Crack AES ECB mode C++ I have this little piece of code for encrypting:

typedef unsigned char byte;

int encrypt(char *filename) {

    byte key[ 16 ];
    int i;
    memset( key, 0x00, 16);

    for(i=0;i<=sizeof(*key);i++){
    key[i]=(byte)(std::rand() % 256);
    }

    auto enc = new ECB_Mode<AES>::Encryption(key, sizeof(key));
}

Is there a method to crack or decrypt a piece of encrypted text encrypted with this function?

The first problem I see is that you use a standard random function instead of a cryptographic random. I don't see how you seeded that, but if it is srand(time(0)) then it can probably be cracked.

However AES ECB mode is still AES. If you have only 1 block of ciphertext it is ok. If you have lots of texts then probably one will still be unable to crack it, the problem with ECB mode is that 2 blocks of the same plaintext will have the same ciphertext block too. So it really depends on the text you want to encrypt and the attacker's knowledge of the original plaintext. What you see on Wikipedia is a picture encoded where there are lots of similar blocks. All the white blocks will be similar, all the black blocks will be similar and so on and so forth.


Tor, PGP and Tor Entrance Nodes Imagine alice posts her public PGP key on her website and bob encrypts a widget with that public key then sends it to alice over Tor. If alice's key is widely and publically available and an attacker were to keep a map of key => identity, wouldn't the attacker, if operating your entrance node, be able to correlate the IP of the sender to alice's identity by identifying the key it's encrypted with (even if she's using Kali Linux for anonymizing her IP - I assume that doesn't completely hide your identity if someone cares enough to know)? I assume here that a Tor server can identify a sender that is not likely a Tor server by simply keeping track of common sender IPs or by other clever means. Does the Tor protocol somehow protect from this? Have ways been explored to separate the identity of the public PGP key from the data it encrypts?

So your question is basically:

  wouldn't the attacker, if operating your entrance node, be able to correlate the IP of the sender to [the recipient's] identity by identifying the key it's encrypted with

No because the entrance node does not know this key. In short, the Tor client encrypts the traffic before it is sent to the entrance node and the entrance node cannot read it. To understand why, you need to know a little about how Tor works:

Your Tor client selects three nodes: the entrance, middle and exit node. Each Tor node has its own public key and identifier. Let's say the entrance node has identifier 0xC4, the middle node has 0x13 and the exit node has 0x37. Say we want to transmit Message to alice.example.net.

Your Tor client would first encrypt Message and the destination alice.example.net with the exit node's public key, let's say this becomes eu3AeShuC.

Your Tor client now encrypts this encrypted packet, eu3AeShuC, a second time (using the public key from the middle node), adding the new destination: 0x37. The packet is now ho7cieRaqhe.

And finally your Tor client encrypts this data a third time together with yet another destination (0x13), using the entrance node's public key. This becomes egoo4eiReeth2Ief. The client sends this final packet to the entrance node.

The entrance node receives egoo4eiReeth2Ief, decrypts it with its private key, and gets ho7cieRaqhe and destination 0x13. It forwards the message to 0x13.

0x13, the middle node, receives it and decrypts the packet using its private key. It gets eu3AeShuC and finds another destination: 0x37. It gets forwarded to 0x37.

Finally the exit node receives it, decrypts it with its private key, sees Message and the destination alice.example.net, and sends it there. This, by the way, is why you'll want to use https when accessing public websites (.onion is different) or PGP when sending e-mail: the exit node sees what goes out to the Internet.

This is of course a simplified model but it does tell us what each node knows: the entrance node knows your IP address, so it can correlate your IP address between packets and maybe even visits. But it has no idea what you are sending or to whom you are sending.

The middle node never has a clue about anything. Poor boy.

The exit node sees what you're sending, if it's not encrypted (such as with https) and whom you're sending to, but has no clue where it came from. Of course if you use the same PGP signature identity every time, the exit node would be able to see this identity, but isn't the point of a signature that it proves that it was you, even if "you" here is a pseudonymous (not anonymous) person?

Take an example of Tor and PGP: Satoshi Nakamoto used Tor and PGP. He proves his identity by PGP but hides his physical location (and thereby real-world identity) by using Tor. I do not believe anyone on the planet knows who Satoshi Nakamoto is if he (or she, or they) didn't want them to know. Tor is pretty good at anonymity if you use it properly and it seems Satoshi Nakamoto did.


Is there any point in using 'strong' passwords? Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this:

Password strength is a rough measure of how long it would take to brute-force my password from a hash. Brute-forcing even a 'weak' password is difficult via the authentication endpoint for the website - it's too slow, and limitations on the number of incorrect password attempts are commonplace. Brute-forcing even 'strong' passwords is becoming trivial when you have the password hash, and this situation will only get worse. In the situation that password hashes are leaked from a website, passwords are reset anyway.

It seems to me that there's no difference between using the password fredleyyyy or 7p27mXSo4%TIMZonmAJIVaFvr5wW0%mV4KK1p6Gh at the end of the day.

Brute-forcing even 'strong' passwords is becoming trivial when you have the password hash, and this situation will only get worse.

This is not true. A highly random password is near impossible to bruteforce given that the web application in question is using a strong hashing algorithm like bcrypt or pbkdf2. On the other hand, weak passwords are laughably easy to bruteforce even if a strong hashing algorithm is used.

So yes, there is merit to using a strong password.


how does mdm (mobile device management ) work in byod environment to control the camera? what i want to know is how  mdm (mobile device management ) works in byod environment to control the camera from clicking pictures of a printed document?is there a way other than to shut off the camera or by not allowing mobile phones with camera?

As you've already surmised, the only thing you can do is to prevent the camera from working at all.

Unfortunately, tiny camera's are prevalent everywhere now so completely preventing this issue is pretty well impossible without taking very extreme actions.


Can PFS be used to prove that a file was transmitted/received at a particular date & time? Can Perfect Forward Secrecy (PFS) be used to prove that a particular file was transmitted or received at a particular time? If so, how? By keeping records of the entire TLS stream?

PFS could be used to guarantee that a given set of packets (e.g. containing a file) belonged to a given session, by using the following "protocol":

Client C (handling the requests of user U1) and Server S establish a TLS session with a key k_i. The entire session is captured and stored using tamper-resistant mechanisms.
C downloads a file from S.
Upon request of a third party with access to the packet capture (e.g. a court), C or S discloses k_i. The third party accesses the content of the packet capture and uses k_i to decrypt it, thus showing whether or not that set of packets belonged to that session.

Note, however, that this mechanism cannot prove that U1 didn't receive the file before that session, as:

1) the same plaintext encrypted with different keys can - and normally does - yield different ciphertexts. Without knowing the keys of all previous sessions with that server (since the very first one, which could have been years before), this problem is unavoidable; and

2) U1 could have obtained the same file previously and "out of band" in many different ways, for example by another server, by having U2 download the file using his account and copying the file locally (or for that matter, stealing U2's credentials), and so on.


Is my BCrypt variant ($2a$) fine, up to date and secure? As far as I know, there are a couple of BCrypt variants and I also understood that some of those variants have security flaws so I was wondering whether it is fine or not that the library which I am using uses the $2a$ variant.
Is it secure? Is it still up to date and still can be used?
I am using bcrypt.net for c# (the new updated version on GitHub) and it uses the $2a$ prefix

This is from the wiki page:

  $2a$ – The current key used to identify this scheme. Since a major security flaw was discovered in 2011 in a third-party implementation of the algorithm,[15] hashes indicated by this string are now ambiguous and might have been generated by the flawed implementation, or a subsequent fixed, implementation. The flaw may be triggered by some password strings containing non-ASCII characters, such as specially crafted password strings.

In case you'll be looking for alternatives, I'd recommend PBKDF2 with SHA512 and 5k - 10k iteration rounds. Should be enough to make brute-forcing too costly and still run your apps without notable delay. Here is an off-the-shelf c# implementation.


Why do unverified restaurants accounts pose a threat to the privacy and safety of users? We have an app to order food from restaurants but the app developers decided not to verify any of the information provided by the restaurants like the location and opening hours. Why this decision might pose a threat to the privacy and safety of users?

Your question lacks context. So, here is some (too) input:

Information security is about three things (order is not of importance):

Technology
Processes
People

Your example is lacking in "process" - i.e. how does the information get into the system?
So, your question is how secure is a system when the information in it may be false.

That depends on the system. There are systems, such as games, where "truthness" of the information is not needed. However, if it is a game, the users are aware that the information is fictional. If it is not a game, but a public service (like the restaurant you mention), then the users should be made well aware that the information is not verified. And then the question comes "who owns the information", i.e. who is responsible. If you order and pay, and then the restaurant is in another city and refuses to deliver, what happens? These are part of the "processes" mentioned above.

In my view, the app owner has some responsibility to verify the information, and cannot claim as being an entirely neutral provider. Just to store and process your personal information, they will certainly be obligated by some regulation to comply to some security norms, depending on which country they are in. And I doubt any security auditor will give them the go-ahead in this case.

But I find your question a good example of information security -- showing that it is not only the technology (SSL, encryption etc.). It is processes. And people of course.


BEAST: IIS6: Failing PCI scan - are these ciphers OK? Our PCI compliance scanner,  TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers:

Cipher Suite: SSLv3 : DES-CBC3-SHA
Cipher Suite: SSLv3 : RC4-SHA
Cipher Suite: SSLv3 : RC4-MD5
Cipher Suite: TLSv1 : DES-CBC3-SHA
Cipher Suite: TLSv1 : RC4-SHA
Cipher Suite: TLSv1 : RC4-MD5

From my research,  these are all OK,  i.e. are 'strong' and not susceptible to the BEAST exploit.  Scanning our site using https://www.ssllabs.com/ssltest/analyze.html results in a pass:

Protocols:
 TLS 1.2    No
 TLS 1.1    No
 TLS 1.0    Yes
 SSL 3.0    Yes
 SSL 2.0    No

Cipher Suites:
 TLS_RSA_WITH_RC4_128_MD5 (0x4)         128
 TLS_RSA_WITH_RC4_128_SHA (0x5)         128
 TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)    168

BEAST attack:   Not vulnerable

Should I dispute TrustWave's findings?

How does one disable CBC 'mode' on IIS6?

You disable all ciphers that have CBC in their name.  http://support.microsoft.com/default.aspx?scid=kb;EN-US;245030 describes how; https://www.nartac.com/Products/IISCrypto/Default.aspx provides a tool to do it for you.

Also, from that second website:

  Note - Windows Server 2003 does not support the reordering of SSL cipher suites offered by IIS. However, you can still disable weak protocols and ciphers. Also, Windows Server 2003 does not come with the AES cipher suite. Microsoft has a hotfix for this.

This means you really only have two choices:

Upgrade your operating system to Windows Server 2008, which I infer as being fully supported by the Nartac tool and is the last 32-bit version of Windows Server, so shouldn't require updating your application too much (although you really should)
Disable all CBC-named ciphers to pass your PCI check (and then re-enable them once it is done, albeit it is on your own head if you ever get caught).

Did I say that out loud?


Patterned password, based on site name I'm considering implementing a pattern for my passwords, using the following ideas:

Master password that I store nowhere
An algorithm to mangle it based on the site I am accessing

So for example I have master password M, I go to website PayPal (P) and run some relatively simple algorithm in my head A(M, P) that produces password for PayPal. Algorithm is consistent but for different sites it produces different results.

Pros:

Stealing 1 or 2 passwords doesn't expose me to further risk.
I don't need any storage or password management apps.
Keylogger can steal only limited amount of passwords.
Since I don't need storage I can't really lose my passwords.

Cons:

If my algorithm somehow leaks the master password can be recovered from few known passwords.
It makes entering passwords harder. I can write small app for my phone for that though. Still generating site password might be problematic in certain situations.
Changing passwords is a problem as well, but this can be added by adding 3rd param - version A(M, P, V) and I can store just version. Or save it in password hint.

Is it good idea?

Since the question has been edited to no longer reference "Two Factor Authentication", I will re-vamp my answer, but I'll leave the original below.

The idea of having a "base password" that you either append a few chars to, or "mangle" in some way to make it unique for each site is a fairly common trick that even some security experts use (until they adopt password managers at least).

So how secure is this scheme? Well, it's better than using the same password for everything, and worse than using completely different and unrelated passwords. Exactly where it falls on this line is a matter of opinion (which I'm sure other answers will provide).

My opinion is that it doesn't matter where it is on the line because you're either worried about people analyzing your leaked passwords for patterns, or you're not. The way I see it, there are two types of attacks (or "threat models") to worry about:

A "drive-by" dictionary attack by a mass cracking tool using stock dictionaries. They are usually looking to pick off the 40% of users with weak passwords - who re-use the same password from site to site, and then they'll move on to a new password leak.
You are being personally targeted - human time and computational power will be spent analyzing your previous leaked passwords looking for a pattern.

If you're only worried about 1) then you may be able to get away with a very simple mangling rule to get your password away from standard rules in off-the-shelf dictionary-based cracking tools. Even here, you're hoping that your "trick" is not popular enough that any hackers out there have added it to their rule sets. If you're worried about 2) then any sort of pattern whatsoever will eventually be figured out.

At the end of the day, "is it secure enough?" depends on your risk management and the importance of the thing you're protecting: very roughly speaking, if (probability of breach) X (value of data lost) > (level of security) then you should increase your security. If you're concerned enough about your passwords to write up a post on a site like this (and good for you!) then you should consider just using a password manager like LastPass or KeePass - they really are easy (unless you forget your super-strong master password and abandon the whole thing like I did).

Original answer:

First, some terminology:

It turns out that there's a little bit more to Two Factor Authentication than you might think on the surface. Generally speaking, there are three types of authentication mechanisms:

Something you know - information, like a password, or your mother's maiden name, or a public key stored in a key file.
Something you have - usually a physical object like the phone that can receive SMS at your number, or a One-Time-Password (OTP) token or public-key enabled smart card / USB stick:

Something you are: aka "biometric" like fingerprints, iris, voice, typing rhythm, etc.

The reason for splitting auth methods into these categories is that each one requires a very different kind of theft in order for a hacker to acquire it.

If you are required to provide a proof of identity from more than one of the above catogories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.

Now for your question:

So what you are proposing is not Multi-Factor. It's not even Multi-Step because at the end of it all, you're only providing one password to the login page.


Source code disclosure vulnerability I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like this:

/* SomeProgram v1.1 <http://www.somewhere.com/software/>
Copyright (c) 2010-2012 Dorothy
This software is released under the GNU License blah blah blah.....
*/
var variable=function(){ ... } // and so on. A bunch of js code

Is this called a source code disclosure vulnerability ? Or is this the correct behaviour? thanks

That is the correct behavior.  In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed.  So, the fact that you can manually browse to the URL for the script file is irrelevant.  It gives you no more access than the application intends for you to have.

A source-code disclosure vulnerability is when the client can access server-side source code that it should not by design need or be able to access, such as PHP or ASP.NET source code.


Decrypt data with known text So I have an encrypted text file that I know contains the phrase "potatoes are awesome" Is there a way for me to decrypt the text based on me knowing that phrase and the encrypted data? (I also don't know the method of encryption)

Thanks in advance

The answer completely depends on the encryption used, which you said you don't know.  Odds are, if it is anything modern, the answer is "no" as one of the comments says.  Modern encryption systems are highly resistant to known plain text cryptanlysis.

However, if this were a simple substitution cipher, or even a poly-alphabetic substitution cipher, then "yes," it's likely crack-able.

If the plain text was XOR'ed with a relatively short, repeating key, that too would be possible to crack.

But ultimately, it depends on which crypto was used, and if it is anything reasonably modern and standard, the answer is no.


How does check.torproject.org know if you're using Tor? I'm looking at the results from the following URL and would like to know how does the Tor Project website "know" that Tor is being used or not.

https://check.torproject.org/?lang=en-US&small=1&uptodate=1

I would set up a packet sniffer, but since I'm not an exit node I'm not sure if that would make much of a difference.

In one line: they have a list of all the exit nodes (something like that).

more detailed:

I have seen this post demonstrates how to detect a Tor connection in php

function IsTorExitPoint(){
    if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="127.0.0.2") {
        return true;
    } else {
       return false;
    }
}

function ReverseIPOctets($inputip){
    $ipoc = explode(".",$inputip);
    return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];
}

A good references explain what it does are available here:

The list of the exit nodes.
Here is a page maintained by the Tor project, that explains how to
determine if it is Tor.

Update:

From Tor offical doc that descirbes the TorDNSEL method that mitigates the drawbacks of the old method of testing exitnodes ip list:

  It is useful for a variety of reasons to determine if a connection is
  coming from a Tor node. Early attempts to determine if a given IP
  address was a Tor exit used the directory to match IP addresses and
  exit policies. This approach had a number of drawbacks, including
  false negatives when a Tor router exits traffic from a different IP
  address than its OR port listens on. The Tor DNS-based Exit List was
  designed to overcome these problems and provide a simple interface for
  answering the question: is this a Tor exit?

In ruby you have a cool Tor.rb gem that implements this technique:

Tor::DNSEL.include?("208.75.57.100")               #=> true
Tor::DNSEL.include?("1.2.3.4")                     #=> false


How to securely store accesstoken in android I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application.

In this case, the local storage will be saved to apps data folder, say /data/data/com.myapp.test/app_webview/, as a .localstorage file. As long as the phone is not rooted, these files won't be accessible to anyone else other than the same app and root. All good :)

But if the devices is rooted, the file becomes accessible for anyone. Since the localstorage contains the accestoken for the current session,here, I assume the app may get compromised. Below are my queries.

Is there a more secure mechanism to store the accestoken that localstorage?
Can this be achieved with sharedPreferences/keystore? If yes, what will be the things affecting app performance?

Can this be achieved with Keystore?

I don't think that fits your use case. Keystore is designed to store cryptographic keys that will be used for encryption, decryption and signing. The idea is that these keys will be out of reach of the application using them, so basically, if you need something signed or encrypted, you call a system function that has access to the keya, but you can't get the keys themselves. This protects them from compromised applications. This doesn't work for you, since you need access to the access token itself.

If you  used Keystore to encrypt and decrypt the access token, this would protect the access token from other processes (or from being extracted by forensic software from the filesystem - but see about access token expiry further down...). So that would definitely enhance security. But if your app was compromised, an attacker would still get access to the decrypted access token.

  Is there a more secure way than using localstorage?

I'd say that if you want to protect against someone with root access and/or a compromised application, then no. You can't protect a secret from root, no matter where you store it on the device, except maybe in trusted computing platform hardware (this isn't exactly true - linux systems support security capabilities which root has by default, but may be denied by the kernel if so configured - but I think that's not very relevant for this discussion)

The problem with protecting from root is that root has access to everything your app can access, so even if you encrypt your access token, root would have access to the encryption key and could decrypt it. The same holds when your application is compromised.

One way to add a bit of security might be to have a service which is housed outside the device do an additonal layer of encryption and decryption of the access token based on a revokable key, so if the device was lost, you could revoke the associated key and then the encrypted access token on the device would be useless. But for this solution, you'd need to have two layers of encryption, one on the device (otherwise, you'd open up a new vulnerability by sending plaintext access tokens over the network to another service)  and one on the service.

However, this strikes me as a ludicrous amount of work to protect an access token (it might make a bit more sense for a long-lived renewal token). Access tokens are generally short-lived and if you deleted an access token as soon as you no longer needed it, that would also increase security.

Storing the access token somewhere other than localstorage might, however, be more secure than localstorage because localstorage is accessible using javascript, so if your webview was infected with malicious javascript, it could steal the access token. But since your own code in the webview probably needs access to it, you're out of luck.

BTW: I'm assuming you're talking about a oauth access token. oath was originally designed to solve authorization for server-side applications which are used by user agents (browsers). oauth 2 then extended this to include authorization and authentication flows for other scenarios, such as for javascript apps running in the browser or apps sitting on devices controlled by the users themselves, but there are a few people (the original editor of the oauth 2 spec among them) who complain that oauth 2 support for these alternative scenarios isn't very good/secure.


Can we check fingerprint with photos? Let's assume an insecure communication channel.
Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to Bob.
Then, Alice sends to Bob a photo of her key's fingerprint so Bob can check if a MITM attack occurred replacing the key.
Obviously an attacker could replace the photo too, with the fingerprint of the eavesdropper's key, but, how likely would this happen? What about time? The eavesdropper doesn't have all the time to do it, and we assume that Bob immediately receives it, so is it safe to assume that the photo of Alice's key's fingerprint is good?
The same could be applied with hash checking, I'm I correct?
And what if Alice signs the photo with her handwriting before sending it? Let's say with a photo editor? I think this would make the eavesdropper taking more time, and Bob would surely know that something is wrong if the photo takes too long to arrive.

Alice wants to send the same public key twice, and Bob has to manually check that they match? Not sure about the practicality of this. If this was a regular thing, and I was Bob, I'd put the photo through an OCR* script to automatically do the checking. And if I was the hacker I'd write a script to automatically alter the public key and generate a corresponding photo. Overall, I think this is not secure.
* OCR: optical character recognition


Can cable modem (with no router) get infected? Can an old cable modem, that has no in-built router, get infected by anything?

If yes, would there be obvious signs of its compromise? Could I make sure everything is okay? What could an infected modem potentially do?

Modem is Scientific Atlanta 2203, A Cisco Company.

Any digital "modem" is a computer with firmware that has the potential to be misappropriated.

However, it isn't that likely to be honest. If you are concerned, you should probably try and persuade your cable company to replace it.

You could also simply put a router inside of it which is a common configuration for security. Many new-ish routers no longer have "modems" built in since both cable and broadband (e.g. FTTC) no longer need them as it is common for users to be presented with an ethernet connection.

Worth noting that certainly many broadband "modems" are actually routers with a fixed configuration set by the ISP. Not sure about cable modems I'm afraid having never used one.


TSA server with OpenSSL From OpenSSL documentation of openssl-ts command:

  HTTP server support is provided in the form of a separate apache module

Does anybody know which module is the one? I haven't found any module to enable a TSA server.

opentsa.org used to develop mod_tsa, in 2006. The site is dead as of 2013. I don't think anyone uses RFC 3161.

See https://web.archive.org/web/20120114151658/http://opentsa.org/


How could one say that older operating systems are more vulnerable? Experiment conducted by me in Windows using Virtual Machine:

I have collected all rogue security software that target a range of Windows versions and several latest malware (no older than a month) that target latest operating systems as well. I have used oldest (Windows 98) and latest (Windows 10).

In Windows 10:
I can execute all kinds of malware (both oldest and latest), could install rogue security software, etc. and etc.
Windows 10 is affected by all kinds of malware.

But on Windows 98: Since the version is much older I can install almost no rogue security software and execution of many malicious programs failed due to incompatibility issues, and may be due to several advanced facilities it uses.

So, I see Windows 10 gets more infected than Windows 98. And, there are still antivirus vendors offering their product compatible with Windows 98. So, how could Windows 98 be less secure or insecure than Windows 10?

There is one flaw in your premise that since those malware ran on windows 10 but not on 98 and hence windows 98 is safe.
By that logic, I can say that my shell script cleared the contents of a linux box but not windows and hence windows is more secure.

Edit:
Modern operating systems are the primary targets for attackers as most of the users use them. If the features used in the attack are not supported by older operating systems, the attack will not run on them. It doesn't make them secure. The attacker is just not bothered about them.

The main reason older operating systems are not considered secure is that if a vulnerability is found on them, the vendor will not bother providing a patch for it. Their support has been ended.

All other reasons are secondary.


Best practice for identity management methods with regards to confirming user existence I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in.

I've been working according to the spec and our organisational Password Management policy. The combination of the 2 would have me give various detailed messages to a user when performing account related actions e.g.:

When selecting "Forgotten password" for a non existing username display the message: This username does not exist.

I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was sent to the email address provided" even when the user provided does not exist.

Applying this principle to other account related actions is a bit tricky, though. For instance; according to the spec when selecting Resend confirmation email for an account that is already confirmed I should show the message: "This account is already activated". That right there shows any other anonymous user that the account exists. Now, if I show the success message, then the user might sit and wait for the email, which means that I should actually send him an email. Should this email then be the usual activation email, or one that states: "Your account is already activated. Please open the site and log in."

Another issue is when registering. If I show a generic "Invalid registration attempt" message when registering with an existing account, my service desk could be flooded with calls from angry users. (OK, probably not flooded, but after the first one the service desk discovers that the user contacted them due to a generic error message for a specific and identified issue, they will request me, or any developer, to amend the error message to show the user what the problem is) Once again, though, if I show the user a message stating that the account already exists, then then we're back where we started.

Also, when a user logs in 5 times incorrectly, I'm to lock out his account. If I tell him his account is locked out, this is yet another means by which an anonymous individual can confirm whether the username exists or not.

I've looked for some literature online with guidelines regarding these interactions, but have not found much.

I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was sent to the email address provided" even when the user provided does not exist.

Yes, this is the proper way to do it. A better message would be "If this email address exists, instructions on how to proceed was sent to the email address provided". It is more user-friendly without giving to an intruder the information whether the account exists.

Should this email then be the usual activation email, or one that states: "Your account is already activated. Please open the site and log in."

The latter.

If I show a generic "Invalid registration attempt" message when registering with an existing account, my service desk could be flooded with calls from angry users.

In this case, you should show onscreen a message "Information has been sent to the email address provided. Please follow instructions." and email to the user "Someone (perhaps you) has tried to register with this email account, but an account bound to this email address already exists."

Also, when a user logs in 5 times incorrectly, I'm to lock out his account.

This is trickier as could be used for a DoS (although, since the attacker doesn't know whether the account exists or not, he can only try email addresses at random).  You need to have a second authentication method (e.g. a mobile phone number or a second email address) where you can notify the user "Your account has been locked due to 5 authentication attempts failed" and allow him to reauthenticate in some other way, perhaps with a nonce.
EDIT: This should also be used for password reset.

A softer way to mitigate incorrect logins would be to deny access for 24 hours, instead of locking out the account.


Security implications of hosting third-party Javascript A client of ours wants us to host a blob of Javascript for their custom-branded version of our website. It is hosted on a subdomain of our site (customer.example.com), but uses the same cookie domain as our primary site (example.com).

What are the security implications of doing this, should we agree?

I would say the implications are the same as any XSS vulnerability.  What you are basically doing is allowing them to insert javascript of their choosing into your application without making them jump through the hoops of finding an XSS vulnerability.

Two big risks that come to mind are performing actions on behalf of the user without their ok and stealing session cookies if they aren't HTTP only.

If you do agree I would only do it on the condition that you will need to review and approve all javascript.


How does the Meterpreter load modules? I've been using the Meterpreter for some time and I'm still quite new to it and one of the questions I have is how it's module loading works.

Correct me if I'm wrong as I'm still learning how to use Metasploit, but to the best of my knowledge I know that the modules that you can load onto the Meterpreter such as killav.rb are written in Ruby. This module is supposed to be loaded onto the Meterpreter and executed.

How is the Ruby script executed if the Ruby interpreter does not exist on the system? Sorry if my question sounds basic or if what I know is wrong as I'm just getting into using Metasploit.

The code doesn't actually run on the remote host.
The ruby module is executed on your machine and uses the Metasploit api to execute code on the other side. The Metasploit api has alot of windows apis mapped as rpc calls (called railgun).
Meteterpter is written in cpp, there is no ruby component or embedding done on the "client" side.
Read more here: How to use Railgun for Windows post exploitation.


Gaining shell access on a Unix Webserver I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now.

I have access to the web admin console but have not been able to find any RFI vulnerabilities.

Also I have gained access to the mysql database but the remote user does not have any file privileges, nor has permissions on the mysql database(has access to the application database only). The root user has no password set, but access is given only to localhost.

So, I am pretty much stuck at this point. Can anyone provide any ideas how to proceed next?

Can you launch commands in a shell even with standard user privileges? Look what kernel has with uname -r. Maybe is vulnerable to Dirty Cow exploit, affected kernels. Or maybe you can use the old Semtex exploit. Always should be a directory to write... check for /tmp.

If you have access to the mysql, you can launch system commands from there using \!. Check this out.

The post-exploitation is more difficult sometimes than the first intrussion! Be imaginative. Here are a lot of useful commands. Good luck!


Fixing large number of SQLi, XSS, RFI/LFI in a PHP application I'm working on a website which was built few years ago in PHP and its riddled with vulnerabilities all over the place. Someone has already gained access to the admin panel and we want to secure the websites, and prevent future break-ins.

Simplest, but tedious solution is to go through each file manually and replace all mysql queries with prepared queries and sanitize all inputs. However, I want to know if there's a simpler solution which could act as a layer between user input (GET, POST, COOKIE, SERVER) and the website logic, and filter out all suspicious looking input data.

I did some research and came across PHPIDS, but I couldn't figure out if it had ability to sanitize the inputs too. Is PHPIDS ideal for this task? Is there something better that suits this purpose?

There are web application firewalls out there that do the type of thing you are talking about.

IMHO, who ever owns this website needs to bite the bullet and make an effort to actually secure the website instead of taking another half assed approach.

If dropping big bucks on hiring a security consultant to perform a security audit on the site is not a realistic option, it is possible for a committed web developer to perform a security audit on a site and fix any vulnerabilities found. Obviously a professional would be a better option, but if that isn't realistic, many developers can do a descent job given the proper guidance.

If this is a route you are willing to go, I would suggest getting a copy of The Web Application Hacker's Handbook (there are many other good books, but I personally liked this one).  In addition to going into detail on how the various attacks work and how to protect against them, it also provides a systematic approach to finding all security vulnerabilities on a web site in the chapter titled, "A Web Application Hacker's Methodology".

Reading this book and performing a security audit will increase your security awareness/knowledge significantly.  A must for any serious web developer.


Is there a way to check if my site visitor has visited another site? I want to know if the current visitor has already visited a specific site. The site is owned by someone else and is on a different domain.
Is there a way?

Generally there is a way for Chrome. You can try to exploit this vulnerability (not a product, but a demo to check if it works in your browser).
The vulnerability uses JavaScript to check from which cache the image was delivered: from F-cache or from disk cache.
Note: This method will only work if target site has a favicon.


Do I must require Authentication for resources with an Hash-key? I have noticed that my private Google Drive resources, for example, although it is impossible to "guess" their hash-key and get it (eg tbEB6fQTqQcFAoRBXYvnpNVq9F3PUr_cs), however the server requires authentication to access the resource.

On the other hand, in ICloud I saw that while there is an "external" link that represents each resource, it is private, but the real address (by which the client-side goes the resource) is without any authentication .

I think that makes sense, that there is no way for an attacker to obtain the key in Query String, because it is encryped by SSL.

The question is whether there is any fear of it and therefore to implement validation as Google does. I'm talking about an application where resources are not exposed in any way to an unauthentication user.

As pointed out in the comments by @Sjoerd simply using a URL to protect a resource in theory can be secure but comes with several potential problems. If this is your question then it is a duplicate of Is random URL token secure enough for file attachments and other user content?.

As per my comments it appears iCloud does not simply use a URL. The link provided contained several query parameters including a session token, (relatively short) expiry and signature.


Is it possible to crack g++ rand()? So, I have this:

I know that some code was used to generate a random sequence, and it looked roughly like this:

#include <iostream>
#include <string>

int main() {
    const std::string alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
    std::string temp = "1234567890";
    srand(MAGICNUMBER);
    for (int i = 0;; ++i) {
        for (int j = 0; j < 10; ++j) {
            temp[j] = alphabet[rand() % alphabet.size()];
        }
        std::cout << temp << std::endl;
    }
}

It was used to generate a sequence of 124660967 strings, the last of which was "2lwd9JjVnE", and then stopped. The compilator used was 64-bit g++ 4.8 for Linux. What I want is to find the 124660968th string – that is, the one that would have been printed next. The caveat, of course, is that I don't know the MAGICNUMBER. I'm pretty sure that it's possible to brute-force all possibilities, but it would take millennia, it seems. I've tried to snoop around in rand() source code, but I don't really understand it, much less exploit it. Is it possible to find that string in more or less reasonable time?

UPD Is it even possible to generate what is supposed to go after my string without finding out the seed?

The compiler itself is irrelevant; the rand() function is implemented in libc.

The glibc implementation uses a linear congruential generator (LCG) or a linear feedback shift register (LFSR) for its rand(). These can be quite easily cracked given some of the outputs (which it seems you have). The details can be found in the answer to another question already asked here, but the crux is that LCGs and LFSRs are not secure and some simple maths and probability can gain you the right answer pretty quickly.

You'll need to work out which version of glibc was used, but the compiler version should give you a rough idea of the patch state of the system, so you can infer it from that.

You can find more resources on Google, but here's a quick set of links to help:

LCGs on Wikipedia
LFSRs on Wikipedia
Cracking PHP's rand() [PDF] - relevant because it uses the glibc function for rand(), and this is covered in the paper.
Untwister - PRNG seed recovery tool with support for rand()
Snowflake - Another PRNG seed recovery tool


Rubber ducky windows mitigation So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions.

Essentially my question is can you mitigate rubber ducky attacks using windows user privlages? for example putting users on a lower privilege account that can block access to the console, or admin privileges. My gut tells me yes, but I am not sure how trusted devices work out.

I have seen the duck hunt utility that can be used to mitigate ducky attacks, but assuming that is not an option will user access controls work?

Thanks!

You are mixing two things up but I'll answer both:

UAC does not pose any mitigation to a rubber ducky or a teensy or any other platform. Next time a UAC dialog pops up, try pressing CTRL + Y and see what happens. They easily overcome UAC. Using UAC is meant to prevent software running on your pc from escalating privileges without your approval, but the pc considers you (or your 'keyboard') as approval.
As for granting a user low privileges - this is a mitigation, in the sense that the rubber ducky can only do what the user can, so the more you limit the user, the more you limit the duck. There is a trade-off here. For power users solutions like duckhunt are far better in my opinion but if this is a non-technical person's computer, then this is a great mitigation method.

EDIT: according to OPs comment and edit, my first point is irrelevant. I'm not removing it since I think anyone interested in HID attack mitigation should read this.


How do I investigate where personal information in a fraudulent email was leaked from? I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about investigating how and where this personal data was 'leaked' from?

A sample of the content/text is:

Dear XXX, Invoice - HWNG6945RYVIZ
NAME SURNAME
1st Line of address
2nd Line of address
County
Postcode
Pass - 1234
I look forward to hearing from you,
Sender's Name

Also worth noting that there is a zip attachment to the email so that's a massive stand out No No that this is dodgy. However, as above the information they do contain is scarily accurate. So where did they get this from?

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal information just like any other stuff.

In addition to this as @anon said OSINT tools might be used to gather information about persons, and there are lot of such tools (Shodan, Recon-ng, Foca, Maltego ...).

An other way also is the previous data breaches defined as:

  "A data breach is a security incident in which sensitive,
  protected or confidential data is copied, transmitted, viewed, stolen
  or used by an individual unauthorized to do so."

You can check if you are victim of a previously known data breach using your email at Have I been pwned.

Hope it helped


How to detect long lived SSH sessioned I am trying to figure out a way to detect ssh sessions that have been established over a long period of time.  I seem to recall that there were ways to detect tcp connections that have been connected for a long time but I do not remember how.  I looked at Snort, even posted here about it, but I could not find a rule that would allow me to watch a ssh session over any amount of time and then only alert if it hit a specific time limit.

Can someone point me in the right direction/technology for this?

Thank you,

I could not find an out-of-the-box solution for this, however I think this can be done by scripting a little. Here are my thoughts.

Set up Snort to alert on TCP handshakes to SSH target ports. Have it log these alerts to a file. Also set up traffic alerts to/from SSH ports. Write these alerts to a file as well.

Then, create a script which correlates these events and alerts if a connection is alive for too long.

A simple state machine should do the job. If the handshake alert is encounter save the from/to ip to some kind of storage (can be memory) as well as the ports and the time of the alert. Have a last seen date saved as well and update that as you see traffic between the two hosts. Check if the difference between last seen and connection established is greater than your preference.


DMARC and SPF are setup for my non-www domain but doesn't work for www My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly:

_dmarc : v=DMARC1;p=none;pct=100;rua=mailto:support@example.com;ruf=mailto:support@example.com

spf : v=spf1 a mx include:_spf.elasticemail.com ~all

However, I keep receiving email reports from google and yahoo saying that my email is not authenticated. When I use free DMARC analysers, it says (as warning):

  No DMARC Record found for sub-domain. Organization Domain of this sub-domain is: example.com Inbox Receivers will apply example.com DMARC record to mail sent from www.example.com

Another one says (as warning):

  A DMARC record is defined, but there are some issues with the configuration that may impact security, visibility, and deliverability for email sent from this domain.

  DMARC is not at enforcement for example.com. Anyone can send messages purporting to be from addresses on this domain or its subdomains.

Whatever I have done, I couldn't overcome this issue. What am I doing wrong? Is it all because my domain is www.example.com and I am using support@example.com subdomain to send the email?

"My website is up and running on www.example.com and I am sending automated emails from >my email address support@example.com."

When these automated emails are sent from your website or application, it sounds like they are being sent using their own mail server without any SMTP authentication. For example, a website may send out user registration email confirmation messages using sendmail or postfix mail server software which is commonly installed on web servers for this purpose, however those who send spam or spoofed email messages use the same techniques and can also claim to be sending email from support@example.com. With some configuration, your website could be sending authenticated emails, i.e. instead of using the built-in mail server software, the website connects to your domain's main SMTP server (could be Exchange or Office365 or Google etc, other mail server brands exist), authenticates with a username and password, just as you would if you were using an email client application on your phone or webmail, and then it sends the email.

  "No DMARC Record found for sub-domain. Organization Domain of this sub-domain is: example.com Inbox Receivers will apply example.com DMARC record to mail sent from www.example.com"

In the absense of a sub-domain DMARC record, the main record for the domain will apply. Unless you are using email addresses like support@subdomain.example.com this is not likely to be an issue. You could ensure there will be an SPF fail in this case by have a wildcard SPF record to cover any subdomains spoofers may think of, for example: v=spf1 -all, and enter * as the hostname for this record. This will not interfere with the SPF record you have created for the @ which covers your normal use of email for the domain, email addresses such as support@example.com.

  "A DMARC record is defined, but there are some issues with the configuration that may impact security, visibility, and deliverability for email sent from this domain."

Without more investigation it will be difficult to tell exactly which issue this may be referring to, however it might be as simple as the fact you're specifying an email address with the same domain name for the reports to be sent. If there are email delivery issues with the domain example.com your reports about it may not be received at support@example.com! Perhaps setup support@example.net or other different domain for processing your DMARC reports.

  "DMARC is not at enforcement for example.com. Anyone can send messages purporting to be from addresses on this domain or its subdomains."

This simply means you have p=none or p=quarantine at the moment. The first is ideal for when you're just getting started and need some oversight as to what's going on without wanting to cause problems unnecessarily. The second is a good mid-way point to start seeing messages quarantined (moved into Junk folders) when you're testing the effectiveness of which ones it blocks and doesn't. Eventually the aim for most organisations will be to set this to p=reject in order to ensure the messages simply get dropped and are never received. Since DMARC forensic reports are rarely implemented at present you might actually be safer going for quarantine until you are entirely satisfied that those being quarantined includes no genuine messages. Some tweaking may be required before you move to p=reject. The message you're seeing doesn't mean you've done anything wrong, just that your implementation is at the early stages.


Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET? The International Domain Name mitigation API's are available here for download.

Has anyone used them since they were first published in 2006?  Are there any pending updates to them (I can't find a MSFT connect site for these)?

Lastly, is anyone aware of a .NET wrapper, or any .NET samples for this library?

1) Microsoft's API's are limited in scope of protection.  And no a .NET wrapper does not exist.  The IDN mitigation API's are limited to conversions between IDN and ASCII (punycode) and providing some rudimentary checking of mixed script as a security precaution.

2) Something like http://www.casaba.com/products/UCAPI/ will provide more significant detection of string confusability including the presence of confusable characters in IDN. This API also allows for comparison of two strings such as:

IsStringConfusable(source, DetectionMethods)
AreStringsConfusable(source, target, DetectionMethods)

UCAPI does have a .NET API but it's neither public nor open source.

3) An open source alternative would be ICU at http://www.icu-project.org/ which includes an API also for detecting confusables similar to UCAPI above.  However ICU is C, C++, and Java only.


How could an attacker read the content of php session variables? In my PHP code, I am generating an RSA keypair, sending the public key to the visitor and storing the private key in a session variable. Is it possible that an attacker might somehow be able to read the content of the session variable?

I know that someone might take over a session by hijacking it, but I have not been able to find out whether it is possible to access the variables of that session.

Thank you in advance.

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

you have a directory traversal vulnerability which allows the reading of files.
on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
you badly misconfigured your server, and session.save_path is publicly accessible
...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution vulnerability, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.


Do interactive ads on Android pose a security risk? I have recently started seeing interactive ads in free applications I use on Android. I'm used to ads that come in the form of images, gifs or videos. Now, a lightweight, seemingly HTML5-compatible version of a game being advertised is automatically loaded, ready to be played. The only mention of any security implications connected with these interactive ads are outlined in this article.

What are the security risks of malicious interactive ads appearing? Are there user practices (not clicking, closing, configuring any settings) that mitigate the risk?

As the famous quote says "If something is free, you are the product". So, most of the free applications in order to generate revenues use ads as a means. However, the ecosystem around the ads isn't really secured and this is where malicious actors abuse the underlying vulnerabilities. In another terms, this can be referred to as Malvertising.

A good read on how steganography is used to exploit at https://www.zdnet.com/article/malicious-code-hidden-in-advert-images-cost-ad-networks-1-13bn-last-year/

Also, HTML5 seems to be heavily abused by Threat actors in the recent days and more on this at https://mediatrust.com/blog/html5-safe-haven-malware

Hope this helps!


OpenSSH: Is setting a long ForwardX11Timeout better than ForwardX11Trusted? I've never loved the idea of trusted X11 connections to shared machines. However, several years ago, we noticed that untrusted connections stopped working after a very short amount of time. After some digging, I found out that there's a "ForwardX11Timeout" setting that's set to a low-ish number; changing it to a big number (596h, in my case) makes the problem effectively go away.

But! I'm wondering if there's an important reason why this is set to a low number. Am I better off using a trusted X11 connection for some reason? ForwardX11Trusted (or ssh -Y) also makes the problem stop manifesting.

I am not sure what is the exact problem you are talking about, but:

  Is setting a long ForwardX11Timeout better than ForwardX11Trusted?

Each of these options solves different problem:

ForwardX11Trusted exposes you local X server so potential evil admin on the remote server can do whatever he wants (screenshots, input, keylogging, ...)
ForwardX11Timeout does not prevent anything from above. It just refuses X11 connections after some time. Settimg that to long time will basically "disable" it (well ... who is running ssh sessions 596 hours?). This option assumes that when you need to run X11 application, you start it soon after the connection is established. It is basically preventing the attack being performed on the idle connections without users notice (after 20 minutes by default).


Difference between interception, spoofing, falsification and repudiation In very layman's terms AFAIK security threats are classified into four broad categories namely

Interception or Snooping or Sniffing
Spoofing
Falsification
and
Repudiation

I could get few related definitions of all which can be navigated to via links above. It will be great if someone can provide basic definitions and fundamental differences between these for everyone to understand? This is my first question on this forum and I was looking for something like this but couldn't find it.

Here is a rundown on the example of emails:

  Interception or Snooping or Sniffing

An attacker intercepts the unencrypted traffic of an email server to record and modify the content of sent and received emails. (Your ISP, router or network administrator are all able to sniff/intercept the unencrypted traffic that they process.)

  Spoofing

An attacker crafts an email with a forged sender address to appear as if it comes from your boss and asks you for a password. This is aptly called email spoofing.

  Falsification and

Falsification refers to spoofing. In a spoofing attack you falsify ("forge") data.

  Repudiation

An attacker gains access to your mail account and sends rude messages to your boss. You probably can't repudiate (deny) having sent these messages easily because the system doesn't keep track of the IPs that logged in to your account.

You might want to have a look at STRIDE, one of the most common models to classify security threats. It distinguishes Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. This classification might be a little more thorough than your proposed list.

Microsoft has a good overview on threats and countermeasures that includes STRIDE.


How to safely extract hashes from domain controller for auditing? I am looking for either tools or method that will extract the hashes and store them securely so that they can be placed onto a dedicated cracking station.

Obviously, they need to be transmitted and stored securely. Let's assume that the internal network where the domain controller is located is not 100% secure.

For safely dumping the hashes, this Optiv reference outlines a number of methods. The most likely of which for your use case is probably to use ntdsgrab.rb to make a volume shadow copy, and then extract NTDS.dit from that shadow copy. Depending on the environment, this may or may not be more subtle than invoking the native vssadmin.exe utility.

For secure transport, as of September 2016, Metasploit's transport control lets you specify encrypted transport methods, including using -t reverse_https to use an encrypted HTTPS connection.


how much security does the iPhone factory reset provide when you factory reset an iphone is all the data on the device encrypted? as iphone uses nand/ is the data in the spare space also encrypted? by spare space i mean the worn out sectors. i'd also like to ask do file shredders do anything secure any deleted data.

The data on the Iphone is deleted not encrypted as Schroeder mentioned in the comments: support.apple.com/en-gb/HT201252

File shredders write over the occupied space with zeros, though doing this on anything other than a spin drive is not recommended as it diminishes the life of the drive and some drives have smart tech which will just make this method infeasible. (shredders normally go over the space x amount of times)

I will suggest however if you want a way to ensure your data is gone I normally encrypted my device with a crazy long unthinkable password, factory reset and then encrypt again! without saving the keys and/or back up keys and re-encrypting over the deleted encrypted space. This should** keep your data safe.


Can a Government block a specific app traffic, even with a VPN running? A few minutes ago, there was a terror attack on a nightclub in Istanbul/Turkey(Thoughts and prayers to the victims and families), usually, the Government limits most of the communications apps traffic and they already block the most popular VPN services.

However, this time they blocked the Telegram App traffic, so I started my own VPN connection (OpenVPN), still nothing and every other app and the rest of the internet connection works normally, maybe there a problem with server, started my paid VPN connection, nothing, another one, still nothing, different internet provider, no traffic what so ever to the Telegram and the rest of the traffic going in/out normal.

Is there any method to target an encrypted traffic that is inside VPN tunnel?

In theory one could use heuristics to guess the kind of traffic. A typical example is flow analysis where one analysis the size, direction and timing of transferred data because various protocols and applications show different behavior in this regard. But unless one has lots of statistics about the various applications the chance of guessing wrong is high. Also, such traffic filtering is not cheap and I don't think that Turkey has already reached the capabilities of filtering like for example Chinas Great Firewall.

It's more likely that the filtering is targeting VPN in general or is targeting traffic which does not pass through the VPN. Technologies like OpenVPN can be easily detected and blocked by typical ports used or by the format of the exchanged data. But if other applications work through the same VPN it is not likely that the VPN itself is the target because even if it would be possible to detect specific applications it is probably impossible to filter only their traffic from the VPN without affecting the other traffic.

Thus if other applications still work over the VPN it is more likely that you are affected by filters of non-VPN traffic. This can happen if your VPN is not properly setup to include all traffic. Typical problems are that DNS lookups are not done through the VPN or that the VPN only includes IPv4 traffic and IPv6 is sent without VPN. In this case it is possible to target specific application by making their DNS names resolve to the wrong side or by filtering their IPv6 traffic. Also, DNS lookups are cached and it might be that you've tried to use the application without VPN first and that even after switching to VPN it still uses the previous and wrong result of the DNS lookup to reach the server. And even if your DNS lookups are done though the VPN you are affected by DNS based blocks if you still use the ISP's DNS server instead of switching to an alternative DNS server.

And since you've got your IP address and initial routes from your ISP it is maybe possible that the ISP is not only pushing a default route but several specific routes too via DHCP and that these routes are more specific than the routes setup by the VPN. This way traffic for specific networks would not pass through the VPN because it has a more specific route directly to the ISP. This technique of using more specific routes is typically used by the VPN itself but also by attack tools like Poisontap.


Does ASLR protect against a buffer overflow within a struct? Assume a simple struct:

struct test {
   char variable[4];
   char variable2;
}

If I write something like variable[4] = '\0' there is a buffer overflow which modifies variable2.

Does ASLR prevent this buffer overflow?

ASLR never prevents any buffer overflow. A buffer overflow is when the application writes more bytes in a buffer than can possibly fit; putting the buffer at any random address cannot fix that.

What ASLR changes is the consequences of the overflow. A buffer overflow is exploited by an attacker by trying to making the extra bytes spill over some other elements in a controlled way. ASLR makes that more difficult in two ways:

By "moving things around", the field that the attacker tries to overwrite will not necessarily be located at a predictable place beyond the overflowing buffer.
A classic overflow exploit is about overwriting a jump field (return address on the stack, vtable for a C++ object...) so that execution jumps elsewhere; ASLR tries to force a blind jump which is unlikely to go anywhere interesting (for the attacker).

In the case of a struct, ASLR will not separate the two structure fields, because that would be contrary to the C specification, and it would break code. Regardless of ASLR, the variable2 field will always be right after the variable buffer in RAM, so the buffer overflow will predictably overwrite variable2. However, ASLR still moves code chunks between two executions of the application, so overwriting variable2 might not be sufficient to, say, inject arbitrary code.


Using Window Servers 2003 after security updates are discontinued Let's say that Microsoft has stopped supporting Windows Server 2003 now so there is no any security updates and I use that system for Domain Controller (Windows XP/7 Professional Clients) and File Server only. I'm using ESET NOD23 AntiVirus.

I don't surf the Internet on that system nor I will install/open any programs/documents and that server is connected to router without any open ports.

What are the security risks in keeping this system running with no more security updates?

  On July 14, 2015, all Windows 2003 support, including security updates and security-related hotfixes, will be terminated.

Will my system be secure?

Maybe. While you say you do not browse from the system nor does it communicate with the internet, there are a number of other possible scenarios to contend with:

That the system is already compromised, making this discussion moot. Unlikely, but still possible.
That the system can be attacked from compromised hosts on your internal network.
The type of attacker you are defending against; e.g. a determined targeted attack ("advanced persistent threat") or a scattergun approach.

Whether the second point holds really depends on your configuration and whether any holes exist in the OS once it reaches end of life. If there are, these will not be fixed.

Whether these holes can be exploited really depends on the type of attack. An automated scattergun-type malware might optionally attempt to scan for known vulnerable systems and try to compromise those too. Or it may miss them, on the basis of no longer considering them viable due to dwindling install numbers.

A targeted attack is likely to be different. If I was looking at how to attack your system, and I had knowledge of this box running beyond-the-grave-software, I'd be cackling like Borris from goldeneye (pleased, basically). The reason for this is simple: if I can find a hole on this box, I know it won't be patched. I no longer have to deliver an exploit within a certain Window - I can simply compromise at will. Got any other systems on the same platform? Great, I can attack those too. Even if you re-install, I can re-infect - because plugging the hole will not happen.

As such, I'd tend to err on the side of saying no, it's not secure. There's a lot of 'if's in that assumption, and a lot of adjustment depending on the risks you believe you face, but given the machine is a fairly critical one, I'd update.


I have continued access of my Facebook account from a particular iPad/IP Address - how do I stop it? I have the Internet abilities of a doorknob. Please keep that in mind.

Through a random series of events, I discovered the Privacy portion of my Facebook account, and saw that an iPad user was accessing my account, and had done so in the very recent hours before. My password was 16 characters long, and a combination of letters and numbers! I selected the option to log out of ALL devices and immediately changed my password. Then I logged back into my cell phone app and desktop using the new Facebook password, and went about my business. This happened just under two weeks ago.

It was disconcerting because I only know one person who has an iPad... my stepson. He is with us the majority of the time, but does have an iPad at his mother's house. That iPad does not come to our house, and as I am the one who picks him up and drops him off, I would know if it went with him.

The new password was 17 characters, and again a combination of letters and numbers. Neither the old password or the new one was anything even remotely related to common info (names/DOBs/nicknames), and was pretty much a random phrase. I checked my Facebook privacy settings again in the next few days, and no more unusual devices popped up.

However, I just checked again, and my Facebook was again accessed by an iPad within 12 hours of my stepson arriving at his mother's house. This time, I saw that I can pull the IP address that accessed, and I tried to look that up too. Looks like one other person reported this IP address for abuse about six months ago.

My stepson does not have a cell phone or a tablet at our home... and I only access Facebook through my desktop computer (password protected because I work from home and have sensitive info on it), or from my cell phone (also password protected). How could this be happening? None of our kids use my desktop computer OR my cell phone. I know that my stepson's mother has a brother who considers himself computer savvy and I've heard stories of him hacking things for the heck of it. But I have never stepped foot into her house or even left my vehicle.. And she does not come to our home or even into our driveway in order to access my devices at home. Could something be just silently scanning anything in range, say running from her apartment, and somehow not only finding my Facebook, but also grabbing the password?

It concerns me mostly because I also have my work email account on my phone, and hacking that would allow someone access to vital information on hundreds of strangers. As I said, I have again changed the password and also selected the option to log out of all devices.

Sorry if these are completely stupid questions, I'm just concerned. There is nothing untoward in my personal life, I'd expect anyone poking around to be quite bored, so I'm not concerned that she (or anyone) is gathering some ammo to ruin our lives.. but it is still very disturbing.

Please let me know if there is a way to prevent this from recurring, and how to report the IP address (I found a website, but it wants me to categorize the type of abuse and I don't understand the definitions!).  I should also note, I checked my gmail accounts (I have 3 that I use, all linked to the same cell phone and desktop that has Facebook) and none of them show any unknown devices logged in, which I find odd that something would target Facebook but not the equally accessible email accounts. Thank you.

Your iPhone may show up in the list as an iPad. Mine does. It shows up in a different state because that is where your cellular provider has its nearest hub.

Try this

Open Facebook on your PC and navigate to the "Where you're logged in page."
Take note of which devices are showing "active"
Sign in and out of Facebook on your phone, refreshing the page on your PC, to see if the status changes.
If it changes, then you've been chasing a ghost.


What are the consecuences of using a false name when using a valid credit card on the internet? I have an Android device and I always use a false gmail account for all the Android related services (meaning a gmail account which does not give clues about my real name) .

For obvious reasons I don't want Alphabet to associate my real name to that device's usage. This has worked for a few months but now I would like to purchase an app which is not free on Google Play.

The only payment method seems to be credit card. I have a credit card, I would give them all the relevant data (Number, expiration date, vc...) but a false name.

Is this possible? Will they receive the real name anyway?

There are two related questions here.

Can the merchant charge your card given an invalid name field?

In general, yes.  Name validation is usually not turned on by default, so from a card processing point of view the name you gave is stored at the processor, but not passed on to the card brands during authorization.

If Name Validation is turned on (or if your merchant is using Address Verification), they may decline your transaction if you provide invalid name (or address) information.

So, assuming no validation, the processor will store whatever name you gave, and associate it with your charge records which are available to the merchant.  So long as you're consistent in presenting the same fake name, that's all they'll see.

Can the merchant request your name given your valid card number?

Essentially, no.  Card-brand-to-processor-to-merchant data flows like Account Updater don't include the cardholder name.  I'm not aware of any API to allow merchants or processors to query this information.  It's not part of the standard card data flow.

I'm hesitant to say it's impossible, however... your issuing bank, obviously, knows the name on the card.  And it's not unthinkable that the merchant might fax a request for clarification of that information with some hand-waving about potential fraud and get a response which includes your cardholder name.  And if Law Enforcement ever gets involved, they'll have your full account info in two shakes of a lambs tail.


Strange TLSv1.2 Handshake I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something.

As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record Layer but it puts the 0x0303 value as version in the Handshake record. The used version is TLS 1.2 (SSL 3.3) actually.
If I got it right, even the RFC5246 says that the value is 0x0303 for this version. So, Why the browser puts 0x0301 in the Record Layer?

This is typical of a handshake that supports a minimum version that is lower than its preferred/maximum version.

In this case, the client is using a TLS v1.0 ClientHello Record, indicating minimum support for TLS v1.0, but inside the record is indicating support and preference for TLS v1.2

Using that technique, clients and servers can negotiate the best possible version that both share.


Will the “Tor Browser” maintain a safe & anonymous internet connection over a computer's sleep/standby-and-resume cycle? Will the "Tor Browser" maintain a safe & anonymous internet connection over a computer's sleep/standby-and-resume cycle?
Is it safe to assume that when the computer sleeps the (internet) connection sleeps as well? What about BIOS settings such as Wake-on-LAN?
What happens to the connection during the steps of said cycle?
Is there any meaningful/relevant difference in behaviour comparing Linux to Windows?

In other words,

Is it safer to close-and-restart Tor Browser when resuming from standby?

Thanks.

While your computer is asleep/standby, it will be disconnected from the internet. When it wakes it will probably try to reconnect straight away (depending on system settings).

If TOR browser loses connection, it will try to reconnect as soon as the internet is available. To check your TOR status just visit https://check.torproject.org

It doesn't matter if you close-and-restart TOR browser, TOR browser will not let you browse the internet without being connected to TOR, so your anonymity is safe.

The easiest way for you to test this is:

Load TOR browser
Sleep computer
Wake computer
Load https://check.torproject.org - It will inform you of your anonymity.


How can I store user contacts (address book) with zero knowledge? I want to provide a user with remote contact list (address book) that they can access and update from arbitrary clients on multiple devices. But I want to have zero knowledge of those contacts. Existing mechanisms (eg XMPP roster, CardDAV) store these details in the clear. Is there an existing mechanism for client-side encryption/decryption of an address book?

Notes (including security model):

The address book will be potentially be used by a variety of clients (XMPP, email, VoIP), so I am open to any mechanism/format.
I assume contacts could still be inferred from the routing logs of XMPP/email/other services. The server would need to be trusted on this anyway, so this is acceptable. It's the "permanent" storage of the full list of contact details that I'm wanting to address here.

The general problem here is storing structured data on an untrustworthy server. Implementations of zero-knowledge / zero-trust databases and homomorphic encryption are relatively uncommon, so even more specific solutions (like a zero-knowledge address book protocol) are unlikely. Instead you will need to implement on of the following:

Store an encrypted blob on the server, decrypt and manage it locally. The challenge here will be handling updates to the blob from multiple clients.
Use a normal relational database and encrypt sensitive fields (e.g. contact details). The challenge here is ensuring that inferences cannot be made from the encrypted data.
Use a zero-knowledge database framework like Crypton (code) or ZeroDB (code). The challenge here is finding a solution that is and will remain well-maintained.

You could then write a client-side module that matches the API of an existing CardDAV module (for example), but instead queries your secure storage, decrypts the result, and returns a plaintext CardDAV object.

Interesting reading: https://gist.github.com/thiloplanz/e1136a04b26c138c8225


How can you I detect low frequency brute forcing over multiple connections? While I realize that servers can easily detect brute forcing strategies via a single I.P, it seems that servers would be vulnerable to a distributed attack from a botnet, with each computer attempting a small portion of the password list at low frequency.

Is there an easily identified signature to these sorts of attacks?

Low frequency against a specific login:

Monitor so that after x attempts over a specific login, one can only try it after x seconds / minutes.

Low frequency against a specific login, using CAPTCHA:

After x trials, begin to ask for a CAPTCHA, perhaps slow it down after x tries.

Just notice that slowing down some attempt by using delays is almost equivalent to enabling a DOS attack against that login. If someone tries to access your account, and fails, it'll end up adding a delay to your attempts, and you, the correct user, might get bored.

Low frequency against multiple logins:

If the overall load of your server increased, in a very detectable way, add CAPTCHAs. If it didn't, your unique alternative will be detecting how many failled attempts you have on your site, and again will have to use captcha. Or to add a small delay for all your logins, and that won't do any good to real users...


How can I hide a program from another program? If program A scans RAM, running processes and whatever, can I hide program B from being detected by A?

Basically, I don't want program A to detect program B, or at least, stop it from identifying it. Is this possible or is something like changing the file name enough?

I can't modify any of the files of program A, but I probably can with program B. Program A is looking for, knows the name and probably looks for behavior as well of program B.

Yes, it's possible.

This kind of behavior is seen on a class of programs called rootkit. A rootkit employs a number of techniques to avoid detection.

Some of those techniques:

Thread injection

In this case, Program B injects a thread on another running process. If Program A is searching for program_b.exe, it will not find it.
Kernel Process Table manipulation

In this case, Program B manipulates the kernel process table, removing itself from the list of running processes. It renders Program B invisible.
Polymorphism

In this case, Program B will create lots of copies of itself, each one different from the another. This is called polymorphysm. As there is lots of different ways to execute the same action, it can create virtually infinite copies of itself. If Program A is searching for the signature of Program B, it will fail to detect the variations.
Behavior change

Program B can have 2 modes of operation: safe and unsafe. Safe mode is how it will behave when it detects Program A running. As soon as it detects that Program A is not running, it loads anything it needs and enters unsafe mode, doing anything Program A would detect.

There's a lot of another techniques, those are just a few samples. A quick search for Detection avoidance  will give you lots of pointers to research.


Storing database credentials for multi server, multi db environment What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information?

For instance I have an auto-scaling site on AWS. At present there is only one database, but at some point new database instances are going to be added (either for data sharding or readonlys)

I'm trying to figure out the best way to store database credentials in a way that also makes them easily updated. Although I've mentioned AWS here ideally i'd like something that is platform agnostic if possible.

It's obviously wrong to store the database credentials in source control so my initial thoughts are along the following (but even this seems wrong)

Use the same username and password on all database servers (there could be different users still depending if it's a write or readonly DB, but all users would be on the servers that need them). Then somehow store these securely on a webserver image. Though I've also read some posts arguing that environment variables should also not be used so wondering how to do this.

A separate config file could potentially live in source control that merely details the addresses and names of the database servers though I also think this should be secret. The issue then arises about getting an updated list of database servers to all the webservers easily.

The problem I'm facing is how to update x number of servers with details of y databases in a secure manner when x and y can both change. y would in theory be more stable than x if x was auto scaling. But at the same time when it does change it would have a greater impact.

This will most likely be on a Linux (Ubuntu) machine. I haven't listed a specific scripting language though as it would be good if there are solutions that can be used more widely

Thanks

Not really a best practice answer, but your use case sounds a lot like the common problem adressed in configuration management. Configuration management applications like Chef or Puppet provide you with the means to efficiently set up and configure software on clustered systems.

Usually you set up a master system that installs and configures all your other systems like application servers and database instances. The master updates configurations every n minutes based on rules like:

When the number of application servers increased, deploy a configuration file containing all the databases credentials and start it up.
When the number of database instances decreases, update all application servers configuration files and restart them one by one.
When the number of database instances increases, get credentials for the new instances from the cloud service, update all application servers configuration files and restart them one by one.

You might also consider having the configuration management application provision your databases. In this case you could go as far as having random passwords generated whenever a new database is required, database users generated automatically and credentials published to all application servers. Strictly speaking, no human would have to get in touch with these database passwords anymore!

Finally let's state some security considerations:

Obviously the master system is a valuable target, and should be secured reasonably. E.g. it should be placed in a MZ (militarized zone) with strongly regulated network access.
The traffic between master and the other systems is usually encrypted to prevent leakage of credentials and other sensitive information.


Minimum required processes with open ports on AWS? I recently started an AWS box to be used for a public web site and it seems to have the following ports open... I was long ago convinced that it's a good idea to minimize the attack surface on any box by shutting down anything not actually needed, but I'm having trouble finding any documentation of what of these processes might be safe to get rid of for an AWS machine. I assume there are some things here that need to be up for AWS's internal monitoring/console/api, but perhaps not all of them? (actual addresses redacted)

[ec2-user@ip-172-xxx-xx-xxx conf]$ sudo lsof -i -n -P
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
dhclient   2028     root    5u  IPv4   9031      0t0  UDP *:68
dhclient   2134     root    4u  IPv6   9256      0t0  UDP [fe80::xxx:xxx:xxx:xxx]:546
rpcbind    2242      rpc    6u  IPv4   9823      0t0  UDP *:111
rpcbind    2242      rpc    7u  IPv4   9824      0t0  UDP *:721
rpcbind    2242      rpc    8u  IPv4   9825      0t0  TCP *:111 (LISTEN)
rpcbind    2242      rpc    9u  IPv6   9826      0t0  UDP *:111
rpcbind    2242      rpc   10u  IPv6   9827      0t0  UDP *:721
rpcbind    2242      rpc   11u  IPv6   9828      0t0  TCP *:111 (LISTEN)
rpc.statd  2263  rpcuser    5u  IPv4   9900      0t0  UDP 127.0.0.1:743
rpc.statd  2263  rpcuser    8u  IPv4   9903      0t0  UDP *:45443
rpc.statd  2263  rpcuser    9u  IPv4   9906      0t0  TCP *:34732 (LISTEN)
rpc.statd  2263  rpcuser   10u  IPv6   9909      0t0  UDP *:36988
rpc.statd  2263  rpcuser   11u  IPv6   9912      0t0  TCP *:36559 (LISTEN)
ntpd       2434      ntp   16u  IPv4  10406      0t0  UDP *:123
ntpd       2434      ntp   17u  IPv4  10410      0t0  UDP 127.0.0.1:123
ntpd       2434      ntp   18u  IPv4  10411      0t0  UDP 172.xx.xxx.xx:123
sendmail   2454     root    4u  IPv4  10476      0t0  TCP 127.0.0.1:25 (LISTEN)
sshd      22860     root    3u  IPv4  32220      0t0  TCP *:22 (LISTEN)
sshd      22860     root    4u  IPv6  32222      0t0  TCP *:22 (LISTEN)

sshd - obviously I want this,
ntp - seems to be talking to a local amazon server but also * so perhaps trim that down in config...
sendmail - is only listening locally but maybe turn that off, as mail sent by the web site should use a real mail server anyway.
rpcbind, rpc.statd - are listening to everyone, so I don't like that unless Amazon needs it for their side.
dhclient - probably has to remain? though the box should now have a set IP, so dhcp in theory might not be required anymore (but how AZ operates this is not clear).

Note that I know all about the amazon console security groups, so I already know I can control access from the outside at that level, but these instances obviously also live in an AWS internal network and if some malware or cracker compromises some other box on that network, or some of AZ's network hardware I'd prefer to give them fewer options for attacking this box.

So the question is, what is safe to remove in the AWS environment?

You're correct, lsof on an AWS EC-2 does not really provide a good image of what can be accessed on your box from outside.  As you already cite in the question, AWS provides you with an extra firewall at a higher level (you can edit that from the user console).  Therefore your only concerns there are ntp and rpcbind against the local network.

AWS modifies the configuration of your machine by appending lines to /etc/rc.local (or at least it does on my Debian there), it does not use rpc.

I'll argue that you can disable pretty much everything, but this:

dhclient   2028     root    5u  IPv4   9031      0t0  UDP *:68

Since it is how your machine may get the local IP re-assigned, either by new DHCP or when the lease time finishes.  (The IPv6 version of the DHCP client at 546 is up to you.  You can certainly leave it, but can close it if you are paranoid.  Not having an IPv6 should not be problematic for a couple of years more.)

All the remaining pieces are up to you.  But a couple of things may be clever:

You certainly want SSH, but you do not need to run it on port 22.  Running SSH on a non standard port is common hardening practice.  (WARNING: remember to test this first!  You do not want to have SSH running on a port that the firewall will not allow you to connect.)
ntp is good to have, and it is a well tested piece of software.  You may or may not care about having the time synced.
If you do not know of a reason to have rpcbind, then you do not need it. The most common thing the rpc service are used for are network mounts (network filesystems), if the server is standalone there is no need for that.  (AWS disks do not use rpc to be mounted, they do it at virtualisation level.)
sendmail (probably postfix actually, your machine looks like a Debian) is already running on localhost as it should.
For a website you will be opening ports 80 and 443, but that is kind of obvious.


Is it safe to post dxdiag on the internet? Is there any information that might be useful to damage me on the dxdiag.txt file generated by windows 7?

A technical support forum from a big company (I guess they know what they're doing) asks me to paste the contents of the file in the forum, for them to understand if my problem is caused by something in my system.

Said posting is visible to everyone on the Internet and it worries me a bit.

TLDR: It's probably fine, and MS meant it not to leak anything important.

It's worth stepping through this line by line, but it's too long. So let's leave out anything that's fairly innocent.

Essentially though, an attacker must work out what your system is (and this has no obvious Personally Identifying Information), and somehow find a specific driver of OS exploits. It's probably too much work to be worth it for most.

System Information: Mostly innocent. Machine name and exact OS version's there. If someone knew how to get to your system in the first place, and there was a specific issue with that version... maaaybe.
DxDiag Notes: Mostly innocent
DirectX Debug Levels: Nothing that seems to be problematic here. Mine gives no useful information.
Display Devices, sound devices, video capture devices, DirectInput devices, System Devices: Driver versions I guess. Driver versions are useful for troubleshooting, so its needed here. If someone knew how to get to your system in the first place, and there was a specific issue with that version of the driver, maaaybe
Disk & DVD/CD-ROM Drives: As above, and how much space you have used.
Preferred DirectShow Filters, Media Foundation Transforms,Media Foundation Enabled Hardware Categories,Media Foundation Byte Stream Handlers, Media Foundation Scheme Handlers, Preferred Media Foundation Transforms
Disabled Media Foundation Transforms
Disabled Media Sources: ALL TEH CODECS. Probably completely useless to anyone.
EVR Power Information: enhanced video renderer information. Nothing much here, I think.
Diagnostics: what's crashed or been troublesome. Looks like this, it's handy:

+++ WER7 +++:
Fault bucket 120429940662, type 4

Event Name: APPCRASH

Response: Not available

Cab Id: 0

Problem signature:

P1: pa.exe

P2: 0.0.0.0

P3: 5626c8a1

P4: KERNELBASE.dll

P5: 10.0.10586.162

P6: 56cd45b4

P7: e06d7363

P8: 0000000000071f28

P9:

P10:

On the whole? Not too likely.


Detect usage of password in public RSA (SSH) key We have a collaborator that specifies in the step for creating an SSH key:

  It is not allowed to use an empty passphrase. We consider an empty passphrase as a violation of elementary security policies and will shut out any user doing so from further usage of our systems.

I use a small GPG smartcard (Yubikey) which is solely protected by a PIN and by me carrying it around on my key ring. However, the private key itself is - to my understanding - not encrypted on the card itself. I know that a password protected (private) key would be stored encrypted on my hard drive, while a password-less key would be stored in a plain format.

My question: As they will never see my private key I'm wondering if it is at all possible to "sniff" (through ssh) if my private key is encrypted or not?

It is not possible for the server to detect how the key is stored. The server only sees the result of a mathematical computation involving the key. How the key client obtains the key is completely out of control of the server.

In theory the server could perform a timing analysis to try to guess whether the key is password-protected. However it is common practice to store the key in memory using ssh-agent, in which case the server would only measure the time it takes for the agent to provide the key; the server would still have no visibility on how the key was loaded into the agent.

Inasmuch as the policy is sensible, storing the key in a smartcard is rather better security than storing it on a hard disk with password protection. (That's of course not a universally true comparison — if you have a very good memory for complex passwords but tend to lose your wallet and the card is badly designed, a password-protected key may well be harder to get hold of. But most people take better care of what they have than of what they know.)

Of course, if the server administrator applies the policy blindly without understanding the rationale, you may be in trouble. If it comes to that, you can argue that the key is protected by the PIN. (The card does a better job of protection, that's why a PIN is sufficient — a 4-digit password is ridiculous security if the attacker has access to the encrypted file. I'm only saying this in case you run into an incompetent administrator.)


Does DNS CAA policy applies to all sub domains? I get following DNS CAA record for google.com using Google public DNS server

google.com. CAA 0 issue "symantec.com"

For www.google.com and mail.google.com I do not see DNS CAA record. Does above CAA record applies for all sub domains of google.com?

Can any other CA (apart from "symantec.com") that supports CAA would issue certificate for mail.google.com ?

Does above CAA record applies for all sub domains of google.com?

All subdomains that do not specify CAA records of their own.

See, for example, the example in section 3:

The following example is a DNS zone file (see [RFC1035]) that informs
CAs that certificates are not to be issued except by the holder of
the domain name 'ca.example.net' or an authorized agent thereof.
This policy applies to all subordinate domains under example.com.

$ORIGIN example.com
.       CAA 0 issue "ca.example.net"

And the lookup algorithm in section 4.

If, for example, mail.google.com had its own CAA record (it currently doesn't), that record would apply to requests for certificates for mail.google.com.

  Can any other CA (apart from "symantec.com") that supports CAA would issue certificate for mail.google.com ?

If their DNS queries are successful and they strictly follow the CAA policy, no. As it currently stands, few CAs implement CAA, and some consider CAA more what you'd call guidelines than actual rules, and flag certificates for extra scrutiny, but don't out and out reject issuance.

Regarding your specific example of mail.google.com, any halfway competent CA has google.com on its VIP list and flags requests for certificates, rejecting them outright or making doubly damn sure they're valid. It's very unlikely a random CA would misissue -- or issue at all -- a google.com certificate unless their validation systems were compromised or people had guns to their heads.