What does an OpenPGP signature consist of? I don't understand how OpenPGP signatures work. I have a picture which I want to sign, and a digital certificate which consists of my name and email address
and my public key. Additionally, a digital signature (hash of public key, name and address, encrypted with my private key).

This certificate is imported to my system and set as trusted.

Now I'm signing my picture (I'm using Kleopatra, but that does not matter). I open a picture and select my certificate. The program outputs a small picture.sig file to the  destination folder . What does this file contain? What I guess is that it contains a hash of the picture, which was encrypted by the private key. So comparing the hash of the picture and the decrypted signature will show whether the picture is what we think it is.

But the .sig file should also contain the entire certificate, or maybe a fingerprint of it. What does it contain? How does Kleopatra automatically choose the right certificate?

Moreover, if I export this certificate, remove it from system and then import it, it will be impossible to check the integrity of the file until I won't sign this imported certificate by one of my own certificates.

OpenPGP Signatures

  The program outputs a small picture.sig file to the destination folder. What does this file contain?

  [...]

  But the .sig file should also contain entire certificate, or maybe a fingerprint of it. What does it contain? How does Kleopatra automatically choose the right certificate?

OpenPGP signatures can contain the original document, or not. It seems, Kleopatra created a so-called detached signature without the original document (on the command line, this is created running gpg --detach --sign).

OpenPGP signatures are calculated on a hash of the document to be signed. Technically, a signature is the hash of the document encrypted using the private key, so it can be decrypted with the public key. Given decryption yields the correct hashsum, the file must have been signed by somebody with access to the private key (hopefully, the key's owner). Remember, regular encryption works the other way round: the message (or to be more specific, a session key for symmetric encryption) gets encrypted using the public key, and can only be decrypted using the private key.

Furthermore, OpenPGP signatures include several meta data, amongst them the signing key's long key ID (not fingerprint). The full certificate/public key is not included, and needs to be fetched (for example, from the key server network) based on this ID when not available locally.

You can view the signature file's contents using the commands gpg --list-packets and pgpdump, offering similar outputs. pgpdump shows some more details when used together with the -l option (prints literal data, the original message if available) and -i (prints the actual numbers being results of crypto operations). An example for a file signed using my own key:

Old: Signature Packet(tag 2)(540 bytes)
    Ver 4 - new
    Sig type - Signature of a binary document(0x00).
    Pub alg - RSA Encrypt or Sign(pub 1)
    Hash alg - SHA1(hash 2)
    Hashed Sub: signature creation time(sub 2)(4 bytes)
        Time - Wed Jan 27 16:36:30 CET 2016
    Sub: issuer key ID(sub 16)(8 bytes)
        Key ID - 0x8E78E44DFB1B55E9
    Hash left 2 bytes - 7d 3c
    RSA m^d mod n(4093 bits) - 18 1d d5 3f 6d f1 3e bb 93 08 8d 83 1a 3b a7 7a 70 56 f4 2c cb 92 cf a9 d1 f0 21 cd 7a f0 f8 5d 3e 75 46 d1 6a 14 56 27 a3 05 4a 6c 31 ee d4 8d 22 c6 d1 8a 41 6c 22 30 e4 90 19 1a 3f 18 ca 76 a3 1d d3 c1 f5 4a b7 54 9e 5f 83 dd 43 25 6b 80 66 65 34 36 80 4d 69 c7 fd 2a 3b 5b e8 a5 d8 c5 5a 26 a5 a8 19 b6 74 bc 47 69 e0 b7 a8 14 4b e7 51 5e e6 65 18 67 69 3e c8 5f 1b 78 8e f2 60 fa 15 a0 a0 be 7e 71 2f 68 19 07 af f7 d2 21 dc fb 3f f6 67 fd de eb ed c0 29 93 b7 59 5e 0a 35 1f 28 f4 89 51 43 a9 33 a9 f1 75 d6 6b 37 6b 3e a1 04 76 c5 43 b7 a8 05 3f 1a 08 b0 83 76 73 1e 61 78 e6 3b be 69 ca 60 93 5b e2 28 6c 53 65 63 ef 4b 06 df ce d4 81 47 ce 29 ea e3 06 a0 2a 13 30 98 00 8b 81 4d af 3d 5f 91 a0 26 e5 be 35 49 95 b3 7f 01 76 47 29 5e 8c 78 2b 22 c7 49 3a a1 b8 c5 48 ec 86 41 9b 34 65 a3 f1 3b f2 a4 8f 2c 2f 56 cd 72 86 42 7c 0d 08 51 8c 26 ee 91 1b 5a fc 6f 60 70 88 f8 d5 83 ea 89 c6 5c 13 0c 32 03 7b e2 82 50 77 f7 0d 2d 10 8c c9 95 05 b2 c7 99 ed 74 e4 46 75 95 00 6d d4 1b fc 4d 77 cf 7d f0 3f 1c 48 fa ab 8e 83 26 9c 09 e2 da e0 92 42 c6 8a df f6 3f 68 54 3a 02 49 d8 0a 1b 32 49 73 13 db 46 28 3a a1 aa 02 9a 9c cf 90 61 a5 ed 3f 7b 16 d3 64 1a cc 76 19 7e 84 62 ce 70 5a a7 cd be 40 28 72 f1 f0 16 7d fb 5a 84 69 d5 dc f9 f8 03 f7 5a ab a5 24 08 da a2 f3 14 1e e4 72 f9 62 72 d7 e0 52 07 b3 7c 1d 72 e5 6b 6f 43 9f 47 24 61 ab a3 c5 9a 6b c0 38 fb 8f 21 38 79 b5 2c 7f e8 1b 25 34 fd ce d5 2c e7 cd f8 57 43 b6 68 47 76 9e 03 70 f5 1e 30 21 83 12 bf fc d4 44 b9 dd 05 fc a0 2b f1 c0 56 3b 92 af 97 08 16 95 01 0d 12 c2
        -> PKCS-1

Trust

  Moreover, if I export this certificate, remove it from system and then import it; it will be impossible to check integrity of file until I won't sign this imported certificate by one of my own certificates.

This is another issue considering trust, and you have to discriminate between two operations: verifying a signature (in terms the signature was issued by a giving key, and the document was not tampered with) versus validating it (whether the key is trusted, based on certifications). As soon as the public key is available, you can very well test whether the signature was issued by this key (with other words, decrypt the hash with the public key and compare it), but you do not necessarily have the required information on whether to trust the key or not. One way to do so is comparing the key's fingerprint with the other party, and issuing a certification.


Checking Browser Agent String for application security I have recently come across some logs in my application where I have seen the user's browser agent info being switched. Even if the user is using the same browser, the agent info has been modified for consecutive requests.

For example, a request from the user came from

Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0)

But the user hasn't changed his/her browser, and the browser info was:

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0)

If I cannot even rely on the browser agent info, what is the ideal way to confirm that the browser agent has/hasn't been changed?

Problem I am trying to solve

Session fixation problem - I am trying to detect when a user does the following:

1) Grabs request headers belonging to an authenticated session.
2) Goes to another computer in a different location (e.g. different computer/browser).
3) Fires a new request with the same headers from the authenticated session and receives a successful response with resources (e.g. file/page with private data).

I originally tried to solve it with IP address and Browser agent checks - but I realised that due to NAT switching IP address check is totally impractical. Now it looks like browser-agent check is also not good.

Don't use the user agent for security purposes.

It's not reliable and easy to change. As others noted, every browser can set the user agent to an arbitrary value. It's just an information header that you may decide to send.
It's not private and easily predictable. There are lists of the most common user agents. So an attacker can either make educated guesses or lure the victim on an own site to log the user agent string and use the obtained value.

The problem you describe is also not a session fixation vulnerability. It's acceptable behavior that the same authenticated request works from different locations. For example, when logged in on Github you could extract the user_session cookie from one browser and simply use it on another machine. Since an attacker doesn't easily get access to your browser's cookie jar, this is not a general security problem.


What preparation do I need to fullfil for OSCP? I am new to this whole Offensive Security field. Also I have not spent much time in IT. 6 months back I started running behind Offensive Security & started studying.

First I studied for C|EH and got some concepts clear. I wish to signup for OSCP & will be my first certification exam. But some confusions in mind about preparation. I have studied CCNA fully, not good in server Admin side. I know C and C++. I am learning RHCE for Linux preparation, Python also.

What do you guys recommend me to do right now. Do OSCP guys teach everything from scratch? Or first I have to do self study everything and then sign the course?

What self study resources are recommended?

Edit: I'm an OSCP now, and you can read my review here, but to briefly answer your question.

OSCP is nothing like C|EH, SSCP or any of the other courses I know that are out there. It is extremely practical and leaves tons of opportunities for further research and development on your own.

If you're looking to learn something new or establish ground in I.T. Security, the PWB course is awesome. It teaches you the ropes, but leaves you to climb them ;D.

Generally a 60 day course period is recommended if you can dedicate 3-4 hours daily, or 30 days if you have prior knowledge or can go 8 hours a day consistently.

Rather than another accolade the course is meant you teach you know to deliver offensive security at a practical level, not only in theory. You take this course and there will be countless times you will be frustrated, bogged down, discouraged, but you have to keep going and as they say "try harder".
The labs are not difficult, they're challenging. But the high you get when you break through the obstacles is worth it and the cost.

If you're doing it as a cert. then it'll be disappointing, if you're doing it to learn, welcome to the lot.

The course doesn't have any major prerequisites as they teach the basics from ground up. This is what I feel you'll need:

Knowledge about TCP/IP
Linux Usage & Navigation
Basic understanding of exploits and payloads in Info. Sec.
Basic Scripting/Programming Knowledge Helps
...and the most important, determination.

Good luck.

Further Research References:

http://proactivedefender.blogspot.in/2012/01/oscp-my-review.html
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/board,58.0/


Is there any real-world use of IPsec modes other than ESP tunnel? Tunnel mode ESP (encapsulated in UDP so that it can traverse IPv4 NAT) is used as the basic building block of most of the modern VPNs that I've used and studied. In it, packets are encrypted and authenticated so that neither the headers nor the payload can be inspected or altered in transit.

The IPsec standards (RFC4301 etc.) also define several other modes of operation—which offer only a subset of end-to-end encryption and authentication:

ESP transport mode, in which headers and routing information are left intact but packet payloads are still encrypted
Authentication headers (AH) in which there is no encryption at all, but headers are authenticated so that they cannot be altered without detection.

What I'm wondering is whether there is any significant real-world usage of these less-than-fully encrypted and authenticated modes of IPsec, as of 2017.

Are there current, or historical, applications that actually benefit from the partial transparency of the traffic carried?

Any specific proprietary or open-source software that could be cited?

ESP / tunnel mode is often used when you want to connect two different POPs' networks together: you're basically implementing a full network and routing layer on top of an encryption layer, and the networks have zero knowledge that they crossed a public network (like the internet). When you simply want to encrypt everything between two endpoints without a routing layer (usually when those two endpoints want to talk to each other, but not networks behind them) it's burdensome to create an additional routing layer.

Transport mode is used all the time between two endpoints when a full tunnel with separate routing and networking is not required. This is somewhat analogous to when you create an TLS connection between your computer and a website; you don't care that someone can see traffic between the two of you, but you do want it encrypted.

Transport mode is roughly the equivalent of a TLS connection to your bank's website, while tunnel mode is roughly the equivalent of using a VPN client to connect to your employer's internal network. There are exceptions, of course, but that's the general gist of it.

Example: say you have two machines with public IPs and you want them to make RPC calls to each other. You obviously don't want them to communicate over the internet with no encryption or authentication. You could do it via TLS (layer 7), but you may as well do it via IPsec transport (layer 4), as that removes the burden of encryption on any software you're using; this is especially important if that software has no understanding of TLS at all. With transport mode everything between the two machines is encrypted, from ping requests to telnet to any random traffic you open between the two.

Now you COULD do this over an ESP tunnel, but 1) this requires all your software to be aware of the new routing endpoints, IPs, and gateways, rather than the public IPs that already exist and 2) it's less efficient, as now you have the encrypted traffic plus additional tunnel-wrap overhead.

As for AH, I've rarely seen it implemented, as its primary purpose is to verify any payloads arrive unchanged from the source. The situations where you care about verification but not encryption are fairly small and often better served with full encryption anyway, but theoretical places where it would be used would include things like anti-virus/malware being injected by third parties in transit but where full encryption might be too costly for the hardware on hand. Again, these are very niche applications.


How to crack AES-based Kerberos TGS tickets (Kerberoasting)? All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password.

However, I want to attempt to crack AES-based Kerberos TGS tickets using a short wordlist.

Looking at Hashcat, it only supports etype23, which is rc4-hmac (deprecated)

Kerberos Parameters

Anyone with experience?

TYPE: Kerberos 5 TGS-REP etype 23
HASH: $krb5tgs$23$*user$realm$test/spn*$b548e10f5694ae018d7ad63c257af7dc$35e8e45658860bc31a859b41a08989265f4ef8afd75652
ab4d7a30ef151bf6350d879ae189a8cb769e01fa573c6315232b37e4bcad9105520640a781e5fd85c09615e78267e494f433f067cc6958200a82f70
627ce0eebc2ac445729c2a8a0255dc3ede2c4973d2d93ac8c1a56b26444df300cb93045d05ff2326affaa3ae97f5cd866c14b78a459f0933a550e0b
6507bf8af27c2391ef69fbdd649dd059a4b9ae2440edd96c82479645ccdb06bae0eead3b7f639178a90cf24d9a

https://github.com/hashcat/hashcat/pull/1955
Looks like Support has been added, but may not be reflected in the release yet.

https://twitter.com/hashcat/status/1105909927825104896


What problem does DNSSEC solve? I have read through the questions tagged DNSSEC on this site, and over the years you hear statistics about DNSSEC adoption and about organizations enabling it on their domains... but nobody mentions what they are actually trying to solve. Well, that it "signs DNS responses", but that's a method and not a goal.

"IP spoofing will no longer be possible," tech news will write when the topic comes up. Or "DNSSEC allows domain name owners to sign their DNS records" howtogeek writes. Yet if I, as an attacker, could spoof a DNS response, I am probably a in the middle with apparent read/write-access to the connection, allowing me to modify the contents regardless. Or if someone uses HTTPS, it does not matter whether I can spoof the IP address because I don't have a matching CA-signed certificate.

It doesn't even make sense that domain owners can sign their DNS records, because how would the public keys (used to sign the data) ever end up with the DNS clients? Beyond it seeming hugely inefficient to bloat each DNS response, if you combine the public key with the signed data, it's an easy operation to swap out the public key along with the signature.

An attack that is supposedly thwarted by DNSSEC is DNS cache poisoning, but wasn't that a solved problem by having recursive resolvers use randomized source ports?

Additionally, I heard from my ISP (Dutch) today that they are enabling it. Wasn't it the domain owners that signed the records? Moreover, I also read of the SIDN (owner of the Dutch TLD .nl) that they enabled it a while ago. They even have a counter on their homepage counting the number of DNSSEC-enabled domains. Some registrars (e.g. TransIP) enabled it as well. Who is signing these things: the domain owners, registrars or TLDs?

Lastly, not everything is signed. It seems that some domains have DNSSEC enabled and some don't (even if they're both from the same top level domain). How will a client ever know whether it was supposed to be signed? It seems like an easy attack to just strip out the signature when spoofing a response.

Could someone explain:

what is the goal of DNSSEC?
who has to have it enabled in order for it to work?
who signs a domain?
how can clients detect a signature being removed?

1. What is the goal of DNSSEC?

DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity.

The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and registrars sign the DNS records that you (probably) put in via their web interface.[2]

You can also have them sign your keys so that you can maintain a signed zone yourself.[3]

DNSSEC exists of fields added to domains, so it's not something that works for every website after you turn it on for your computer. If a registrar does not support it, or if a TLD does not support it, your computer just cannot verify the authenticity of the records of the domain you're querying.

2. Who has to have it enabled in order for it to work?

We've already covered the root, the TLD of your choice and the registrar. Now ISPs or other recursive resolvers (e.g. OpenDNS) can also have it enabled or not. Having it enabled means their resolvers will check signatures and return an error code if the validation fails.[4]

The user's client also has to have something enabled in order for it to work: if your client (e.g. Firefox) does not alert on an invalid signature, the signatures will never add any value.[5]

3. Who signs a domain?

The registrar either signs your records or the key with which you sign your records. So you trust the registrar. If you don't trust the registrar, you will have to get a different one. And you trust the TLD, since they could just sign it with any key they like (since they can sign registrar's keys). And you trust the root for the same reason.

4. How can clients detect a signature being removed?

If someone removes the signature, presumably to modify records without triggering a signature validation error, it might appear that the domain simply does not have DNSSEC enabled. However, the parent signer (the TLD) will have mentioned that DNSSEC should have been enabled for the domain, and the TLD's response is signed so cannot be forged.[6]

So what if we remove the TLD's signature as well? Alright, then the root will tell us (with signature) that the TLD should have had it enabled.

If the root is trustworthy, and the root only signs legitimate TLDs, and the TLD is trustworthy, and the TLD only signs registrars, and the registrar is trustworthy, then you can be sure the signed records came directly from the domain owners.

5. Bonus: Does DNSSEC have any issues of its own?

It makes responses bigger (not a security but a performance issue) and helps domain enumeration.

Domain enumeration is made possible because of the way they solved NXDOMAIN signing. Signing is meant to be done offline so name servers don't have to sign things on the fly. But how do you sign a response, in advance, for something that doesn't exist? By signing a response that says "between ftp.example.com. and mail.example.com. there are no other records" and returning that when anyone asks for something like jkl.example.com.[1]

Now to enumerate, you start with aaaa.example.com. and it will tell you the first record, like ftp.example.com. Then you request ftq.example.com (one character incremented) and it will give you the next record.

This was solved by hashing the names and going "between hashes a8fba8[...] and da8a8bfdf[...] there are no other records". This is called NSEC3.[8] This still allows for hash enumeration and then offline cracking the hashes, which is orders of magnitudes faster and stealthier than guessing by querying the name servers.[9]

It's an ongoing discussion whether it's an issue that names can be enumerated. The people who design DNSSEC typically say that the DNS system was supposed to be a public phone book; the people who deploy DNS servers typically prefer to keep their phone book private.[7]

[1] https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Zone_enumeration_issue.2C_controversy.2C_and_NSEC3

[2] https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Operation

[3] "you tell your registrar your signing key's fingerprint by creating a DS record" https://security.stackexchange.com/a/11571/10863

[4] "they enable their DNS resolvers (which you use to translate fancy domain names into IP addresses) to verify DNSSEC. So from now on, if you ask your ISP for the IP for a domain and the signature is invalid, you will get an error instead of the wrong IP." security.stackexchange.com/questions/142604/what-problem-does-dnssec-solve?noredirect=1#comment267595_142626

[5] "It's up to the client to prefer (or alert) on non-signed responses, just like TLS on a web browser." security.stackexchange.com/questions/142604/what-problem-does-dnssec-solve?noredirect=1#comment267602_142604

[6] https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Recursive_name_servers "If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on"

[7] https://security.stackexchange.com/a/11571/10863 "DNS (and DNSSec) was designed largely by folks in the first camp; [...] the servers tend to be run by people in the second camp"

[8] https://security.stackexchange.com/a/126518/10863

[9] https://dnscurve.org/nsec3walker.html See "Future work"


Database compromised and some passwords cracked I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people downloaded

By the time I realized that happened, I forced a password change on all users and I immediately changed my database password

The passwords were encrypted with SHA1 and as I realized some users got hacked (so I'm guessing their passwords were cracked) after asking the users who got hacked about what their passwords were, they were mostly numerical passwords which were cracked. The accounts that got hacked did ingame actions that affect the whole gameplay and thus I'm forced to restore my latest backup of the database (which is also the database the hackers have)

Now, once I do that. The passwords for the users would have stayed the same (the ones that were cracked) so I was wondering how would I be able to restore my database backup and also ensure that the users are secure

I thought of generating random passwords for each users + salt and emailing them their new password, so they have a new password which the hackers do not have, and after they login they will also be forced to change it. Would that be best practice? Does anyone have a better idea?

Generating random passwords and sending them to users is fine. But the most important thing to do, if not already done, is to warn ALL users that their passwords have been compromised and if they are using the same on whatever other website/app they absolutely have to change it.


Why can't Windows 98/IE5 connect to HTTPS sites in 2015? Recently I found an old installation CD for Windows 98 Second Edition, and looking for a bit of a nostalgia kick, I installed it inside VirtualBox. Win98SE shipped with IE 5.0, and browsing the web with that browser was as broken an experience as you might imagine.

I noticed that, no matter what I tried, I could not get IE to connect to any, any HTTPS site. And it got me wondering why that was. Are all the trusted CA certificates it shipped with expired? Were all the default TLS/SSL algorithms phased out over the last 16 years? Did it need the IE High Encryption Pack (wow, it's been forever since I've thought about that).

I'm curious if this would affect other operating systems of that era (Mandrake 6!) or if the core issue is somehow Windows-specific.

The main problem is probably that an IE from that era would like to support SSL 2.0, and, therefore, sends its initial message (ClientHello) in SSL 2.0 format, which has about nothing in common with the ClientHello of later protocol versions (SSL 3.0 and all TLS versions). That allowed the browser to connect to a server that knew SSL 2.0 but nothing else, while the ClientHello still documents that the client is ready to use something more modern.

However, modern servers no longer support the SSL-2.0 ClientHello format. There has been a transitory period during which they still accepted that format (even though they would not allow the connection to actually use SSL 2.0), but now they dropped the support altogether. Notably, the SSL-2.0 ClientHello format has no room for extensions like SNI, which explains the urge to drop such support.

Other issues include the following:

IE 6.0 supports TLS 1.0 but it is deactivated by default. I don't know if IE 5 would have supported TLS 1.0, but in any case it would not have been enabled by default. However, many modern server reject SSL 3.0 as well (because of POODLE, as was noted by @etherealflux).
The client code will know nothing of AES, since it dates from before the standardization of that algorithm. It will try to use cipher suites based on RC2, 3DES, possibly RC4 (this would require some verification because RC4 was the property of IE's nemesis, Netscape, so possibly IE 5 would not use it). These algorithms are not a lot popular among server admins nowadays...
Modern sites use rather large cryptographic keys. Typically, RSA with keys of at least 2048 bits. An old Windows+IE might be more limited in the size of RSA keys that it can handle. In particular, a Windows+IE that would comply with the US export rules on cryptography of the pre-2000 era could be limited to a maximum size of 1024 bits for RSA keys. The same combination would also refuse to use 3DES or anything with a symmetric key larger than 56 bits, while no decent server of 2015 would accept anything less than 128 bits.

For Linux-based systems, there is no central SSL implementation (there is often an OpenSSL library, but not something as pervasive as Microsoft's SChannel and CryptoAPI). So every browser will have its own rules. Before 2000, this would have mean Nestcape Navigator (the one that segfaults when it sees anything in UTF-8...). Maybe some early KDE-based browser could do some SSL ? In that case, it would probably use OpenSSL and that should still be able to connect to some servers, with the right configuration (in particular if avoiding SSL-2.0 format for the ClientHello).


Will hashing a password, and then splitting it into multiple db fields increase security? I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right."

I'm curious about the possibility of storing a split of a Hashed password in multiple user fields.  Meaning hash the password first, then split, as it seems splitting a plain-text password, making it's length smaller, then hashing, will weaken security.

Lets say I have  a password field, an then another field somewhere else in the table that's also hashed.  When trying to see if the entered password is the same, could I take the 2 hashed values that were split, combine them, and see if that equals the entered one?  Granted, I would like to hash a lot of values in my DB, so having a random "hashed value" wouldn't seem suspicious in this case.

  Example

  Field Password: SA234j23kljfs

  Other field : 23lkj4as89dfADk

  User password: SA234j23kljfs23lkj4as89dfADk

I also am curious if I could append data to the fields in order to confuse an attacker even more. I believe this would be a form of SALT?

  Example

  Field Password: SA234j23kljfs|dSl92slC3lD29

  Other field : 23lkj4as89dfADk|298fskASDlk2sl

  then split the extra data behind |

  (Note that | is there just as a placeholder for this example and it would be split would some sort of logic to split correctly).

  User password: SA234j23kljfs23lkj4as89dfADk

Is there anything wrong with either of these approaches?  I surely feel that this would be a problem for any attacker.

EDIT:  I decided to edit some details and explain better/give better examples of what I'm trying to do.

It seems that a lot of the answers had to do with splitting the plain-text, and then hashing each piece, instead of hashing everything, then splitting...

I understand why splitting then hashing is a risk, but why would splitting an already hashed password, be the same?

From what I've read, hashes aren't supposed to have any relevance to each other so "hello" and "world" hashes put together, should not be "helloworld" hashed, or is this wrong?

Thanks.

This would make the password LESS secure.

Consider a 16-character password made up of a sequence of randomly chosen letters, numbers, and symbols. By itself, this password is basically "uncrackable" for all intents and purposes, even if your password database is leaked, assuming you hash the password. You could probably even use something stupid like MD5 and be OK against most attackers. Assuming a trillion password guesses per second, it would still take millions of years to crack this one password.

But now, we apply your storage method. Assume you take the first 8 characters and hashed them in one field, then take the next 8 characters and hash them for the next field.

Now you have two 8-character passwords. Each password can be cracked individually in a few minutes to a few hours, depending on the hash you use, if your password database is ever leaked, just by trying every possible sequence of 8 characters.

Assume no help at all from the fact that the password is "hiding" in two different fields. At best, you have security through obscurity; you're relying on the fact that the attacker may not know which fields to combine together. At worst, the attacker who manages to steal your password database, will also manage to steal the website code, and will know immediately which fields to grab. A basic tenet of information security is to always assume the attacker knows how your system works, and make sure the system will remain secure despite that knowledge.


Why should small and medium-sized businesses care about security? Pretext

I'm not a security expert, just a web dev with an interest in "security".
I've been tasked by my employer with giving an internal talk on security (specifically web application security) and why it is important for SMBs.

Reflecting on my motivation, I've realised this particular subject interests me because:

I find the technical aspect fascinating
It's the right thing to do
I don't wanna get pwned (professional dignity)

Which is all fine and dandy, but not something the board will be terribly impressed with. Consequently, the talk should focus on the business impact of security for SMBs.

I've been thinking about incorporating some often-heard arguments:

"Security is only for the financial/medical/insurance sectors"
"We are too small to get noticed by hackers"
"There's nothing to get from us – our data is not interesting"
"We don't store credit card data or anything sensible"
"Even if an account gets hacked, there really isn't anything you can do with it"
"I don't think anybody's interested in what User X has been doing on our platform"
"There is no business value in security"
"We need to focus on implementing new features for our users instead"
"We are lean, and code that doesn't make money is waste"
"If we make this too complicated, the users will go to our competitors instead"
"Adobe has been hacked and people still love them"
"The probability of this ever happening is so low, we can't justify spending any resources on it."

Some of these may be silly, but others raising the question of the business value of security, are perfectly valid. Unfortuately, these are the the hard ones for me to answer, because frankly I do not know the answer.
I feel like I can google this until the cows come home and still don't get anything other than sales pitches and platitudes like "Your website is your virtual business card and you want to make a good impression."

Some notes I have made so far:

Small businesses are in fact targeted quite a lot, because they are "low hanging fruits"
An attacker might not even know your business, e.g. if malware is installed with a dependency manager
All data is interesting if you have a purpose
Attackers don't care about your platform and very likely they don't care what the user has been doing on that platform. They are interested in the user data stored (PII, plaintext or poorly hashed credentials, e-mai addresses etc.)
Attack vectors might include several targets and your platform might be just one small piece in a larger plan
Compliance with lawmakers and potential business partners
The business value of security can be quantified after a breach has happened (e.g. number of customers lost)
"Lean" comes from the automotive industry and they have a lot of regulations to follow
Security as a differentiator (stand out & build trust with customers)

TL;DR – Actual Questions

I'm not expecting anyone to address all these questions. Just looking for some input, and perhaps some pointers in the right direction.
The talk won't happen before Q3 2019, so there's still some time to do research.

The big question in need of an answer is "Why should SMBs care about (application) security?"
Is security, at the end of the day, simply risk management?

Every business, no matter what it does or how big it is, runs on information
Information has value to the business, so the business needs to protect the availability and integrity of that information
Information has value to others; your customers, your employees, your business partners, and has value to others who can exploit it for their own gain, so that information needs to be protected so that people cannot use it to cause harm
Every business needs to ensure that information is used in the right ways at the right time so that customers, employees, and partners get the benefit they need

These four points mean that there needs to be processes and training in place to make sure that the maximum benefit is derived from information and the minimum impact is experienced when something goes wrong. We call this "information security". Information security is not about technology and it is not about "hackers". It's about the proper handling of information for the life of the information and the business.

Information security processes are not new. Businesses of every size need to handle all assets in the same way. In fact, you can replace the word "information" with "asset" in the four points above, and businesses will not be surprised. Information is as important as assets to a business because information is the most important asset.


What are the security challenges encountered with attribute exchange? OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.

What are the security challenges that these services face?

At the end of the day the client (usually a browser) still needs a token to maintain a session (usually with a cookie variable).   If the attacker gets this token,  by XSS or OWASP A9 then they can access the same resources.  CSRF is also a concern.

Now this is assuming that these authentication providers are totally immune from attack.  If a flaw exists in one of these services,  you are also in trouble.   SQL Injection,  Phishing, Insecure backups,  lack of brute force protection are just a few concerns.

oauzz is an oauth fuzzer,  which can uncover serious flaws in an oauth implementation.


Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm? For example: a 10 MB file will be sliced to 10 pieces (each 1 MB) and then dispersed between network nodes. Each node will encrypt it with its own key and different algorithm (AES, TwoFish, Blowfish, DES, 3DES, ... ).
(without using Rabin's ida or Shamir's secret sharing and so on).
Only slicing in a simple way and then encrypting with different key and algorithm. (Key size is not important).
Assuming that there is no resource limitation, would this be helpful? Does it increase security? Does it have equal security if encrypted it with one key and one algorithm without slicing?
In this case: which one is more important, splitting data between nodes or different algorithms/keys?

It depends what you're worried about, and what you are really trying to protect.

If each of these slices is individually important (say a 1 MB list of credit cards), then you're basically just encrypting each chunk by itself. The total strength of protection for each chunk is just the size of the key you used for that chunk (modulo strength/weakness of the algorithm used).
Regarding that last point - swapping around the encryption algorithms does not add any protection, you will still be only as strong (or as weak) as the algorithm you use for that chunk.

Likewise, if a breach of confidentiality of ANY CHUNK is gameover to you (i.e. the attacker only needs to break any one chunk, and once he does so he is not interested in the rest. E.g. a list of usable entry codes, the attacker only needs one) - then the total protection is the strength of the SHORTEST key used - and/or the WEAKEST algorithm of any of the nodes.
So unless all your nodes are using the same strong algorithm and the same keysize, you would be effectively weakening the solution.

On the other hand, if the only risk you are worried about is theft of ALL the chunks (e.g. even 9 out of 10 chunks stolen is not a threat) - then, assuming all the nodes are using the same strong algorithm (e.g. AES), the total protection achieved is the SUM of all the keysizes. (e.g. 10 x 256 bits).
In this specific scenario, it seems like you did achieve in overall improvement, since the attacker would need to brute force 10 keys of 256 bits, instead of just one.

However.
Even if that was the case, you would achieve the same affect by just using a longer key, or cycling keys on the whole batch.
I won't even try to get into the mathy parts of cryptanalysis, if that would make it overall easier...

Since when it comes down to it, if you're using a proper strong algorithm, like AES, and a long enough key, brute force has already become irrelevant, so any possible increase in strength would be academic, with only a possible downside to this complicated solution. (At the very least, complexity is the last thing you want in your cryptosystem).

TL;DR:
Don't bother splitting it up.
In most cases it is directly worse.
In other cases, even if hypothetically there were any benefits, they would be irrelevant and come at a high cost.


Are complex passwords necessary in web applications? If there is a web application that holds important data, how important is it to use a complex/long/secure passphrase?

When I use for example something like "applefreezer" as password for my admin account in a forum, one would say that its not very secure. No special characters, not long enough, predictable words and combinations. And of course, I would never use this with an important encrypted piece of hardware.

But if I know, that a web application is programmed to prevent brute force attacks and even password lists, why should I need a passphrase that withstands these kind of attacks?

One reason might be, that someone could crack the password when he/she hacks data from my database. But honestly, if someone hacks the server, the password is senseless anyway. Of course, its important then that its not reused in other applications.

TL;DR do I need complex passwords for applications that prevent bruteforce/list attacks?

Assuming that you have every popular brute-force prevention technique in place. You are still a web service that serves users. So, you must allow some leeway in login procedures.
Now, login brute force attacks are most likely to be targeted at high-value targets so an attacker would probably be committed to compromising your account.

Assuming an attacker can try 10 passwords every hour (Probably stricter that any regular web service), it is still possible to try 7200 passwords per month from a single attacking endpoint. Now consider a dedicated attacker with more than one computer attempting to log in to your account.

This makes passwords such as applefreezer that would be close to the top of password lists, somewhat vulnerable. Depending on the value one would assign to his/her account on that specific web service, that may be tolerable or not.

So there are reasons why strong passwords should be used anywhere, no matter the other defenses. But if you are not a high value target then yes, brute force mitigating techniques are a pretty solid defense, even with a weak password.

TL;DR: You are right, brute force mitigations are enough to allow you to use a weak password. But since brute force is usually targeted at high value targets, an attacker will be patient enough to try long enough and break weak passwords.


Password list generation I've found during a lot of recent pen-tests that companies will use passwords like

c0mp4ny@b(

for a company called "company abc"
Is there any quick and easy way to generate a list of passwords based on as many possible 'leet speak' letters?
So the input would be

company abc

and the ouput would be

c0mpanyabc
c0mpany4bc
C0mpany4bc1
etc....

Where permutations of caps, underscores, added num/special chars at the end etc are all generated?

I crafted an answer using Javascript, because it's what I am used to and no language is specified. I am confident that you can find/create an analog in whatever other language you please.

First off, I stole a function from This answer to create a cartesian product. The explanation of cartesian products is not really in the scope of this question, but suffice to say it combines arrays of possible characters into arrays of possible strings (very oversimplified).

OK, so ckozl's function is :

function cartProd(paramArray) {

  function addTo(curr, args) {

    var i, copy,
        rest = args.slice(1),
        last = !rest.length,
        result = [];

    for (i = 0; i < args[0].length; i++) {

      copy = curr.slice();
      copy.push(args[0][i]);

      if (last) {
        result.push(copy);

      } else {
        result = result.concat(addTo(copy, rest));
      }
    }

    return result;
  }

  return addTo([], Array.prototype.slice.call(paramArray));
}

and mine is :

function findSubs(string) {
        //create a linked list of sub characters
        //expect lower case input
        subs={
                "p":["p","P"],
                "a":["a","A","4","@"],
                "s":["s","S","$","5"]
        }
        //create an (initially empty) array to store possible characters in each position
        result=[]
        for (var i=0;i<string.length;i++) {
                result[i]=subs[string.charAt(i)]; //Would be more robust if you added logic here to handle it not being a key in the subs object.
        }
        /*
        so result might look like:
        [
                ["p","P"],
                ["a","A","4","@"],
                ["s","S","$","5"],
                ["s","S","$","5"]
        ]
        for an input of "pass"
        */
        return cartProd(result)
}

Honestly, ckzol's function does all the heavy lifting here. You would need to flesh out the subs array before use, and this does not handle adding characters at the end of the string (because it seems kind of arbitrary).

Also note I have ever so slightly modified the cartProd function, such that we can hand it an array of arrays as input params rather than multiple arrays overloading the arguments.

Edit: also note that the returned value is an array of arrays, so you would want to iterate through it and for each element e do e.join("").

Edit again: also note that you could easily extend this to apply other mutations to the password. For instance, if you wanted to add a number between 0 and 99 to the end of the string you could push an extra array onto the end of result, containing ["0","1","2",...,"99"]. You could include an empty element ("") in this array to also output possibilities not including the number suffix. The same logic could be used to add a prefix. Essentially you are building an array of arrays of possible characters in the result array, so you can include any mutations you can think of.


How can antiviruses protect our computers if virus maker checks them with antiviruses? I would like to know if we can really trust antiviruses because virus makers check their virus with antiviruses before releasing them. So how can we place our confidence in antiviruses?

Because we know that the antivirus can detect what it was tested to detect.
There is no "silver bullet" in security. There is no one thing that will magically protect everyone from everything in the future. Security is about reducing risks and defending against specific threats.
And eventually, the antivirus makers will be able to detect the new virus. So, really, all you are worried about is the window of time where the new virus is released and when the antivirus starts to detect it. And since no virus can hit all computers at once when it is first released, you also get a reduction in risk by the fact that the chances are low that you will ever see a truly new and novel virus that your antivirus will not detect.


Is an outdated library in a Windows user mode desktop application an actual security risk? I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example:
This application uses libxml2 as a DLL distributed in the application directory (as is "usual" on Windows). The libxml2 version used is somewhat dated, but it covers the use cases of the app.
Obviously, libxml2 has it's list of CVEs, but the question I'm asking is: does any of this matter?
There doesn't seem to be an attack vector, other than crashing the app itself (locally), by exploiting any security vulnerabilities of such a library.
So what's the answer if someone claims: "You application is insecure because it uses XYZ!!" when all I do is use XYZ in a local user mode app?
This is not just theoretical: It costs to keep all dependencies up to date in new builds. Users need to be advised if they need to update based on these factors.

... it does not "talk to the internet ...

There is a difference between does not usually talk to the internet or is not able to talk to the internet. As long as the application is not somehow sandboxed or firewalled some exploit can likely make the application talk to the internet.

... this application is a local tool only ...

Just because it runs locally does not mean it does not process data originating from untrusted sources. Even if it does not retrieve the data itself, it might be confronted with such data. Thus the impact of the vulnerability depends on the actual use case, which is unknown.
If the application processes only data fully generated by yourself then there is likely no problem. If instead you feed data into the application from potentially untrusted sources or if the generated data include data from untrusted sources without proper sanitization then there might be a problem, since you no longer have full control over the data.
Note also that the application might be associated with specific file extensions, in which case calling the application with untrusted input might be done by accident.


Does Yubikey 4 support multiple OpenPGP encryption keys or only one? When my OpenPGP encryption key expires, and I want to generate a new one, can I keep the old one on my Yubikey 4, or will I have to reencrypt all of my encrypted files/emails with the new key?  If I do have to reencrypt everything to the new key, is there documentation on how to do this?

Note that I am using a key that is generated directly on the device itself, so that it is more secure.

Then OpenPGP smart card standard explicitly reserves each slot to the respective usage. If you use the Yubikey as OpenPGP smart card (so it can be used with GnuPG, ...), you will not be able to upload keys to "incompatible" slots.

I just tried to upload a signing key to my card/Yubikey (which just holds an authentication key up to now), and was only able to choose among the signing and authentication slots (the encryption slot was not offered).


Insecure Direct Object Reference - Change email from client end I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be triggered to that Address. As an end user, I can change the hyperlink using Chrome developer tools to point to some other valid email address and trigger password reset to that user. Should I flag this issue? What are the implications this issue might have?

No, this is normal behavior. Because the reset password email is sent to that user, only the owner of the email address can reset the password. So even though you can trigger the email to be sent, it is not possible to actually reset the password of another user since you don't have access to the link in the email. Most sites work this way, where you can enter a username or email address to request a password reset for.

However, if the password reset functionality makes it possible to bypass two factor authentication, it is a serious issue. If a user has SMS tokens as second factor and the application also allows password reset through SMS, having access to SMS messages gives total access to the account.


Authentication by Signing or MAC? I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send to a variety of approved recipients. I know I should also use some sort of authentication mechanism so the recipient can verify the integrity of the original message, but I'm not sure how best to go about doing this. It seems that I can do this by prepending a MAC of the message to the message. How is signing the message with a CA signed certificate different? Do they accomplish the same thing or are they used for different use cases entirely? Does this change if I use AES-256-GCM instead?

The main difference between a MAC and a digital signature is that with a MAC, the same key is used to generate the MAC value and to verify it; whereas with a signature, distinct keys are used. In a signature, the generation key and the verification key are mathematically linked together, but it is not feasible to recompute the generation key from the verification key -- which is why the verification key can be made public while the generation key is kept private.

Signatures are for asymmetric situations, where the people who can verify signatures should not be given the power to generate signatures. If this feature is not needed in your system, then a MAC will be simpler.

Combining MAC and encryption, or a signature and encryption, is not easy (you can easily do something which works, but not easily do something which is secure). So you are encouraged to rely on an already thought-out protocol which does the job -- especially if you are "new to security". For synchronous data transfers, use SSL/TLS. For asynchronous communications (such as emails), use OpenPGP. Opensource implementations of both already exist in many languages. The protocol which is easiest to design and implement securely is the protocol which has already been designed and securely implemented by someone else.


Can a file contain its md5sum inside it? Just wondering if it is possible to create a file which has its md5sum inside it along with other contents too.

Consider this: you create a file that contains every member of the set of 16-byte sequences. An MD5 checksum is a 16-byte sequence, so by definition this file contains its own MD5 checksum. Somewhere.


Ensure data doesn't linger after being deleted I'm trying to make a service that keeps as little data on its users as possible. To that end, I want to make sure that someone using forensic tools won't gain any more information than I would by looking at my database or filesystem. In other words, you shouldn't be able to go through my hard drive with a hex editor and find a message that a user deleted yesterday.

Measures I've taken already:

I delete logfiles with identifying info within 30 minutes. I have swap turned off. I have /tmp, /home, /root, and /var/log mounted on a RAM-disk. I've removed rm, and put a hardlink to srm in its place.

I have a hard drive that does not reallocate blocks, unless there is a bad sector.

Problems with my system currently:

If a sensitive file is modified and made smaller, that will (AFAIK) deallocate a sector, which will then not be shredded, even if srm is called on the file.
Changing rm does nothing for programs that call unlink directly.
I have rows in MySQL that contain sensitive data. I delete those rows, but I'm concerned that MySQL keeps them around somehow.
Edit: It appears that SQLite has a config setting called secure_delete. I'll use SQLite instead.

Possible improvements:

Set the chattr attribute s (secure deletion) I don't have this set now because the chattr manual says that ext2/3/4 ignores this flag. I found conflicting information about whether ext4 supports it. Which filesystems respect it?
Wipe free space. Seems like kind of a sledgehammer approach, but I can't figure out a way to solve #1 otherwise. Also, the ways I've seen for doing this involve making a really big file, then deleting it. I'm concerned that it might make a program crash when this system is almost out of space.
I could make text backups of the MySQL database (which definitely don't contain the deleted rows) delete the originals, then restore them.
Switch to a different SQL daemon?
Reboot to clear the RAM disk. However, I don't want frequent downtime. Also, it wouldn't do anything to clear out data lingering on the hard drive.

What's the best way to fix these three two problems? I'm currently using Arch Linux with ext3 and MySQL SQLite. I'm willing to change out any of those.

Thanks for your attention!

Destroying data properly without physically damaging the media is quite a difficult task, especially since HDDs have started coming with block reallocations. This is orders of magnitude more difficult (if not impossible) with SSDs, since there the firmware does literally magic with what is really stored in the flash. As my comment asking for more detailed information about your setup went without an answer, let's assume an SSD is involved.

Since you can't really destroy the data, the next best thing is making them inaccessible. Which is what encryption is usually rather good at (when done right). Hence your generic solution is to encrypt all the data you want to be able to forget easily and throw away the key once such a time comes.

Implementation for various services may differ a lot and may (or may not) require substantial changes to your infrastructure. In all cases however, two rules will apply:

use good encryption algorithm and configuration (mode of operation, IV generation)
make sure you will be able to discard the key (actually any sensitive plain text data for that matter!) really properly - this basically mandates storing it physically in RAM and remembering to overwrite it with something else when not needed any more1.

A simple example (on Linux) concerning users' home directories

Create a regular file - its size will determine the size of user's home, fill it with (pseudo)random data (one way to do it is to write zeroes to a dm-crypt device backed by that file)
Create a dm-crypt device backed by the file, keep the password stored only in RAM (see 1). If you used a dm-crypt device for "randomising" the backing file in the previous step, use a different password now.
Create a file system on the crypto device;
Mount at user's home;
When you decide to remove the home, unmount it, throw away the key, remove the file (possibly fill it with random data again, but remember this doesn't make that much sense for SSDs).

1Rather tricky part and your mileage may vary (as always with security). The point is, that even for a server there are case when that key (or other sensitive data) may be present in memory when it should not. In your case this can be for example when a service (database...) crashes (or is just stopped for maintenance) or, as suggested in a comment, in the case of a power-off, especially a forced one - i.e. the attacker physically removing the server from its place for analysis.

The first case could be solved by kernel wiping any memory pages belonging to an application after it frees them (thus including any form of application stop).

The second one is even trickier. You may ask why you should bother with RAM  after a power-off and you wouldn't be the first one - read on Data remanence, Cold boot attacks and check e.g. Are there volatile memory chips which dont retain data after power off?. General answer: there's not much you can do without a specially designed hardware that would erase the RAM on power-off. And even then - can you exclude a possibility of an attacker hooking onto a running the machine on hardware level?

While this sounds paranoid, it is just a hint about what you may want to consider when implementing such a service. You have to decide what makes sense, what threats you don't really want to spend resources on and what trade-offs are acceptable. For example if you want to be able to reboot the machine unattended, then you're pretty much out of luck, since that requires it to have access to at least some unencrypted sensitive data (let's say the encryption key), which in turn breaks the whole privacy chain.

Another problem is, that you need to make sure it doesn't get swapped out - at least not an unencrypted swap storage.

To sum it up: question is not whether you can make it impossible for an attacker to get the data - it is how difficult you make it. You have to specify the how much part to see what makes sense.


Does one need to be a good programmer to perform secure source code analysis? A person has good knowledge of overall security risks, knows what OWASP Top 10 vulnerabilities are, and has certifications like CEH, CISSP, OSCP, etc. which are more black-box testing. And also he has gone through the OWASP Testing Guide, Code Review Guide, etc. and cheat sheets. Will he be able to perform secure code review without knowledge of multiple programming languages and mastery over them?

It depends on what is meant by "secure source code analysis."  One can do anything one pleases.  The issue, I presume, is when someone else has asked for something called "secure source code analysis," and one wonders why one is not qualified for it.

In many cases, such analysis must be done by a Subject Matter Expert (SME).  In the final product, a SME will deliver a statement basically saying "I declare this code to be secure," with an understanding that is a more profound statement than "I looked for a bunch of known patterns, and found no problems."

If you were interested in the authentic translation of a Chinese philosophy, would you trust an individual who knew a great deal about philosophy, and had a bunch of cheat sheets to help decipher it, but did not actually know Chinese?

One great example that comes to mind is a bug that hit a SQL engine.  Forgive me for not having the name of which engine, or which version so you can verify, I have had trouble finding it since.  However, the error was poignant.   The error was in code that looked like this:

int storeDataInCircularBuffer(Buffer* dest, const char* src, size_t length)
{
    if (dest->putPtr + length < dest->putPtr)
        return ERROR; // prevent buffer overflow caused by overflow
    if (dest->putPtr + length > dest->endPtr) {
        ... // write the data in two parts
        return OK;
    } else {
        ... // write the data in one part
        return OK;
    }
}

This code was intended to be part of a circular buffer.  In a circular buffer when you reach the end of the buffer, you wrap around.  Sometimes this forces you to break the incoming message into two parts, which is okay.  However, in this SQL program, they were concerned with the case where length could be large enough to cause dest->putPtr + length to overflow, creating an opportunity for a buffer overflow because the next check wouldn't work right.  So they put in a test: if (dest->putPtr + length < dest->putPtr).  Their logic was that the only way this statement could ever be true is if an overflow occurred, thus we catch the overflow.

This created a security hole that actually got exploited, and had to be patched.  Why?  Well, unbeknownst to the original author, the C++ spec declares that overflow of a pointer is undefined behavior, meaning the compiler can do anything it wants.  As it so happened, when the original author tested it, gcc actually emitted the correct code.  However, a few versions later, gcc did have optimizations to leverage this.  It saw that there was no defined behavior where that if statement could pass its test, and optimized it out!

Thus, for a few versions, people had SQL servers which had an exploit, even though the code had explicit checks to prevent said exploit!

Fundamentally programming languages are very powerful tools that can bite the developer with ease.  Analyzing whether this will occur does require a solid foundation in the language in question.

(Edit: Greg Bacon was great enough to dig up a CERT warning on this: Vulnerability Note VU#162289 C compilers may silently discard some wraparound checks., and also this related one.  Thanks Greg!)


Why is the reuse of the Elliptic curve Diffie–Hellman (ECDH) public server param considered bad? When reviewing the SSL/TLS configuration using Qualys SSL Labs, I've found that the reuse of the Elliptic curve Diffie–Hellman (ECDH) public server param was flagged.

Why is the reuse of the Elliptic curve Diffie–Hellman (ECDH) public server param considered bad?

Note: I'm deliberately ignoring the difference between regular DH and elliptic curve DH. Doesn't matter here.
Just poor phrasing.
"public server param" vs. "Ephemeral DH parameters" vs. "dhparam"
I think this is just poor phrasing/terminology. SSL Labs uses the definition as per RFC to basically tell you "Yo, i received the same pubkey twice! This shouldn't happen!"
SSL Labs uses the terms DH public server param (Ys) and ECDH public server param for this.
And this only makes sense if you know that they're referring to the RFC definition of what makes up the "parameters" and not to the openssl definition of what makes up "dhparams".
RFC definition
As per the TLS 1.2 RFC the params are defined like so:
struct {
    opaque dh_p<1..2^16-1>;
    opaque dh_g<1..2^16-1>;
    opaque dh_Ys<1..2^16-1>;
} ServerDHParams;     /* Ephemeral DH parameters */

So they DO INCLUDE the pubkey (dh_Ys).
OpenSSL definition
But this conflicts with OpenSSL use of the term params which DOES NOT include the pubkey:
$ openssl dhparam 123 -noout -text
Generating DH parameters, 123 bit long safe prime, generator 2
This is going to take a long time
......+..++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*
    DH Parameters: (123 bit)
        prime:
            04:f4:19:58:a6:2c:ad:1f:4f:b8:a9:b9:fd:3d:ea:
            1b
        generator: 2 (0x2)

Only the prime and the generator are including. No PubKey.
Further reading:

An earlier answer of mine.

(Read part below only if you're bored.)

Long and rambling Sidenote
Sloppy openssl documentation.
The openssl documentation for ephemeral DH seems to have been contaminated from the openssl documentation for ephemeral RSA. eRSA is a thing of the past and no longer supported but it did the same thing that we now use ephemeral DH/ECDH for.
So what does that have to do with DH/ECDH? Well, the documentation for SSL_OP_SINGLE_DH_USE reads like this:

SSL_OP_SINGLE_DH_USE
Always create a new key when using temporary/ephemeral DH parameters [...]

But wait a minute! According to the usual openssl terminology the KEY is the ephemeral part of the parameter/key combo. So why do they even use a term such as temporary/ephemeral DH parameters. -- Well, I think they just copied that from the documentation for the (now dead and buried) eRSA.
So while THIS made sense to say for eRSA:
/* Generating a key on the fly is very costly, so use what is there */
if (rsa_1024)
    rsa_tmp=rsa_1024;

It does NOT make sense to copy that to the documentation for eDH:
/* Generating a key on the fly is very costly, so use what is there */
setup_dh_parameters_like_above();

This is copied verbatim from the old eRSA example. And in the DH context this does NOT make sense. What is costly is not so much to regenerate the DH-KEY but regenerate the DH-GROUP.
Edit 2017-07-23Sun: Removed wrong "you can share your modulus, no problem" statement.


Way to protect from cold boot attack After reading some research papers about cold boot attack, I got a big shock and start searching for ways to protect against that kind of vulnerability. I got one solution that is using BitLocker pin access to RAM. But I have still a concern.

Windows 10 Latest patch can protect cold boot attack?
DDR3 or DDR4 RAM still have vulnerability?
Is there another way to protect rather than BitLocker pin?

Windows 10 Latest patch can protect cold boot attack?

No.

DDR3 or DDR4 RAM still have vulnerability?

DDR3 and DDR4 retain memory for a shorter period of time than DDR2, but cold boots are still possible. DDR4 additionally uses memory scrambling (for purposes of electrical reliability), but the scrambling algorithm, which is an LFSR, is not designed for security and can be broken.

Is there another way to protect rather than BitLocker pin?

A BitLocker pin does not protect from cold boot attacks.
Some modern AMD CPUs support full and transparent memory encryption called SME and branded as "Memory Guard". I don't know if you can enable the full memory encryption from Windows. Other than that, all you can really do is use physical security. Use strong encryption, and always turn off your computer before you leave it unattended. As long as you are with your computer for a few seconds after it has powered down, the chances of recovering any memory quickly becomes nil.


How to prevent hotlinking on binary content served through PHP? I am trying to secure a byte serving script, written in PHP, mostly taken from http://www.tuxxin.com/php-mp4-streaming/ to protect against linking the video directly and easy downloading.
I therefore have placed the video outside the public http-root. The pseudo-streaming itself works perfectly fine.

The pages structure like this:
mysite.com/watchvideo.php:

<video>
  <source src="/media.php?t=<?= $t = Token::generate(); ?>" type="video/mp4">
</video>

mysite.com/media.php:

$token = isset($_GET["t"]) ? $_GET["t"] : "";

if (
    !Token::check($token)
    || $_SERVER["HTTP_REFERER"] !== "mysite.com/watchthisawesomevideo.php"
    ) {
        header("HTTP/1.1 403 Forbidden");
        exit;
}

do_the_byte_range_stuff();              // from tuxxin.com

The Token class simply generates a random string, saves it in the php-session and returns it, respectively when checking compares the parameter to the token stored in $_SESSION.

With this method I have the problem that some browsers, like stock and chrome 47 on Android 4.1.2 seem to hand over the streaming to some different process, therefore losing the HTTP_REFERER (possibly related: android issue 1780). If I unset the token on checking it subsequent requests to media.php get abortet. Same goes if I set a time limit for the token.

Once this is sorted I would hide the video and mirror its content onto a canvas.

What would be suitable security measures to protect against downloading the video file and making media.php inaccessible? I know there can't be absolute protection, but I want to  make it reasonably difficult.

Edit: Please note that I am not looking for some form of DRM for the video as I know it could be simply recorded off the screen. I am looking for ways to get the video to the watchvideo-page making it only accessible from there and preventing hotlinking.

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so:

<?php
 $ip = $_SERVER['REMOTE_ADDR'];
 $browser = implode(':', $_SERVER['HTTP_USER_AGENT']);
 $userFingerprint = md5($browser . $ip);
 setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 sec
?>

On media.php, you read the cookie back:

<?php
 $ip = $_SERVER['REMOTE_ADDR'];
 $browser = implode(':', $_SERVER['HTTP_USER_AGENT']);
 $userFingerprint = md5($browser . $ip);
 if ($_COOKIE['userdata'] != $userFingerprint) {
    header("HTTP/1.1 403 Forbidden");
    exit;
 }
 do_the_byte_range_stuff();
?>

I used MD5, because I don't care about collisions here, I just want a fast hash. You can go overkill and employ BCrypt or PBKDF2, but you absolutely don't have to.


Use (or not use) OAuth for internal service to service communication in SOA So we are a group of students making an online platform for our University. We are modelling our platform as a set of services.

For example, a service "A" might store only personal information of users and expose a REST API on top of it. Another service "B" might only be sending emails.

A rough structure would look like this:

Now we want to use OAuth for Authentication and Authorization (I know OAuth is an Authorization framework but we want to do roughly what google does).

A typical scenario could be something like:

User requests webpage of service "A".
Service "A" sees that user is not authenticated, so it will send a redirect to Auth Server.
User enters its credentials, and an access token is granted to service "A".

Now, service "A" may need to call another service "B". Note that this is an internal server to server request. Various other services might be calling service "B".

I want to make sure that when service "B" is called, only allowed services can call it. For example, "A" has the right to call "B", but "C" doesn't. In other words, I want to ensure only whitelisted callers for a particular service can call it.

So my question is, is it possible to secure internal service-to-service calls using OAuth?

Can it be done in a simpler yet secure way?

I don't want token delegation: that is, I don't want the first token issued to service A being used somewhere else. It is assumed that if "A" is calling "B", then "A" has the right to do so, even if there is no user logged in.

My attempt: (might be wrong, please correct me)
* The Auth server can issue clientIds and client secrets to each service.
* A service which wants to call another service identifies itself to Auth server using key and secret.
* If the service is allowed to call the target service, Auth server issues a token, else returns forbidden.

But even in this case, the Auth server is doing too much.

Can't each service itself control what other services can call it?

Thanks.

This started out as a comment, but it grew a bit large for that, so I've moved it to an 'answer'.

The step that is missing from the OAuth2.0 specs is the 'backend communication': the part where the authorization server and the various services agree on what is a valid token and what scope is associated with it. These 'implementation details' are is left the discretion of the OAuth Service Provider.

Also, your diagram is could be improved by sticking closer to the OAuth2.0 terminology (I'm not saying you did a bad job, the diagram is helpful, but it could be more clear).

Your 'User' in this case is (presumably) the Resource Owner. The 'Frontend' could (I'm guessing here) be a single-page application, running inside the User Agent.

It is the API Server that is receives the Access Token from the Authorization Server, to access data on behalf of the Resource Owner.

In other words, your diagram is missing the communication between the 'User' and the 'Auth Server'.

For the flow of OAuth, maybe the follwing diagram is helpful:

Figure 1: OAuth flow for (confidential) clients.

To answer your question: OAuth is about delegation of authorization from a Resource Owner to some service to access the Resource Owner's data on their behalf.

So, using OAuth may not be your best option. However, I don't know of any out-of-the box solutions that really solve your problem (delegation of access rights, on behalf of a user). You could take a look at authoriZation Based Access Control (ZBAC) but it may be quite an overkill for what you are attempting to achieve.


Are files recoverable that have been deleted BEFORE encryption? I have recently decided to sell my Android device (MotoG3). I know that before I sell it I am supposed to Encrypt the device before I perform a factory reset as it is my understanding that the Encryption keys will also be deleted, therefore making any recoverable data unreadable.

However I am confused as to whether this also applies to data previously stored on the device BEFORE the device was Encrypted.

E.g. I have had many photos (and other files) on my device in the past which I have decided to delete to free up space, however at the time of deletion my device was NOT Encrypted.

So what happens to these files after I Encrypt my device and perform a factory reset, are they recoverable or is the hidden space which the files previously occupied also encrypted?

I believe modern android versions support "fast encryption". To quote the documentation -

  fast encryption, which only encrypts used blocks on the data partition to avoid first boot taking a long time. Only ext4 and f2fs filesystems currently support fast encryption.

This to me suggests it will not overwrite currently unused storage. If you are concerned I would suggest filling the disk as completely as feasible (either before encrypting or while encrypted).

It is worth noting recovering deleted files from flash media is considerably more difficult than from spinning disk media. As such the risk here is extremely low.


Whats the actual harm in open directory listing? What can a attacker do here? There are times when directories are left publicly accessible intentionally. What's the harm here? How is this even considered a flaw?

I know that it can disclose sensitive info from the server then why are they sometimes intentionally left publicly accessible?

Because it makes sense to do it when it makes sense to do it. The usual practice is to disable it and only enable it for directories you specifically want it to in order to avoid accidental information disclosure but of course... not having a directory listing doesn't prevent them from accessing your /admin/err.log or whatever because you can still guess file paths. You might for example have a directory where you store pictures of your employees with random file names to avoid people from scrapping your website (but still allow them to access single pictures when necessary). If you don't disable directory listing (and have no index.html usually) an attacker could easily get a list of all employees that way.


Security risk of a service that allows a user to test from connectivity from a server to a printer What are the security risks in adding a feature to an application which allows users to test for connectivity from a server to a printer?

I'm planning to add a feature to my application to allow users to click a button which will test whether the server can connect to a printer.  The button won't allow the user to send any data, but they will be able to specify the IP address and port of the printer to be connected to.

I'm concerned about the risks that a malicious user might be able to use this feature to carry out network scanning from the server's perspective.

What would be some good controls to add to this kind of facility to minimize any security risks? For example, perhaps I could limit it to a specific port or ports which are used for printer configuration or limit the function to only be usable by a privileged user.

You're correct to say that depending on how the application is deployed and who the user's are, there could be some risks in allowing users to do this.

Some controls which would likely help in this kind of scenario

Allow administrators to specify a list of valid printers, and then allow users to only choose from that list of printers.  This is likely the best option as it removes the user's ability to enter arbitrary IP addresses and ports to the application.
As mentioned, restricting to specific ports can reduce the risk, however some printers operate on the common web ports, so this is of limited use.
Also restricting which user's can use the facility would reduce the risk.
Logging all actions, whilst it won't prevent abuse, could be a useful feature in enabling administrators to spot and react to that abuse after the fact.


How do I know which subkey GitHub is using for signing? I added my gpg subkey to GitHub today and noticed that regardless of which subkey I export, the PUBLIC KEY BLOCK is the same. I have since found this post, that explains why: is-it-possible-to-export-a-gpg-subkeys-public-component?

In adding this public key block to github, it has now recognised my public key, and lists both my encryption and signing subkeys under my account.

My question then, is how do I know which key github is using for signing, since my public key has usage SC, and my signing key has usage S?

Github is not signing your commits at all -- all it does is verifying signatures. In fact, git is doing the signing work on your computer, relying on GnuPG for the cryptographic operations. GnuPG again will generally use the newest non-revoked key with signing capabilities unless you enforce something else, which will usually be your subkey.

When verifying commits or tags through git verify-[commit|tag], GnuPG will print the key ID used for signing, for example

gpg: Signature made Mon Jun 27 23:22:05 2016 CEST
gpg:                using RSA key 0x8E78E44DFB1B55E9
[snip]

This key ID references the key actually used for writing the signature, if a subkey was used, the ID is printed here. You verify by running gpg --list-keys [key-id] and having a look whether the key is listed as primary key or subkey.

For signing, usually the pinentry implementation of your choice will also print the key to be used when querying for the passphrase.


Why is it so difficult to protect an application against buffer overflows? For example, buffer overflow vulnerabilities in Flash are often discovered. Shouldn't a proper verification of all function parameters in Flash source code be enough to protect against buffer overflows?

The difficulty comes essentially from the fact that, in C language, you are in charge of the memory-sanity of your own program. Meaning that you have to a full access to the memory, which allow you to do extremely efficient program but, also, might end up in an unspeakable chaos.

In this context, checking that you write within the bounds of a memory area is already a challenge. Especially if these bounds are dynamically chosen at runtime.

But, this is not enough to make a security issue, you also have to control that the outer World cannot access to the ability to write outside of these bounds.

As you have noticed in your question, only certain types of programs and/or part of the code are involved in these two issues. Usually the part that import inputs from the outer World and process it. And, there is absolutely no way to ensure that:

There will be no writing outside of the proper bounds.
No external input will be able to tweak an illegal writing in order to control it.

Again, all these problems are caused by the fact that you want memory efficiency and, thus, a full access to it. This is the price to pay.


Visiting the U.S. for a security conference I am planning to visit a security conference in the U.S. and I am unsure about how to prepare myself and my devices for immigration. What are sensible technical measures to take and situations to expect?

On a personal level, I'm afraid that because of my infosec background and intention to visit a security conference, I might be singled out for interrogation or even denied entry if border officials decide that "hackers" can't be permitted. On a technical level, I'm afraid I will be asked to give access to my laptop and phone for which I want to prepare appropriately. What are things to consider for someone with an infosec background when passing U.S. immigration - especially regarding the technical setup?

(I'm not primarily asking for opinions but for founded advice on what (technical) measures are important when traveling to the U.S. as someone from the infosec field.)

I've travelled to several countries to give speeches at security conferences. IMHO, the right approach is not in lying, but in not saying more than necessary. When asked about the purpose of my trip at the border, I truthfully tell that I am on a business trip, going to an IT conference. Nobody ever asked me details of the conference, and nobody ever asked if I'm a visitor or a speaker. And if one day they interrogate me more deeply, everything I said was 100% true.

For technical measures, Gruqq's post on Medium is right, most of the advise given is bullshit and will only get you into trouble.

However, we all have things to hide. Be it trade secrets from our business, naked pictures of our girlfriends or our personal diary. The best way to hide the things you want to hide is, of course to not have them on the device you travel with. Store them encrypted in the cloud or on a file server.

At the same time, keep your not-very-secret-secrets on the device. Hide only what really needs to be hidden. If your device is checked, the best result for you is not that it appears blank or freshly installed or securely encrypted, but that it appears boring and ordinary.


Do we need VPN to access corporate resources while we have WiFi with EAP TTLS/PAP? Company X has LDAP integrated WiFi (EAP TTLS/PAP).
When employees connect to WiFi, they can access the public internet.
However they don't have access to internal resources (for example database ports, hadoop ports etc). To access internal resources, they need to get on a VPN (SSL VPN) which used the same LDAP credentials used to access WiFi.

Question: Does the VPN make it any more secure (it uses the same password)? What would be the downside of making internal resources accessible after WiFi access?
Any critique of this set up?

Theoretically the WIFI setup should be secure enough on its own.  However, company wifi is usually provided so that people can hook there personal devices up to the internet ... providing VPN access gives people the availability of internal resources as needed while keeping the rest of riffraff out of the corp network.

This setup is a classic example of compartmentalization ... if your ifruit doesn't need access to anything more than internet for stream music ... why provide access to the internal exchange server.  It significantly reduces the attack surface in the case that your ifruit has some nasty rootkit on it that you didn't know about.

It is generally considered annoying to the people who DO want access to the internal resources, but in most cases these people are the vocal minority.


Textbook uses terminology like Double/Single Bastion Inline/T to describe firewall architectures. Are these terms used in professional environments? I apologize for the weird wording of the question title, I was hitting the character count.
I am taking a network security course in college and the textbook we use, Network Security Essentials: Applications and Standards 6th Edition by William Stallings, dives into firewalls in chapter 12. The book defines 6 firewall deployment architectures: host-resident, screening router, single bastion inline, single bastion T, double bastion inline, double bastion T, and distributed firewall.
I am doing a bit of research for a project and the only places I've been able to find the terms single/double bastion inline/T are on websites referring to the book or places that define the terms and don't give anything other than a definition. I've had trouble finding any more information about these architectures. I've found terms like screening host, multi-homed host, and others but I'm having trouble connecting them to the things discussed in the book.
Are there other terms used to describe these firewall layouts? If not, what terms are used and how do they relate to the ones discussed in the textbook?
I've included a picture that does a decent job of showing what the book describes below.

There are many textbooks that invent their own terminology; as long as you can understand the terms used in the context of the book, that's OK. For example, your "single bastion inline" is called "Internet screening firewall" elsewhere, and your "Single bastion T" could be called "Internet Firewall with a Single DMZ"
(When I use a word, it means just what I choose it to mean—neither more nor less.")
That being said, there are a number of standard terms.
A host-based or host resident firewall is most of the times a bit of packet filtering by the OS. At best unreliable: we've had examples where a server's "host-based firewall" was completely opened by the upgrade of a software package.
A screening router is a  router that filters the IP traffic. Rules should be kept simple. In general (but not always) it is stateless filtering. (https://dullaart.website/acl/index.html for some more info on that).
A screening host is a host that screens/filters the network traffic. You could say that a firewall is a screening host. Some will also say that a proxy is a screening host (though at a higher level of the OSI-stack).
A bastion host is a host through which all traffic must go. Many describe firewalls as bastion hosts, though some use the bastion host only for a host like a web server or proxy. A bastion host is always at least dual-homed: it has an input and an output. Although that may be virtual too.
A multi homed host is a host that has a network adapter in different networks. Like, for example, your bastion hosts.
The T in the architectures is for the optical likeness, but you may have guessed that. When I learned about firewalls (long ago), your "double bastion in line" was called "Dual firewall with a T-DMZ" Inline is also a term that describes how hosts are connected.


How do I secure my networked printers? I've been reading a lot about how network printers can be a big security breach, but precious little about what to do about it. I have 2 Canon printers, a Pro-100 and a MG6821. Neither one requires the network password when you set them up on the network, so I assume they're doing some sort of WPS business.

Over 18 months ago there was this thread How dangerous is an unsecured printer? that seems to say they're very dangerous but, again, not much as far as what to do about it.

Has anything changed since then? Can someone tell me how to secure them?

Yes, it is still a problem. Printers are the first big "IoT" device and the problems that have plagued printers plague every other IoT device today.

And the way to mitigate problems are similar:

patch
configure
isolate

Make sure the IoT device is fully patched (and because they may not tell you they need updating, you might have to manually check)

Ensure that the configuration of the IoT device is as secure as possible as the device permits (default passwords, strong passwords, turn off unused services, etc.)

Isolate the device in its own network and lockdown the traffic. Consider blocking all traffic initiated by the device, blocking internet access.

These are things that you can do either in a corporate setting or a home setting.


How safe is virtual box without internet I am running a windows 7 virtual box without internet connected. Internet is, however, connected to the host, and I allow any internet access to and from the host. On the guest platform I am working with some sensitive documents that I do not want any viruses or attackers to get. Can someone look at the virtual box hard-drive stored in my host machine, and extract the information from the files there? If so, how can this be completely prevented. I am a Python programmer with massive experience in algorithms (no internet experience or networking), so I was wondering If I could create a program to block all internet access to a given file. This program would be able to completely deny EVERYTHING from the host that tries to access it; programs, internet, anything. I am not sure if that can be done though. Any suggestions would be greatly appreciated!

In order to clarify the questions:

How safe is virtual box when not connected to the internet?
Can a listing of all internet access at a given time be obtained?
How can everything be prevented from accessing the virtual box hard-drive, or anything related, where important data can be stored?
If anyone knows any Python related security, how can this be implemented if at all?

P.S. I don't want a solution that encrypts the virtual hard drive so a point where I cannot use it. I want internet and foreign program access blocked, but still be able to use the guest virtual box machine from the host. Simply no outside access.

Virtual machines work as sand boxes to keep bad things in, not bad things out.  If the host is compromised, so are the containers running within it as the virtual machine has to call out to the host for many actions and the host has full awareness and control over the system running within it.


Due to which reason might a windows 7 password been reset to empty? A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. Assuming that the user is not lying to the question whether he reset the password himself is there any other reason besides a hacking attempt on that user account due to which the password was reset?

If it was a hacking attempt from an amateur (an he didn't modify the log files) in which log file would the password reset been written?

Local user password changes should register as audit events in the Windows event log, under Security. The event ID is 627: Change Password Attempt if the user changed the password himself, or 628: User Account Password Set if another user performed the change.

You can reach the log via:

  Start » Run... » eventvwr.msc » Windows Logs » Security

You can filter the log using the Filter Current Log button on the right panel, and enter 627 and 628 in the event ID filter list.


Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable?  The scanner test I need to satisfy believes so, but is this a false positive?

This is easy to test.  After the browser finishes rendering,  open the JavaScript console and try this:

alert(document.cookie)

If you can't access the session id using the terminal,  then an attacker cannot access it using XSS.


Is BCRYPT easy do decrypt? I know that bcrypt doesn't encrypt, but how easy would it be to get the password from a stored bcrypt hash?

I wanna split my question about bcrypt into 2:

I read over here that bcrypt generates random salts for every hashing it does. How can 2 different "hashing-actions" with the same number of rounds and the same password have the same output if bcrypt generates a random salt for every time you hash something?
BCRYPT saves the output hash, the salt and the number of rounds with the kind of algorithm version. The output would be something like this:

$2a$10$vI8aWBnW3fID.ZQ4/zo1G.q1lRps.9cGLcZEiGDMVr5yUP1KUOYTa

You basically have everything the Algorithm needs except the input, but for that you have the output instead. Wouldn't that make it pretty easy to decrypt / un-hash the password back to its original state?

Bcrypt like any other salted hash method use the salt to avoid that the same password hashes to the same string. It is doing that by initially generating the salt randomly and then hashing password and salt. This can only be verified if the same salt is used when verifying. This is why the salt is saved together with the hash.

Bcrypt like any other iterated hash method can not directly be inverted, but you can try all possible passwords to see if they hash to the same result. In case of salted methods you cannot precompute this, because you have to try with the actual salt (as described above).

The idea of a iterated and salted hash is, that this bruteforcing is so slow, that it takes very long to try all possible passwords. Therefore reasonable long and complex passwords cannot quickly be bruteforced. Bcrypt is one of the (with configurable workfactor) slower and therefore better methods (but it is not invincible). This is true for all password hash methods (unless they use additional protection like encryption with a secure key 'pepper' which cannot be extracted from the authentication server).

NB: Scrypt and Argon2 are more modern variants of password hashing. And PBKDF2 has similar strength than Bcrypt but with a better compliance bullshit factor.


I have the password "data/hash", next what? In theory, passwords should not be stored in plain text and also it should be avoided to store them as a simple hash, something like md5(password).

Is recommended to store the output of the function that uses algorithms/ciphers like bcrypt, script, PBKDF, passed to the password with some salt.

But once the database/file with passwords has been compromised for example a file containing data like this:

id, password

12, $2a$10$zkeaH43RM9Ep5.KPcyXWYuCaVSbKmmXaKLztvCa0G867ItEpvx4fa  (bcrypt)

12, 05ffaebcca41770af425d4ba9b4e7bcdff532237dca931c192a36d94db7307d4 (scrypt)

12, JDJhJDEwJHprZWFINDNSTTlFcDUuS1BjeVhXWXVDYVZTYkttbVhhS0x6dHZDYTBHODY3SXRFcHZ4NGZh (base64 ofuscation bcrypt)

As an attacker, from the first look, I can see that in first case bcrypt with a cost of 10 is been used, for the second I have just a length of 64 in where probably salt is included, the third one ends being the base64 just obfuscating bcrypt

base64($2a$10$zkeaH43RM9Ep5.KPcyXWYuCaVSbKmmXaKLztvCa0G867ItEpvx4fa)

just to mention some random examples.

So once this information has been compromised, besides following a procedure for changing password etc, what could be the best way to store the passwords that at least could delay more the process of finding how it was generated and have more time for allow all users to reset/change passwords.

Or asking different, while having this kind of data what an attacker normally start to do? and based on this what could be improved so that it could be more difficult to find a pattern, start cracking the passwords, etc.

Increase the work value, that'll exponentially make a hackers life harder. Use a random salt for every password, that'll make it so a hacker needs to generate attack dictionaries unique for each user. Use a hardcoded pepper in your application to add a hidden element to your hashes that the hacker would be forced to brute force.

Any attempt to hide the method you used to hash the password is security by obfuscation, which itself isn't really security.

There's quite a few scenarios that can occur if an attacker gets access to your database, I'll go over a few of them.

No salt/same salt for every entry. In this scenario I, the attacker, can crack all of your users password in one go. Since the only variation I have to worry about is the password itself, I can hash once and check against all 10,000 of your users.

Unique salt for every entry, salt appended to hash. In this scenario, I can only crack your users passwords one at a time. Let's say of your 10,000 users, 300 had the password "password". Instead of me figuring out 300 of your users had that password at once, I'd need to rehash with the users salt 10,000 times to check them all.

Unique salt + hardcoded pepper. This scenario is dependent on how deep of an intrusion you suffer. If they get access to your application servers, they could sniff out the pepper. If not however, instead of me having to guess the password, I also have to guess the pepper. Only problem with that is I have no way of telling if I'm close. Should you choose to use a pepper that is 128 characters long, initially generated using a cryptographically secure library, I would have to brute force that on top of the password, virtually destroying dictionary based attacks.

Our goal is to make it hell for an attacker to crack the passwords, by doing things in such a way that the attacker has no choice but to sit and wait an eternity.

On a side note, if your password database was ever compromised you should immediately flag all the accounts, and on next sign in require the user to follow the password reset procedure, not the change password procedure. This allows you to verify the users identity by using a side channel to ensure authenticity of the request.