Qubes OS or TENS for security? Is Qubes a good idea for a total beginner? What would be the most appropriate to use for as much security as possible? TENS looks very simple and straightforward, which is why I like it. However I have barely seen anyone suggesting it, I suppose they don't trust its devs (USAF Research Lab). Most seem to recommend Qubes OS or Tails.

Note that I'm not interested in a Tor or I2P distro, I'd like to know what is the optimal distro to use on a computer that could be potentially infected and that no matter how many bad links or files I open, nothing would be affected after a reboot.

Also I've seen many people say that Qubes OS is very hard to properly set up and it is a bad idea for a Linux beginner. What does that even mean?

Summary
I think you want Qubes. I really enjoyed using it (and I miss it a lot while writing this up!). Expect that you'll need to sink a fair amount of time and energy following guides on the Qubes Docs page to do linux-wizard-y stuff like editing config files on the command-line (the price you pay for a hardened OS!).

My experience using Qubes for a year
I've been a linux-only user since about 2006. Last year I put Qubes on my laptop and used it as my primary OS for about a year - everything from web browsing to software development.
Out of the box it worked great for web browsing and basic tasks like opening PDFs, but trying to do more involved tasks like installing new software, connecting to the NAS on my home network, plugging in a USB stick, etc quickly became very complicated and forced me to learn a lot about the internals of linux, networking, and virtualization - Despite being a 10 year linux veteran. That said, for me learning Qubes was a really fun experience and I learned a lot!
My opinion is if you just want a secure way to web-browse then out-of-the-box Qubes will be straight-forward enough. If you want an every-day OS to do all the things you currently do on Windows / Mac, then you're in for a learning-curve (hopefully a fun one :)

Head-to-head comparison Qubes vs Tails vs TENS
I've never personally used Tails or TENS, but here goes at an attempt to compare the three head-to-head.
Qubes OS
TL;DR: Qubes aims at being an everyday OS where you isolate different apps from each other by giving each its own full virtual machine. It gives a nice balance of usability (your data and installed applications persist across reboots, for example) and security (things are isolated from each other, and it's quick and easy to for example, create a clean VM, paste in some sketchy links that you didn't want to open in your banking VM, and then destroy the VM).
Definitely designed to be an every-day OS. It's based around the core idea that you run multiple VMs which (through some clever linux wizardry!) all co-exist in the same desktop so you can interact with them all at the same time, but each VM is unaware of the existence of the others. In the following image the green window and the yellow window belong to separate VMs.

That means that each application can have its own complete complete computer - a pretty good security barrier! For example I gave facebook its own VM (which I set to be destroyed on laptop reboot). Casual web browsing, banking, and each work project also each had their own VM. Qubes supports running different OSes in each VM, so if you want an Ubuntu and, a Debian, and a Fedora, you can do that. In theory, Qubes even supports Windows as a guest VM if you want to keep using Windows apps.

Tails
I have no direct experience, so from its wikipedia page:

Tails or The Amnesic Incognito Live System is a security-focused Debian-based Linux distribution aimed at preserving privacy and anonymity. All its outgoing connections are forced to go through Tor, and non-anonymous connections are blocked. The system is designed to be booted as a live DVD or live USB, and will leave no digital footprint on the machine unless explicitly told to do so.

The list of software that comes pre-installed seems all security and privacy focused. So if you wanted to install your favourite web browser, or a spreadsheet program, or wtv, you'd probably have to jump through some hoops (and of course do it again on each reboot). From quick googling, it looks like Tails can be configured to have persistent storage, but it's definitely designed to wipe itself back to the factory state on reboot, which I would personally find very frustrating.
Because it's designed to use Tor at the network-driver level, I suspect "everyday" things like connecting to a network printer, or your Chromecast, or maybe even streaming youtube or netflix would be very frustrating.

TENS
I have no direct experience, so from its wikipedia page:

Lightweight Portable Security (LPS) is a Linux LiveCD, (or LiveUSB), developed and publicly distributed by the United States Department of Defense’s Software Protection Initiative that is designed to serve as a secure end node. LPS boots only in RAM, creating a pristine, non-persistent end node. It supports DoD-approved Common Access Card (CAC) readers, as required for authenticating users on DoD networks.
As of version 1.7, the distribution was rebranded as Trusted End Node Security, or TENS.

So this is very similar to Tails in that you'll lose all your data on reboot and probably have a fair amount of frustration at installing software that doesn't come pre-installed (which seems limited to DoD internal tools). The networking (streaming, connecting to other devices on your home network, etc) might be easier that Tails.

Summary (same as above)
I think you want Qubes. I really enjoyed using it (and I miss it a lot while writing this up!). Expect that you'll need to sink a fair amount of time and energy following guides on the Qubes Docs page to do linux-wizard-y stuff like editing config files on the command-line (the price you pay for a hardened OS!).


What information can be found about a LUKS-encrypted drive? Let's say someone found a USB drive at their home and wants to try to figure out what it is (and they don't know the encryption phrase). What information could be determined about this encrypted drive, in theory?

For example, is it feasible to determine the date/time that the drive was encrypted or last written to? What other metadata, aside from the drive name, could be extracted?

That depends.

Obviously, he can get all the data stored in the luks header. That's basically the cipher used for encryption, the salt, the number of keys that can be used to unlock the data and so on.

If you've filled the USB drive with random data prior to encrypting it, that's basically the extent of the information anyone can get.

If you haven't overwritten the USB drive with random data, an attacker will likely be able to determine how much data is stored on the partition, and making assumptions about the underlying filesystem, he could gain insights into the structure of your filesystem (e.g. how many files are stored in how many directories etc).

AFAIK, the date of first encryption or last write can't be determined from the LUKS header.

For someone with very good hardware knowledge, it might be possible to access the wear-leveling protocols on the drive and therefore gain access to previously written data, which, even though encrypted, would give hints about which parts of encrypted partition were changed. I'm not sure what anyone could do with that knowledge.


False positive SQL Injection by ZAP with adding new parameter query I have a spring MVC web application and am running ZAP Active scan on it.

I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL Injection. And in my case, it raise HIGH MEDIUM SQL Injection.

The application is not even reading the parameter query and hence am sure the response is always the same, with or without this parameter. So my question is

What is the logic behind testing SQL Injection by adding a parameter which is not read by application and raising it as SQL Injection alert? I could understand when value of a parameter that is read in application is changed but not this. This has raised false positive SQL Injection in web applications that I work on.

This is related to a question that I have asked in Stackoverflow but havent found solution yet .
https://stackoverflow.com/questions/51874818/false-positive-sql-injection-by-zap-in-spring-mvc

I hope to hear something in security forum.

ZAP is flagging a possible SQL injection attack; it doesn't have any way to know that this isn't a legit query, so it flags it for you to manually examine and check. That's pretty much the point of running it.

I had something similar happen on one of my own Spring projects: it flagged a possible injection weakness on a path that wasn't in use, and accessing that path just returned HTTP 404. That project was meant to teach myself some basic vulnerability scanning, so I just documented it as such.


How to restrict flash drives in Local Area Network It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office.

Now we need to ensure any one will not be able to use USB drive in our Local Area Network.

How can we ensure this?

If the USB ports are not necessary, disable them in the BIOS (and password the BIOS), or simply epoxy over the USB sockets.

Some BIOSs will let you disable USB only for mass storage devices, which would seem to solve your problem. It's not a feature found on many boards, though.


Using port port 25 on the same WiFi Me and my brother live in the same apartment and use the same internet connection. (A WiFi router with WPA2 password).

He uses Microsoft Outlook as his primary email tool and I noticed that his POP and SMTP port settings were to use ports 110 and 25 respectively, which means he sends and receives his emails in the clear.

I know that the mail and the credentials are also passed to the servers in both POP and SMTP.

My question is, if someone visited the home and we gave him the WiFi password, and my brother was sending and receiving emails at the same time, is there a one the other person can get his password? (For example by Sniffing via Wireshark)

The settings of the outlook are as below.

Eavesdropping on WPA2 networks are not that trivial as in WEP or Open networks. Certain conditions need to be met (such as distance to the AP, frame rate and lack of beamforming) to be able to really decrypt the traffic. More information can be found here.

Also, you need to check if your POP and SMTP are sending information in clear text. Most of the email solutions nowadays support SSL, so your credentials most likely would be encrypted. You can check that on your email client configuration.


Who proposed adding heartbeat to SSL? And who proposed it's form? So we now know who wrote the bad code (Robin Seggelmann).  And we have an idea of why it is needed: Why does TLS need an explicit heartbeat protocol?

We can also understand why the client supplies the length: Heartbleed: Why does the client supply the length of the message at all?

But who proposed the form of the ssl heartbeat?  Could there be some nefarious input from the NSA in the hopes that someone would code it the wrong way and leave it vulnerable for easier snooping?

I've heard rumors that they added flaws to several encryption schemes (if I could quote which ones and where I would), could this be yet another way they introduced insecurity in their desire to have a copy of everything?

I know this sounds like I might be wearing a tinfoil hat, but given the lengths they have gone to since 9/11, this does not seem out of the realm of possible.

The RFC6520 describing heartbeats was had R. Seggelmann of Muenster Univ. of Appl. Sciences as its first author.  Seggelmann denies intentionally introducing the flaw and claims to be unaffiliated with any intelligence agency.  Similarly, the NSA and the Director of Homeland Security has publicly denied knowing about Heartbleed vulnerability, though Bloomberg reported from two people familiar with the matter that the NSA did know about the vulnerability and regularly used it.

Granted, looking at egress logs it appears attackers were using heartbleed style attacks in the wild last year from IP addresses that appear to have been used to systematically log IRC chats (making it suspicious to be intelligence agencies).  (So even if they didn't introduce heartbeats, it appears they were aware of it and didn't publicly disclose it).

Further, weirdness things is that two independent groups apparently discovered heartbleed (google and codenomicon) on the same day over two years after OpenSSL released the vulnerable HB protocol in 1.0.1.  The google engineer tweeted claimed "Heap allocation patterns make private key exposure unlikely #heartbleed #dontpanic", while the codenomicon tweeted "We're very certain" encryption keys can be stolen.


How to discover known vulnerabilities (CVEs) in Go executables? Tools that discover CVEs need to create software bill-of-material. In many cases it can be done simply by inspecting files on the target system e.g. RPM or NPM index.

Would it be possible to do composition analysis on Go executables in contrast to Go source code?

Is there any tools attempting to do that?

edit: the question is about executables programmed in go language in general and how to automatically discover transitive dependencies of those executables as part of executing vulnerability scan for a target system.

Not really. I mean, in theory you could, but it's absurdly unlikely that anyone will.

Go is a relatively safe language, so vulns in Go code tend to be logic errors, not mechanical ones. This means that vulnerabilities are marked not by patterns in the binary, but attributes of the control flow.

Essentially for detecting a given CVE you'd have to construct the opcode sequence that corresponds to the vulnerable logic, and match the binary against that pattern. This might be simple for a trivial pattern, but trivial patterns are unlikely, and it's a lot of work for essentially no benefit.

After all, vulnerability detection is fundamentally a supply chain problem. If your upstream can't source vulnerability metadata, then your whole trust model is borked. If you are the upstream (you build the binaries) then you need to start embedding metadata in your package details (eg. source code provenance) that can be used to determine CVE relevance.


Secure data in memory (C#.Net application) One of the requirement of the .Net project I am working now is to secure private information such as SSN, DOB and Password.. We are performing required encryption when we are saving the data but what are the things we need to do secure data in memory before it is stored in the DB ?

What is the best encryption algorithm for our case?

The first thing you need to consider is how you are managing the sensitive information in your code. As an example if you manage your password(plain text) using a string data type, there is a high risk that some one can grab your password from the memory. Because in .Net, the String data type is immutable and you do not have any control over it.

So the best way to manage sensitive string data in a .Net app is by using the SecureString class. It is managing string data as byte arrays and you do not need to worry about data conversions etc.. You can use the Dispose() method when ever you finish your work with sensitive data.

        // Instantiate the secure string.
        SecureString securePwd = new SecureString();
        ConsoleKeyInfo key;

        Console.Write("Enter password: ");
        do {
           key = Console.ReadKey(true);

           // Ignore any key out of range.
           if (((int) key.Key) >= 65 && ((int) key.Key <= 90)) {
              // Append the character to the password.
              securePwd.AppendChar(key.KeyChar);
              Console.Write("*");
           }
        // Exit if Enter key is pressed.
        } while (key.Key != ConsoleKey.Enter);
        Console.WriteLine();

        try {
            Process.Start("Notepad.exe", "MyUser", securePwd, "MYDOMAIN");
        }
        catch (Win32Exception e) {
            Console.WriteLine(e.Message);
        }
        finally {
           securePwd.Dispose();
        }

  What is the best encryption algorithm for our case?

I hope you are not using encryption in passwords ? Passwords need to hashed using good salt and good hashing algorithm. Do not use MD5 or SHA1 because these are weak hashes according to the current standards. At the moment we can consider the PBKDF2 is one of the best hashing algorithms available. The AspNet Identity framework using the PBKDF2.

You can use AES algorithm to encrypt your other sensitive data. But keep in mind to secure your keys. You can use the .Net Key container for that purpose


Security of data distributed to different cloud providers This is an purely educational question:

Suppose we have  different cloud storage providers. Imagine a files as a stream of bits and we save each 'th byte on the ( module )'th cloud provider's storage space.

Q1: Would =2 be a save way to protect data?

Q2: Would some  bigger than <2> effectively protect data?

Good protection would mean, that an attacker who obtained the data stored at one provider wouldn't be able to render the original data set.

Assuming that you don't trust your cloud provider(s) and that an attacker may gain access to your data, no, saving unencrypted data is not going to be particularly secure, even if you're only saving partial data to each provider.   There's no guarantee that an attacker won't be able to guess the missing data from the data he does have (and the more you save, the more he has to work with and the easier this gets unless you're continually increasing the value of n), or that patterns in the data won't cause all of the important parts of a chunk of sensitive data to end up at a single provider.

The security is beside the fact that this mechanism is going to be slow and complicated and require all of your n providers to be up in order for you to get or put data and therefor for your app to function.

The safe way to protect data is to encrypt it using a good implementation of a known algorithm before you send it up to the cloud.   It works. it's proven, and it's simple.


How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority? My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this.

Server_cert > Intermediate CA > Root CA

How do I set this up in Windows 2012R2 certification Authority? The only tutorial that I see is it will be signed by a root CA like this.

Server_cert > Root CA

AskDS team (Microsoft) have a series of posts that covers 2-tier PKI (what you are looking for) deployment with ADCS:

Part I Design and Planning
Part II Implementation Phases and Certificate Authority Installation
Part III Certificate Templates
Part IV Configuring SSL for Web Enrollment and Enabling Key Archival
Part V Disaster Recovery

what you can safely skip is web enrollment component installtion and key archival feature. Web enrollment is deadly obsolete and key archival is necessary only for user encryption certificates. For SSL/TLS it is not necessary.


Is it necessary to verify that my order confirmation IDs are unique? I'm generating 9-character order confirmations such as K1YBFRG17, O1D15ZCOM, etc and using them as order confirmation numbers. It's basically just picking at random from the string 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890' nine times.

While this allows for 36**9 different IDs, which I believe is around a hundred quadrillion, and the likelihood of a repeat is infinitesimal, I'm just wondering how this would be looked at from a security standpoint. Is it important to sweep the database each time a new ID is generated, and make sure that it's unique, even if there's almost no chance of it?

The probability of sampling the same random value twice from a uniform distribution depends both on how many possible values there are and how many samples you've recorded so far. You are unlikely to generate two identical IDs in the first 100 IDs you generate, but the probability goes up (somewhat counter-intuitively) the more IDs you make. This idea is referred to as the birthday problem.

As a rule of thumb you should expect that if you're sampling (with replacement) from a uniform discrete distribution of size n then you should expect to see your first repetition after around sqrt(n) samples. In your scenario that's about 10 million IDs.

In cryptography it's common to use an RNG to avoid repeat values. But it requires very large numbers. that make 369 seem insignificant. The minimum size of these numbers is probably between 192 bits and 256 bits. This assumes we're using a uniform distribution and a true random number generator (or some approximation of a TRNG).


Unexpected/unwanted/unknown participant joined WebRTC session While running the simpleWebRTC example Step8 of the WebRTC codelab tutorial on my local computer 192.168.2.101 (in my own home private network), when someone (that I don't know) joined in (video + audio) (???)

I am wondering how could this have happened since I am running the WebRTC in my private network.

Could that person have sniffed packets on the simpleWebRTC STUN server while the browser was negotiating the session? I am trying to understand how he exactly did this.

The WebRTC APIs provide the means to capture audio/video and transfer data to other peers. To get connected to another peer, both peers need to exchange their local session description (SDP) which contains (among other (authentication) data) the IP addresses and (random) port from where the peer can be reached. These IP addresses are found by querying the local network interfaces and via STUN. The WebRTC (RTCPeerConnection) API provides a way to generate this SDP, but not a way to transmit it to the other peer (known as signaling).

It should be clear that it is extremely unlikely to get connected to a random stranger by accident, because the browser needs to generate the SDP and also has to listen on the local port as stated in the SDP. So, most likely one of your libraries has a built-in signaling mechanism (commonly via WebSockets) to share the SDP with another peer. This turns out to be the case in your specific example: https://bitbucket.org/webrtc/codelab/src/c75c8e837a125441d2ee008c55348ac5a24a85d4/complete/step8/index.html links to http://simplewebrtc.com/latest.js, which defines a default (external) server for signaling (https://signaling.simplewebrtc.com:443/).

If you open the browser's devtools before (re)loading the page, then you can inspect the protocol messages in the Network tab.


Relative costs involved in making changes to the current organisational security I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".

Am I to compare the cost of a breach with the cost of improving security or I'm required to compare the cost of alternative security enhancements to the current organizational security procedure?

Neither, you're being asked to evaluate the costs involved in making changes to procedures. That's all your quote says. Generally those costs will be people costs. In security that may mean how much more effort it is to do things right when building a server, or patching. It could mean how much it will cost to have a working 24x7 incident response.

First you need to do a gap analysis between current procedure and what procedures need to be in order to satisfy policy and security goals, then to perform an analysis on what it will take to change the procedures. They may want that compared to the potential cost of a breach, or the cost of loss of compliance, etc.


Application-Server connection security I have this  school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as secure as PHP, I decided to have the app interact with the database through the website:

On the website, there's a php file used to establish a link between the app and the database. This is the algorithm i set up to have it as secure as possible:

User inputs a password in the app, it sends it to the php file as
a parameter (/get.php?pwd=1234)
The website sends a token (call it T0) to the app
The next time the app wants send a query to the website, it sends the md5 of T0 (call it T1), the website on its side calculates the md5 of T0 and compares it T1
The next query has to be sent using the md5 of T1 (T2) and the
website will compare it with md5 of T1

What's good about this method is that in case of a man-in-the-middle (assuming he doesn't know we use the md5 of the token), reading either the password or T0, it won't serve any purpose.

As an additional security measure, every used token is saved in a separate database containing exact location of the user, ip and the operation done with it.

Since I'm no security expert, I wanted to know how hard it is to infiltrate this system.
Thank you

First, may I ask why you think the app is not as secure as the website?  Generally speaking, from a security perspective, one of the worse things you can possibly do is to involve PHP, which has more security pitfalls then, well, probably all of the other common technologies combined.

Additionally:

if you're any sensitive traffic from the app to the website, it needs to be over HTTPS.
Do not submit passwords as querystring parameters.  This practically ensures that they'll be logged in plaintext, even if transported over HTTPS.  Then need to be POSTed as form values instead.
Hashing the token doesn't do much for you.  If you're submitting it over HTTPS, a MitM can't get it.  If you aren't, an attacker can generate an MD5 just as easily as you can.
Saving the used tokens is a good idea, from an anti-replay perspective.  You don't really need to save the ancillary information..It'll take up storage and probably won't give you much in the way of useful data.
However, saving the tokens can be a problem if you aren't using HTTPS, because an attacker who knows your scheme (and you should assume that an attacker will know your scheme) can pre-calculate the next token and hijack the session going forward, not only impersonating the real application, but also DoS'ing the real application out, because when it sends the next tokens, they'll already be in the used tokens table.

There are likely other issues here, but these are the first few that I've seen.

The bottom line is that I think this scheme needs a re-think, and a trip back to the drawing board.


Length of passwords that are rainbow table safe With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that you have to pay for.

What are the largest tables that secret services could possibly use and what's the maximum characters you can have for the password?

I am wondering how long passwords should be considered when you choose a new password yourself? (This is not the question here!)

What is the maximum password-length those huge underground rainbow-tables (used by evil forces) are hosting?

Length of the password, and size of the rainbow table, are red herrings. Size does not matter. What matters is entropy.

Rainbow tables are not really relevant here, for two main reasons:

Building the table is expensive. A table "covers" a number of possible passwords; let's call it N. There are N distinct passwords that will be broken through the table. No other will be. It so happens that every single one of these N passwords must have been hashed during table construction. Actually, a lot have been hashed several times; building a table which can crack N passwords has a cost of roughly 1.7*N hash invocations. That's more expensive than brute force. In fact, brute force requires on average 0.5*N hashes, so the table building costs more than three times as much.

Thus, a rainbow table is worth the effort only if it can be applied at least four times, on four distinct password hashes that shall be cracked. Otherwise, it is a big waste of time.
Rainbow tables cannot be applied more than once. That's because of salts. Any password hashing which has been deployed by a developer with more brain cells than a gorilla uses salts, which are non-repeating variation parameters. The effect of salts is equivalent to using a different hash function for each user. Since a rainbow table must be built for a specific hash function, one at a time, it follows that a rainbow table will be able to crack only one password hash in all. Combine with the previous point: rainbow tables are simply not useful.

Now, of course, there are a lot of deployed systems where passwords are not hashed with human-level competency. Ape-driven development has resulted in many servers where a simple unsalted hashing is used; and even servers where passwords are stored as cleartext or some easily reversible homemade encoding. But one could say that if your password is to be managed by such sloppily designed systems, then extra password entropy will not save you. A software system which utterly fails at applying sane, documented techniques for protecting a password, which is the archetypal sensitive secret data, is unlikely to fare any better in any of its other components. Crumminess and negligence in software design are like cockroaches: when you see one, you can be sure that there are hundreds of others nearby.

Now let's assume that reasonable password hashing was employed, combining salts (to defeat table-based and parallel attacks) and configurable slowness (to make hashing more expensive). E.g. bcrypt. This answer is a lengthy exposition of how passwords should be hashed.

For instance, consider a server using bcrypt, configured so that, on that server, verifying a password hash takes 0.01s worth of CPU time. This would still allow the server to handle 100 user logons per second, an extremely high figure, so the server will not actually devote a lot of its computing power to password hashing.

Now, imagine an attacker who got his hands on some password hashes, as stored on the server (e.g. he stole an old backup, or used an SQL injection attack to recover parts of the database). Since bcrypt is salted, the attacker will have to pay the full brute force attack cost on each password; there is no possible parallel cost sharing, and, in particular, no precomputed tables (rainbow or not) would apply.

Our attacker is powerful: he rents one hundred servers of computing abilities similar to the attacked server. This translates to 10000 password tries per second. Also, the attacker is patient and dedicated: he accepts to spend one month of computing on a single password (so that password must protect some very valuable assets). In one month at 10000 passwords per second, that's about 26 billions of passwords which will be tried.

To defeat the attacker, it thus suffices to choose passwords with enough entropy to lower the success probability of the attacker to less than 1/2 under these conditions. Since 26 billions is close to 234.6, this means that the password entropy shall be at least 35.6 bits.

Entropy is a characteristic of the method used to generate the password, and only loosely correlated with the length. Password length does not imply strength; length is just needed to make room for the entropy. For instance, if you generate a password as a sequence of random letters (uppercase and lowercase), then 7 characters accumulate almost 40 bits of entropy, which, by the calculations made above, should be fine. But this absolutely requires that the letters are chosen randomly, uniformly, and independently of each other. Not many users would go to the effort of using a computer PRNG to produce a new password, and then accept to learn it as it was generated (I do that, but when I explain it to my work colleagues they look at me in a weird way).

As this famous question hints at, human memory can be at odds with entropy, and a longer password with more structure may be a better trade-off. Consider that the "correct horse" method ends up with "only" 44 bits of entropy for 25 letters or so (by the way, take note that a 25-letter password can have less entropy than an 8-letter password). The extra typing can be worthwhile, though, if it allows an average user to remember a 40-bit entropy password.

Despite all the propaganda of Hollywood movies, Secret Services rarely involve stupendously advanced technology (for that matter, they are also quite short on dry Martinis, leggy blondes and motorbike chases). Any rationally managed Secret Service will avoid spending 10k$ on breaking your password, since 1k$ will be more than enough to hire two goons to break your kneecaps. Ultimately, this is all a matter of relative cost.

So let's get practical. To generate a password, use this command on a Linux system:

dd if=/dev/urandom bs=6 count=1 2> /dev/null | base64

This outputs a password consisting of eight characters among lowercase letters, uppercase letters, digits, '/' and '+'. It is easily shown that each such password offers a whooping 48 bits of entropy. The important rules are:

Generate the password and then accept it. Don't go about producing another one if you don't like what you got. Any selection strategy lowers your entropy.
Don't reuse passwords. One password for each site. That's the most important damage containment rule. If you have trouble remembering many passwords, you can "write them down" (password managers like KeePass may help).
If 48 bits of entropy are not enough, then you are using a password in a weak system, and that is what you need to fix.
Your enemies are after your money, not your freedom. Don't try to defeat phantasmagorical three-letter agencies; concentrate on mundane criminals.


HIPAA Compliance or What measures would you recommend to secure PHI for devs? I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing access to this data in a database? Should developers be allowed unfettered access to the entire database, since it is part of their job, or are there measures to be taken to obscure or change data?

Short answer: No, developers should not be allowed acces to PHI. But in order to let them work in an environment which correctly mirrors the real world, many do!

One of the options I used to see where the organisation had the capability was to provide developers with a sanitised copy of the live database.

Obviously this takes some resource

you need a real development
environment, not just one with
pointers to a live database
sanitisation is resource heavy and
time consuming
change management around the
development and production
environments and code promotion
becomes critical

Just thought I'd update to give a little more info around sanitisation. For sensitive information this really means removing identifying information. I have seen this done by completing a full replace of names and account numbers by random (but unique) ones, or by carrying out a swap of data, so the names are no longer connected to the addresses and medical details which they started with. This is hard work - especially as you usually have to ensure the age and sex of each individual is appropriate (especially for medical databases) otherwise testing may get tricky (eg trying to track down use cases for a pregnant 90 year old man)

If your dev needs aren't as in depth, you could just provide a small database with made up data - much simpler, but not as close to real world conditions.


About file encryption I'm here to consult those who know more about encryption issues, since I do not have much knowledge on the subject.

A few years ago, I acquired a program that allows me to store information in a single file. The program had to protect the folders with password, and I was putting it to the test, until I discovered how to access that information (supposedly encrypted) without entering the password.

This is where I ask how is it possible that I could access the information through the same program and without entering the password if the file is encrypted? Should not I have obtained illegible information?

As far as I know, by entering the password, the file is decrypted and readable. But in this case, the developer says it uses encryption and I managed to access the information without the password. What he says is not real? There are different types of encryption?

If you can read it without the password either it is not encrypted or the encryption is key is not tied to the password. I had seen such a thing in an Android app. User data was encrypted and stored in the DB. When activity B is opened data was decrypted and displayed to the user. To be able open activity B you had to enter a password on activity A. If the password is correct activity A starts activity B. But when a root user force opens the activity B data is still decrypted and displayed to the user. We don't have enough info to answer your question but it could be something like this.


SHA256 hash can be used to decrypt data? I have a backup script that encrypts everything using AES 256

Every day, I generate a random binary file as the password, and encrypt this random file with my public key.

Until now, I printed the SHA256 hash of the unencrypted file on the log, but today I thought that, maybe, the SHA256 of unencrypted data can be used to help a brute force attack to decrypt the password file.

This is how I encrypt the random file:

openssl rsautl -encrypt -pkcs -inkey key.pub -pubin -in random.bin -out random.enc

do you think this has some sense?

It generally on your threat model!

For example, if the two files are identical before encryption, then correct encryption will yield two different files, but two identical hashes before encryption. As a result, an attacker can know that these two encrypted files, while looking different, have the exact same plain text. Is that a problem for your use case? You have to decide.

Further, it depends on the kinds of files you encrypt, and what your attacker knows about them. If these files are in a structure known to the attacker and have very little entropy, then a brute-force attack could be a valid attack vector. This, for example, is a problem if your file looks basically like this:

  Employee #1234 received 2501 USD.

Just by plugging in an employee number and brute-forcing the right side, you'd quickly end up with the "correct" sum.

On the other hand, if your files are quite large and very random (e.g. images, videos, spreadsheets, etc.), then a brute-force search becomes infeasible very quickly.


Passing query string into a stripe API How secure is it to pass in to a Stripe website (external, not our own site) some data to prefill a form through the query string? It's an external site so we can't just pass it in encrypted like we would with our own sites data.

I would assume it wouldn't be too bad considering its only usage is to prefill the form and the only way other people can get said data is to log in to a certain company which we have security for anyway. (permissions)

Example data(with the URL used): https://connect.stripe.com/oauth/authorize?response_type=code&client_id=blahblahblahxxxxxxx&stripe_user[email]=my.email@yahoo.com&stripe_user[first_name]="billy"

I'll add more info if needed...

[edit]
The data is not restricted to just the ones i provided they just seemed fitting at the time. We got these options for the business:

[email]
[url]
[country]
[phone_number]
[business_name]
[business_type]
[first_name]
[last_name]
[dob_day]
[dob_month]
[dob_year]
[street_address]
[city]
[state]
[zip]
[physical_product]
[shipping_days]
[product_category]
[product_description]
[average_payment]
[past_year_volume]
[currency]

The information I've already got from you guys is pretty clear by itself though. The things I see as sensitive on this are the addresses (city, state, ZIP etc) but that's all...

The question is what you consider "bad" in this case. Since I can only guess what is considered bad in your use case:

Stripe will have access to the data in the GET request without further intervention from the user if you load it the way your example works: this might be a privacy regulation issue depending on the details.
Anyone that sees the URL sees the data. That means the users' browser, but also anyone that visits the site that contains the URL.

However, as far as I'm aware, Stripe already offers its' users a pre-fill feature through an SMS/text message to the user when Stripe detects that it knows their browser -- I'd recommend using that unless you have a very specific reason to pre-fill this data.


Network scan for vulnerabilities free tool I have a huge distributed network with over 1000 servers and network devices. It is mix of operating systems.
I'm looking for some free tool to scan network for SSL v2, SSL v3, RC4,TLS v1.0 and older.
For example https://www.ssllabs.com/ssltest suits perfectly for my needs, but it cannot scan many servers at the same time and most of the servers are not accessible from internet, so I need this tool to be working from inside of the network.
Do you have any suggestions? Help is much appreciated.

OpenVAS is very much like NESSUS except that the vulnerability feed at the heart of the service is free.  Tenable security gives away the NESSUS tool freely, but charges for vulnerability updates.

Based on  your description of the problem, you can also use NMAP scripts (check out this article) to list service ciphers:

  nmap -sV -sC target

  443/tcp open   https   syn-ack
  | sslv2:
  |   SSLv2 supported
  |   ciphers:
  |     SSL2_DES_192_EDE3_CBC_WITH_MD5
  |     SSL2_IDEA_128_CBC_WITH_MD5
  |     SSL2_RC2_128_CBC_WITH_MD5
  |     SSL2_RC4_128_WITH_MD5
  |     SSL2_DES_64_CBC_WITH_MD5
  |     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
  |_    SSL2_RC4_128_EXPORT40_WITH_MD5


Two-Step vs. Two-Factor Authentication - Is there a difference? These days, there's pretty much three forms of authentication in general use on the web:

Single-factor authentication, e.g.: PIN or password.
Two-factor authentication, e.g.: Single-factor plus a software- or hardware-generated token code, or a smart card.
"Two-step" authentication, e.g.: Single-factor plus a code sent to the user out-of-band.

Usually, the second step in two-step authentication involves the user receiving a code via e-mail or SMS and entering it alongside (or after) their pin/password on the website/app being used. The e-mail inbox or receiving phone could be considered as "something you have", thus qualifying this as two-factor authentication. However, the code that is actually used (and the credentials used to access the account/device which receives the code) in the second step is still a "something you know".

So, is two-step authentication a new form of two-factor authentication? Or is it really just multi-single-factor authentication?

Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".

A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.

A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.

The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.

The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication.


Are the rules used to validate certificates in the major browsers documented anywhere? I'm trying to get a certificate that's good for two subdomains. Essentially, the TLS equivalent of the human-level logical cert "*.*.example.com".

I've tried:

Name constraints: these work in the standard, but don't work in practice, mostly because OS X doesn't support them.
Wildcard certs. A single * doesn't cut it:

  If the wildcard character is the only character of the left-most
  label in the presented identifier, the client SHOULD NOT compare
  against anything but the left-most label of the reference
  identifier (e.g., *.example.com would match foo.example.com but not
  bar.foo.example.com or example.com)

a *.* doesn't work either,

  The client SHOULD NOT attempt to match a presented identifier in
  which the wildcard character comprises a label other than the
  left-most label

FF rejects the double-wildcard; Safari accepts in incorrectly. Chrome rejects it (but due to using OS X to implement the certificate information dialog, upon interrogation, claims to accept it!).

Instead of feeling out these rules one at a time, is there any documentation of the algorithm(s) used by major browsers to validate certificates? (Especially since thus far, Firefox seems to be the only browser implementing the standard…)

1Section 6.4.3 in the RFC heavily implies that *.*.example.com should validate,

What browsers do is subject to change at the whims of whoever maintains them, and they do so without any proper documentation.

The treatment of wildcards in dNSName entries in certificates is formally defined in RFC 2818, which would imply that, e.g., *.*.example.com would match a subdomain name that's two levels down example.com; it also says that f*.com shall actually match foo.com but not bar.com.

It turned out that browsers don't follow these rules, for a variety of reasons which have never been fully documented, but which mainly fall into two categories:

"Security reasons"
Laziness

"Security" here means "we ran into some abuse and changing the rules on the fly looked like a good idea at the time". For instance, once somebody produced an *.com certificate, somebody figured out that it was not a very good idea, and found it expedient to simply forbid it in the browser code. An important point to consider here is that browser vendors and commercial CA are not the same people; from the point of view of a browser maintainer, if something must be done quickly (e.g. within 24 hours, not 24 months), it must be done in the browser itself. Security issues related to browsers tend to be highly publicized and quite damaging to the browser's image, so this call for prompt reaction, which usually (and unfortunately) precludes good documentation.

Laziness is probably at fault for the lack of support of "double wildcards" like *.*.example.com. In all generality, if you want to implement support for expressions with several wildcards, you have to do it with nested loops (to explore all possible matching combinations). Restricting wildcards to a single "*", moreover at the very start of the name, makes the implementation much simpler.

An additional fact to take into account is the paralyzing property of "security". When something has been done, or seems to have been done, in the name of "security" then many developers lose all initiative and are extremely reluctant to modify it -- because they know that any mishap related to security entails full blame.

RFC 6125 tried to document existing practice, although it varies quite a lot depending on browser (and OS, since some browsers delegate certificate validation and processing to the OS). Note that RFC 6125 does not really forbids more than one * in a name; in fact, an errata has been submitted about that, and the editor put it under the status "held for document update", which really means "good point, we'll fix it in a later RFC".

While RFC 6125 lists requirements on the browser side (consumer of certificates), the CA/browser forum also considers the CA side (producer of certificates). The Baseline Requirements seem to imply that only a single * may occur, and only at the left of a name (but this is not very clearly stated).

While there is a lot more to certificate validation than wildcard name processing, all the business around the * character illustrates quite well that nothing is firmly documented, and browser vendors have already taken the habit to do things first, and document things only much later (if at all).


What TCP-level commands affect the global configuration of the stack? I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor.

What TCP commands (for lack of a better word) affect the global TCP stack?  Or that or a session to an existing server?

One example is window size.  I could open a connection to a server using Javascript in IE and then open up an in-private session in Chrome.  I would assume that this window size, maintained by the OS) would pick up where the IE client left off.  That number, might be enough to identify a user.

Is that a valid scenario, or what other aspects of TCP may persist in a OS stack, useful for fingerprinting?

TCP fingerprinting doesn't really help you identify a client.

When we talk about TCP fingerprinting, we're talking about the configuration details that, taken together, help identify the habitual configuration of an OS.  Different OSes have different default TTL values, for example.

You're asking about identifying non-habitual (unique) aspects of TCP traffic from a given host, but these details rarely vary from one installation of that OS to another.  If 100 visitors to your web site are running Windows 7, then those 100 visitors will share TCP characteristics that are essentially indistinguishable from each other.  For this reason TCP fingerprinting is used to identify a generic aspect (the OS) of a single system, not identifying aspects of multiple systems.

(The exception is actually TTL - if a remote machine is trying to spoof IP addresses, their traffic may be distinct by the TTL of packets as they arrive, because they all start with the same default TTL and they generally will decrement by the same amount as they follow the same network path to you).


Is it a good security practice to force employees hide their employer to avoid being targeted? A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, limited email access and so on.

Is it a good practice to force employees to hide their employment status from the public to avoid being targeted for hacking (e.g. remove the employer from LinkedIn)?

Hiding your employer would not appear to be of any use at all when you want to hide the employee's email address from the public. If you hide your employer info but spread your contact details far and wide, the employer info is not interesting.

The assumption being made is that once you know the company name and the employee name, then one can freely email the employee. Trying to address the threat of incoming emails by trying to hide the company name, so that the email address domain can't be guessed, so that emails cannot be addressed is trying to push on the wrong end of the lever of control. And you are trying to do it with a wildly difficult policy to enforce.

The trivially effective control is to break the direct tie between company name, employee name, and email address.

I know of companies that stand up a separate domain to send emails from. So example.com stands up example-email.com. This immediately wipes out a lot of automated emails. Other companies salt the email address with 2-4 numbers, so kelly.smith@example.com becomes kelly.smith.1234@example.com. Others use only the employeeID number: 12345678@example.com.

While each one of these can be overcome through analysis of other disclosed email addresses from the company, it is more effective and much, much easier to control and enforce through technical means than forcing people not to disclose where they work.

The company name is simply not the primary data to control in this threat scenario. It's the email addresses. You can control those.

Managing digital footprint is always a good consideration but you have an awareness problem and a trust problem with your employees that such a policy is not going to address.


Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports? Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point to set up passwords for services like that? Personally I can't see any. Thanks!

Security is all about defense in depth. Most breaches happen not because someone left a door open, but because a number of small vulnerabilities can stack up to make an unexpected and much larger problem. What if you accidentally make a mistake in your firewall configuration? What if someone gains physical access to your network? There are a lot of "what-ifs" that can happen that can make your assumption - "no one else is on my network" very questionable.

I can't find the article at the minute but I remember reading about some ATM attacks that allowed hackers to withdraw hundreds of thousands of dollars from ATMs in southeast Asia. The attacks started with the attackers hacking into the London offices of the bank, and from there to move laterally through the network and eventually access the ATMs in southeast Asia due to lack internal Network security on the part of the bank. Better security In just one more place might have stopped the whole thing, but the bank assumed that they only had to worry about external security.

The point here should be obvious. If you only have one line of defense you are fine up until that line of defense is breached. With multiple layers of defense you improve the odds that even if there is a sscurity failure in one place your systems may stay secure.

Of course, security is not an absolute concept. Perhaps there is not anything of any real value in your MySQL server. Perhaps you have regular and reliable backups in place so that even if a hacker maliciously drops your data just because they can, you can be back up and running in no time. Maybe this is just a personal project so there is nothing at stake anyway. I don't know what your systems do, and if it is nothing important and you are willing to risk intrusion to make managing your systems easier, then that is certainly a choice e you can make.


Best and secure way to do a authentication protocol between Restfull webservice and Android client Im developing a system which a android client send and receive data from a mysql database (connected to a java restfull webservice).

To do the authentication method, i dont want to send id&pass in clean text in the URL. Maybe hash and cryptography methods are apropriate, with CHAP or one time pad to avoid replay attacks. But im not sure if this is enough.

Maybe use cryptographic tokens its a better way. But im new with this concept. Any other sugestions or good tutorial for this case?

The best way - as it mostly the case - is to use TLS. Then you can simply log in using username/password. Besides authentication, you probably also want to protect the requests and responses. It's not often that you just have to protect against eavesdropping alone, in most of the cases active attacks are also possible (e.g. when using insecure WiFi connections).

You could also have a look at the SRP protocol, but that might be more tricky if you aren't that well informed about cryptography. Besides that, it doesn't provide a complete solution.


Is OpenVas an active or passive scanner? I am using Ossim and I did a scan vulnerabilities with OpenVas. I received feedback that some of our softwares broke after the scan. We will check the logs to see if the scan cause this, but I was wondering:
is OpenVas an active scanner? What are the risks associate with a tool like that?

With the default Configuration OpenVAS will scan actively. It happend to me sometimes in the past that software crashed while scanning it with a vulnerablity scanner. In my expience this applies mostly to badly written PHP apps, IoT devices and cheap routers but of cause it can happen with other targets too.


Does FTPs (FTP over SSL using explicit TLS) support encryption of data channel? I am exploring the ability of the FTPs(FTP over SSL using explicit TLS) to encrypt the data channel.
I read online that the secure data channel can be entered by entering the PROT command. PROT P for private.

Sorry if my question is too naive as I new to this area, but doesn't SSL offer encryption of data channel anyway by default? Or does TSL encrypt the data channel by default if explicit TLS is used?

Any help would be much appreciated.

You are correct in that SSL/TLS does provide encryption of the data.  However, one thing to keep in mind with FTPS is that there are actually two TCP connections involved: the control connection (e.g. to port 21) over which FTP commands are sent and responses received, and the data connection, over which requested data such as directory listings and file uploads/downloads are transferred.

The PROT FTP command is for configuring the protection for those data transfers; see RFC 4217, Section 9 for the specification/details.  The control connection will have its SSL/TLS session, and thus be encrypted (and protecting your USER and PASS values).  But should the data connection also use SSL/TLS?  Some use cases may say yes, some may say no.  Most sites wishing to use the full benefits of SSL/TLS for data private and confidentiality will want to use PROT P for encrypting the data connection, in addition to the protection on the control connection.  Sites that don't want this may allow FTPS clients to send PROT C, to request that data transfers not be encrypted.  (And some FTPS servers also allow the CCC command, which can be used to remove the SSL/TLS encryption from the control connection.)

Hope this helps!


Are there more hacks done by social engineering, etc, than breaking the software system? There is a saying that, rather than finding a vulnerability in a strong security system, the hacker is more likely to hack into your system by social engineering, physically breaking into the room the server is in, getting help from an insider, or even physically forcing you to compromise, etc, or any other way bypassing the software system.

Count phishing as a form of social engineering, this seemed quite convincing. But is it (or its negative) supported by any statistical data, say in the following cases?

For any hack.
For systems where the administrators supposedly know security enough.
For valuable targets.
Maybe others.

Simple answer.  That's no longer true, malware attacks are now most common.  However that doesn't mean they are most important to everyone.

Various bodies like SANS/CERT and so on publish statistics of incidents they handle (for example UK Cert Q3 2015 report).  Key quote:

  malware is, and remains, the greatest threat to cybersecurity.

And that seems to be clear across almost all domains and reports.  After that Phishing is almost universally listed second.  This doesn't match with the (old) conventional wisdom that most attacks are social because most malware attacks are now automated.  Instead of targeting one chosen machine, they are part of an massive automated attack looking for victims that match a given vulnerability.

By definition, however the statistics only cover the "unsuccessful" cases where the hackers get caught or don't even try to hide. For example there is a lack of reported cases where hardware was compromised during delivery.  That's probably because people only just started looking.  Apple seems to be a target for this and started checking all circuit boards.  Soon we might find out that it's an important case.  Or maybe they won't choose or be able to tell us:

  Many of the organizations were compromised and, therefore, out of
  compliance for months, and some for the duration of the study—meaning
  they never detected their compromises or outbound malicious
  communications, nor did they acknowledge warnings from the Norse
  response team.
  - quote from SANS health care report - nobody will ever investigate these cases

However the whole statistical approach is misleading.  It's "think like an engineer" instead of "think like an attacker".  The majority of malware is randomly attacking everyone and don't particularly care who they get.  For them the weakest link is the computer with the worst security.  Probably, because they are working in big companies who actually hire security people, most security people should be more worried about a targeted attacker such as an employee or overseas competitor who will be more likely to use a social attack simply because the cost of entry is lower than writing custom malware.  Even if an attacker is using malware for compromise, they may need to get it past your firewall.  They compromise one machine via a phishing mail and then 1000 more inside your company with a worm.  Does that count as one phishing attack and 1000 malware attacks?  In the statistics it does.


Do I need PCI DSS compliance when using PayPal Express Checkout? If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant?

PayPal says "With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro Hosted, PayPal handles the payment card information on your behalf and so greatly eases the burden of PCI compliance." What? "greatly eases the burden"? What does that mean? Do I need it or don't I? If I do, what version do I need? SAQ A? SAQ A-EP?

Please help, I'm very confused and not sure whether I need to put the work into becoming compliant or not.

IANAQSA...

  If I'm using PayPal Express Checkout on my website, am I required to be PCI DSS compliant?

Yes.  If a customer goes to your web site, puts stuff in their cart, and then clicks "I want to pay for this stuff" and gets redirected somehow to a payment page hosted by someone else, you still have PCI compliance obligations.

  With Website Payments Standard, Online Invoicing, Express Checkout and Website Payments Pro Hosted, PayPal handles the payment card information on your behalf and so greatly eases the burden of PCI compliance." What? "greatly eases the burden"? What does that mean?

"greatly eases the burden" means you'll be eligible for a less onerous SAQ than you would be if you weren't using their services.  I don't know enough about the different products they've listed there, but for example, tokenization can help reduce scope from SAQ-D to SAQ-C.  If tokenization is in use and a web redirection is used to transmit payment data through their servers, then you can drop down to SAQ-A EP or SAQ-A, depending on which type of redirection is used.

Looking at the Express Checkout description, it probably means you're looking at SAQ-A or SAQ-A EP.

  Please help, I'm very confused and not sure whether I need to put the work into becoming compliant or not.

You need to become compliant.  In the case of SAQ-A, that's pretty simple.  In the case of SAQ-A EP, just a little bit more complex.  If you go up to SAQ C+, now you have work to do.

To find out which level of compliant you need to be, you work with your processor - which in this case would be PayPal.  Tell your sales contact you want to understand what your PCI obligations will be and ask if you can talk to someone in their Compliance department about understanding which SAQ you'll fall under and what the process is for submitting it to them.


Secure yet reversible encryption for local data store I'm working on a piece of software to store and manage records for a youth group. They've found that a lot of the time they spend on record-keeping and admin is taken up by scanning through looking for various conditions, like "is older than X years and has Y qualification" or "has been a member for X years and has done Y event more than twice", or "has done events X, Y and Z and therefore needs award A". As a programmer, I recognised that this sort of thing could very easily be handled by a computer, thus saving them hours of work, so I'm building an application to take care of it.

Up until now, their records have been kept on paper, or in Excel spreadsheets, so it could be argued that I don't need to encrypt anything because they weren't encrypted before, but I don't feel entirely comfortable with writing a program that stores information on underage kids (ages 14-18, roughly) without having some way of controlling who can get at that information.

I've never really done encryption before, so I'm not really sure where to start here. I've implemented numerous password management schemes, so I'm familiar with some of the principles, but that uses nonces and one-way encryption methods like hashes, none of which can be used here because I need to be able to get the data back again. The best I can think of is to use a password (plus salt) in plaintext as the key to encrypt in some two-way scheme, but then only store the hash of that password to verify on login. The password would then be stored in memory while the program is running, though, and I'd like to reduce the amount of time where the password is anywhere other than the user's memory.

I understand that putting this data anywhere other than a server that I can control increases the risk, but I need this data to be accessible offline. Can anybody explain a solid way to store this data?

Encrypt the data with a strong algorithm like AES. Use pbkdf2 or bcrypt to derive the encryption key from a password.

You need a way to propagate and update the data, unless the solution is meant for a single computer only (If so, just stick with excel spreadsheets. why bother to write an application?). Have the client connect back to the server to update the database and/or download new data from the database. Have the client authenticate using certificates and secure the connection over SSL/TLS.


Security papers or material focusing on the industrial control systems (SCADA) Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?

For specific analysis of a particular attack in this space you should read the Symantec Stuxnet paper - gives good background as to just how badly a SCADA attack can compromise an industrial system.


Securing API against DDoS attacks I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs.

How can I protect my API against DDoS attacks? What services, tools and design considerations should I bear in mind to protect my API service from DDoS attacks?

I'd suggest to hide your REST API behind a so-called API Gateway. Such components should handle that.

I know that APIGee provides different features (http://docs.apigee.com/api-services/content/comparing-quota-spike-arrest-and-concurrent-rate-limit-policies) that can help to mitigate DDoS attacks.


Can your cell phone transmissions reveal your identity? Is it feasible for hackers sitting near you to have some sort of RF listening device that uses your phone's transmissions to identify your name or other information that could be used to determine who you are? Would this be through the network, wifi, and/or bluetooth? If so, are there any protective measures that people can take that don't involve simply turning off transmissions?

AS Hugo stated, yes the phone can act as a tracker via it's IMEI & SIM card IMSI numbers. These are sufficient for a telco to identify the phone owner, but a third party can still identify the unique phone without necessarily knowing the registered owner. Even without actively using the phone, it pings towers to let the network know where you are in order to handle call routing for you.

Additionally with many modern smart phones, turning it off doesn't really turn it off, you need to physically remove the battery to make sure it's actually off. This can be problematic with many phones (Apple).

Putting the phone into "airplane mode" will stop it from talking to cellular towers. Unfortunately many smart apps collect WiFi SSIDs that they've seen and will report that information later after you come back online, providing an historic trail of electronic bread crumbs.

Faraday bags and such will only make your phone spike its power levels to punch through, rapidly killing the battery in the process.


Sending Group Keys over network For multicast encryption one user creates group keys on his local (Symetric and asymetric).

If we encrypt these with other group user's public keys and send over networks .

Is this acceptable?

Can we say that this is equivalent to send anything with public key over network?

Is this a used method for multicast encryption.

If I understand you correctly, you are describing a hybrid cryptosystem.

As Natanael mentioned, GPG and PGP use the OpenPGP message format (RFC 4880) by default.
OpenPGP is a hybrid encryption system.
As far as I know, OpenPGP is the most commonly used format used today for email that is end-to-end encrypted. It supports efficiently sending the same plaintext message to many different recipients, more-or-less like multicast.

I don't know any better method for multicast encryption than hybrid encryption.

The original question uses the term "group key", which doesn't seem to match up with anything in OpenPGP.
However, I hear that several group key protocols have been developed for pay television encryption systems, such as
"Multicast Encryption: How to maintain secrecy in large, dynamic groups?";
"An efficient and secure group key management scheme supporting frequent key updates on Pay-TV systems";
and
RFC 2023: "Group Key Management Protocol (GKMP) Specification".

WPA also uses group keys.

Entire books have been written about this topic, such as "High Performance Group Key Management: A Way to scalable Internet Television"


Does WPA2 Enterprise mitigate evil twin attacks? One of the dangers of using WPA2-PSK is the possibility that an attacker may setup another wireless network with the same SSID and even use the same access point MAC address via MAC spoofing. The attacker then may use a deauth attack to cause an internal computer in the network to have to reauthenticate, allowing the attacker to recover enough of what he needs to eventually bruteforce his way into your wireless network.

However, I'm not sure if this attack method is mitigated when using something like WPA2-Enterprise. I'm a system administrator and it would be relatively trivial (< 1hr work) for me to setup WPA2-Enterprise with an internal RADIUS authentication server and migrate away from WPA2-PSK. However, does this mitigate the evil twin problem?

I would call this an evil twin attack. And it's not uncommon to see corporate laptops vulnerable to this.

WPA2-Enterprise supports a number of EAPs - Extensible Authentication Protocols. (Wikipedia article) The security depends on which EAP you use, and how you configure it. Some EAPs more vulnerable to an "evil twin" attack than PSK, as an attacker doesn't need to brute force the key.

Fortunately, a number of EAPs are secure against an evil twin. One approach is to use TLS internally; PEAP is a popular option that does this. To be secure against an evil twin, you must enable certificate verification and distribute the certificate to all your clients. There is no need to get such a cert issued by a root CA.


Is it a good idea to generate certificate-specific CRLs? What is this technique called? Suppose I create 3 certificates with the following CRLs

Cert1    http://crl.server.com/batch1/root1.crl
Cert2    http://crl.server.com/batch2/root2.crl
Cert3    http://crl.server.com/batch3/root3.crl

Assume that the CRL is properly formed, the next update is valid, and is properly signed from the CA (here called "root").  The contents of the root*.crl only can ever contain one certificate.  (assume the server software supports it, or the CRL is formed by an openssl command)

Question

Would this solve the following goals:

"Hide" the revocation status of a certificate unless someone actually possesses it and therefore needs to know it.  (Assume the word "batch" is an assigned GUID)
Reduce the size of the CRL during ongoing maintenance

What are additional benefits drawbacks of this approach?

Are there other / better solutions that may address this need or incorporating CRL size reduction and or privacy?

What is this approach called?

(both goals of efficiency and privacy aren't requirements... this is a thought experiment for me)

Segmenting the space of certificates so that "partial" CRL can be computed is possible and supported, but it must be done properly. One base principle of CRL is that a CRL should be amenable to processing regardless of how it was obtained: that's the whole point of having signed objects. Since a certificate is considered as non-revoked by virtue of not appearing in the CRL, it must be possible to unambiguously verify whether a given CRL applies to a given certificate or not -- in X.509 terminology, whether the certificate is in scope of the CRL.

The extension to use is CRL Distribution Points -- see section 4.2.1.13 of RFC 5280. This extension has two distinct roles: it documents URL where CRL may be obtained, and it implements certificate space segmentation. For segmentation (that which you are interested in), the extension must be marked critical, and there must be a match between a "distribution point" and the corresponding structure in the Issuing Distribution Point extension of the CRL. In effect, each distribution point characterizes a sub-space of the certificate space; each certificate is marked with the sub-space to which it belongs, and each CRL is marked with the sub-space to which it applies. As with all things X.509, details are intricate and some thorough testing is needed in order to assess the reality of support by existing applications.

Such segmentation is useful for keeping CRL size low. It could be used to make single-certificate CRL, although this would have to be balanced with the cost of signing all these CRL (signatures are not expensive, but one million signatures can become a burden -- not really the signatures per se, but all the encoding and file transfer has some overhead).

You cannot expect much privacy gains that way: certificates are inherently public elements, which travel unprotected in many protocols. They cannot be considered secret. There is little more that can be obtained from CRL; actually, a full CRL is already discreet since it talks only about revoked certificates: it says nothing about unrevoked certificates and does not even hint at their existence.

Ultimately, single-certificate CRL already exist but are called OCSP responses.


What are the security or privacy issues with allowing users to forward email from our Google Apps account to their personal Gmail? But we have a new employee that would rather all his email in one inbox. I know he can forward the mail to his personal account, send mail using an alias so that it looks like it is coming from the company account, and that a simple bcc could put a copy of any replies back into his work account, but I feel like I should have some privacy concerns with this. Any input would be great!

The user sounds like the person who has a privacy concern, since a significant side effect of that action is that the company is prevented from access or control over his email account.

The company has operational concerns, as the email can't be recovered easily in the event of the employees resignation or incapacitation. The company does not really have a privacy concern, since even if there was no off-site forwarding, the user can still easily reveal email contents.

This is a management problem, not an IT problem. If your company policy forbids sending work email outside company control, then enforce the policy. If the policy does not cover that scenario, then is there really a problem? (If it is a problem, then write some policy!)


Do firewalls always run in userspace? There are many Firewall solutions for the world on different operating systems: iptables, pf, ipfw.

My question is: Does the firewalls run in kernel-space or all of them runs in user-space? (in general, not just the mentioned ones)

It depends on your definition of firewall, and you're definition of run.

The actual packet interception is done in kernel space, before the packets are seen by any user programs. The network stack is in the kernel, so naturally filtering on that network stack also has to be in the kernel. You could build a userspace network stack, but it's a lot of work with no real benefit, and nobody does that anymore.

So by that definition, all modern firewalls run in kernel space.

Except that there are userspace programs for managing the firewall rules. The word iptables refers sometimes to the "netfilter" component of the kernel, and also a userspace program called iptables for managing netfilter rules. There are similar stories for other OSes.

But it gets even muddier because most modern OSes support the ability to send packets to a usespace tool for inspection, modification, etc. So while the initial interception happens in-kernel, the kernel outsource part fo the firewall tasks to userspace programs.

And even less clear when it comes to what qualifies as a "firewall". From a purist point of view, a firewall runs at layer 3† it can do basic state tracking for TCP and can even scan for FTP port associations, but it's not parsing HTTP requests. That's not to say that a box you've designated as "the firewall" can't do it, though. It's not uncommon to associate a "firewall" device with a transparent HTTP proxy and cause all sorts of headaches for your users in the name of security. This, of course, is definitely not in-kernel. That's not to say that it couldn't be. But nobody does.

†: In addition to iptables, there's also ebtables, which does the same thing but for ethernet frames.


Security Log Analyze is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.

There is benefit to using a full-cycle platform that allows SIEM Engineering (e.g., Splunk ES) and Security Automation (e.g., Splunk Phantom), but these can also be performed using open-source platforms (e.g., HELK for SIEM engineering and Rundeck for Security Automation).

There are many benefits to ATT&CK detection, which may be platform-dependent. For example, Microsoft Sysmon is great for Windows and Windows Server, but no use on Linux or macOS. osquery has many configurations for all 3, but ATT&CK coverage tends to be Windows-only as well. auditd is Linux-only. xnumon is macOS-only, but there's a lot going on there, which even this forum has covered.

It sounds like what you are asking for in this question is not only going to be OS-dependent, but also perhaps Web Server or even Application Dependent. However, there are some standards, such as the NCSA Common Web Server Log format, and loose guidelines.

After-the Fact, there isn't much you can do, but I have seen a few articles cover tools such as apache-scalp. For Apache httpd web server, the access log file(s) are usually in /var/log/apache2/access.log, but can be anywhere (even the config can be anywhere). For Windows Server IIS web server, the log files are usually in \WINDOWS\system32\LogFiles\W3SVC1, but again, can be configured elsewhere. Most databases and other integration points for web applications do not log by default, or their logs are uninteresting for security purposes (but this is not always the case).

If you can install tools or run Python scripts, etc, then you may be off to a good start. If not, then you may be able to bring the logs elsewhere, but then you end up right back at the original Not-Using Splunk problem that brought you here in the first place. Microsoft has a more-official tool for web server / web app log analysis named LogParser which can do cool things, such as:

  logparser.exe -i:iisw3c -o:Datagrid -rtp:100 "select date, time, c-ip, cs-uri-stem, cs-uri-query, time-taken, sc-status from C:wwwlogsW3SVCmyserver*.log where cs-uri-query like '%UNION%'"

Apache, Nginx, and IIS web servers tend to only log HTTP GET requests and their associated server response codes. If you want more, then you'll  need to turn to additional bolt-on utilities and/or configurations.

For example, for Apache, mod_dumpio has been around since 2009, and mod_security and others were added later to support HTTP POSTs and lengthy server response collection.

proxy_pass or fastcgi_pass lines can be configured for the Nginx web server in order to leverage the $request_body variable.

The Advanced Logging Extension for IIS can be added to Microsoft IIS Server to achieve the same, or better.


Malware spreading via installation media Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that after reinstallation system is still compromised through installation media? Or it is hard to automate and rather subject of targeted attack?

I am not aware of anything that would compromise a installation media while the user is writing it. It's possible to do something like that, but it would be a very focused attack.

An attacker would need to know the installation file and the burning software. There are a lot of ways to create a installation USB media (dd, unetbootin, USB Image Writer, for example), so the attacker would need to monitor all of them, intercept the read or write, and compromise the request.

Possible, but it's easier to change the DNS and direct the user to a rogue download site.


To what extent are supplementary yum repositories certified by CentoOS? I'm building something which uses libsodium and will run on Ubuntu and CentOS 7.

Ubunutu has the libsodium-dev package, but CentOS doesn't seem to include it by default.

I see instructions to use the REMI repository and then yum --enablerepo=remi install foo

As I understand it, repository contents are cryptographically signed with root verification keys distributed with the OS. Are supplementary repositories used in this fashion certified by CentOS as trustworthy? Or by downloading and installing the repository rpm am I affirming to the system that I trust this new repository?

CentOS is a operating system. It can't certify anything.

If you are asking if the packages are cryptographically verified with a key that is part of CentOS: yes. The public key for this repository is part of a current CentOS installation

If you are asking if anyone will guarantee you that the packages in the repository fulfill any requirements you might have: no, no one does that

But you are using CentOS. No one guarantees you anything for your operating system anyway. If you need any legal security, you have to pay for a support contract. What exactly is guaranteed depends on your contract.


Monitoring a specific application for creation or modification of files I don't know if I'm looking for a file integrity monitoring software here.

Basically let's say we have firefox or chromium, let's say the user is watching a youtube video, then we'll find that video in our cache right? Now i would like to know if a specific application is creating or modifying some file, even if it calls an "external module" (like, I don't know, launching mkdir command on linux from our target application).

I need a software that does that online, when it's happening. I have just to tell him which process has to be monitored.

I need it for Windows right now but since the application is multi-platform a Linux solution would be ok.

If you're looking for something interactive, and not service-style long-term monitoring software, check out Microsoft's (nee SysInternal) Process Monitor.
Very versatile.


Azure Networking VPN Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources from the Web and Mobile Apps exposed to the internet. While concern is not clearly formulated there is an unease due to the fact that Azure will be responsible for securing access into our network and not our respective IT Risk and Networking teams.

Is there a good set of articles to explain the VPN and ExpressRoute security? Are there good use cases to demonstrate that even if security of the Web or Mobile application is compromised then our on premise resources are still protected by Azure VPN? We need to present network architecture that demonstrates the security of Azure VPN networks and addresses the concerns our risk, security, and governance teams might have.

While I couldn't find much on it, I did find this article  that may provide some answers. Also there are vendors such as Barracuda that provide additional security on top of what exists.

That being said, if the Web or Mobile app is an Azure PaaS or IaaS service then a highly secured environment can be built using an App Service Environment with hybrid connectivity. The App Service Environment can act as a DMZ while the hybrid connection can have additional protections such as Web Application Firewalls, Firewalls and IDS.

Hope this helps!


What's the standard way to encrypt a file with a public key in Java? I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?

From websites such as this one, I gather that usually, a symmetric key is generated to encrypt the actual file, and this key is then encrypted with the RSA public key and sent along the file. Is there a standard way in Java or a standard file format (without additional libs) to package the encrypted symmetric key and the symmetrically encrypted file?

Of course, I could design my own file format, but I'd rather stick to standards if possible.

One common, standard encryption format is Cryptographic Message Syntax (CMS, evolved from PKCS#7), and e.g. BouncyCastle supports it.  It allows for signatures also, and is the basis, e.g., for S/MIME mail message security.  It may be overkill, but is widely supported.

Example code is provided by Bouncy Castle.  For CMS, see org.bouncycastle.cms.test, probably the Enveloped Data examples.

Another option is the XML Encryption format, standardized by W3C.  For Java examples, see e.g. Exploring XML Encryption, Part 1 or do it with XSS4J: Implementing XML Encryption in Java


Is there an equivalent of an Apple cryptochip in Android devices? Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several failed attempts to authenticate. This allows for a reasonable security using a 4 digits PIN.

I did not find any information about the existence of such a hardware mechanism in Android-based devices. The closest could be the TEE (Trusted Execution Environment)

  The TEE is a secure area of the main processor in a smart phone (or
  any connected device). It ensures that sensitive data is stored,
  processed and protected in an isolated, trusted environment

My understanding is that this is essentially an implementation of a TPM, which only secures the encryption keys, and specifically does not handle the authentication itself.

In that case, how does Android ensure that the throttling of failed authentication attempts is not by-passed during an offline attack?

Specifically:

decryption of a bare disk extracted from the device is not possible (the key generated by the TEE is robust)
decryption of a disk in the device with the help of the TEE must be protected against - via throttling or wipe after a given number of attempts.

A description of the implementation of the latter is what I am looking for.

Note: I am aware that there are security bugs which help to bypass a security setup. This happens everywhere and on every device and is hopefully fixed with patches. This is not the subject of my question - I am specifically interested in hardware mechanisms designed to protect against seemingly insecure authentication mechanisms (which a 4 digits PIN, in the absence of these systems, would be an example of).

EDIT: also see this answer about TEE itself (as a complement to the question above)

how does Android ensure that the throttling of failed authentication attempts is not by-passed during an offline attack?

Android KeyStores can be hardware or software based previous to android N, which has made hardware KeyStore a MUST in the CTS.
EDIT: In the below I am using the term online attack as something with the property

Online entities can perform additional security checks to make a protocol more safe. For example, an online entity can regulate the number and speed of login attempts (from another SO q)

...rather than being conducted over a remote network. Maybe I am not using it in the common way but to me the interesting property about online attacks is that there is a layer between the attacker and the data being attacked which is not under the attackers control. Whether this layer is a remote webserver or some local hardware does not make much difference in this case, as both can perform rate-limiting, unless the physical chip is attacked / inspected, which would be a completely different class of attack.
This SO answer actually has a definition closer to the one I am using

An online attack tries automated routines providing input to a legitimate system. They are not looking to create an exploit in functionality, but to abuse expected functionality.
An offline attack attempts to emulate the encryption/hashing and requires a known output of that process (i.e., you don't attack the system, you already have the hashed/encrypted password)

If hardware based, private keys should be extractable from the KeyStore without a sophisticated physical attack (maybe an electron microscope or some black box vuln exposed by the TEE/TPM. This is an online attack. You would hope the TEE/TPM implements throttling.
EDIT: I just tested the nexus 6p KeyStore impl and no throttling takes place for general Cipher operations (was seeing if a padding oracle was exposed for RSA). I have not tested KeyStore rate-limiting for the main unlock however.
If software based then with root, the KeyStore blob can be lifted and potentially bruteforced. This is an offline attack and no throttling can take place.
In answer to your question, it cant ensure throttling of an offline attack, by its very nature.


WiFi WPA cracking with Reaver This question is for anyone who has tried or succeeded to crack WiFi WPA/WPA2 keys with BackTrack Linux and Reaver. So, I wanted to test it on my WiFi router. I started everything as described here.
But I got this error:

root@bt:~# reaver -i mon0 -b 74:31:70:05:4B:A7 -vv

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner <cheffner@tacnetsol.com>

[+] Waiting for beacon from 74:31:70:05:4B:A7
[+] Switching mon0 to channel 1
[+] Associated with 74:31:70:05:4B:A7 (ESSID: ALICE-WLAN20)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[!] WARNING: Receive timeout occurred
[+] Sending WSC NACK
[!] WPS transaction failed (code: 0x02), re-trying last pin
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
^C
[+] Nothing done, nothing to save

It tries the same pin over and over, can anyone explain to me what the problem is, and how I can fix it?

First make sure that reaver is up to date (using apt-get update && apt-get upgrade will do this for you).

Second, remember this is an exploit tool. I have had mixed results. Certain linksys routers will crap out under the load and simply lock up. Some other models have given me the same behavior yours is showing (repeated pin, or repeated series of pins even when WPS is enabled).

This tool will not work on every router. Try it on a few different targets. If you get the same issue against multiple models it could be your wifi card or driver as well.

From my experience reaver works on maybe 60-70% of WPS enabled routers I come across. The other 30-40% either get DoS'd or simply fail.


Cookies information disclosure "PreviousLoggedinUser" I was wondering if what kind of information a cookie is allowed to reveal. As an example i was testing a website and I see in Burp that its cookie contains several pieces of information one of which is "previousLoggedInAs" identifier which identifies the previous logged in user of the application in plain text( just the username). I certainly feel that this should not have happened but cant figure out a way this may be used by attackers and how best it can be avoided ?

Any ideas ?

It can be used by an attacker with access to cookies to determine the username of the last person who logged into that site using that browser. It can also possibly reveal a person's other account if they have multiple of them and were previously logged in using the other one and did not clear their cookies (which to be fair isn't necessary assuming they trust the site and expect logging out to fully log them out and not leave references to their account in cookies).

I am not sure why the server needs that information nor how is it used but there may be a vulnerability where the server blindly trusts the value and allows some kind of access based on it. In that case an attacker could set the cookie to anything they want and impersonate the corresponding user.

How to avoid it? Not set the value in the first place - again I am not sure what purpose it could serve, but if you truly do need such a value, keep it in the server's session instead. The client will not be able to see nor tamper with the value that way.


Is Password Complexity required at all For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:-

        Byte[] lPassword;
        var lRNG = new System.Security.Cryptography.RNGCryptoServiceProvider();
        var lSalt = new Byte[16];
        lRNG.GetBytes(lSalt);
        using (var lPDBGen = new Rfc2898DeriveBytes(Password, Salt, 1000)) {
            lPassword = lPDBGen.GetBytes(16);
        }
        ... Save lPassword and lSalt to the database ...

If an attacker gains access to this information they essentially have access to the protected data (I can't afford a separate secure password server).

So, using this scheme is there any purpose at all in requiring any form of complexity on the user's choice of password, down to and including an empty password?

It doesn't matter how strong your password hashing algorithm is (well, it matters. But not much) when the password is stupidly weak.

Common passwords like password123 or ilovehowmileycyrustwerks will fall quickly to dictionary attacks regardless.


Does it matter what version of GnuPG I use to create revocation certificates? Today I am about to create a bunch of revocation certificates for all of my emails. Why? Because it already happened to me in the past, that I lost my private key, or my computer was compromised. It does not really matter, but I felt like it is better when you know. I will store it in a safe place, no worries.

Now, I have both GnuPG 1.4.16 and GnuPG 2.0.22 on my Linux machine installed. What version should I use to generate them? I am used to using version 1.4, but since there is a newer version, I can't think of any reason as to why would I not use the newer one. Or is there?

Anyway, I created the revocation certificate with both versions and they differ.

Both versions of GnuPG are compatible in the output they produce: they both implement RFC 4880, OpenPGP. They're even compatible in the keyring and trust database formats they're using.

GnuPG 2.1 supports some additional ciphers and has changes to the keyrings which might prevent using both older versions of GnuPG and GnuPG 2.1 (or in future: newer) at the same time (at least without hassles), but still revocations produced by GnuPG 2.1 are readable with GnuPG 1.4 and 2.0 with issues if the revoked key's cipher is supported by those (which is, as you mostly use it with GnuPG 1.4).

This is the relevant information on compatibility considering revocations, I wrote up a more complete discussion about Are GnuPG 1 and GnuPG 2 compatible with each other? and their differences on Super User.