How do I secure my advertisement space against ad overlay browser attachments? I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look at them. The issue is with browser add-ons that detect and conceal a websites ad space with a third party application. The majority of which, these days contain their own advertisements and are in essence stealing a viable product. Is there an ethical way to override the technology or is the only recourse to simply script for detection and lock sites to users with those types of add-ons enabled?

for an example click to view overapps

You can detect client-side modifications to your content by using javascript.

A very simple solution is to load a "base" page without useful content, but which contains your basic page layout, your ad, and some detection code. Once the base page is loaded, yout detection code checks to make sure that your ad is visible and displaying the expected content. Once that verification is complete, your client-side code fetches the "main" content via AJAX and inserts it into the page.

Obviously this is sub-optimal on so many different levels that I won't even go in to it, and obviously it can be circumvented by a determined attacker. But if your priority is ad traffic, and your a small enough target that you're not likely to attract the attention of someone who can circumvent your measures, then solutions (albeit less-than-perfect ones) exist.


Can everyone see my Chrome passwords if they boot a live Linux distro? I have an iMac 27" Late 2012. My browser is Google Chrome and I have a handful of passwords saved in it.

When I come across a website that requires authentication, Chrome automates it without asking me for my Google Account Password. My (administrative) user account on Mac OS X has a password, and it requires it on login, as well as when I need Superuser permissions (sudo, su, installing software etc...).

Power supply is now dead, so I'll have to send it to Apple for repair. I dunno how OS X has been implemented in Google Chrome passwords encryption, but I was wondering: can "Geniuses" (or so they call 'em) just plug in a Live Ubuntu USB (even OSX maybe) and get my Google password, subsequently getting access to all encrypted passwords stored in Google Chrome?

If that's so, then it's designed really badly!

Short answer: if your account has no password or you gave them access, i'm afraid so. But even the Live USB won't work if that's not the case. (guessable passwords aside)

  If that's so, then it's designed really badly!

Yes. Yes it would be. As you might've noticed, Google (Alphabet w/e) is somewhat skilled in making computers do what they want. That's why they try to make sure it is actually hard to steal the keys to your digital life.

Chrome browser used to use the OSses native cryptography interface for storing passwords as an encrypted blob.

As can be seen here, Chrome on OS X uses the Keychain for the master key. (The actual data has been moved to the browsers internal store in '16)

They use strong, publicly known encryption algorithm (3DES), that stood years of attack. There is no way we know of to attack these better than bruteforce. Which, at the current keylength, will take longer than the heat death of the universe if implemented properly.

Too bad it isn't implemented too well by google, despite arguably having one of the most active security departments in the world. If you can get into the account, everything's exposed. There's no way to set a master password.

They somehow thought it gave a false sense of security.
Because someone could install a keylogger there's no added benefit.

But using a phone, a simple pattern will stop your classmates from reading your messages. Not too secure, but preventing >90% of the abuse with minimal impact to user experience. The android devs understood, and i understand the tradeoff.

Luckily there's plenty of third-party plugins that do have a master password setting.


Certificate for Email Encryption and signing I don't understand the flow of Digital Certificate with Email Encryption and Signing.

For Example,
There is 2 users, Sender A and Receiver B.

Is Certificate required to encryption to A or just private key is enough?
How B decrypt email ? With the certificate of Sender ?

PKI-based signature and encryption works this way (in email and any other application):

When signing data, you need access to the private key
When validating signed data, you need access to the public key
When encrypting data, you need the public key
When decrypting data, you need access to the private key.

Now, a (X509) certificate is a set of data that contains (mostly):

Identity information
Usage limitation information
Public key data
Digital signature of all of the above by a certification authority (for allowing 3rd parties to decide whether or not trust this information).

So:

For encrypting data all you need is the public key that matches the private key that will be used for decryption. In the case of email, that means access to the certificate of the recipient (an not the private key itself).
In order to decrypt data you always need access to the private half of the key used to encrypt it. In the case of email, it means that you need access to the private key linked to the public key contained in the recipient's certificate.

In the case of encryption, you do not and never need access to any part of keys belonging to the sending party. In fact, you do not actually need to have your own certificate or key pair to perform email encryption.

A personal certificate is only required when you intend to sign data or allow others to send you encrypted data.


Why do certificates need thumbprints? I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate.

For intermediate and end-user certificates, it is verified by its issuer. so it can simply be calculated as the certificate itself is trusted.

For root/self-signed certificates, they're not trusted unless it is provided with the OS. So the thumbprint included is also not trusted.

I think that I just misunderstood something, can anyone point it out?

There is no thumbprint included in the certificate. What is included is a signature which is used to build the trust chain.

The thumbprint (or fingerprint) is just a hash over the certificate to make it easier for humans to compare certificates. It is not included but computed when needed.


What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM? I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a real scenario project will be implemented. This SIEM will monitor some CentOS 7 machines
I have the following doubt: we want to put under monitoring when some important file changes.
I was thinking that for a first demo we can monitor events related these two use cases:

When the content of some configurations files changes.
When logs file size decreases (this could indicate tampering with the log files in order to eliminate information of an attack).

What do you think about? If it make sense can you suggest me a list of important configuration files and a list of important logs files that deserve to be monitored on a Linux system (in particular related to CentOS 7 system).
Moreover can you suggest me also some directory that have to be monitored in order to avoid for example that an attacker upload malicious files?

I'll answer these backwards in order to hopefully make the reasoning clearer.  With regards to the second question:  the contents of local log files stored on disk should always be considered untrustworthy.  Logs should be forwarded to a SIEM in real-time, precisely to avoid an attacker being able to cover their tracks.  How you can accomplish this:
Traditionally, syslog daemons like rsyslog or syslog-ng would dump system logs under /var/log.  However, CentOS 7 uses systemd as its init system and thus journald for syslog.  What you will want to do is integrate with journald such that its logs are forwarded to the SIEM.  There are several options to do this, such as systemd-netlogd (this solution is unofficially endorsed by Lennart Poettering).  You can read about other options for accomplishing this here, here or here.  Most SIEMs will accept RFC5424-style syslog over UDP port 514.
To accomplish the first, you will need a File Integrity Monitoring tool.  The open source standard is OSSEC (wiki, site, source).  Similar to the above, alerts should be sent to the SIEM as they are generated, rather than being stored on disk - the documentation how to do that is here.
OSSEC already comes with a large suite of predefined profiles for monitoring security-sensitive locations and other possibly interesting security events.  Beyond the defaults, you will want to have a security professional further configure it for specific events or changes they are interested in, and you will also want to have a developer on the project in question work with that professional to also configure it for sensitive modifications specific to the that project.  Plus, it looks better to the client to present a solution which is specific to their project, rather than just a generic one for monitoring an arbitrary CentOS system.
If required, there are also commercial FIM solutions, such as Carbon Black that you may look into.


Is Enabling DEP (Data Execution Prevention) For All Programs Worth the Risks? Data Execution Prevention in Windows supposedly is a line of defense against malicious code by "by monitoring your programs to make sure that they use computer memory safely".  However, I also know for a fact that not all programs are made for DEP, and crashes and other problems can result if a "safe" app is blocked and deemed as unsafe.
In the DEP settings panel (screenshot below), I have the ability to enable this service for all the programs installed on my computer.

Does DEP really work in protecting against exploits (let's assume that I already have a good AV and firewall), or it is just not worth the compatibility risk?

To understand what DEP does, you first need to know a little bit about how memory is laid out in a process.  The key concept is that code (instructions the CPU can execute) and data (stacks and objects) exist in separate areas of memory.  User input, files, program data, etc. all live in the data areas of memory.

DEP allows this separation to be enforced by marking the code pages in memory as "executable".  By similarly NOT marking data pages, the processor can now recognize when a region of memory is intended for CPU instructions and when it is not.  As a protection, the CPU will fault, allowing the OS to terminate the process when DEP is enabled and the processor finds itself trying to run code from data memory.

In summary, this means that a user cannot simply input data containing executable code and, through a vulnerability, point the processor's instruction pointer to that data, and begin executing code, as was previously possible before widespread DEP adoption.

As a security mechanism, this is one strategy to mitigate an exploit running arbitrary/malicious code on a system.  However, modern exploits are typical able to defeat DEP.

I've not encountered a program that cannot handle DEP, ever, and I've had it enabled since it was first offered in Windows XP SP2.  That's not to say that there aren't programs that might be disrupted by it but modern programs, even immensely complex ones like web browsers, are able to operate when DEP is enabled.

Given hardware support for DEP as indicated in the screenshot above and widespread modern application support for DEP (as well as more advanced mitigations like ASLR) you shouldn't notice any performance differences with DEP enabled and there's some additional security provided over having it disabled.  Given this, I see no point in running DEP for system services only: there's no harm in running it for everything.  If you encounter something that is crashing due to DEP, you could add that individual program to the blacklist though I'd also consider finding a product that's more current and I'd absolutely not allow an Internet facing application to run without DEP (and all other available exploitation mitigations) enabled.  I'm not aware of risks caused by enabling DEP globally: I'd assert that your accepting risk by not doing so.


Why are KDFs slow? Is using a KDF more secure than using the original secret? According to the Wikipedia page for key derivation functions, a KDF's purpose is to derive a secret key for cryptography:

  In cryptography, a key derivation function (KDF) derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function.[1][2] KDFs can be used to stretch keys into longer keys or to obtain keys of a required format, such as converting a group element that is the result of a Diffie–Hellman key exchange into a symmetric key for use with AES. Keyed cryptographic hash functions are popular examples of pseudorandom functions used for key derivation.[3]

Let's assume we just completed a Curve25519 key exchange, and we want to use the key for a symmetric algorithm, e.g. AES.

If the raw shared secret can be  used as a key for the symmetric cipher, does using a KDF provide any security benefits? (Assuming that the KDF's output can also be used in the symmetric cipher.
If the raw secret cannot be used as a key for the cipher, we apply a KDF to it. In this case, why does the KDF have to be slow? (Or is this property of a KDF just for specific cases, but not this one?)

The confusion here is that there are two distinct kinds of key generation function, and people often say "key derivation function" without being explicit which one they mean (or even understanding there are two):

Key-based key derivation functions
Password-based key derivation functions

A key-based derivation function like HKDF presupposes that the inputs may be biased or partially predictable, but that otherwise it has enough min-entropy to be reliably unguessable.  The shared secret produced by a Diffie-Hellman exchange is one of the textbook examples.

Password-based functions, on the other hand, assume that the inputs have low entropy, and thus they're designed to impose as high a cost as reasonable to a guessing attacks (without becoming unbearably costly to the honest parties).  Slowing down the computation by having a high number of iterations is the classic technique, but newer functions like scrypt and Argon2 go beyond this and aim to be memory-hard:

The canonical algorithm for computing them uses a large, tunable amount of memory;
Any algorithm for computing the function that uses less memory than the canonical one should pay a very high time penalty (adverse time-memory tradeoff).


Can someone take down Wi-Fi signal? Is it possible that someone made an attack (DoS or something else) to my Wi-Fi router (without knowing of the password) and make my router's signal unavailable?

1) How it can be done?

2) What are remedies?

There's a lot of ways you can attack a WiFi without knowing any passwords:

Physical layer attacks: Simply jam the frequency spectrum with your own signal. That signal might just be noise, but it might also be a WiFi of your own under heavy load, with the nodes in that WiFi being configured not to play nice with others. (depending on the WiFi chipset, that can be extremely easy) Spectrum can only be used once!
Tool: noise source (e.g. Gunn Diode, SDR device), or normal AP
Electromagnetic sledgehammer: EMI gun. Take microwave oven oscillator, attach directive antenna, pray you don't cook someone's (your) brain, and point in the rough direction of the access point. Poof! Microwave ovens operate in the 2.4 GHz band, and thus, antennas of Access Points are picking up exactly that energy.
Tool: Microwave oven, some sheet metal, lack of regard for other people's property and own health, or extended RF knowledge
MAC and Network layer attacks: Especially for networks using WEP (noone should be using this anymore, but sadly...) it's easy to forge what is called deauthentication packets – and thus, to throw out stations from your WiFi.
Tool: Aircrack-NG's aireplay
Targetted jamming: As opposed to simply occupying the channel with noise or your own WiFi, you can also build a device that listens for typical WiFi packet's beginnings (preambles), and then, just shortly, interferes. Or just sends fake preambles periodically, or especially when it's silent. That way, you can corrupt selected packets, or fake channel occupancy.
Tool: Commodity off-the shelf SDR
authentication attacks: at some point, even "proper" clients for your WiFi need to register with the WiFi. That mechanism can of course be forced to its knees by simply sending hundreds of authentication requests every second, from randomly generated MAC addresses, or even from MAC addresses of clients you know (by observation) exist. There's no solution to the problem for the AP – either it succumbs to the overload of auth packets, or it starts blocking out legitimate users.
Tool: your network card, 10 lines of bash scripting
Man-in-the-Middling / access point spoofing: With anything short of WPA(2)-Enterprise, nothing proves that the access point calling itself "Toduas AP" is actually your Access Point. Simply operating a slightly higher-powered access point with the same ID string and, if necessary at all, a faked AP MAC address (trivial, since just a setting), will "pull" clients away from your access point. Of course, if the spoofing Access Point doesn't know the password, users might quickly notice (or they don't); however, noticing things don't work is nice, but doesn't help them.
Tool: a random normal access point

You have to realize that it's a privilege, not a right, to have your WiFi use a channel. WiFi happens in the so-called ISM bands (Industrial, Scientific, Medical usage), where operators of transmitters don't have to have an explicit license. That means it's OK for everyone to use that spectrum, as long as they don't intentionally harm other devices and are not easily damaged by interference.

So, it's absolutely legal for someone to operate a high-definition digital camera stream that occupies the whole WiFi channel. That will effectively shut down your WiFi.

If you need something that no-one can mess with, wireless is, by definition, not the way to go.


Dangers in hosting software on a webserver? I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc.

The problem is, the software used for the build process (Xilinx Vivado) does not have deterministic/repeatable results across different machines and operating systems. For example, Two participants running different versions of Windows, building the exact same code with the same config settings, would get different results. While participants can have a local copy of the software installed to get a baseline of their design performance, the final results from all participants will have to all be built on the same machine.

As such I'm considering hosting a Linux server from home with the Vivado software installed, and finding a method to allow participants to upload their code, and have it go through an automated build and verification process.

The server won't have any sort of sensitive information on it(final results will be public, that's the idea), however I'm wondering if I should have any sort of security concerns when doing something like this. I have about 4 other devices at any given time on my home network, and mainly just want to be sure I won't be creating any vulnerabilities for them. As for the server itself, I need to ensure I am the only one with root access and the ability to modify files outside the space where code is uploaded.

I will also need a method of allowing an indeterminate number of participants to upload code without having to create a user account for each one, while simultaneously preventing malicious activity. I'm not even sure if that is possible, however I would greatly appreciate any input!

you can get a VPS for a month for $5 USD from one of the big VPS providers. You can even get one hourly, just for the competition. That way, you risk nothing to your home and don't rely on residential internet to host your competition.


What are the disadvantages of single sign-on authentication? We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication.
In the words of Shwetha on the Cymfony System Testing blog:

  Advantages

  Users select stronger passwords, since the need for multiple passwords and change synchronization is avoided.
  Inactivity timeout and attempt thresholds are applied uniformly closer to user points of entry.
  It improves the effectiveness/timeliness of disabling all network/computer accounts for terminated users.
  It improves an administrator's ability to manage users and user configurations to all associated systems.
  It reduces administrative overhead in resetting forgotten passwords over multiple platforms and applications.
  It provides users with the convenience of having to remember only a single set of credentials.
  This also improves security as users find
  it easier to remember their credentials and do not have to write them
  down, allowing for a more efficient user logon process.
  It reduces the time taken by users to log into multiple applications and platforms.

What disadvantages exist when implementing single sign on technology?

Single point of failure
Single high-value target (attracts more attackers)
Necessary information disclosure between trusting site and SSO authority
Side channel attack against authentication step (theoretically; implementation dependent)
Lack of control over your user list
Yet another interface to maintain (added complexity)
You may never know how secure your system is or if there is a breach
Added cost

These are all off the top of my head. I imagine someone has compiled a canonical list somewhere.


nmap to read ports from a file I found this question and tried the solution given (accepted)
Can nmap take a list of ports to scan from a file?
However, it didn't really work as expected.
$ cat ports.list
21
22
23
25
$

Instead of scanning the ports in the file, nmap assume those ports as part of the host. See output below.
$ nmap 127.0.0.1 -vvv -p `cat ports.list`
Starting Nmap
Initiating Ping Scan at 10:50
Scanning 4 hosts [2 ports/host]
Completed Ping Scan at 10:50, 1.22s elapsed (4 total hosts)
Nmap scan report for 22 (0.0.0.22) [host down, received no-response]
Nmap scan report for 23 (0.0.0.23) [host down, received no-response]
Nmap scan report for 25 (0.0.0.25) [host down, received no-response]
Initiating Connect Scan at 10:50
Scanning localhost (127.0.0.1) [1 port]
Completed Connect Scan at 10:50, 0.00s elapsed (1 total ports)
Nmap scan report for localhost (127.0.0.1)
Host is up, received conn-refused (0.000059s latency).
Scanned for 1s

PORT   STATE  SERVICE REASON
21/tcp closed ftp     conn-refused

Read data files from: /usr/bin/../share/nmap
Nmap done: 4 IP addresses (1 host up) scanned in 1.28 seconds

$

Is it possible to take a list of ports to scan from a file?

Try a single line port specification without spaces, like such:
$ cat ports.list
21-23,25
$

That works as expected:
$ nmap -p `cat ports.list` host.example.com

Starting Nmap 7.60 ( https://nmap.org ) at 2021-03-25 15:07 UTC
Nmap scan report for host.example.com (192.168.1.17)
Host is up (0.00089s latency).

PORT   STATE  SERVICE
21/tcp closed ftp
22/tcp open   ssh
23/tcp closed telnet
25/tcp open   smtp

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
$

Note that in the answer you reference, he used 'tr' to translate one-port-per-line into single-line-comma-delimited.


"Sniffing" Wifi Password? I wonder if the follwing is possible:

Assume you want to gain access to the AP "ap".

Isn't it possible to set up a hotspot with the same BSSID, so that clients think that you are ap and send the password to authenticate?

Please explain if this / why this is not possible. Thank you!

Let's start by thinking of what would it happen if we had 2 different networks with same SSID (say SSID_share), but evidently different BSSIDs (MAC addresses).
What happens if there are 2 different networks with same SSIDs?
Each router sends radio waves which are then decoded by your wifi software manager. It will probably understand that both networks are actually the same, since they have same SSIDs. So it shows you only one SSID to connect to. Now, depending on which AP is closer to your wireless network interface, you are going to connect to one network or another.
For instance, consider your legitimate network A has password MyPass and the fake one B has password MyFakePass. If a client is really close to A's AP (say in the same room) and significantly farther from B's AP (say another level), then B won't affect him.
What happens if a client tries to log into the fake network?
Suppose now a client is closer to the fake AP than to the legitimate one. Without noticing it, he is going to connect to the fake SSID_share. He will not be able to authenticate, though, since passwords are different.
Can an attacker read the password logged from a login attempt?
That acctually depends on the authentication system being used. Fortunately, for WPA2-PSK (pre-shared key) the answer is NO. WPA2 does not send the password to the gateway. In fact, the gateway sends a time-changing challenge created using the plaintext password. When a client wants to authenticate it generates a one-way answer to that challenge 1. So the attacker will never get the password in your logs. The best he could do is try to use brute force techinques.
PS.: Don't know why but I have a strong feeling you did not ask this question for noble purpose :)


Learning IT Security while being paid Is there any program out there (from the government or the private sector) where you can learn IT Security (from senior workers) while getting paid (to do the basics as you are learning)?

To make things a bit clearer:
I would like to go in to pentesting, and I'm wondering if there is a place (or organization) that will hire newbies and pay them while they intern (possibly in return for a few year contract etc.)

What is your experience level thus far?  What sort of IT Security role are you looking to get into?  Generally, you're going to have some level of expertise in one or more of the common domains.  System Administration and Network Administration are probably two of the most common entry routes.

That said, you shouldn't be looking to shortcut the game.  If you're going to keep your credibility while talking security principles and best practices with your peers, you definitely have to know what you are talking about.

If you don't have any experience, then I would say if you could get a junior network or system admin job straight out of the gate, you are probably doing VERY well and/or know someone.  And you can start to pickup what you need to move forward.  A lot of the folks I know, myself included had to start out in desktop support or helpdesk, that's not bad either.


How to remote access a server behind firewall? I have a server with defined IP address (it is for my own usage). I would like to use it from remote access. The server is behind a firewall. Is there a way to access it from remote computer? Is TeamViewer going to do the work? Is there any other solution without a need to open a port?

I would like to mention that in both the server and the remote computer the OS is Windows. In the server Windows for server and in the remote computer Windows 8.

There are several possible solutions. TeamViewer will work because its basicly whats called a "backconnect". This means that TeamViewer from the view of the firewall acts as a client, not as a server by initializing the connection instead of waiting for the incoming connection like a server does. This way TeamViewer bypasses statefull firewalls.

If you want to you can also use a port forwarding. This means that you configure your firewall to foreward all incoming traffic from external hosts on a specific port to another host on the LAN. This is called PAT (Port Address Translation) and is widely used. How this can be implemented relies on your router but almost every routers support this.
You can also expand this solution with portknocking which is a "security through obscurity" kind of approach. It means that a connection is only accepted after a defined packet has been received before from the same source.


Secure Software Distribution: Is serving a file through HTTPS good enough? I'd like to know whether HTTPS can be used as a secure means of software distribution.

Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?

If no, what other ways are there to securely distribute software?

Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?

HTTPS only secures the transport. If this is your only problem then HTTPS is sufficient.

But, HTTPS does not secure the files at the server, nor does it secure the transport to the server (unless you use HTTPS too or for similar security SSH). It does also not protect your computer so it might be possible that the binary you ship already contains malware (would not be a first).

  If no, what other ways are there to securely distribute software?

A good idea is to start with security es early as possible. I.e. make sure that the build itself is fine (no malware on your machine, source code not compromised by including suspicious third party code...) and then sign the binary, see Wikipedia on Code Signing. If any changes are done to the software after the signing process the signature will be invalid.


How to identify this hashed text and if it encrypted using a key? I have 2 hashes which I don't remember which type of encryption I used or if i used a secret key.
can you help me identify these I will just give all details but not paste the whole hash here.
hash1
start: qe$weroodjf end:ejosfkgowieorjwr  length: 71 bytes
hash2
start: bHQ4VNwAbe3b end: TagEhBhrpZXVPqr6jQ== length: 152 bytes
NOTE: there was originally 157 bytes but it was white space i don't if I pressed accidentally or it was there.

For the second one, I think you mean 152 characters, not 152 bytes.  The character set looks like base64, and the equals symbols at the end are another tell-tale sign that this is probably base64, as equals symbols are often used for padding in base64.
In base64, each set of 4 characters represents 3 bytes.  You have 150 characters of actual information (again, the last two equals symbols are padding).  This equates to 112.5 bytes of data ( (150/4) * 3).  That equates to 900 bits of data (8*112.5).
That's most likely not a hash, as no standard hashing algorithm produces a 900-bit result.  It's most likely not the result of AES encryption either, as AES produces blocks of 128 bits, and 900 is not a multiple of 128.


Feasibility of time-based database brute-force attacks on websites I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier if the beginning of the string is different than if the end is different and the previous characters are correct. If the attacker manages to get exact isolated access to the query time, the tries necessary to find the correct string  significantly decreases in comparison to standard brute-forcing.

Is it even possible to isolate the query time on a remote webserver given there are constant visits of other people and running background processes?

If this is in fact a threat, what are best-practice solutions to secure webservers?
Things I thought of:

Hash the input strings in order to obfuscate the character sequence.
Add some kind of minimum response time to related queries. Probably bad idea because it may open up DOS attack-vectors and might not be feasible with typical PHP/MySQL-scenarios due to poor multithreading support.

How feasible the attack is depends on how much noise you have to remove to get to the signal you want to have. If you can do a lot of tests against the website you should be able to increase the level of signal which might be enough to filter out enough noise to make this kind of attack feasible. But details depend a lot on the actual setup of the system you want to abuse.

To fight this kind of attack you use operations which are deliberately constructed so that their behavior does not depend on the input. Such algorithms are an important part of practical cryptography, not only for simple string comparison but also for hashing and encryption. And timing is not the only side channel but you have also need to look at power consumption and even weirder side channels like radiation.

And you probably not only need to have a look at timing attacks against string comparison. Your web application might leak other data which makes brute force easier, like behaving differently if the username exists or not.
Please also note that simply hashing before comparison might not help if the hash function you use is not resistant against timing attacks itself.

I think the best approach if to have some serious rate limiting for the number of login attempts. This not only makes brute force much harder but also will probably make timing attacks infeasible because their is too much noise around and the signal can not be amplified due to the rate limiting.


HMAC password reset link and replay attacks I like the look of this technique for sending password reset links:

https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/

(TLDR: don't store token in database. Send password reset link w email address, expiry time, and corresponding hmac)

especially after reading about the Mozilla / Bugzilla reset bug.

It seems like it's vulnerable to replay attacks though.

Q1: Under what circumstances is it vulnerable, assuming good HTTPS?

I think someone monitoring my network traffic (at say a wifi hotspot) would not be able to simply replay the GET request to the link, correct?

Q2: If it's only a replay attack if an attacker has access to my email or physical access to my computer, isn't token-based password reset equally vulnerable, as the attacker could simply request a new link?

The major risk of email password reset systems is the SMTP transport of the reset token.

Any competent email infrastructure will use either HTTPS (HTTP/TLS) webmail, IMAPS (IMAP/TLS), or POP3/TLS, or a proprietary protocol like MAPI/TLS.  If not, get another provider ASAP.

Your visit of the reset token link itself use HTTP GET over TLS and the only thing the attacker can see is TCP connection level info (source/dest port/address).

This leaves the attacker with only SMTP interception on the Internet, at the sender network, or at your mail provider's network.  That's not economical for most attackers unless you are a high-value target like a CFO or other individual with valuable privileged data access.

If the attacker has access to your email via account compromise they can get new reset links.  A two factor token would mitigate that.  If the attacker has compromised your endpoint they can steal your session directly.  A defense for that is for the application to lock sessions to particular hosts.


Downloading and updating the software via Playstore I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account.
Here my question is that how can trust that I'm securely  communicating to download and upgrade the software of my phone and also assure that the software downloaded using my account is 100% trusted and safety ?

The play store uses SSL/TLS to ensure the integrity of your downloads, just like your web browser. Basically it downloads metadata for a particular package including a plain HTTP URL and a checksum of the binary. After the download it compares the checksum to the APK and ensures they match.

  how can trust that I'm securely communicating to download and upgrade
  the software

This gives you a reasonably strong assurance that the download hasn't been compromised during the communication process, however if the TLS can be compromised then the metadata request containing the download URL and checksum can be tampered with.

Compromising TLS wouldn't be trivial to most adversaries, however TLS depends on the integrity of the 150 root CA certificates installed on the device. Many of these trusted CA certificates are controlled by departments of various governments including the US and China. If your adversary has the resources of a nation state then there is a good chance they could compromise your downloads.

Also there is the potential for an attacker to trick the user into installing a malicious root CA certificate via social engineering techniques such as phishing. Android has reasonably strong defences against this though, including a warning in the notification bar whenever additional CA certificates are installed.

Another layer of defence is that certain permissions can only be accessed by APKs signed by the same certificate as the system. This provides additional protection for system Apps such as the settings App.

  assure that the software downloaded using my account is 100% trusted
  and safety ?

What I've mentioned above ensures that your download is what you wanted to download. It does not guarantee that what you intended to download is trustworthy or safe. Google does some automated scanning of submissions for malicious functionality (they call this system "Bouncer"), however I'd only consider that a first line of defence.

In general you should apply the same discretion to Apps as you would to PC software.

Only download from trustworthy vendors
Check reviews and feedback
Check permissions manually and thoroughly
Don't install software you don't absolutely have to

Etc, etc.

Note: My answer is applicable to Android 4.4.4 and Play Store 4.9.13, however it most likely applies to newer versions too.


Are URL shorteners "vulnerable" due to open redirects? The OWASP state that open redirect is a vulnerability:

  An open redirect is an application that takes a parameter and
  redirects a user to the parameter value without any validation. This
  vulnerability is used in phishing attacks to get users to visit
  malicious sites without realizing it.

However, it's trivial for an attacker to create a phishing URL and get it shortened, thus "get[ting] users to visit malicious sites without realizing it".

Does this mean that all URL shorteners (e.g bit.ly, goo.gl, etc) are by definition vulnerable?

How can a URL shortener be fixed/modified such that it does not violate OWASP?

URL shorteners meet the definition of sites with open redirect vulnerability, yes, but it would be perverse to describe them as vulnerable when their sole purpose is to act as an open redirect.


Client app auto-updating passwords, no SSO My customer has an ActiveDirectory server and a work server, both without SSO. Employees use their ActiveDirectory account to connect to the work server.
They change passwords every month.

My app connects to the work server. My app can use SSO, or can let users set a password manually.

For some reason my customer does not want to implement SSO, but their employees are fed up with manually changing their password every month.

QUESTION: Can I do anything about it?
I believe it would not be secure for my app to somehow get the changed passwords from ActiveDirectory or otherwise connect to the work server without knowing the new passwords, and without SSO. Might it be able to work securely using hashes maybe?

(If that matters, the work server is Alfresco)

Your application should be able  to use ADFS or LDAP to send authentication questions to the AD, without your application having to know anything about the users and their passwords. You'd essentially use the AD as a directory server.


Where is the data generated by ettercap -T -i wlan0 saved? I executed this command out of curiosity:

ettercap -T -i wlan0

After a couple of seconds, it started flooding my terminal emulator with loads of data (sniffed data, I guess). I think this data is going into some kind of cache memory or something. I want to know where is this data saved?

Is this data really saved somewhere? Or does it vanish after the operation?

As per basic bash syntax you can use ettercap -T -i wlan0 > dump.pcap to redirect the output to a file instead of printing to stdout.


The best way to change my pgp key I would like to change my pgp key because I have the same one 2 years ago. But, I want to warn my freinds that the owner of the old key and the owner of the new one is the same person (me). hwat is the way I can use to prove I am the owner of the new pgp key ? Include it on the revocation certificate of the new one ?

I would personally probably sign my new public key with the old private key and send it to my friends with an e-mail explaining the change.  They could then verify I was the holder of the previous key and are made aware of the change.  I'd then post a revocation of the old certificate and include the details of the new one if supported.  (I'm not that particularly familiar with PGP, just general PKI.)


Security implications of attaching a wireless printer to network I am looking at these instructions which suggest basically giving the wireless printer your network password to configure it. I don't know enough about security or networks to know the implications of it and wanted to know if there are any potential security risks in doing this. It seems more secure to give it the network password so it can use the network, rather than directly connecting it via ethernet to the router. I don't think just by giving it the network password it could do anything, but perhaps it opens up the possibility of broadcasting that network password to a centralized place on the internet, which allows others to connect into the network remotely haha. I don't know, just trying to learn more about security with each new device I'm exploring. This and its links to other articles was helpful.

Giving the printer the password for the WiFi (which I assume you mean with "network password") is similar to connecting the printer directly with ethernet to the router: it allows the printer to be part of the network.

The main difference is that bugs in the printer might make it possible for an attacker to extract and misuse your WiFi password even if the attacker itself is not already connected to your network, for example using your browser as a trampoline within a DNS rebinding attack. This can of course not happen if you connect the printer directly with ethernet and don't provide it with the WiFi password since something which is not known to the printer in the first place cannot be extracted from it.

Another advantage of direct ethernet connectivity vs WiFi is that you usually have one potential layer of problems less to debug in case of connectivity problems to the printer. Thus, if the printer is near the router anyway it is better to use an ethernet cable to connect these instead of relying on the more flaky WiFi.


Why does Chrome display "Your connection to website.... However, this page includes other resources which are not secure...”? I know there is a similar post, but I thought this one is different because I do not get this consistently, the message and icon are different.  Please compare the message with that of the so-called "duplicated" question, so you can see the difference.  Any light shed on this will be appreciated.

Chrome shows the following:

There are two pieces of information in the message:

The site has outdated encryption. The site is probably using something less than TLS 1.2. You should probably fix it but not a big deal.
The page is loading an insecure component. This can be 3rd-party widgets, ads, analytic code, social bookmark buttons, etc...

I'm guessing that you only get the message when both are true. I'm also assuming that you haven't run into a Chrome bug.

The intermittent nature makes me think that you have some JavaScript on the page that is dynamically choosing what URL to insert into the page. Sometimes this URL uses HTTPS, other times it uses HTTP. You get the error message when it's HTTP. This JavaScript can be in your page or one of the components that your page uses.

Please post when you find an answer. This is a fun one.


Computer name naming convention for security I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup).

I would like to report this so that they use less obvious computer names and it becomes harder for an attacker to identify machine roles on the network. I would like to give some weight to this proposal by linking to some security naming convention from a trusted organisation. After some search, I've been unable to find some. Is there any existing ?

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names.

I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names.

This is how I would assess those conflicting measures:

Use unpredictable host names

Benefit(s)

An attacker will need to spend (significant) more effort in determining the layout of your network and to identify the most profitable targets for a penetration attempt.

Risks

Operator error. Users and administrators may have difficulty identifying systems  and their correct roles e.g. confusing test and production systems.

Probability: high
Impact: high

Rationale: Most humans have terrible memories where "random" data is concerned --> high probability.

Also there are usually very few barriers that prevent trusted users and administrators from making high impact mistakes  --> high impact.

Use predictable host names

Benefit(s)

Reduced operator error rates, ease of management and automation.

Risks

Attackers will  also have an easier time determining the layout of your network and to identify the most profitable targets for a penetration attempt.

Probability: medium
Impact: low

Rationale: Not every naming convention is immediately intuitive to a black-hat  attacker --> medium probability.

Also using hostnames to predict a network layout is only a shortcut, but doesn't provide information that an attacker wouldn't be able to learn through other means.  And  knowledge of the role of a server as disclosed by a hostname does not automatically make it more vulnerable (only more or less valuable). --> low impact.


Secure Boot - Usage of blacklist DB I have been reading up on the details of Secure Boot, in particular the authorized and forbidden databases:

  Before enabling UEFI Secure Boot (by setting the PK) the white and black lists DB & DBX must be set up with authorized and forbidden certificates and signatures. Recall that DB contains authorized signing certificates and images while DBX contains blocked signing certificates and images.

The above is from http://gschwinds.net/cache/SigningUEFIImages-1.31.pdf

What is the point of having the black list DB when we have a white list DB already? If a certificate/signature is found to be comprised, wouldn't just removing it from the white list be enough? Am I missing something here as the black list DB of comprised signatures/certificates just seems redundant to me.

I believe that it is designed this way to circumvent technological limitations. Remember that the BIOS is written in a low-level programming language (Assembly or C), which are not object-oriented obviously. As such, assigning attributes to a signature or certificate that determine whether it is black- or white-listed is not an option. You can not just put them all together in a single 'database' (array, register) - there's no context. The only way to determine whether a signature/certificate is black or whitelisted, is based on the 'database' it is stored in.

That being said, there's still no clear need for two separate databases: you can block everything that is not in the whitelisted database - right? However, look at the below UEFI Secure Boot algorithm to determine whether an image shall be loaded or not (copied from the paper you referenced). You can see that an image which is signed with an authorised (whitelisted) certificate can still be denied if its specific signature is blacklisted... That is not something you could have accomplished by having only a whitelist and blocking everything that is not explicitly in there.


Handling "forgot password" functionality with encrypted data without security questions As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web application without using security questions?

From a security standpoint, the problem boils down to needing a second key to unlock the data in case the first (the password) is lost, leaving:

Security questions

I would rather not implement these due to both security and user-experience concerns (in my experience, either the questions will be so obscure that the user likely won't remember them, or the answers will be publicly-available information, defeating the whole purpose)
This is certainly the approach that most users would be familiar with, and will be the one I implement if I can't find any other good solutions

A backup key

An example being Apple's "Recovery Key", which you are supposed to print out when you enable two-factor authentication for your Apple ID
This is an extra step that the users will either not take, or will take and later lose their recovery key, leading to confusion and a poor user experience
Other possibilities include an app on the user's mobile device that stores a second key until needed, but that seems like overkill to me, and likely a step that the users will forget about, leading to the app not being re-installed when they get a new phone, for instance

Some form of key escrow

My first thought here was to allow users to connect an external account with OpenID Connect, but none of the common providers (Google or Facebook, for example) return any sort of unique, stable, and secret value that would be useful as a second key into the account (the closest thing from Google is a unique account identifier, which every site requesting access to their Google account will receive)

Are there any options that I've overlooked here, or any clever solutions anyone can think of that don't involve security questions?

EDIT: To clarify, for this specific application, it's a requirement that I (or any other developer or administrator of the system) not have access to any of the unencrypted data, at any point in time. This means that methods such as sending a one-time code will not be sufficient, as it requires that, at some point, I have access to the key to decrypt the data. (This restriction excludes the brief amount of time that the key is in memory when the user submits it in order decrypt their data. I'm more concerned about offline decryption of a dump of the data than the application itself being compromised to leak/store keys)

I agree with you on the security questions issue.

How about having the users give you their mobile number as a backup so that you can then text them a one time code, which they will then enter to prove they are who they say they are? It is actually how Yahoo does this now. You can create a free account there (or probably already have one) and test this feature.

The only issue is that it requires your users to have mobile phones. Though, you have already mentioned mobile phones in your Key Escrow solution so I am guessing your users will be expected to have them.


Why must I have a "strong" password for sites like this? I don't share any personal information with StackExchange, I'm not really worried about anyone trying to hack my account and I can't see any incentive for them to do so, and yet the password strength requirements are about the strongest I've ever seen.

Why does this site, and others, insist on strong passwords? What's the reasoning behind it? I can understand why my bank might insist on high security, but isn't it up to me how secure I want to be on here?

Do you remember earlier this year when Apple's cloud was hacked?

Well, Apple's cloud wasn't hacked. Some celebrities with really weak passwords had their passwords guessed.

But the headlines will still read that Apple's cloud got hacked. And that is why you don't allow users to use really weak passwords.


Credit card number entropy? I want to confirm that this understanding is correct:

A card has 16 digits plus a CV2

The first 6 digits are an issuer identification number

The last digit of the 16 is a Luhn mod 10 check digit.

This leaves 9 digits in the middle.
Are these 9 digits random, as in, unguessable ?

The last 3 digits, the CV2, are these random also?

Yes, the first 6 are an issuer ID

Those middle 9 digits are unguessable in the sense that should you try to brute force them with a payment processor they'll catch you.

If somehow you had a hash of the complete CCN (or an encrypted version and the public key) you should only need a maximum of 10^8 (100,000,000) attempts to figure it out, as Luhn's decreases the complexity by one order of magnitude.

To calculate a 3-digit CVV, the CVV algorithm requires a Primary Account Number (PAN), a 4-digit Expiration Date, a 3-digit Service Code, and a pair of DES keys (CVKs). source


I'm running Android 4.1.2; it includes known vulnerabilities. Installing a newer firmware image would take time and effort. Must I really do so? Background

My Android phone is rather old. It's running stock Android 4.1.2, which includes known security vulnerabilities. Unfortunately, this is the latest firmware which T-Mobile offers for this phone. Still, I'm fairly happy with Android 4.1.2.

I plan to upgrade to a newer phone in the future. Maybe a BlackBerry Priv, in a year or so, once the price of a used Priv falls has fallen some more. But not yet.

I generally only install apps from the Google Play store or from F-Droid; normally not from other sources. I surf the Internet a fair bit, normally using either Google Chrome or Firefox. I'm not picky about making sure that I watch videos hosted only on trusted websites such as YouTube; I'm willing to watch online videos hosted anywhere. I install app updates from the Google Play store perhaps once a month or so.

I don't have a data plan; I use Wi-Fi sometimes. I do download and view MMS messages from friends. I never receive MMSes from strangers.

My device is rooted. I use SuperSU to let me decide which apps can become root. I only let an app become root if I have a good reason to do so.

I see at xda-developers.com that there are various third-party "ROMs" (unofficial firmware images) available for my device, including CyanogenMod and others. If I install one of these ROMs, I can end up with a newer Android version, including all of its security fixes.

I already have ClockworkMod Recovery installed, which is a tool which helps to install third-party ROMs. I have a current backup of my existing stock ROM; the backup is stored on a MicroSD card.

My question

Like I said, I am running Android 4.1.2, and it does include known security vulnerabilities. But I'm not a security professional and don't really know how bad these vulnerabilities truly are.

I would rather not install a third-party ROM. This would require time and effort.

Is it important for me to install a newer ROM? If so, how important is it?

That depends how important is anything you do on the phone. If it is prepaid plan and you only anonymously watch youtube clips and surf the web, the worst that could happen is your phone becoming just another of zombies in some botnet and use up your credits and spy on you.

If it is postpaid, it could build up your phone bill with extra data usage, calls and sms/mms to who-knows-where. If you use it to access email, it could destroy or takeover your email account. If you use it to enter credit card details for online shopping, your credit card could get maxed out. If you are famous person, your pictures and homemade videos could make some paparazzi very happy. And so on. So it really depends.

Another question is how likely you are to be exploited. That is also pretty hard to say. If you drive Audi A7 while under influence of alcohol, how likely is it you'll have an car accident? There is just no way to tell (even if you provide much more detail), and even if we had accurate statistics, they still won't tell what happens to individual.

So, you should assess what is the worst risk that can happen if your phone is taken over, how likely you think that may be, and how much effort are you willing to put in to avoid it. Nobody else can do it for you but you...

About exploits - some are pretty bad, other less so. It depends mostly on your luck... Judging by amount of red stuff there, I'd upgrade if I were you...


Analog CCTV over wireless I work in a security company, and we have a client who would like CCTV put in around their premises. They have an existing analog system (over COAX) that we were going to replace, but he would also like some extra cameras on a separate building and it is not feasible to dig a trench the whole way.

We were trying to find the best way to do this but have had no luck. is there any way to convert analog video signal to a wireless signal that is then picked up on the other side, or if that is not possible is there a way to convert the coax to a CAT5e cable that we can then use a wireless network to connect with?

Thanks

Using wireless for security devices is a very bad idea as it can get jammed. No matter how good the crypto is, an attacker doesn't have to actually break it but simply flood garbage data over the frequencies with a stronger transmit power than the legitimate device and your CCTV goes dark.

I highly suggest you rethink your approach and switch to wired cameras (if possible network cameras - coax and analog are a thing of the past).


Is TLS 1.2 client authentication really different from that earlier ersion of TLS From wikipedia link (cannot post due to stackexchange constraints). "http://www.yassl.com/yaSSL/Blog/Entries/2010/10/7_Differences_between_SSL_and_TLS_Protocol_Versions.html" and  and also from the RFC http://tools.ietf.org/html/rfc5246
, I don't see any major differences in client authentication between TLS 1.2 and earlier version. However, at the same time, there is no specific statement that says that they are similar. I need to do a check to understand this before starting to work with TLS 1.2. I am wondering if due to the other changes (e.g. changes like this

-There was substantial cleanup to the client's and server's ability to specify which hash and signature algorithms they will accept.

-Addition of support for authenticated encryption with additional data modes."

it may be implied that TLS 1.2 has notable differences. Inputs are welcome.

Client authentication in TLS normally uses a client certificate and the method by which the client is authenticated has not substantially changed since SSL 3.0: during the initial handshake, the server asks for client authentication (a CertificateRequest message), and the client responds by sending his certificate and then a signature computed with his private key over the concatenation of all the previous handshake messages (which includes the two "random values" sent by the client and the server, and also the negotiated cipher suites, the server's certificate...).

There are details, though. A signature algorithm uses a hash function, and the hash value is then used with the private key. Up to TLS 1.1, the client necessarily used the concatenation of MD5 and SHA-1 as "hash function". With TLS 1.2, client and server send to each other the list of hash functions and signature types they support, so that the client may choose an "appropriate" hash function, and also an appropriate certificate in case the client owns several of them.

The pre-1.2 method employs a "special padding" with RSA: in PKCS#1, the hash value is first stored in a structure which identifies the hash function (in practice, a fixed header is attached to the hash value), and that encoded structure is then padded with some bytes (most of them equal to 0xFF) up to the key length. In the signatures used from SSL 3.0 to TLS 1.1, the hash value has length 36 bytes (16 bytes for MD5, 20 bytes for SHA-1), and there is no header: the 36 bytes are directly used in "type 1 padding". With TLS 1.2, only one hash function is used (negotiated between client and server), and the header is back.

Thus, TLS 1.2 aligns itself with the PKCS#1 standard and supports many hash function, which should improve interoperability. Yet, it is conceivable that a specific hardware token for the client private key (e.g. a smart card) could be incompatible with TLS 1.2 (if it supported only the 36-byte-hash-with-no-header mode of older SSL/TLS). In that sense, TLS 1.2 might break compatibility with deployed tokens (this is rather improbable, but still warrants some tests). For software implementations, this should not be an issue.


For which content types is it recommended to set X-XSS-Protection header? One may probably suggest setting this header for all responses from a web server (I am thinking of value="1; mode=block").

However, does it make sense to set it when serving, say, images? CSS files? JSON responses made from AJAX calls?

Does XSS Auditor care about presence of this header when processing these responses?

If you decide to use X-XSS-Protection, you should set it for any page capable of running active script content. Non-executable formats like CSS or images are not affected by the header.

Note that SVG images, despite being able to run script code, apparently don't respect the header in Chrome which suggests that it is only applied to HTML documents. Proof of concept:

<?php
header('X-XSS-Protection: 1; mode=block');
header('Content-type: image/svg+xml');
?>
<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg">
<?php echo $_GET['foo']; ?>
</svg>

Run it in your browser like this:http://localhost/xss.php?foo=<script>alert(1)</script>

In my tests, the reflected JS from the parameter is executed although the XSS filter is active. But if you change the content-type to text/html, the JS will be properly filtered.

(Also note that the use of the X-XSS-Protection header is controversial and can result in new vulnerabilities which is why Facebook even decided to deactivate the XSS auditor entirely. And be aware that setting the header doesn't replace proper output escaping.)


Why isn't PKCE encouraged for Single-Page Apps? A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta - now recommends PKCE w/ implicit fallback, Google, Auth0)

Some newer guidance out there points towards using the Authorization Code Flow without a client_secret in the token exchange step, which I can agree makes sense for the reasons cited in the article (e.g. tokens don't live within browser history, web logs, etc.). Why isn't this concept taken a step further with PKCE? Instead of omitting the client_secret completely, why not utilize a dynamic one as it is recommended for native applications? SPAs and Native Apps are both considered "public clients" where a secret cannot be safely kept, but only Native Apps get the PKCE recommendation while SPAs seem to be kept in the past.

I understand the security implications PKCE is trying to solve doesn't directly relate to a browser only context, but couldn't this be viewed as a defense-in-depth mechanism and utilized anyway? I know from experience Google won't let you generate a Web Application Credential and try to use anything but implicit for a SPA (see this issue), the Authorization Code flow will expect a client_secret and the PKCE exchange only works if you choose a native app credential type but then you can't specify https redirect_uri's for your application.

Other providers allow PKCE with Authorization Code flow in a web-context, but it isn't recommended from them. Am I wrong in wanting this and utilizing it? It seems fairly trivial to add the additional steps of generating and passing around the code challenges with the Web Crypto APIs available (targeting newer browsers and shimming as needed).

@catanman makes excellent points regarding the technical considerations around PKCE in SPAs, however just recently the IETF Oauth working group has published a best current practice document (December 28, 2018) stating:

  Note: although PKCE so far was recommended as a mechanism to
  protect    native apps, this advice applies to all kinds of OAuth
  clients,    including web applications.


mifare desfire ev1 security with wiegand and rs485 I have learned a lot on access badge rfid but something there is not much in the google world.

I know Mifare Desfire ev1 works like apps with several keys for each app.  As of now it is the most secure.

What I am wondering is for an access control system the security of the desfire isnt taken in to account if using the wiegand format (from reader to controller)?

As I understand it the reader would need to know the encryted keys to use authentication tokens.  The MT15 that I am really looking at I cant find anything about adding encryption keys.  I couldnt find anything on any readers about changing/updating encryption keys on the reader.

How can mifare desfire be used with the best security when it comes to access control systems?

UPDATE:

Turns out the MT15 has a standard encryption key they use and also put in their badges.  If you want to change it you have to work with them to do so (I called).
 Also have to get special keys that use the new encryption key.  Elias answer was exactly right you just cant do it yourself with that reader.

Normally you use key diversification. That means you start with a masterkey M and then you have some key derivation function KDF which maps the masterkey and the card id ID to a card specific key C(ID) for each card.

C(ID) = KDF(M, ID)

This process is used when creating the keys on the cards and in the reader every time a card is trying to authenticate.


How is my school blocking new Internet traffic after midnight? My school supposedly cuts everyone's connection at exactly 12:00am. Although the network is still there, Windows shows the "no internet" sign when connecting to the network.
However, the strange thing I have been noticing is that although the school wifi blocks new connections (for example connecting to a new website or watching a new video on youtube), it doesn't seem to care about the connections that it already has (for example, it doesn't cut your connection when you are watching an hour-long youtube video).
Also, it doesn't seem to block your connection if you are continuously connected to a VPN, but cuts you off as soon as you disconnect from that vpn, even when you turn your VPN back on.
Does anybody have any idea how this internet connection control works? (if it is used widely and has a name, please tell me) And is there a way to bypass this block without connecting to a VPN?

It looks like they add a rule to the firewall to deny outgoing connections. Since it is a stateful firewall, any new traffic is a new "connection". Existing traffic streams are unaffected since it is not a new "connection", but a part of the existing stream.
VPNs are a constant connection and traffic is tunnelled through that.
Example using iptables:
iptables -I OUTPUT -p tcp --dport ANY -m state --state NEW -j REJECT


Sending multiple Content-Length headers in a HTTP POST request using Javascript I'm playing around with a self-xss bug that I believe I can escalate with a CSRF attack. However, the exploit relies on sending two identical Content-Length headers in a single POST request.

Essentially, I'm looking for a piece of Javascript code that will make the visitor's browser issue a request that looks like this:

POST /authenticate[xss payload]
Host: target.net
Content-Length: 4
Content-Length: 4

whatever=whatever

It doesn't matter if the Content-Length is correct or not - there just has to be two identical Content-Length headers.

Sorry if the answer to this is trivial, I hope you can cut an infosec n00b some slack.

Content-length is a special header which can not be set using JavaScript in the first place, i.e. it is one of several forbidden header names. You might try HTTP request splitting to bypass this restriction but it is unlikely to work on modern browsers.


Mentioned On A Blog By A "Hacker" - Should I Care? Some (insert noun here) who seems to be a black hat hacker thinks that I am his #1 enemy and has posted some of my information on his blog. He is mad because I am advertising for others. The information he posted on his blog can be found using Google. He has also sent me some tweets calling me every name in the book. By reading his blog and Twitter, he sounds like he has some anger issues so I'm probably not the only person who he has targeted. He didn't post any personal information (name, address, phone number, etc) which I'm glad. I'm wondering if I should be worried about this? Is there anything I can really do? If this continues, is there anything I can really do (considering he's in a different country)? Is there anything I can/should be prepared for him to do to me?

So there is nothing you can do about his activity, except to ignore it as the comments suggest.

What you can do, is to re-evaluate your security practices, and make sure your house is in order in case he decides he wants to try to do some digital damage, to ensure you're as well protected as can be.

This means:

Choose strong passwords.
Don't reuse passwords.
Turn on two-factor auth anywhere that offers it.
Watch your bank accounts and credit history for anomalies.  No need to be paranoid, just keep an eye on it.
Don't associate email accounts with other online accounts unless your email account offers two factor authentication.
Clean up after yourself.  Don't leave junk hanging around in the ether for someone to find and possibly use against you.  Delete old email you don't need.  Don't create accounts on websites you won't ever use again.  Delete shared files that are past their prime.
Be careful about clicking links in emails.  Don't if you can avoid it, and watch for other forms of phishing and malware delivery.
Don't install/enable crap you don't need (Java in the browser) and keep the things you do need updated. (Flash, Acrobat Reader, etc.)

I'm sure there are other things you can do that aren't coming to me off the top of my head, but this is a good start to ensuring that anyone who wishes you harm will have the bar raised on progressing beyond Internet taunts.


Does connecting an android device via usb to a PC pose a risk if charging is selected? If an android device has some something malicious on it that can also target/affect PCs. And that device is connected to a PC via USB, by default it automatically chooses to start charging.

Is there any risk that anything could be transferred to the PC? As in, is it possible for a split second before it chooses the "Charging" setting that it allows some data transfer to the computer?

At work we are warned not to connect and USB devices to our computers but a colleague had told me that they charge their phone (Google Pixel - Android 9 Pie) via USB and since charging is chosen by default it's fine. While this seems totally logical wasn't sure if it was exactly true?

Theoretically, there is definitely a risk, though practically (with that specific phone), the risk is mitigated; regardless, no USB policy should mean no USBs of any kind are plugged into the computer (not just flash drives). What's preventing the phone from acting just as if it's a flash drive (hint: it's the software) - they're communicating through the same port and data lines.

You are assuming the phone's manufacturer is secure - Google hasn't tampered with the hardware, OS or firmware
You are assuming the phone's OS is secure - Android doesn't act maliciously and is bug free.
At a nation state/APT level, you are assuming there are no zero-days exploits (take a look at Stuxnet)

TLDR: no USBs of any kind should be plugged in.


What encoding could this be? Looks similar to base64 I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know.

The second part (26 characters) looks base64-ish but it's not. It sometimes contains a dash or a dot. Here are three examples:

m1inhO2VNYBgOSLJWAeluQjlgf

ev25cx6cHsjpyK8hArabg-jjMs

CZzyYFLg0AIimHNy.fadAppubt

I'm not asking you to tell me what the values mean, just a hint which encoding it could be. It's a Java EE web application.

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet.  This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web application developers do when they think they're being clever (they're usually quite wrong, thinking it's harder to suss out than it is).

I haven't tried to do so, but given a large enough encoded text sample, deciphering the custom alphabet used is quite possible.  You just need to determine the contents of the alphabet, then it's a reconcilable problem to just try different orders out.

(If you build the custom alphabet and it's not 64 characters, it might be another base.  There's nothing magical about base64.  If I recall correctly you can even go crazy wild like base53.)


ret2libc calling function arguments order While I was studying ret2libc, I saw that tutorials use:

call_to_function + ret addr + arguments

For example I understand that if I want to execute system function from libc I can use the following  scheme:

system_address(that overwrite eip) + addrsssOf_exit_function + arguments

What I didn't understand is why we use this order if before calling a function the arguments need to be already on the stack.

If I overwrite the eip the next instruction called is system but we don't have already the arguments, right? What's I'm missing?

It can be confusing indeed. What you have to consider is that you are not interacting with the stack in the same way you would if you were writing code. The stack grows down, but your data in the buffer goes from bottom to top. Also, items are popped off the stack from the bottom.

Your buffer overflow allows you to populate the stack in one shot. You will overwrite the stack starting at the bottom. So, when a ret is reached, the program pops the next thing on the stack, which is the address of system() in your case. It then pops the next thing, which is the return address for that function. Finally, the last thing to be popped off the stack is the argument to system().

In summary, it just has to do with the ordering of the stack. It may help to watch the stack while stepping through the program after overflowing the buffer (using GDB or debugger of choice).


OSSEC capabilities for handle a virus that already spread into the deepest system As far as I know, OSSEC is a Open Source HIDS. It's a "Detection System". I read in journals, it collect logs and flag any anomaly that had been found in a system ( e.g. Debian Server ) and do some action with it.

Some of the OSSEC's rules, there's like a possible way for prevent the anomaly for doing it action like, prevent brute force by blocking an IP for 600 seconds if the authentication failed 2 times.

Is there any rules, or some active-response command that would stop some virus or anomaly from spreading, infect and crushing our system. Is there ever any demostration regarding those condition ? where could i find it ?

what i have tried is like blocking an ip for brute force attack (FTP, SSH), but what about if the hacker are in some condition could prevent the ossec rules blocking ip, and he started to spread some unwanted files/document as known as virus ? Is there any footage or demonstration about that ?

My question, How can OSSEC handle a virus that already spreading ? OSSEC is just like detect the anomaly and do some action. Is it possible ?

Yes, basically you've answered your own question. Active response allows you to run any commands. Since it accepts executables, start with shell scripts, chmod it and the script will run when the corresponding trigger comes. Then you can enhance it further with python scripting to do more things not possible by bash. You'll need some programming but because active-response allows any executable to handle the triggers, the possibilities are endless.

Start here:

http://ossec-docs.readthedocs.io/en/latest/syntax/head_ossec_config.active-response.html
https://github.com/ossec/ossec-docs/blob/master/docs/syntax/example_ossec_config.active-response.trst


What's the difference between "Trusted Root Certification Authorities" and "Third-Party Root Certification Authorities" Windows certificate stores? Windows Certificate MMC snapin shows that there're two "root" certificate stores on Windows:

Trusted Root Certification Authorities
Third-Party Root Certification Authorities

I'm trying to setup mutual SSL for an application running in IIS and it looks like the client self-signed certificate must be added into either of the listed stores or otherwise IIS refuses to even pass the request to application code.

So to me they look identical. Both contain some certificates of well-known certificate authorities (such as VeriSign).

What's the difference between the two? Suppose I decide to import the self-signed client certificate into either of them - which do I prefer and why?

The Third-Party Root Certification Authorities is a subset of Trusted Root Certification Authorities.

The Trusted Root are all the Microsoft certificates and the certificates for your organization plus the certificates in the Third-party Root.

The Third-party Root has all certificates that are not from either Microsoft or your organization.

For more information please check this website.


Is it secure to use a URL to automatically authenticate to an OAuth-protected API? I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password.

We have created an API which is protected using OAuth 2.0. I want to take advantage of this and create the possibility to GET a URL when you provide a OAuth Token (Token is bound to a user) which automatically logs the user in. I think this URL should be valid for 1 time use and only for a certain timespan.

I could generate a GUID or some sort of random string and save this in the database and remove it after for example 10 seconds. Then when someone requests the login URL with a GUID I check if the GUID is in the database and set the authentication cookie for the user. I could possibly take this one step further by checking if the user ever logged in himself on this machine by setting some cookie and validate the presence of the cookie once the URL is used.

I wonder if this is secure and if there are any other common solutions?

No, this scheme you propose is not secure, because you are potentially exposing your cross-domain authorisation token in server logs and referer strings on any third-party web servers you'll be linking contents from (or possibly injected by XSS to inspect for request values), if you're passing it along as a URI parameter.

As for cookies, it depends whether you'll be using this authorisation token on multiple domains or a single domain:

Multiple domains: Since you'll be needing your cookies to be read cross-domain (not limited to a certain path), meaning they could be read by any of your third-party content providers (any linked contents, including but not limited to external domain JavaScript, CSS, image, video,... files) as well. A better way to do it would be with the use of HTTP POST method, so you're at least not needlessly exposing this token to any of your third-party content providers (form data on POST is a part of the request body and not header, meaning its values are not simply inspectable through web servers).
Single domain: You could use cookies for this, but make sure they're locked to a single domain in their path value, and if possible, use httponly cookies also (if you framework doesn't support working directly with this value, you could simply attach ;httponly to the end of your authorisation cookie value). Using httponly will make sure these cookies can't be read by JavaScript on all supporting browsers (most do support this), thus eliminating the threat of XSS injections to steal your authorisation tokens and hijack user sessions.

These are the considerations you will have to take care of, regardless if you meant in your question you're after multiple-domain authorisation, or a single-domain one:

Tokens should not only be random, but also unique. Random here means they can't be predicted by knowing any of the previous tokens, and unique means you not only have to expire them as fast as you can, but completely remove from your token pool, and check on token creation you're not repeating and with it invalidating any previously generated tokens that are still valid. Though the unpredictability should theoretically take care of the latter uniqueness requirements, it's still best to make sure and check against your pool before writing a new token to your database.
You will probably want to lock your token validity to a unique client, as soon as possible. While that unique client might be a rather moot point and easy to spoof, it still provides for added validation when a single token will be used to authorise a single user across multiple domains (or on single domain, when the user resubmits the login request for some reason). I suggest signing any client data you can get your hands on with a HMAC and then storing it in your database along with the token. On any further authentication request, you then also check against this client signature HMAC to further validate the token used.
Perhaps most importantly, make sure all of this token exchange is secured by using encrypted transport layer, namely HTTPS (SSL or TLS), and eliminate MiTM type attacks on your authorisation process.


How can I exploit a web application if content sniffing is not disabled? I just come across one of the customer's website for penetration testing having  JSON callback reflecting the user input in the response body.

like this:

https://example.com/somepage?callback=<wow>mypayload

{"callback":"mypayload"}

As content-type is application/JSON therefore browser is not parsing the HTML tags and also X-Content-Type-Options=nosniff" is not set in the response header.

Is is possible to create a exploitable payload which result in XSS or other kind of vulnerability?

Content-Type is just a suggestion of the data provided to the receiver (consumer). This means that the receiver may or may not take action based on that header.

A typical browser will read the content type header to render the content in the best possible way (JSON as a tree, audio stream as a player, etc.). Try to send a JSON string to a browser with Content-Type: application/json and without. Same payload received, different presentation.

A generic application will do whatever it wants with the content. In particular it may decide to display it (or parts of) as raw HTML. In that case if your payload includes correctly formatted JavaScript, it will be executed.

This is not different from classical application hardening. The golden rule is never trust anything you receive. This includes not only the body of your HTTP query but also the headers.

As a side note, the malicious content can get to your data not only though what you receive and process. Someone can also modify, for instance, the data which is stored in your DB directly in the DB. Thus the absolute need to escape what is sent to the recipient, which is ultimately how XSS (and similar) attacks are performed.


Are their any consequences to encrypting a one bit message? Does size/variability matter? I'm trying to understand encryption a little more and couldn't get past this one nagging question. Let's just say I happen to want to send a one bit message to someone over an encrypted channel. I do the whole public key private key thing and an encrypted version comes out. How much information comes out?

Would there be any discernible pattern that someone snooping on the conversation could spot, especially if a similar message is sent with just the opposite bit over the same channel?

I couldn't think of any good reason to encrypt a one bit message since it's so ambiguous. A sequence would make more sense to encrypt to me. But if there is one.. or a few, I wouldn't mind to know why and why someone couldn't use it to reverse engineer the secret key.

I guess, a more general question would be, how safe is encryption when you know some information about the different types of things that could/will be sent? Not only content but something like the size from Server A is 15mb and so always know it'll be somewhere between such and such size when encrypted?

There are actually two parts to this question. First, the minimum size of the encrypted message will be much larger than a single bit. This is done to prevent the scenario you describe. See this question for details.

Second, here's an explanation of why decryption (or determining the private key) won't be any easier, even if you know the public key, the message, and the encrypted version of the message.


Does Perfect Forward Secrecy (PFS) make Man-in-the-Middle (MitM) attacks more difficult? Does Perfect Forward Secrecy (PFS) make Man-in-the-Middle (MitM) attacks more difficult? If not, why?

Not really. PFS means that if an attacker obtains your private key in the future, they cannot use it to decrypt recorded communications in the past. They can still use it to impersonate you ("you" being your server) if they have a MitM position. This allows them to record and/or modify all the plaintext.

Without the legitimate server's private key (or a fraudulent certificate for said server, and said certificate's private key), MitM on a TLS connection is pointless (aside from certain attacks against bugs in the TLS implementations). PFS makes no difference here.

Now, PFS does matter for forward secrecy of encrypted data obtained through passive recording. MitM is definitely a way to obtain that recording - your ISP could do it, for example, since they always have an MitM position on you - but it could also be done via passive eavesdropping without actually being in the middle of the connection. Examples includes wiretapping, connecting to a hub (not a switch) and putting your network interface in promiscuous mode, monitoring an unencrypted WiFi network (capturing all traffic transmitted), and so on. If your attacker is doing anything like that, either from an MitM position or not, PFS is relevant because it means even if they later get the server's private key they can't decrypt the recorded TLS traffic.


Is this method of hashing passwords good? Node.js I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code.

const crypto = require('crypto');

function RandomSaltString(length) {

    return crypto.randomBytes(Math.ceil(length/2))//I have absolutely no idea what this is
        .toString('hex')        //And this
        .slice(0,length);      //Well I think know this thought

};

function Hash(password, salt) {
    var hash = crypto.createHmac('sha512', salt);
    hash.update(password);

    return hash.digest('hex');
};

function preparePasswordForStorage(password) {

    var salt = randomString(20);
    const hashedPassword = hashFunc(password, salt);

    //Will encrypt the hashed password and salt here once I figure it out.

    return {
        hashedPass: hashedPassword,
        salt: salt      //Will be stored in db directly after this.
    }
};

Two issues I see:

the salt size is recommended to be the size of the hash, which would be 64 bytes in this case, however a 10 byte salt isn't terrible.
You only have one iteration of the hash.  You should have a minimum of 10,000 iterations (ideally more) of the hash, to help make it brute force resistant.

Having said that, why are you doing your own password hashing code?  Use PBKDF2, bcrypt, scrypt or Argon2.  You're reinventing the wheel for no good reason.


How does OpenSSL generate a big prime number so fast? In order to generate a 2048 bit RSA key pair, you need to generate two big prime numbers with 1024 bits length. As far as I know, OpenSSL chooses a random 1024 bit number and starts looking for a prime number around it. How can OpenSSL check if the number is prime or not so quickly?

Testing for primality is much easier than performing integer factorization.

There are several ways to test for primality, such as the deterministic Sieve of Eratosthenes and the probabilistic Miller–Rabin primality tests. OpenSSL uses several tests to check for primality. First they subject the number to the deterministic checks, attempting division of the candidate with a number of small primes, then a series of Miller–Rabin primality tests. The vast majority of candidate primes are discarded with the very first primality test. Any candidates which pass them are subject to further rounds of testing, each of which increase the certainty that it is a prime.

When using the Miller–Rabin tests, a composite number has a 75% chance of being detected as such at each round, so after a mere 64 rounds of testing, the probability that a composite number goes undetected is a staggering 2-128. In other words, the test has a 4-n chance of a false negative, where n is the number of testing rounds. There are also a number of much slower ways to test if a number is prime with complete certainty, such as the Agrawal–Kayal–Saxena primality test, but for cryptographic purposes, being really, really sure is sufficient, so they tend not to be used.

By default, OpenSSL tends to be extra paranoid and does some other tests, specifically for a safe prime. So when a prime, p, is found, it also checks if (p - 1) / 2 is prime. This is important for specific applications of primes such as Diffie–Hellman where safe primes prevent certain attacks.

This is possible at a high speed because verifying that an integer is a prime with an extremely low margin of error is significantly easier than factoring it, and because primes are not that uncommon (it is easy to find a large number of primes by incrementing a number and testing for primality). The Miller–Rabin primality test is very efficient. The test proves compositeness if xn - 1 ≢ 1 (mod n) (the Fermat test), and by testing whether or not x(n - 1) / 2e (mod n) is a nontrivial square root of 1 mod n where n is the integer being tested and x is a random witness satisfying the interval 1 < x < n.

The pseudocode implementation of the test taken from Wikipedia is:

Input: n > 3, an odd integer to be tested for primality;
       k, a parameter that determines the accuracy of the test
Output: composite if n is composite, otherwise probably prime

write n − 1 as 2r·d with d odd by factoring powers of 2 from n − 1
WitnessLoop: repeat k times:
    pick random integer a in the range [2, n − 2]
    x ← ad mod n
    if x = 1 or x = n − 1 then
        continue WitnessLoop
    repeat r - 1 times:
        x ← x2 mod n
        if x = 1 then
            return composite
        if x = n − 1 then
            continue WitnessLoop
    return composite
return probably prime

See this Crypto.SE answer on RSA key generation and the FIPS 186-4 standard, section 5.1.


"Memory Sinkhole" attack and virtual machines? Recently a design flaw in some Intel X86 processors was revealed at Blackhat. The flaw enables malicious code to gain access to SMM. The flaw can be exploited by an attacker with administrator privileges.

Can the flaw be exploited from within a virtual machine in hypervisors like VirtualBox, Qemu ... etc. if VT-x is enabled?

CPU Virtualization Basics
CPU virtualization emphasizes performance and runs directly on the processor whenever possible. The underlying physical resources are used whenever possible and the virtualization layer runs instructions only as needed to make virtual machines operate as if they were running directly on a physical machine.
CPU virtualization is not the same thing as emulation. With emulation, all operations are run in software by an emulator. A software emulator allows programs to run on a computer system other than the one for which they were originally written. The emulator does this by emulating, or reproducing, the original computer’s behavior by accepting the same data or inputs and achieving the same results. Emulation provides portability and runs software designed for one platform across several platforms.
When CPU resources are overcommitted, the ESX/ESXi host time-slices the physical processors across all virtual machines so each virtual machine runs as if it has its specified number of virtual processors. When an ESX/ESXi host runs multiple virtual machines, it allocates to each virtual machine a share of the physical resources. With the default resource allocation settings, all virtual machines associated with the same host receive an equal share of CPU per virtual CPU. This means that a single-processor virtual machines is assigned only half of the resources of a dual-processor virtual machine.

VMWare Article Explaining how virtualization works
This tells me that if the host processor running the virtual machine is vulnerable then it is possible that the VM iteself can be an entry point to the exploit since the code running on the processor. My assumption is that it doesn't matter the entry point into SMM so long as it gets in and can execute. So if you have a virual machine with access to any hardware it seems that it is likely affected. I can not confirm definitively that is the case, but I would most definitely take caution if you have host hardware running virtual machines that is susceptible to this vulnerability. Intel is planning to release a patch if they haven't already.


firewall settings for VPN In my firewall settings there are options for "Allow VPN connections via PPTP" and "Allow VPN connections via L2tp-IPsec". All of my internet traffic goes through a VPN. Should I have these settings enabled or what do I need to find out to be able to tell?

You could

ask the person who set up the VPN what exactly it is (PPTP? L2TP? etc)
use tcmdump (or wireshark on windows) to see what IP protocols and TCP/UDP ports are used to setup the VPN connection

or ... simply disable both, and see which one you need to enable to have the VPN go through.