously, and by not keeping anything on the server which may be linked to you. This is important enough that, without knowing your specific threat model at least, I would consider buying a dedicated server from a company like Ecatel anonymously and forgoing the extensive physical security you have put in place. The reason is that, with enough effort, any physical deterrence measures can be bypassed. A few notes on your current setup, though:

  I have placed a thick resin to JTAG ports, PCIe ports and RAMs, in case of a cold boot attack.

Be aware that you would need to use tamper-resistant epoxy (and non-conductive and non-insulating at that), not just any thick resin, otherwise it may be possible to destroy it with various solvents. In addition, cold boot attacks do not always require physically removing memory. There have been instances where a server's BIOS was modified on the fly to trigger a low-memory footprint cold boot attack. Just because your RAM is epoxied down doesn't mean your RAM is safe.

  ESXi shuts down automatically when chasis intrusion is detected.

Chassis intrusion is often very easy to defeat.

  I have a CCTV installed in the server room and if it detects too much movement, it will cut power to the server.

There are many ways to defeat this. For example, gradually dimming (or increasing) the lights so no sudden change is detected. Eventually the lights will go beyond the camera's specifications and it will be effectively blind to any further motion. You can prevent this by using motion sensitive software which takes into account the risk of gradually changing ambient light levels to hide motion.

  What more can I do to be more safe?

There are other things you need to take into account. Before you decide to host something highly illegal, you need to really understand in detail both your adversary, and various ways your anonymity can be defeated. For example, when you SSH into a server, your public key is uploaded to it. Unless you explicitly disable this in the configuration, every server you SSH in to will be able to know you are the same person, even if you use a different IP. Additional things to keep in mind are keystroke biometrics, where your unique typing pattern (monitored either over the wire or on a compromised system) can be used to identify you. Anonymity is hard if you are going high-profile.

You must use remote attestation if you are going to be managing this server remotely. Setting up remote attestation can be complicated, but it is absolutely vital in this scenario. It will protect from firmware tampering as well as intercepting your LUKS password as you send it over the wire. Remote attestation is a technique using a device's TPM (yes, they are safe) to prove to a remote party that the software and firmware exists in a specific, known-good state. It will be able to send back to you a quote which cryptographically ensures that the server is in a good state.

But the most important thing of all... maintain your OPSEC!


Does the existence of two-factor recovery codes mean that my 2-factor code isn't completely random? With some services that use standard 6-digit TOTP codes, they also offer the ability to have a set of backup codes, in case you lose your two factor device.

With Google, for example, you can print out a hardcopy of 10 backup codes. These are more than 6 digits, so that isn't worrying.

However, some other sites that generate backup codes do use 6 digits. Reddit, for example, is rolling out two factor authentication, and their 10 recovery codes are all 6 digits, which is the same length as a standard two-factor code they use.

Does this mean that those 10 codes are somehow never going to be generated at random by the TOTP seed key? Since they're using a standard algorithm (used by Google Authenticator, Authy, etc), I assume every 6 digit number is possible.

Alternatively, does that mean that over time, some of these codes will become invalid, assuming the TOTP algorithm generates that code? Or even longer term, if I log in many times, I imagine I'll run across one of these codes eventually, use it to login, and unknowingly remove that code from my backup list.

What can be implied about a setup where the two-factor recovery codes are the same number of digits as a standard two-factor code?

The backup codes, or scratch codes, are totally independent (at least in terms of operation) from your standard codes. TOTP is based on the time.
The scratch codes are rather based on an incremental counter.

The implementation details are probably provider dependent, but I think it's safe to assume that they use 2 different seeds. Maybe the underlying HMAC function changes as well, it's hard to tell.

On the number of digit, it all comes down to the choice of underlying HMAC and/or Truncation function. Why would the scratch code being longer than TOTP could be to ensure a sufficient level of security. The scratch code being fixed for potentially a long period, it makes sense for them to be longer. TOTP on the other hand requires less, because cracking the shorter code in the given time frame of availability is already hard enough, hence it provides additional flexibility to the user who has to type it manually.


How do I know if my company or my ISP is using a TLS proxy? I was reading the other day on "Does https prevent man in the middle attacks by proxy server?". Let me quote few lines:

  Blue Coat, the biggest name in the SSL interception business, is far from the only one offering SSL interception and breaking in a box. Until recently, for example, Microsoft would sell you a program, Forefront Threat Management Gateway 2010, which could do the job for you as well. With an SSL interception proxy program or device in place, here's what really happens

  If your company has set up the proxy correctly you won't know anything is off because they'll have arranged to have the proxy's internal SSL certificate registered on your machine as a valid certificate. If not, you'll receive a pop-up error message, which, if you click on to continue, will accept the "fake" digital certificate. In either case, you get a secure connection to the proxy, it gets a secure connection to the outside site -- and everything sent over the proxy can be read in plain text. Whoops.

So if I understood correctly all my private information like banking credentials, Facebook, mail etc. can be easily intercepted without me even knowing about it.

If that is true how may I know whether my company or my ISP has a proxy in place and is eavesdropping on all my sensitive data?

How to know if your company does TLS intercept

As the post you linked to explains, the proxy will decrypt all the traffic, and then encrypt it again but signed with another certificate. Therefore the certificate you receive will be different from the one the website send. So one way to detect this is to compare the certificates you get when you visit a website from your company network with the one you get when you visit it from outside of that network (e.g. from home).

All browsers have functionality to view the thumbprint of a certificate. In Chrome, click the green lock in the URL bar, then click "Info", and finally "View certificate".

Some caveats, though:

Some websites may serve different certificates to different users for various reasons, so that they don't match for one site might not be enough to conclude there is a TLS proxy.
The proxy might not intercept traffic for all domains, so even if all the certificates you try match it is impossible to know that your traffic will never be intercepted.

So how do you get around those caveats? You would have to go through the trust store in your OS and your browser (if it uses it's own) to see if any certificates have been added there. For instructions on how to do this, see this question.

Finally, it should be noted that TSL interception is a perfectly legitimate thing for an employer to do. And since you are probably using a computer provided to you by your employer at work, there are many other ways they could monitor your browsing habits and anything else you do on your computer without relying on a proxy server. So if you want privacy, don't use your work computer or network.

But what about the ISP?

While your employer might have legitimate reasons to do this, your ISP most certainly does not. Fortunately, they can not easily do this. Why? The answer is in your quote:

  If your company has set up the proxy correctly you won't know anything is off because they'll have arranged to have the proxy's internal SSL certificate registered on your machine as a valid certificate. If not, you'll receive a pop-up error message, which, if you click on to continue, will accept the "fake" digital certificate.

Since your ISP does not control your computer, there is no way for them to install a root certificate (other than making you do it). So you would get a warning that the certificate is incorrect every time you visit a site over HTTPS. Not very stealthy in other words.

If you are still concerned someone might have sneaked a root certificate into your trust store, you could used the method above to check. But you would need to compare the certificates you get from the ones from a computer with another ISP, preferably even in another country. Or you could just compare them to the preloaded public key pins for sites that use HPKP.


Can extra loading times on login attempts be a security threat? I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password.

Since I'm using the PHP native (slow) hashing function, every time a visitor enters the email of an existing account it will use the password verify function to check if the password is correct. This also increases the load time of the page by about 0.5 sec because of the password verification process.

If there is no existing user account with the input email, the page loads fast because it won't even attempt to verify the password if there is nothing to verify against.

Since anyone trying to brute force probably would figure out that there is an existing user account for the input email because of the page's additional processing time, would this be a possible security threat?

Note: I'm only showing a generic login error as recommended by OWASP. So that's not of any issue.

This is a type of timing attack, leading to a username enumeration vulnerability.

Whether this is a threat or not depends on the design of your system. If usernames are supposed to be private them it is a concern. Some systems are written in such as way that the enumeration of users fits into the design, such as email providers, as email addresses are generally public and if someone has the email address foo@example.com then they definitely have some sort of email account at example.com and there is nothing leaked by letting other users know that this exists. The username being public carries more of a risk as an attacker will know which accounts can be targeted. In an email system though, this can be achieved by an attacker sending an email to the address to find out if it bounces so there is little you can do to narrow this attack vector in this case (if you want typos in email addresses to be notified to the sender of course).

Basically the vulnerability is summed up well here:

  As an attacker if I can use your login or forgotten password page to narrow my list from 10000 targets to 1000 targets, I will.

Sometimes it is assumed that if a website allows user registration with user chosen usernames or a password reset then user enumeration is always possible. This is not always the case - a user registration system can be combined with a password reset system and allow a user to select a unique email address as their username without revealing to other parties that it is already in use. This is accomplished by always returning the same message to the user on the website, but emailing the link to the next step of the process to the provided address. This ensure that only someone with access to that email address can either register or reset the password. Of course this would be for a medium security system where it is assumed an email MITM or other compromise is not a viable or worthwhile attack vector.

Timing attacks by their very nature will take time for an attacker to execute. So they might want to use this attack on your system in order to narrow their list before attempting a brute force attack on the "slow" login attempts, which will also take time.

If you wish to narrow the attack vector then you should introduce an artificial delay that will make all logins whether they have a valid username or not take around the same amount of time.


What is an ITGC Audit? I don't get the purpose of such an audit especially given the way it is conducted. We have a 3rd party auditor who I won't name, but let's just say they probably audit the majority of the publicly traded companies in the world.

The kind of requests from the audit teams are: Can you give us a screen shot of the installation folder of xyz financial applications and what server(s) they are on?

This is of no material significance to anything / anyone. Not to mention, I can change this information from day to day given the virtualized architecture of our company. In fact, it's likely to change multiple times before next year's audit. I must be failing to grasp some significant relevance? What is the purpose of one of these audits? Who / what is it meant to protect? What is it meant to prove?

What is an ITGC Audit?

ITGC stands for Information Technology General Controls.  While it sounds general, there's a backing standard and set of documentation that auditors use to maintain some consistency from the IIA (Institute of Internal Auditors).  Non-members of IIA can buy copies.

Some important points -

It's a standard, not just a willy-nilly set of what your 3rd party auditor thought would be good to check.
If you want to, you can buy a copy of the rules you're being compared against.  (I make no claim that you, or I, could understand those rules! But it's something...)

  I don't get the purpose of such an audit

That's a broad question.  Here's an analogy - I have to take my car down for a Safety & Emissions inspection every year.  They review a very limited number of aspects of my car (tailpipe emissions, turn and brake signals work, headlights aimed correctly, etc.) as a form of due diligence that my car is safe (for myself and others) to be driving on the road.

The purpose of an ITGC audit is to ensure that the car (computing resources) of your company is basically safe - not generating undue risk to your company.  If my car causes an accident because the headlights don't work, myself and others can get hurt.  If your company causes an accident because your databases don't work, then various people - employees, shareholders, customers - can get hurt.  The ITGC audit is the test to make sure your setup is correct enough so as not to be a danger to yourself and others.

  especially given the way it is conducted.

Also kind of broad.  Let's drill into the example you've provided and make some guesses.

  The kind of requests from the audit teams are: Can you give us a
  screen shot of the installation folder of xyz financial applications
  and what server(s) they are on?

Your company says to the auditor, "we run SAP ERP to manage our financials."  Being an auditor, they can't just take your word for it.  They need proof.

The audit world has been moving rather strongly over the last few years towards Proof.  SOX audits are much more rigid about getting a screenshot to provide evidence of something.  PCI 3 got much more explicit about the auditor needing to actually see evidence rather than just being told.  Both are shifting to require that the evidence collection be under the eyes of an auditor, to ensure no evidence tampering takes place.

Installation directories are the simplest form of proof that something is installed.  Screenshots are the cheapest, easiest form of proof to gather with any evidentiary integrity.

So they want to know that you've got financial software, what servers it's on, and have some sort of proof that that's true.

Later on in the audit, they're going to be asking you about disaster recovery.  And when they get there, they're going to say "Show me the your list of assets and their DR rating, e.g., what's most important to return to service after a disaster."  And they'll want to cross-check that the list of servers that you put your financial server on are all in the right tier.  It's a basic safety check - if your ERP web frontends are tier 1 recovery, but your ERP database backends are tier 3, then oops!  Your whole ERP solution is tier 3, which is probably not what you wanted.

  This is of no material significance to anything / anyone.

Well, I disagree.  I would rather know that my stock broker is using an enterprise-class database with redundancy and not hand-coded Berkeley DB files as a backend for my trading.  I can't go in and demand they tell me, of course, but if they've gone through a reputable audit, I can feel comfortable that somebody looked at their setup and decided it was sane.

  Not to mention, I can change this information from day to day given
  the virtualized architecture of our company.

You could.  You could do it deceptively and maliciously to mislead your auditors - which is they they now ask for screenshots and shoulder surfs, to make it more difficult.  You could also do it legitimately in response to business need, but most likely, business need is not going to be to switch to something that wouldn't pass an audit the second the auditors leave the building.

  In fact, it's likely to change multiple times before next year's
  audit.

Audits are point-in-time only.  However, the expectation is that

You won't shuffle things in time for the purpose of fooling an audit, and
If you're doing things in an audit-acceptable manner today, then hopefully you are doing your job correctly enough that you'll do it in an audit-acceptable way tomorrow when you have to change it.

  I must be failing to grasp some significant relevance? What is the
  purpose of one of these audits? Who / what is it meant to protect?
  What is it meant to prove?

I think you're missing the following things about audits.

"Audits" aren't called "Enforcements" for a reason.  They're looking and making notes, and they'll make recommendations, but they're not going to touch your stuff, and they're not going to whip out the thumbscrews to force your cooperation.
Audits presume reasonable levels of cooperation.  Yes, they realize you could lie and cheat, and they do things (like screenshots) designed to make that harder.  But at the most basic level, IT audits are not adversarial.
ITGC Audits protect everybody.  The make sure you're doing things properly enough not to be a meltdown waiting to happen - because when companies melt down, employees lose their jobs, shareholders lose their money, and consumers are impacted.  (Other types of audits may be more limited in their protective focus - an IRS audit, for example, is focused on protecting the government and the taxpayer, and the company being audited is not being protected).
Audits prove nothing except that the Audit was performed (and only up until the point in time the audit was completed).  Now, due to standardization, that means a lot more than it used to.  The only thing the audit proves is that someone came in, asked questions, collected answers and evidence, and applied an organized set of judgments to that data, resulting in recommendations.  So while they prove nothing, they do have some beneficial side effects.

ITGC audits measure what you're doing against they way a set of auditors have decided things should be done, or should not be done, based on history, knowledge, and experience.  They can be enormous, imprecise, and focused on inane details all at the same time.  They can be helpful, or they can be a waste of your time.  Half of that is getting a good auditor - and the other half is how you work with your auditor.

Good luck!


What is a device that scans the network it is connected to called? Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose  in a way that you can just drop them in a network and scan that network remote? If so, what are those devices called?

Example:
I buy that nice shiny box and I put it in your network and I start to scan your network.

I know a few like:

Pwn Pro
Secpoint Penetrator

But I don't know the exact generic name of those devices and I don't think there is one.


Is there a password manager that combines a "master password" solution with a keystore solution? There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools.

The general idea is that a function hash("my_master_password", "facebook.com") could deterministically give you the password for your account at any website.

Benefits:

Avoids a keystore like Keepass or LastPass which have their own risks inherent to password storage
Still provides unique password per website account

Drawbacks:

Can't update your password on a specific site
If someone discovers your master password then they have your password for all accounts

Is there a password manager that combines this idea with a keystore solution to address these drawbacks?

It would effectively mean a password generation function hash("my_master_password", "facebook.com", "facebook.com_password_from_keystore")

my_master_password would not be stored anywhere, so you must memorize it or store outside the system. The keystore would have separate login key keystore_password in order to fetch the remaining arguments facebook.com and facebook.com_password_from_keystore.

Benefits:

If keystore is compromised there is still no way for attacker to discover "my_master_password" so you have more time to reset your passwords once attack is discovered
Cycle passwords by generating new random value for facebook.com_password_from_keystore

I would consider using a product like this because I like that there is information in the scheme that is never stored in or sent to a keystore. What are some additional drawbacks?

Additional Context: I don't think I really understand why solutions like LastPass or KeePass are trusted as much as they seem to be. I see how they are a great solution for the problem of password uniqueness and complexity, but there have been breaches on LastPass and other popular file storage solutions that may be common for storing KeePass files.

Original question

With only one master password, for both the final hash and the key store.

Your scheme adds no additional security on top of what standard password managers already offer.

So lets say that the password file from your password manager is leaked. Generally, these are encrypted using a key that is derived from the master password. So an attacker will need to crack the master password to get your site specific passwords.

If your master password and the key stretching algorithm are both good, that is a tall order. But for the sake of argument, lets say that the attacker succeeds. She then knows (a) the master password, and (b) all your site specific passwords. Nothing is stopping her from just calculating the hash you proposed.

An attack on your scheme would work exactly like an attack on say LastPass, with the addition of the calculation one simple hash at the end.

Updated question

With different master passwords for the final hash and the keystore.

You are using two passwords here. The relevant benchmark to compare against is using a normal password manager with one password that is as long as the two passwords combined.

You can argue if this is a security benefit or not. To gain access to all your passwords, an attacker needs to brute force first the keystore password and then the password for the final hash. To do the latter, the attacker would need one correct password that is in the keystore to compare the results against.

If the attacker have no such password, then your system is better.

If the attacker have such a password, a normal password manager is better. Brute forcing two passwords of length n/2 is sooooo much easier than brute forcing one password of length n.

So my recommendation would still be to use a normal password manager with a strong password. If you use a strong password, an attacker will be chanseless anyway.


Why do some websites enforce lack of SSL? When trying to visit https://www.ebay.com, I noticed that I get redirected to HTTP immediately. Here's what cURL says about that:

$ curl --max-redirs 0 -v -L https://www.ebay.com
* Rebuilt URL to: https://www.ebay.com/
* Adding handle: conn: 0x6c8cc0
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x6c8cc0) send_pipe: 1, recv_pipe: 0
* About to connect() to www.ebay.com port 443 (#0)
*   Trying 66.135.210.61...
* Connected to www.ebay.com (66.135.210.61) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using SSL_RSA_WITH_RC4_128_MD5
* Server certificate:
*       subject: CN=www.ebay.com,OU=Site Operations,O=eBay Inc.,L=San Jose,ST=California,C=US
*       start date: Jun 06 00:00:00 2013 GMT
*       expire date: Jun 07 23:59:59 2014 GMT
*       common name: www.ebay.com
*       issuer: CN=VeriSign Class 3 Secure Server CA - G3,OU=Terms of use at https://www.verisign.com/rpa (c)10,OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
> GET / HTTP/1.1
> User-Agent: curl/7.32.0
> Host: www.ebay.com
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Location: http://www.ebay.com/
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0
* Maximum (0) redirects followed
curl: (47) Maximum (0) redirects followed

Why would websites force plaintext HTTP while their support SSL, thus exposing the user's browsing habits to eavesdropping?

There are some reasons (not necessarily good reasons, but reasons nonetheless) to prefer HTTP over HTTPS. If these reasons apply, then it makes sense to enforce HTTP usage even when the client appears to want to use HTTPS.

A (usually) bad reason for preferring HTTP is one that is commonly uttered in such a debate: SSL is often assumed to be heavy, both for the computational cost of encryption, and because of its consequences on caching (though it is possible to cache pages served over HTTPS, the SSL layer prevents some tricks such as transparent proxies, that are commonly applied by ISP). The computational cost is overrated (it used to be a bottleneck in the times of 3DES and 90 MHz Pentium machines with fast ethernet, but things have changed since then). As for caching, one point to make is that it is increasingly irrelevant when pages become more dynamic.

We may imagine, though, that Ebay wants to encourage widespread ISP-based proxying for all the item pictures that they serve. I can easily conceive that these pictures eat up a substantial part of the network bandwidth of Ebay. Enforcing plain HTTP maximizes the probability that caching takes place, thus saving money on Ebay's side.

A less bad reason for preferring HTTP is to allow easier automatic scanning of data for unwanted content and intrusion detection. SSL is end-to-end, so if such scanning is applied in an HTTPS world, then it must happen at one of the ends, which may be inconvenient in a given big architecture.

As for the privacy of your browsing habits, I don't think that Ebay gives a fig about it. In fact they are, by construction, quite eager to learn, analyse, profile, and possibly sell away your browsing habits (advertisers pay for such information). So it does not seem reasonable to really expect Ebay to actively protect your privacy, since part of their business model is the exact opposite.


How can Joe Citizen report or at least hamper a phone-based PC scammer? Within the last week, I've received 3 phone calls at 3 different locations from technicians who are calling "from Microsoft" about "Windows problems" that they've detected on my PC.

Which they haven't because scam.  And it was only good luck that I was visiting my parents when they called them.  I've since warned them to just hang up on anyone who tries that.

I'm in the United States.  I'm on the do not call list.  The phone calls come from an unidentifiable phone number.  The voices on the other line have been heavily accented, reminiscent of someone from a call center in India.

I've seen this video of someone completely awesome running one of these guys through a honeypot.

I'm technically inclined, and I'm tempted to create my own virtual garbage environment for them to screw with and try to hijack, but it might be more effort than I am capable of putting out.

Other than requesting the caller perform deviant acts upon himself and his family, then hanging up, is there anything technical I can do, or report?  Is there a fake honeypot website I can use to simulate what he's looking for to waste his time and perhaps backtrack him?  How should I handle this for maximum impact against the caller?

I've had this happen to me before and realizing to them that their time is money, I decided to take them on a little ride (it was a Sunday and I was bored...don't judge me).

Basically I pretended to be a complete computer luddite - kept them on the phone for a good hour pretending like I had no idea what I was doing. I could't find the event viewer, didn't know what a browser was, didn't know if I was on a Mac or PC (or maybe this is an iPad, I'm so computer illiterate I don't even know!). They wanted to do a remote session and I didn't know I could do that, etc.

While I can't provide any insight on how to track who's calling you (and truthfully, they're probably in a location where nobody even cares that these calls are happening) but I can tell you that listening to the caller get so frustrated that he gave up was worth it to me. I have yet to receive another phone call of this nature.

As they say, Trolling is a art :)


monitoring outgoing network traffic The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago.

How can I monitor/log/capture/analize this traffic to see what is it,
where is it coming from and where does it go to?

The server is a linode (hosted at linode.com) running linux debian lenny.

Are there any command line http sniffers for linux ?

Have a look at tshark.

It's like wireshark, but then for commandline. Just install it with apt-get.

A tutorial on how to use it can be found here. You can easily filter for http with it.

To capture http traffic:

tshark -R "tcp.port == 80" -r /tmp/capture.cap

If port 80 is your http port. If you don't know the port just capture everything and you can later filter it for http. Filtering for http while capturing is not possible.


Does the Ophcrack LiveCD require hash collection via programs like pwdump? When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes.  Question is: If Ophcrack does not automatically find hashes,  how can I go about obtaining them for a Windows 7 computer for which I do not have administrator access (which is required for pwdump7).

Typically if you don’t have a user with admin rights you need to escalate privileges (i.e. exploit a vulnerability), then fire up the pw dump tools.
copied from Ophcrack wiki verbatim:

"You can either enter the hash manually (Single hash option), import a text file containing hashes you created with pwdump, fgdump or similar third party tools (PWDUMP file option), extract the hashes from the SYSTEM and SAM files (Encrypted SAM option), dump the SAM from the computer ophcrack is running on (Local SAM option) or dump the SAM from a remote computer (Remote SAM option).
For the Encrypted SAM option, the SAM is located under the Windows system32/config directory and can only be accessed for a Windows partition that is NOT running. For the Local SAM and Remote SAM options, you MUST logged in with the administrator rights on the computer you want to dump the SAM."


Session key renewal between two constrained devices I'm not keen on encryption and security overall,  so please forgive my ignorance.
Let's assume the following:

We have two nodes which are constrained devices (resources not sufficient for asymmetric encryption), and we want to securely establish a shared key for symmetric encryption.

My solution is the following:
save a key K(0) in the devices at deployment
program the devices to automatically generate a new key of a new session based on:

the previous key
a random number generation function installed in the two devices, with the same epoch

So a session k(i+1) is generated based on the information of the session k(i) that the only two participants have.

Please, now tell me what are weaknesses of this solution.

Thank's in advance.

This approach works, if you derive the session key in a secure manner (using a cryptographic hash function or some construction built on a cryptographic hash function).

As only the two parties know the key, only the two parties will know subsequent keys.
It may even be possible to omit the the synced random number generator and just use some session constant as derivation parameter for your key derivation function (KDF).

Another approach:

But there's a way to do this without a synced Random Number Generator (RNG) and fresh keys for all connections. This assumes you've got a good random number generator and the pre-shared key K of length 64 bytes which is highly random. All undefined variables below are random and 32 bytes long.

Device A sends device B a random number n_A.
Device B responds with E_K(r_B,n_A,n_B). If the answer takes too long A refuses the answer or if the n_A is not the n_A sent in step 1.
Device A responds with E_K(r_A,n_B,n_A). If the answer takes too long B refuses the answer or if the n_B is not the n_B sent in step 2.

Now you can use the xor of r_A and r_B and use a KDF to get the session key, if you're not sure about your RNG you can also input K into the KDF call.
Note that you may wish to use GCM mode for your cipher.


Warning message about Git on IE 11: "a website wants to open web content using this program on your computer" This is something that happened while using IE 11 on Win 7 x64. Not sure if it matters but IE is running in "Protected Mode".

I was posting a support request for a software that I use at that software vendors site and clicked on the browse button to add a screenshot (from my desktop) to the request. When Windows Explorer opened, the following message was displayed:

I had submitted the other support request to the same vendor's site earlier the same day, also with a screenshot, without receiving any warning like this.

Update: Not sure if it matters but the vendor, in this case, was Reallusion (a maker of animation software). They do not provide any software through git to regular end users and I had already attached a screenshot to another ticket on their site earlier this same day (without this kind of message).

Would anyone know why this error happens and if it is related to browsing the file system from IE?

Also is there a way to find out if this notification actually originates from the currently browsed website (or if it was caused by some other process and just coincidental that the message popped up when it did)?

Thanks,

As it often happens IE does not fare well with certificates of other authorities. Basically your IE does not recognize "The Git Development Community" as a valid issuer of certificates.

If you are still unsure, you could do a research on the community, or try to upload the screen shot the same way you did it earlier.

Using an already proven and working way to do something is always preferred, but I would not worry too much over this particular instance.


How to perform in-browser signing of data with Javascript using HMAC-SHA512? My client-side JavaScript program needs to make HTTP posts to a service that requires POST data to be signed by my private "secret" according to the HMAC-SHA512 method. I have the "secret", but I cannot find JavaScript code/library to perform this signing.

Does anyone know how to accomplish this in the browser? I'm trying to avoid adding the complexity of adding a server-side component, which would use the Node.js crypto package e.g. crypto.createHmac("sha512", api._apiSecret).update(queryString).digest("hex").

There are many client side librarys out there, that are able to create HMAC signatures (google can help you here). For example jsSHA, which can also be found on cdnjs. Explainations on how to use the library can be found on the github page.

But keep in mind, that when you share your API secret with the client, be it hard-coded in your javascript file or with a request to your server, the client can extract the secret and use it for other requests. These request could violate the terms of service of your provider or simply use up your quota.
To prevent this abuse, you should either create the hash or preform the whole request on the server side and share the results with the client.


What are ssh-keygen best practices? Most users would simply type ssh-keygen and accept what they're given by default.
But what are the best practices for generating ssh keys with ssh-keygen?
For example:

Use -o for the OpenSSH key format rather than the older PEM format (OpenSSH 6.5 introduced this feature years ago on 2014-01-30)

How should one calculate how many rounds of KDF to use with -a?

Should -T be used to test the candidate primes for safety? What -a value to use with this?

For the different key types, what are the recommended minimum -b bit sizes?

etc... (there are a mind-boggling set of options in the manual page).

I recommend the Secure Secure Shell article, which suggests:
ssh-keygen -t ed25519 -a 100

Ed25519 is an EdDSA scheme with very small (fixed size) keys, introduced in OpenSSH 6.5 (2014-01-30).  These have complexity akin to RSA at 4096 bits thanks to elliptic curve cryptography (ECC). The -a 100 option specifies 100 rounds of key derivations, making your key's password harder to brute-force.
However, Ed25519 is a rather new key algorithm (Curve25519's popularity spiked only when it was surmised that other standards had been diluted) and its adoption is not yet universal. Large steps were made in 2018, so we're nearly there, but on older systems or for older servers, you can generate a similarly-complex RSA key with 4096 bytes:
ssh-keygen -t rsa -b 4096 -o -a 100

(The -o option also requires OpenSSH 6.5 and is the default starting in v7.8, so it is no longer present in the ssh-keygen man page. This dictates usage of a new OpenSSH format to store the key rather than the previous default, PEM. Ed25519 requires this new format, so we don't need to explicitly state it given -t ed25519. A previous man page stated that “the new format has increased resistance to brute-force password cracking.” See this answer for more detail.)
Do not consider the other new ECC algorithm called ECDSA.  It is considered suspect (it has known weaknesses and since the US government has been involved in its development, it may be compromised beyond that). Ed25519 was developed without any known government involvement.
Stay well away from DSA (“ssh-dss”) keys: they're not just suspect, DSA is insecure.


Why authenticated boot not Secure boot? Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted software, the authenticated boot detects a non trusted software but does not prevent its boot.

Questions:

What are the reasons that would encourage deploying authenticated boot in the system rather than secure boot? In my point of view, it makes more sense (from security point of view) to deploy the secure boot.

Is there other varieties of the secure boot except the authenticated boot?

Any recommendation of reading about Trusted Computing and secure boot?

Thanks!

What are the reasons that would encourage deploying authenticated boot in the system rather than secure boot?

Because the device owner owns the device, and often owners are developers. See also: people interested in "rooting" / "jailbreaking" their mobile devices.

Secure Boot is currently largely deployed, but in detail you might have some options to control the boot.

Consider for example TPM-based full disk encryption (1, 2) where the system won't necessarily refuse booting a different kernel (e.g. a recovery suite), but simply the TPM won't release the key(s) unless the boot environment is secure, so you can't snatch the key from the recovery toys. This falls in the middle of your question

Another great example is the Android ecosystem. Android has a true Secure Boot implementation where you can't boot or flash software that is not signed by the vendor. For example, a number of Nokia devices (manufactured by HMD) can't be unlocked. Why did I use bold?

Because in the Android world there are a number of ways to actively disable Secure Boot, which then becomes an optional, yet recommended, feature. As the owner, you can disable Secure Boot and install your own kernel. You will have full control over the device, and will even be able to experiment new technologies with your own device.

The goal of Secure Authenticated Boot is to provide a sane environment to applications, e.g. banking applications. If you unlock the bootloader of your device to run untrusted (e.g. rooted) software, your bank will be particularly mad and could refuse to interact with you through their mobile application because the system is not certified to their security standards.

As soon as you can revert the Authenticated into Secure boot, everything will revert back to the "trust zone".

Note that, as a security feature, most Android devices require wiping the encryption keys of storage when the bootloader security state is changed. This happens to protect the data, especially if an attacker with physical access to the device wants to exfiltrate data without user's consent (or if the user is unavailable/dead/etc) by flashing a recovery solution.

  In my point of view, it makes more sense (from security point of view) to deploy the secure boot.

Points of view are always relative. In my point of view (security point of view), switchable Secure Boot is the best option. I could choose to deploy SB to my old grandparent's phone and keep it disabled for myself.

On the counterside, consider devices physically given to third parties, like POS/cash, kiosks etc. Of course, we both want Secure Boot to prevent unauthorized third parties to mess with the software and steal financial information, or create duplicate transactions.

All depends on the effective point of view. There is no "generic" security point of view

  Any recommendation of reading about Trusted Computing and secure boot?

This article from the FSF seems outdated but highlights some points. Outdated because it ages from the Windows 8 era. Following is my comment.

The problem with secure computing environment, which today happens with gaming consoles, but not (yet) with mobile phones, is market barriers. It's not a real problem for the final user, but trusted computing could be leveraged in the future to create walled gardens where software vendors may be kept out.

The "app marketplaces" concentrate the offer of software applications. If a marketplace has oligopoly (e.g. Google) or monopoly (e.g. Apple), then they have power to choose who can deploy their software, ask for money, exclude certain competitors or certain parties for political reasons. This was especially true in the age where "ipa" applications could be sideloaded only via jailbreaking.

Today, no console natively allows to run "homebrew" games. Regardless of software piracy, homebrewing means the ability for a small start up born in a garage to deploy software to the martket, and not be forced to pay exhorbitant fees (e.g. 30% commission, along with Gov taxes) to the app store owner.


What are the best practices to create a safe and performant user registration and validation with Nodejs and Postgres? I've been asked to write an app with registration and login systems. In essence, I've already wrote the first version of their app using PHP, some javascript/jquery and storing data in MySQL. It worked for a time but now they are growing and expanding so they want something more performant and in realtime with push notifications. You know, the whole nine.
I'm always up to a great challenge especially if I need to learn new technologies. So I have leveled up my game and Im now learning to use Nodejs, Postgres and socket.io. So far I'm understanding the basics fairly well. Ran a few tests and it's top notch.
The only thing that has been plaguing me for the past week is security and registration. I've been doing extensive research on OAuth2 and PKCE Flow. I'm trying to figure out the best practices without compromising UX.
I'd be happy to read more on the subject or if there are any API available. I'm thinking perhaps it's not safe to handle registration and login by myself. The methodology used with PHP and MYSQL is very backward in my opinion and I'm looking for something more modern working with Nodejs and Postgres. Most login and registration systems, for example Google, send temporary numbers that expires within 30 mins and they can recognize your device and send alerts if you login from a device they dont recognize asking you if it's you who just logged in. That's the level I'm trying to reach. Any suggestion?
With PHP  and MySQL the current registration flow is as follow :

I want to post an answer here for future references.
This is mainly for developers who are developing hybrid apps, native apps (ios,Android) and Progressive web apps (PWA).
Most common technologies used with those types of apps (not exclusive) :

Cordova
Nodejs
Vue
React
Javascript
JSON
socket.io (websockets)

Most common databases used (not exclusive) :

Firebase
MongoDB
PostgreSQL (still RDBMS but offering support for json/jsonb)

When it comes to me Im using Nodejs, javascript for front-end,
storing JSON/JSONB in PostgreSQL and socket.io to listen for updates in my database which allows me to create real-time apps.

At first when I was asked to migrate our app to a more performant and efficient technology, I had no idea what to look for in terms of security but I knew I wanted something more

secure
efficient
performant
less error prone

Coming from a PHP/MYSQL background, I realized I had to unlearn a lot
of bad habits that I'm still unlearning at the moment.

Things I have to let go of to meet all above requirements :

password hashing : md5(), sha1(), hash()
username matching

But what's wrong with password hashing and username matching, you may ask?

The short answer : it's error prone, inefficient and very synchronous

The solutions
I found actually 2 solutions to creating more secure and efficient oAuth systems in your apps. Your login and registration systems don't have to be a pain to write.
 Solution #1 : JSON Web Tokens (OpenID Connect)
If you are already making heavy used of Javascript in your software, especially JSON and the technologies I've mentioned above, learning to work with JSON Web Tokens (JWT) is standard practice these days. JWT are also certified and follow the OpenID Connect protocols which means any app using JWT is compliant according to the oAuth 2.0.

JSON Web Tokens are an open, industry standard RFC 7519 method for
representing claims securely between two parties. JWT.IO allows you to
decode, verify and generate JWT.
Read more here

Benefits and advantages of tokens

create two factor authentication systems (email, username + tokens)
single sign-on systems
security compliant
standard usage of oAuth protocols

Disadvantage of tokens

learning curve

 Solution #2 : authentication-as-a-service
If you don't want to handle registration and login on your own for security issues, you can safely turn to a third party who will handle it in the background for you and all you have to do is connect your app using their API.

Authentication as a Service (AaaS) provides authentication services
like multi-factor authentication, single sign-on, and password
management in the cloud. With Authentication as a Service,
organizations can control access to their applications and servers
from various devices and networks.

There are several different AaaS around, but during my research, the one I found to be open source and free to an extent is auth0.

I'm not using auth0 services nor do I work with them nor am I
affiliated to them in any way. This is for education purposes only.

Benefits and advantages of AaaS

secure out-of-the box solution
human friendly with dashboard and user management
remote hosting
Easy API docs

Disadvantages of AaaS

must rely on third party service
Can be pricy in the long run (not exactly open source)

Open Source Projects
Great alternatives to expensive AaaS. The MAJOR plus is that they are self-hosted which means YOU own the data no third party.

GLUU Server
SuperTokens
NextAuth.js (React)
ORY.sh


Reverse Engineer this basic Hash using known answer? Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, even with the admin account (Via the interface at least) (And I'd like to either delete the account, or get access to it again).

I've used telnet to directly access the CCTV file of passwords, and I was just wondering if it's possible to find the type of encryption being used.

I know one hash it's showing. Eg: This hash: 4WzwxXxM I know is 888888. Using that translation is it possible to find the rough encryption being used for the other account I would like to reset?

(Before you ask, it seems CCTV DVR's are horribly built, the shell via telnet seems to not even have FTP access :( )

Based on a google search of your hash it's a Dahua hash.Luckily for you it looks like it has some vulnerabilities
www.exploit-db.com/download/29673/ I don't know if they fixed vulnerability and I don't really know much about CCTV systems.If that fails you could try bruteforcing the hash.


"No identity information" alert on gmail Am I being hacked?

Firefox is displaying this warning to me:

  This site does not supply identity information.

  Connection with this site is not totally safe because it contains
  unencrypted elements (such as images).

  Permissions: open popup windows: allow.

Clicking on "more info", on the "security" tab it says

  Site: mail.google.com
  Owner: This site does not supply ownership information
  Homologated by: unspecified

Clicking "show certificate" says there is a certificate, issued by "Google Internet Authority G2" on 04-06-2014 and valid until 01-09-2014.

Go here: https://grc.com/fingerprints.htm and put in mail.google.com

Then compare the fingerprint the server shows with the sha-1 fingerprint in your cert.

grc.com and my SSL cert both tell me 84:45:3A:42:E0:2D:3D:50:00:30:C1:2D:D3:2C:26:06:6F:78:AB:3D and a bunch of people in chat agree.

If yours matches, then it is mathematically impossible that someone is doing something nasty, unless they have a true quantum computer that can trivially factor large integers more efficiently than a digital computer (which, if true, would make Heartbleed look like an echo ha ha "virus"), or unless they actually used a vulnerability against Google's servers (fairly unlikely now that Heartbleed has blown over).

You can trust the connection is end to end to Google based on the manual and independent verification of the fingerprints.

However, I believe Gmail has mixed passive content which is the reason why Firefox doesn't consider it to provide "identity information". A full explanation is on Stack Overflow.


Ransomware doesn't change file extension after encryption Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions.

Is this possible? Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Based on the .txt and .png files with the message for the user, I think it might be a Cerber variant, but I'm not sure.

Is this possible?

Of course it is. It doesn't have to change the filenames at all. It just encrypts the content.

  Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.

Yes, you could name it foo.txt.enc and then enable the "Hide extensions" option in Explorer. But as I mentioned above, it doesn't have to change the extension at all.


How does google docs know password for published googledocs document on a public site? Google Docs documents can be published on public sites.
How does Google know the password to use (to get the document) when all you specify in the HTML is a string like:
src="https://docs.google.com/document/pub?id=..." and no explicit password is used?

The document is set as public, so anyone who has the link can view the file.

Google Docs doesn't need to know your password in order to transmit the document to the person requesting it.

If you'd like to protect the document so that only certain people have access, view the document, then click File -> Share.


TACACS authentication: is it possible to get the user groups or other attributes? TACACS is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management https://en.wikipedia.org/wiki/TACACS

The question if is it possible to get the user groups or other attributes.
According my understanding the answer is not but I will happy to clarify if I miss something.

No,

nothing in the RFC about user Groups https://tools.ietf.org/html/rfc1492

P.S: You should upgrade to RADIUS or DIAMETER. TACACS is just so old.


document.cookie and its scope There is some basic confusion that I have.

A non-suspecting victim visits a vulnerable website, vulnerable.com and logs in there. vulnerable.com, post login, sends back a response that has the following HTTP header set,

  Access-Control-Allow-Credentials: True
  Access-Control-Allow-Origin: vulnerablesite.com

Let us say that the session cookie is scoped to /home.html path alone (which may not make much sense, but let's just assume so for the sake of this discussion) and does not have HTTPOnly flag set.

Now in the same browser he opens a new tab and visits vulnerablesite.com/some_page.html
An attacker identifies a stored XSS in vulnerablesite.com/some_page.html and decides to exploit it to gain access to the session cookie of the user on vulnerable.com.

To do so, the attacker injects an AJAX script in vulnerablesite.com/some_page.html, so when the victim visits the page, it will make an AJAX request to vulnerable.com/home.html. Now this request will definitely succeed (no reason for it to not to and also because Access-Control-Allow-Credentials was true) and the response that's received will also be readable by the attacker's AJAX script (because of Access-Control-Allow-Origin was set to vulnerablesite.com, so no same origin policy violation)

When the attacker's AJAX script says xhr.response, this response object will definitely hold the /home.html page.

The main confusion is around the path and domain attributes of the cookie.
Questions

So in this case when the attacker's script says document.cookie now,
will the attacker be able to read the session cookie of the victim?
because the cookie is scoped to /home.html, any request made to
/home.html will carry this cookie along. But because the response to
/home.html is not doing a set-cookie at all, when attacker's ajax
say document.cookie what will exactly be read?
have no idea about what the domain attribute would be of the cookie
in this case and how will it impact the reading of the cookie in
anyway if at all it will.

If the domains were the same, so the cookies were set on http://example.com/home/, and didn't have HTTP Only set, but there was an XSS vulnerability in http://example.com/vulnerable/, then the cookies can be accessed by the attacker - they can inject an iframe into the page, and use a script resembling document.getElementsByTagName("iframe")[0].contentDocument.cookie to access the cookies.

If the domains are different, as they appear to be in your question, then no, accessing the cookies isn't possible. All Access-Control-Allow-Credentials: true  does is tells the browser that it's OK to include credentials (cookies & HTTP Basic Auth) in the request - it doesn't expose those credentials to the requester (unless the website is for some reason including the details of the cookies in the response, which there are very few good reasons to do).

However, being able to access the actual value of the cookie is not necessary to be able to exploit it. The attacker is make authenticated requests as the user, and they are able to bypass any CSRF (Cross Site Request Forgery) protections by reading the CSRF token from the HTML document that was returned from the first request. This means that, provided that all endpoints return the relevant CORS headers (including Access-Control-Allow-Methods if some endpoints require POST rather than GET), the attacker can make the same requests via AJAX as they would have been able to on their own computer with access to the session cookie.


Restoring database from a hacked system A linux VM with postgres 9.4 was hacked into. (Two processes taking 100% cpu, weird files in /tmp, did not reoccur after kill(s) and restart.) It was decided to install the system from scratch on a new machine (with postgres 9.6). The only data needed was in one of postgres databases. A pg_dump of the database was made after the attack.

Regardless of whether the data - the tables/rows/etc. - were modified during the attack: is it safe to restore the database in the new system?

P.S. I consider using pg_restore with the -O option which ignores the user permissions

No. It is not secure to restore the data without taking steps to ensure that the data was not corrupted in ways that can lead to more security holes.  It is also unlikely that upgrading from 9.4 to 9.6 is going to make any difference, and might actually complicate the restoration.

Many attacks involve the altering security information stored in the database.  Even if you don't have such tables, it is just as common for attackers to embed code in what would normally be considered data and exploit security holes in the boundaries between code and data.

The correct way to proceed is to take a dump immediately prior to the attack and compare it with the last dump.  This takes some skill, and you may have to assume a worst case scenario if you can't ascertain from audit and log files when the attack began.

Try to find ways to compare the before and after dumps, eliminating legitimate changes with each compare iteration.  You will eventually find nothing, in which case you may have to take a risk of importing the data or restore to the last known good backup and live with the loss.

It would be better if you could use the compare and log and audit information to reverse engineer (best case) or determine the likely breadth of (less sure) the attack.

As unhappy as the truth is in this case.  This IS like rocket science.  You may need to ask more questions.  Of course, much depends on how sure you need to be that you've cleaned all potential threats from the system, which depends on how critical the data and the user accounts are.


Gave scammers my name, date of birth, ... What now? I was contacted on a world wide exchange and chat site, on which the contactor (disguised as a normal, friendly person) wanted to be friends. They gave me their mail address. In their first e-mail they asked me about myself and I gave them my name, my date of birth, a photo, my nationality and my interests. With their next e-mail it got clear that it was a scam. Now I'm scared of what comes next. What can I do to prevent an identity theft? What can they use these information for? I am slightly panicing here...

Note: This question is different and no duplicate to the question referred to as duplicate, since I am asking about the possible consequences of giving away date of birth in combination with further information.

The identity information you revealed can be used for multiple purpose.

Impersonation

They might use it to impersonate you by making a fake ID card potentially to gain access to places where only you are authorised to.

Financial Frauds

They would try to find out other factors which are absolutely necessary for a financial transfer and take the money. For eg: just the account number and routing number of an account along with basic contact information is required for a preauthorised wire transfer in the United States. So the only missing piece of information they need here would just be your bank account number.

Word Dictionary

People tend to use passwords which they can always remember. Usually related to their demographics. It is likely to include their name, place or DOB in the password. In case of a password attack, the attacker can use your personal information to create an effective dictionary list of passwords.


Can all your public files on Dropbox be accessed by anyone with one of the links? Dropbox is one of the most famous cloud storage and sharing platform.

Dropproxy's website claims that there is a weakness in the Dropbox security:

  Lots of people use Dropbox. Lots of people share public Dropbox links. But not everyone knows that you can be identified by your public links and not everyone knows that once someone has one of your public links, they can access all files in your public folder.

Can people escalate from accessing one file to all public files?

They're sort of correct. Let me explain.

In Dropbox, there are two ways to share files. Sharing a link to a file from any folder will generate a link in the following form: https://www.dropbox.com/s/randomkey/filename Anyone can access the file you posted with that link. However, each time a file is shared like that, a new random key is generated and associated with that file. Other files cannot be accessed using that key.

However, there is also the "Public" folder in Dropbox. Files shared from this folder generates links differently, in the form: https://dl.dropboxusercontent.com/u/userid/filename In this form, any file from your public folder can be accessed, because your user ID will not change. Someone would have to know the filename of what they're retrieving if they're accessing a file you did provide a link to, but it is a public folder.

Thus, they're sort of correct, but it's not really a security flaw because you're declaring the files as public anyways. No files are public unless you place them in your public folder, declaring them as so.


Am I missing any loopholes with my current session managment? I'm building a site with Spring, which requires authentication in order for accessing certain pages.

The site is actually composed of a client host, which render the views and handle the data binding, and a REST api host (built with Spring as well), it's responsibility is returning/manipulating data, validation/generation of user token etc..

I've decided to implement a custom authentication in the REST side, upon receiving a valid username and password, it will return:

JWT signed by the REST API with AES-256, the payload will contain the user id and expiration date.
The JWT is stored on a cookie, which is HTTP only, secure, and valid only from the client site domain (is it enough to counter measure csrf attacks?)

The only backdoor I could think of is if the attacker steals the cookie, for which I could add to the JWT payload a unique random value for the user (which is stored on the database), and in the case the user is suspecting that his session was stolen, he could issue a request to reset the unique value, rendering the stolen token useless.

Am I missing any backdoors which could allow an attacker to bypass the authentication easily?
Should I use Spring Security instead? I'm afraid I will not be able to achieve the stateless behaviour I currently have...

Thanks!

You will be vulnerable to a CSRF attack.

Since you want to be stateless, best option is to use double submit cookie variation. You need to be careful and not to do it naively, please see this question. In short, you will need to tie your CSRF token to a security session:

Generate sufficiently large CSRF token
Include CSRF token inside JWT as one of the claims
Provide CSRF to the client as a result of a successful authentication in a JSON object for example. You will provide cookie containing your JWT in the same step. Cookie can't be read from the client (httpOnly) thus the necessity to provide it in a JSON object or some other format.
On client side store CSRF token in sessionStorage or localStorage and send it to the server on each request that changes state as a header.
On server side validate the value from header and JWT

Your solution for revoking JWT is fine. Be sure to generate new id and issue new token when user changes password.

To minimize possible impact a stolen JWT can have on your application, keep expiration as short as your application can allow it to be.

You can implement a stateless JWT security using Spring Security and should avoid doing it in a REST controller and rolling your own custom implementation. See this as a good starting point. Even though it is for Spring Boot, it can easily be modified so it works with plain Spring.


Thousands of 404s from various search engines Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed.

I found a similar, but less detailed, stackexchange question. That question has Google, Bing, Yahoo, Yandex and "some place in the UK", just as I note in my description below.

So my question is, how does someone get at least 5 search engines to start asking a site for a pile of the same URLs all at once?

As near as I can tell, the maximum number of requests per second is 16, for  2015-06-11T18:51:11-0600, 8 requests each from 207.46.13.99 and 207.46.13.106. Both of these are in a Microsoft netblock, and identified themselves as "bingbot". I understand that the more reputable search engines throttle themselves, but 16 per second is hardly throttling.

Just to head off some likely responses, my site doesn't have, and has never had files that match these URLs. As near as I can tell, nobody has tried to move files by these names on to my site. Neither httpd.conf or .htaccess files have mod_rewrite rules that give out 301 or 302 HTTP responses for these URLs. My site does not have strange PHP files lying around that would re-direct or gateway these URLs from somewhere else.

All the URLs are by domain name (example.com), not IP address. As far as I know, I'm the only one to ever use that domain name. Similarly, the IP address for example.com has remained unchanged for some years. I have access_log files going back to 11/Feb/2009, and this type of URL doesn't show up in them until April 9, 2015.

I also, until 2015-08-22, had my 404.php set to redirect to "shock porn" for any of the URL components listed below. I did not consider that anyone would be thorough enough to try those URLs. I humbly apologize for not believing that people are sincere and  thorough. Since mobody but search engies and spiders looks for those URLs (on my site), I've deleted that feature.

I should add that I'm running a WordPerfect honey pot, in order to collect passwords used by WP bruters, and to collect PHP malware. I'm not actually running WordPerfect at all. If you ask for a URL with wp-login.php in it, you get a simulated WP login.

You can see my write up here, but that was an earlier honey pot. I've totally re-written it.

One of my theories was that the porn URL requests are some kind of DDOS attempt by spammers/hackers that got caught in my honey pot, and actually realized it.

Here are the details:

Search engines that ask for non-existent URLs, based on user agent strings:

Google
Bing
Majestic12 (?)
Yandex
Baidu
Yahoo
Yahoo Japan ("Y!J")
Sogou web spider
Yisou

I have Apache httpd set up so that the 404 page is a PHP script that records all values of $_SERVER, $_REQUEST, $_COOKIE and $_FILE, so I'm pretty certain of user agent strings, IP addresses and so forth, and that the server is finding the URLs in question non-existent. I have double-checked a few IP addresses. The addresses I checked matched the user agent strings.

My server fields as many as 6000 requests a day for what appear to be Indian or Indonesian porn. Some example URLs:

/egblzsd/foto-bugil-cewek-indonesia-dunia-panas.html
/egblzsd/WWW-Hiroin-Alia-Bhat-Hot-Sexy-Nude-phato-in.html
/xvlgorj/mallu-anty-faking-images.html

There are many others.  If I google for "foto-bugil-cewek-indonesia-dunia-panas.html", I see some semi-scandalous pictures, but a lot of the "filenames", if googled for, lead to 404 pages elsewhere.

Every URL includes a component like this:

/zyjos/
/jhkbla/
/fakfxs/
/egblzsd/
/xvlgorj/
/vkbjnid/
/phxyy/
/lfgkvol/
/vnkdax/
/sxzocl/
/zfkdoh/
/brungh/
/bumlefz/
/tyndst/

All of those strings bring up lots of search results in Google, mostly sketchy seeming Indonesian porn sites, or other hinky sites. Following the links, I get a lot of 404s.

Your website has been compromised.

Any request that includes a URL component listed by you leads to a 301 permanent redirect to a random porn site serving advertisements.

GET /phxyy/whatever HTTP/1.1
Host: stratigery.com
Accept: */*

HTTP/1.1 301 Moved Permanently
Date: Sat, 22 Aug 2015 02:17:04 GMT
Server: Apache/2.4.16 (Unix) PHP/5.6.12
X-Powered-By: PHP/5.6.12
Location: http://www.somepornsite.massorgy/
Content-Length: 0
Content-Type: text/html; charset=UTF-8

It should be noted that the redirect is served out by your server, which can only mean that your server (not the authoritative name server) is compromised.

What you should do:

Take down your website and investigate the following locations for signs of obfuscated code:

/index.php
/wp-config.php (if using WordPRess)
/configuration.php (if using Joomla)
/wp-content/themes/yourtheme/functions.php (if using WordPress)

If you don't have the above, look for files containing long lines of code. Since you are using linux, you may try the following:

$ grep -rl --exclude-dir={image_folder} ".\{1000\}" /var/www

Also, to look for obfuscated code elsewhere, try this:

$ grep -rE --exclude-dir={image_folder} "eval|GLOBALS|error_reporting|chr\(|\\\\x?[0-9]{2}\\\\" /var/www

Although you have mentioned that you have checked your server configuration files, I would highly recommend you to do so again.

After confirming the cause, the next step is to re-install your server with the latest security updates and date from last known good backup to eliminate any possibility of undiscovered backdoors.


Has use of /dev/urandom instead of /dev/random ever caused a vulnerability? Not theoretical mumbo jumbo. Has anyone, ever, in any way, made known an actual exploitable vulnerability due to using /dev/urandom? One that would have been mitigated if they had instead used /dev/random?

Yes, there are.

A quick search shows CVE-2003-0094 for instance:

  A patch for mcookie in the util-linux package for Mandrake Linux 8.2
  and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie
  to use an entropy source that is more predictable than expected, which
  may make it easier for certain types of attacks to succeed.

Issues of using /dev/urandom instead of /dev/random may occur during the boot sequence. At that time, the system may not have enough entropy available to provide safe random numbers.

Concretely, this "entropy" designates the number of possible internal states for the pseudo-random numbers generator (PRNG):

When the start sequence is being initiated, the system starts from a known state, always the same (particularly true for virtual images), and mostly the same also on any other identical environment.
As the system processes more and more "things" (I/O or whatever), the number of possible states also growths more and more.
But during the boot sequence, relatively few things are being processed and above all these are mostly the same each time and on each identical environment.

The CVE linked above targets mcookie, which generates a secret for X authentication. But the very same thing for instance would also apply for the automatic generation of new SSH keys on the first boot after the installation of a system or the deployment of a new virtual machine.

A well-founded attacker could run the initial boot sequence of your VM template tens or hundreds of thousands of times and collect the keys generated each time. As the combination of ways a freshly installed system may boot is not infinite, I expect that at some point the attacker may find duplicates.

The attacker can then try to reuse those keys against identical systems who are still using the key automatically generated at install time.

While the post-install startup sequence is the most vulnerable, most (all?) systems now store a seed in some file to be used early-on upon next reboot.
This file is nothing special, just a random byte sequence designed to break any potential determinism in the early PRNG states.

So, nowadays, apart from material generated during the post-install phase, only code run before the seed has been loaded might still really show a vulnerability because it used /dev/urandom instead of /dev/random.


Did I just give away my credentials by trying to connect to the wrong VPN? I'm trying to configure AirVPN on my router. I accidentally put in IPs for airservers.com domains instead of airservers.org.  Does someone else now have my credentials?  If so, the worst they can do is log in to the VPN as me, right?  The information that might have been sent would inclide static key, certificate authority, client certificate, client key.

No. OpenVPN is constructed in a way that the client and server will mutually authenticate each other, so the credentials is never sent over the wire.

Also, in addition to this, the validation is failed due to mismatch between the imported CA and the server's certificate. So no authentication happened.

Basically, the server sends you some random data, that you sign with your client key, and send along with your certificate to the server. The certificate itself, without the key, cannot be used to login on the VPN as you, and isn't sensitive.

If the Connection succeeded, it just means that AirVPN both owns airserver.org and airservers.com


If a “man in the middle attack” obtains the username & password of user, are there mechanisms that can prevent them connecting to server? Assume that we have a user that wants to connect to the server, for example with login page, when user submits the username & password goes to the server - if man in the middle reads the user & pass, can he connect to server or there are mechanisms that can prevent this?

If you only have username+password authentication, and this login info is intercepted, you cannot realistically block the attacker from connecting. You have to look into two-factor authentication to prevent attackers from reusing login credentials etc. And even then, when the attacker has continued access to all traffic, this will not help at all.

If you don't use https, the attacker can also simply intercept all traffic, so even if you can prevent him from logging in himself, no information is actually protected.


cURL cert validation with curlopt_cainfo not working I want to validate my SSL certificate each time I run API calls. I've been following this guide:

http://artur.ejsmont.org/blog/content/how-to-properly-secure-remote-api-calls-from-php-application

This is my code:

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "https://api-3t.sandbox.paypal.com/nvp");
curl_setopt($ch, CURLOPT_POSTFIELDS, ($apiCredentials . $nvpStr));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); //Returnerar resultatet istället för att skriva ut det

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, curlopt_cainfo, (dirname(__FILE__) . '/cacert.pem'));

$response = curl_exec($ch);

The problem is that my SSL cert is not validated at all - it seems the file cacert.pem isn't even checked! I have changed name of the file, deleted it, and I've even tried editing it by removing all certificates in the cacert.pem file that are from my certificate issuer. The API call is still run no matter what!

What might the problem be?

Quite simple :-)

First of all I got some weird errors when I run your script:

PHP Notice:  Use of undefined constant curlopt_cainfo - assumed 'curlopt_cainfo' in ...
PHP Warning:  curl_setopt() expects parameter 2 to be long, string given in ...

So I replaced with curlopt_cainfo with CURLOPT_CAINFO - that seems to get rid of them.

I added the following after curl_exec() call:

if (curl_errno($ch)) {
    echo 'Curl error: ' . curl_error($ch);
}

When I missed the cacert.pem or the path was invalid it showed:

Curl error: Problem with the SSL CA cert (path? access rights?)

After I tried to hack-in the certificate from the paypal site like this (do NOT do this on production environment):

openssl s_client -connect api-3t.sandbox.paypal.com:443 </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cacert.pem

It complained again

Curl error: Peer certificate cannot be authenticated with known CA certificates

After properly supplying a certificate bundle from mozilla:

wget http://curl.haxx.se/ca/cacert.pem -O cacert.pem

It works just fine :-)

I don't think you have to supply the CURLOPT_CAINFO option as curl comes bundled with the cacert.pem from mozilla and this should work out of the box with just CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST enabled.