Is storing the bcrypt salt in isolated database a good idea? I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really where you place the hash. But, I am assuming here that a hash is generated such as
hash(plain+salt) or something as such.

Most people recommend that, the best way to put salt is in a different column or alongside with the password hash itself. As far as I understand, this also improves performance for credentials validation easily. And also I assume the server side ensures different salts are used to hash different passwords. So, in case of database is leaked, Attacker will have to compute Rainbow tables for all the hash+salt which is tedious.

But, I am considering an edge case here. Let's assume the attacker is specifically interested in cracking password for one particular user. Attacker dumps the database, gets access for the Hash, and Salt as both are either placed alongside each other or in different columns. Now, attacker will be able to build a custom rainbow table for that salt to run attacks.

So, assuming if you are going to do a trade-off between timing to check password & security, Isn't storing salt alongside with password a bad idea?

Wouldn't you prefer using a secondary, isolated database just for storing the salt with respect to id field to pin point which id the salt is applicable to in the users table in main database?

Would not that be a better option rather than the option which I see daily on Internet everywhere? Or are there any other better options than this ? I do not mind trade-offs between timing/performance of the webpage & security.

Now, attacker will be able to build a custom rainbow table for that salt to run attacks

I don't think you understand what a rainbow table really is and how much effort it is to create one. Basically a rainbow table is a trade-off where one invests lots of time (and memory) initially and then can crack lots of password hashes faster, as long as the relevant hash is covered by the rainbow table. To crack a single password it is way faster to just brute-force it instead of creating a new rainbow table with the specific salt. The protection against attacks based on rainbow tables is thus not to hide the salt but to use unpredictable and sufficiently long salts so that the attacker does not have already a pre-built rainbow-table.

In other words: there is no need to protect the salt against the attack you imagine.


Large number of spurious retransmission - is my server under attack Please take a look at this picture, can anybody tell me are those packets sent from some kind of malware?

It is the same source IP address, different port numbers, SEQ number is always 0, and there are a lot of those packets...

To be clear, a packet capture won't tell you anything about a malicious payload. I suppose if you work with malware enough, you can see a pattern for particular malware byte code, but probably not.

Network analysis should be done based on a baseline. That's when red flags are apparent. If you've never done a base line before, it's hard to tell what is normal and what is worth investigating.

Spurious Re-transmission

This blog gives a good rundown, and since I don't need to re-write the definition, from the blog:

  Basically “Spurious Retransmission” means that data was sent again
  that the receiver had already acknowledged, which is something that we
  used to call “needless retransmission” in our own expert system.

At this point, this question is not really for Information Security. It's damn near impossible for anyone here to give you security answer about a system they cannot directly analyze.

That being said, I would suggest you up date you question to trying figure out what's causing the Spurious Re-transmission, rather than thinking it's something else.

Here's a reference link to ask wireshark which may be of use. I'd move this to the networking or wireshark community.


Where should I store a username during a password reset? I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet
The cheat sheet advises not to send the username as a parameter when the form is submitted and sent to the server. Instead one should store it in the server-side session.
However, I am not sure how I should do that, since for me to be able to store the username in such a way, the user needs to enter his/her username and send it to the server at some point, right? Why not send it together with the form where the user answers security questions? Or am I just understanding this the wrong way?

This is what I usually do:

The user asks for a password reset.

The system asks for the registered email.

The user enters email, and no matter if email exists or not, you say that you sent a reset link.

The server stores email, expiration and reset token on a reset_password table

When the link is accessed, expiration is checked and a form to reset the password is shown.

User only receives a link with a large random token.


apparmor alternative for MacBook Does anyone know an alternative to apparmor for Mac? Every time I use winebottler my MacBook gets Windows viruses. Wanted to protect my Mac from it.

Very little work has been written on OS X security, especially malware issues. The book Incident Response & Computer Forensics, Third Edition, 3rd Edition's Chapter 13 covers investigation of Mac OS X system integrity breaches. Of perhaps primary interest would be the section on system auditing which includes information on OpenBSM configuration and analysis.

The best recent work is from Yelp with the FOSS project -- https://github.com/Yelp/osxcollector -- based on the original -- https://github.com/jipegit/OSXAuditor

They link out to some additional resources on this page -- http://www.mac4n6.com/resources/

Another book, The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory, covers OS X malware from a memory capture assessment perspective. It links out to a few blogs, such as ones that cover techniques and others that provide case studies and downloads of live OS X malware samples.

Be sure to check out the recent news from this year's BlackHat US and DEF CON. Stefan Esser's public exploit was discovered in the wild shortly thereafter and OS X malware made a lot of fanfare during that time period, including a more-recent one from Luca Todesco.


Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)? Although I think OpenID 2.0 is a cleaner and better authentication protocol than OpenID Connect, I have to implement an OpenID Connect IdP.

One point I like in OpenID 2.0 is that the IdP can return a signed identity to the Relying Party (through the user agent) and there’s no additional round-trip between the RP and the IdP.

At first sight, OpenID Connect defines an “Implicit” flow which looks fine to me. But when I look at the details, it seems to be designed only to be used with “Clients implemented in a browser using a scripting language”.

I thought that I might anyway use the “Implicit” flow with a server-side RP, using the “query” Response Mode, but the “OAuth 2.0 Multiple Response Type Encoding Practices“ document explicitly forbids the use of “query” Response Mode with the id_token response type…

Why is it forbidden ? And more generally, why is the “Implicit“ flow frowned at?

As I understand it, as long as the ID tokens are signed, and the RP use (and verify) nonces, the “Implicit” flow should be safe.

2020-12 UPDATE
There is an OAuth 2.1 draft to get rid of Implicit flow - short summary  here. OAuth 2.1 brings together the latest OAuth 2 best practices.
TLDR; best to avoid Implicit flow if you can.

And more generally, why is the “Implicit“ flow frowned at?

Because the access token is exposed to the user agent (browser). See Implicit flow diagram in the OAuth 2 spec, then compare it to the Authorization Code flow that doesn't expose the token to the user agent.

... explicitly forbids the use of “query” Response Mode with the id_token response type... Why is it forbidden ?

Quick definition:
scheme://host:port/path?query#fragment

The "query" portion of a URL is easily inspected by many parties - it may be recorded by the user agent (e.g. browser history), and is often found in Web server request logs. Rule of thumb is to never send any sensitive information (e.g. tokens, authorization codes, passwords) via the "query" parameter.
However, the "fragment" portion is never sent in HTTP requests, nor will it appear in Referer headers. Only JavaScript executing on the user agent (browser) would have access to it.
For instance, a client (browser) could make a request like this:
GET /authorize?
  response_type=id_token%20token
  &client_id=s6BhdRkqt3
  &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
  &state=af0ifjsldkj HTTP/1.1
Host: server.example.com

Auth server would respond with (note the "fragment" denoted by "#"):
HTTP/1.1 302 Found
Location: https://client.example.org/cb#
  access_token=SlAV32hkKG
  &token_type=bearer
  &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
  &expires_in=3600
  &state=af0ifjsldkj

The browser would then exclude the "fragment" when it redirects to the target location. JavaScript code in the browser is expected to submit the relevant token(s) using a more secure mechanism (e.g. POST body).
There are quirks among the various browsers, but nothing apparent that defeats the security assumption.


Private VPN server in public cloud I need to encrypt all my traffic, because I often work in unsecure network environments.

My questions is this:

if I buy my server from VPS providers (amazon ec2, digitalocean, etc) - how secure will be my traffic if I often work with http/ftp protocols (unencrypted protocols) ?

Can other clients from the same network (amazon ec2, digitalocean) sniff my traffic ?

I will use openvpn/ssh tunnels for routing my traffic.

In regards to your first question:

The protocols you use will matter when leaving the VPN and going to the servers that you are trying to contact, so anyone sniffing traffic to those servers will be able to see what's being sent.

In regards to your second question:

If another person using EC2/Digital Ocean were able to sniff your traffic through that provider's network, it would be a MAJOR security flaw on the part of the provider, and I sincerely doubt that it would happen (unless you piss off the government and they get a warrant to force the provider to do it, but if you do that, they could also probably force the provider to identify you).

The main comment I have, though, is that you might not want to set up a VPN yourself, for multiple reasons:

You're leaving a paper trail of who owns the VPN server with the cloud provider, who (as I mentioned) will be perfectly happy to identify you to the government.  If you don't care about the government knowing what you're doing, you should be fine.
The companies that provide VPN services will be able to host more than one VPN client on a single box, which provides:

More protection (as an attacker will not be able to distinguish traffic that is yours from traffic that belongs to other clients)
Lower costs, as they only require one instance for multiple VPN clients

They're probably more optimized for what they're doing than something you set up will be, and they'll hopefully be less likely to make mistakes like allowing weak encryptions to be used.


Understanding nmap output / author explanation ...(Scapy) I just read this example and explanation (below) in the OReilly book Security Power Tools (2007) in section 6.3 that is written by the creator of Scapy, Philippe Biondi.  I think the example is very interesting, but I don't understand what it is saying.  Can someone clarify this goldmine of info he is referring to?

Here is another example of a tool interpreting a situation:
#nmap 192.168.9.3
Interesting ports on 192.168.9.3:
PORT STATE SERVICE
22/tcp filtered ssh

"Nmap says that the port is filtered, but this answer has been triggered by a host
unreachable ICMP error sent by the last router. In this context, the ICMP message
has been interpreted as The packet has been blocked on its way to the target, while it
should have been interpreted as The packet was to be delivered, but the target was not
reachable. This situation typically occurs when a port is allowed to pass on a whole
IP network block while not all IP addresses are used. This is a gold mine of information
when you want to set up a backdoor, but if you trust your tool, not only will
you miss the gold, but you’ll also lose the whole mine because Nmap makes you
wrongly assume no backdoor can be implanted there."
 Security Power Tools (2007)

So I can take a swing at this, but I'm essentially guessing at the motivations of the author, the only person that can definitively answer this.

What he appears to be saying is, in the case above the filtered result might make you believe that a firewall rule is in place blocking access to port 22/TCP on 192.168.9.3 as such you might not think it possible to use that host and port for your own services (assuming you're the attacker here), but in reality access to that host isn't blocked, the IP address just isn't assigned.

It's true to say that to get the best out of tools like nmap, you need to understand what they're telling you.  "filtered" for TCP services really means "I didn't get a response".  Now if you're only checking hosts that have responded to some kind of pinging behaviour (the default with nmap) then that answer probably makes sense, as the host is present (it responded to ping) but it doesn't respond on that port (thus the filtered result).

In his example above I'd guess that the scan was run with -PN or similar so that nmap would scan hosts even with no response to ping.  In those circumstances "filtered" means "I got nothing back, that host may or may not actually be there"


Is it secure to SMS your Credit card info (or other info) to someone else? I am buying some products and have mostly communicated with the store via email.  I am planning on paying by credit card, but the store doesn't have online billing.  Normally, I would just phone the store and provide my credit card info but they are out of country and I can't make calls there.  Is it safe to SMS my credit card info?

More generally, is SMS a secure method to send sensitive information?

Similar to Is it still unsafe to email credit card number nowadays?.

Via virtual Phone Services like Google Voice, SMS can be delivered to someone's email, SMS can be no safer than email. There are also many Services that clone SMS messages from your phone to your computer or email. So, like the question you referenced, even if the receiver is trustworthy, you're relying on an awful lot of infrastructure staying secure. Sounds pretty risky to me.


How Likely Is It For A Virus To Spread From A Linux VM To The Windows Host I'm currently running Windows 10, and I plan to use a Linux distro to run in a VM (Virtual Box). I know Linux is one of the most secure operating systems there is and I'm curious as to how likely it is a virus could spread from the Linux distro onto my Windows. I've seen posts similar to this where answers usually mention a virus could still spread over a network, but I never saw Linux specifically mentioned. Does this still apply no matter the OS?

Edit: I am fully aware Linux still has holes and is still a target for malware. I only said one of the most secure because it's more secure than more widely-used operating systems like Windows.

Depending on your setup between the host and the virtual guest there are a few ways that a worm or virus could propagate.

1) Simple networking.
- If you have the networking adapter enabled on the virtual and the host can interact with it, then yes. A piece of malware that was multi-OS could propagate. Alternatively, if the malicious code was written in a cross-platform engine like Java, and you run Java on both the guest and host. This could be from setting the guest networking to host only, or host networking.  Technically possible with any enabled networking, but more likely with those two. Nat and Bridged form the connection to the host's NIC differently.

2) Sharing enabled.
- Having the host files or the clipboard even be writable to the guest can allow for an escape  or evasion tactics. VMWare shared folders had at least one CVE published for escaping the guest via the shared folders function.. 2008-0923 when I searched it, but there might be more.

3) Driver based
- Venom by crowdstrike showed how to do a Virtual escape based on the floppy driver being enabled by the guest. There may be similar vulnerabilities for other drivers.


Brute Force Decrypt VeraCrypt - No Rescue Disk - Password Fails My PC has failed in some way, as the PC was off when I checked it. I checked the CPU temperature etc., and runs at 54deg C in the BIOS, and does not fail when left on. So, I am not sure if it is a hardware issue.

The hard disk is encrypted with VeraCrypt, and despite entering the password it will not boot/decrypt, and I do not have the VeraCypt rescue disk for this specific disk. This is the second time a WD drive refuses to boot/decrypt – I suspect it has corrupted the relevant hard disk sector.

I know what the contents of the hard disk is – as I have a backup from some time ago.

So, the only alternative is to attempt to decrypt using a brute force algorithm – which is nigh on impossible.

Will knowing what the hard disk contains be of any benefit?

And if so – are there any free decryption programs that can use known hard disk contents to accelerate the hard disk decryption?

No, knowing the encrypted contents won't help.

This is called a known-plaintext attack and good ciphers should not break when confronted with one.


OAuth - How does the Resource Server validate the access token is not for any other Resource Server? Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.

Both resource servers - RS1 and RS2 use authorization server - AS

If a client requests an access token for RS1 and passes it to RS2, how will RS2 validate it and fail?

One possibility is to depend on scope checks - but it seems scope checks are nothing more than string comparisons (or am I wrong here?). In that case, if both RS1 and RS2 define exactly the same scope name (e.g. Read) then there is no reliability even with scopes.

You can also use JSON Web Token (JWT) (https://tools.ietf.org/html/rfc7523).

The JWT includes an "aud" parameter to specify the audience of the issued token.
Resources servces must check the signature of the token and the data it contains.

See https://tools.ietf.org/html/rfc7523#section-3

Another solution would be to associate a resource server to the access token by creating a new property (containing a name or url or the client_id to identify your authorized "resource server").
 Then checking this parameter depends on how the communication between your authorization server and your resource servers works.


How does full memory encryption in newer processes protect against DMA attacks? Upcoming Intel CPUs have TME, current AMD processors have SME.

These are full-memory encryption techniques to protect against physical attacks such as cold boot attacks.

Both support encrypting the entire RAM from boot so that software does not have to be modified to support them.

In combination with full-disk encryption and a TPM1 (which solves the boot key problem and can guarantee booting unmodified software all the way to unlocking the disk encryption without user input), this should allow operating and safely booting machines in fully untrusted environments without physical security (please correct me if this is wrong). The machine should either boot unmodified software, or refuse to boot; the encryption keys cannot be extracted at run-time due to the full-memory encryption.

It is unclear to me to what extent these techniques protect against DMA attacks. Usually, you can read the entire machine's memory directly via such an attack, e.g. by plugging into a PCIe port. If all memory is encrypted, then you can likely not.

How do devices like GPUs, which rely on DMA, even work in the presence of full-memory encryption?
Does using such a device spoil the benefits of full-memory encryption and thus safety without physical security?

Thanks!

1 Note conventional on-mainboard TPMs were susceptible to physical TPM reset attacks and bus spying attacks, but on the new processors mentioned above (such as AMD EPYC), the TPM is integrated into the processor die as it is part of AMD SPS or Intel ME respectively, so there "messing with the cables" should be very difficult.

How does memory encryption impact DMA attacks?
Full-memory encryption is not designed to protect against DMA attacks. That is what an IOMMU is for. The IOMMU is configured using a type of ACPI table for DMA Remapping, or DMAR. This table contains a list of regions used by each DMA-capable device connected to the PCH. The IOMMU will then restrict memory access to those regions and those regions only:

How do devices like GPUs, which rely on DMA, even work in the presence of full-memory encryption?

There are two techniques to support DMA. The first is to exploit the fact that memory accesses over PCIe still go over the PCH, meaning that the chipset has the opportunity to transparently encrypt and decrypt the DMA buffers. The other technique is simply to mark the pages used for DMA as unencrypted. The latter technique prevents DMA attacks, but it is likely that the former is implemented instead. The latter technique is more common for experimental software-based memory encryption such as vCage and HyperCrypt. This is not an issue at all, as I explain later.
According to the TME link you provided, a single exclusion range is supported where encryption is not supplied. This range is designed for things such as the BIOS (which has components loaded very low in the address range). Since it specifies that only a single range is supported, this means it cannot be used for DMA buffers as they are spread out among multiple ranges.
Also, you should be comparing TME with TSME, not SME. Regular SME only encrypts individual pages. TSME, on the other hand, behaves more like TME by transparently encrypting almost all system memory, making it unnecessary for software to explicitly support the feature.

Does using such a device spoil the benefits of full-memory encryption and thus safety without physical security?

Not at all! When memory encryption is in place, the data will be transparently decrypted and sent over the PCIe bus when the device requests it. This is actually not that different from memory scrambling, a technique to reduce di/dt on DRAM chips by encrypting memory with an algorithm called an LFSR. This algorithm is very weak, so it is not used for confidentiality, only to improve the reliability of hardware. TME and SME just takes this to another level, using hardware-accelerated encryption with a real, strong cipher instead of the weak LFSR algorithm.
As a bus gets faster and faster, successive bursts of 1s or 0s become very stressful on the device. This can cause severe, rowhammer-like interference (a single 0 in the burst of a million 1s will not be very happy). It can also cause power surges, as every capacitor that is charged needs to be recharged every 64ms. Memory scrambling prevents this from being an issue by ensuring that, on average, each bit being stored in physical DRAM capacitors will have an equal chance of being a 1 or 0, regardless of the logical data that is actually being stored. This is not unique to DRAM in any way and is employed by a wide range of high-speed buses.

Note conventional on-mainboard TPMs were susceptible to physical TPM reset attacks [...]

Once you have unrestricted physical access to a machine, maintaining integrity becomes very, very hard. An attacker can simply attach a JTAG probe and control the processor like a puppet.
How do DMA attacks and DMA work?
So, what happens if you plug in a rogue PCIe device? First, the computer will configure the device. If a driver requests it (which is usually the case if the PCIe device pretends it is, say, a WiFi card), it will be given bus master, which allows it to mount a DMA attack (which is also often called evil busmastering for this reason). Each PCI or PCIe device is part of what's called an IOMMU group. Without ACS at least (see section 4.3 in the Intel document), each IOMMU group has its own dedicated memory range and any device in that group will have the same restrictions applied to it.
Taken from a question I asked, you may look at your kernel log and see something like this:
DMAR: Setting identity map for device 0000:00:1d.0 [0xa95dc000 - 0xa95e8fff]
...
iommu: Adding device 0000:00:1d.0 to group 11

This means that any device in group 11, including 0000:00:1d.0, will only be able to read physical memory from address 0xa95dc000 to 0xa95e8fff. The kernel is configured to look at that region of memory for any DMA buffers that needs to be shared between it and the device.
I describe how DMA works and why it is needed on another answer. The relevant part:

It might be useful to understand why DMA exists and how it works. When DMA is supported, a dedicated region of memory is set up and the controller (whether the ICH or PCMCIA) directly writes the data read over IDE to that memory region (using the DMA-based UDMA or MDMA protocols). From the CPU's perspective, it issues a command to read data and then can go do its own thing, knowing it will be asynchronously alerted with an interrupt as soon as the process has been finished, with the requested data waiting right there in memory for it. Likewise if it wants to write over IDE, it can simply populate that memory region with the desired data and tell the controller to take it. Just like when reading data, the CPU is free to go off and do its own thing without needing to micromanage the transfers. It will be alerted with an interrupt as soon as the task is completed. This is why transferring data to and from devices (GPUs, NICs, storage devices using IDE or SATA, etc) can be made so fast and require so little CPU to perform.

How secure is an IOMMU?
There are some ways to bypass an IOMMU or reduce its effectiveness. For example, older IOMMUs on Intel using VT-d1 which lack x2apic and interrupt remapping are vulnerable, and Address Translation Services, or ATS, can bypass restrictions. A properly implemented IOMMU will, however, completely prevent a DMA attack from reading arbitrary system memory. This is what you will be relying on for protection from DMA attacks, not memory encryption. Memory encryption is designed to protect from passive bus sniffing and from cold boot attacks.
Memory management on x86 is incredibly complex, with their specifications including thousands of pages of dense technical information. All this complexity can have strange security implications, such as allowing a GPU to reconfigure an IOMMU to reduce security. While in theory, an IOMMU will prevent a device from accessing illegal memory ranges, there is no end to the complexity that underlies this technology and the potential vulnerabilities that come with this.
If this wasn't bad enough, DMAR tables, which an IOMMU relies on to restrict devices, are managed by a computer's OEM. It's not uncommon that a computer ships with a broken DMAR table, forcing the computer to completely disable DMA attack protection. For this reason, some operating systems (such as Debian GNU/Linux) actually have the IOMMU disabled by default!


Is it as easy to crack a wifi password, as shown in the video? I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist.

According to the video it takes about two minutes to crack the password, but I guess it can take a longer time, depending on the difficulty of the password. But what is the downside of this method? I mean, if it is so easy to crack a wifi password, why do wifi which requires payment exist, for example on an airport?

Is the likehood of getting caught 100 percent? Or was the person in the video cracking an "easy" wifi?

And to the main question, how does one protect oneself from an attack like this?

Essentially, yes, the person in the video was cracking an "easy" WiFi. The password chosen to secure the network ("plausible") was simple enough to be contained in a short wordlist. They simply tested all of the entries in the wordlist until they found the correct password. In practice, this method is unlikely to work as effectively as it did in the video because most actual networks are, at least in theory, secured with longer and more complex passwords that would not be found in most wordlists. Brute-forcing takes exponentially longer as password length grows, so once a certain password length and complexity is reached this method becomes impractical.

Paid public WiFi networks generally don't use any encryption at all, so that is a separate discussion entirely.


Web Applications terminate strings on null-byte I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string actually terminates the string there.

That is fine for the lower level languages like C, I know how that works, but why does this apply to the web applications, I have seen this happen in both PHP and ASPX pages.

Is this a vulnerability, an intended feature of the language or just a bug with the languages?

Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open the file foo.txt\0.php (where \0 stands for a null byte), then the OS will only see a request for foo.txt, ignoring the rest of the string.

This is documented. In other languages as well.

In your case, one must assume that the bytes received as a "search string" are sent unmodified to an underlying search system for which the null byte has the special meaning of terminating the string. Though this is not a vulnerability in its own right, it is indicative of the Web site not filtering input characters, and that can lead to trouble.


Can a powered down cell phone be turned on remotely? I know this is tin-foil hat fodder, but at least one judicial opinion referenced a bug that could track/listen in on the subject "whether the phone
was powered on or off," although that may have been a judge misinterpreting the technobabble spouted at him, or an FBI agent overhyping their tech to the judge.

It seems like with smartphones all the rage now, it would be possible, e.g. to create a root kit that would simply mimic the phone entering a powered down state while still transmitting, although this would have an obvious effect on battery life unless it actually powered down most of the time and just woke up to transmit basic location information in a heartbeat configuration.  Is there anything similar out there in use by either "good guys" or "bad guys" that you know of?

Who's to say that the phone is really off?  If someone controls the firmware of the device then the off functionality could be replaced with state in which the phone appears to be "off" but is in fact maintaining a line of communication to a remote user.

However firmware cannot stop you from introducing a hardware switch to disconnect the microphone.   A similar switch could be used to disconnect the battery.  With physical control over the device you can just move to a lower layer than your attacker and cut them off.


Will using SSL to secure Wordpress admin area only still actually be secure? The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.

There are many articles on the internet that instruct to secure the admin areas in order to harden the wordpress site, however if the person with credentials is in an active session and browses to another portion of the site that isn't under SSL (say, to check the post they just published), wouldn't that nullify efforts to secure the session? Or am I a crazy lady who doesn't get how this works?

If it would nullify it then how does one secure the admin interface? Is HTTPS an all-or-nothing thing? We already have the contents outside of the install, so that alone helps greatly in hardening the overall site, however we don't want login pages and session cookies out there with their pants around their ankles.

Generally speaking, that's true.   Authenticated requests (requests that contain cookies or other state information that identifies a specific user) must only be made via HTTPS for that data to remain reasonably secure.

However, in this particular instance, there may be a potential alternative, which is to set the "secure" attribute on the cookies, and treat the users as unauthenticated on non-HTTPS pages.   If they don't need to be authenticated on the non-admin pages, then setting the secure flag on the cookies will insure that they aren't sent along with requests to non-admin pages that aren't protected by SSL.

So, if they cookies need to be sent with every request, then every request needs to be HTTPS.   If they don't, then you're equally safe simply making sure that the cookies aren't sent except when the request is protected by SSL.


Which algorithm is used to combine a key between client and server? I read a lot of Q&A here, and read a lot of articles about RSA and Diffie-Hellman, but it seems like they are all saying opposite things about the question:

When I start an HTTPS session in a website, for example, is the symmetric key that will be used in AES combined with the RSA asymmetric algorithm, or is it combined using Diffie-Hellman key exchange algorithm? Because, it seems like both of the algorithms can do the same thing: combine a symmetric key between two sides of communication.

This is another variant on "How does TLS work?".

With Diffie Hellman, the shared secret that results from the exchange (g raised to the power of a raised to the power of b mod p) is fed into the PRF (together with other values) and is used to generate AES keys (and other values). The keys from the certificate do not participate in this process. Asymmetric authentication is achieved by doing a new online digital signature on the values of the DH key exchange using the private key for the certificate, which protects from MiTM attacks.

With the obsolete RSA key exchange (which does not provide PFS and does not exist in TLS1.3), the client just generated a random value, RSA-encrypted it to the public key from the certificate and sent that. The server RSA-decrypted the value using the private key for the certificate, thus establishing a shared secret value and at the same time proving possession of the private key from the certificate. This allows retroactive decryption of network intercepts after the private key for the certificate leaks (even if the certificate is already expired). The shared secret value is fed into the PRF, yada-yada.


Would Axolotl Ratchet protocol be suitable for encrypting email communication? Axolotl Ratchet is used by the Signal messenger (formerly known as TextSecure) and an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt messages without both parties to have to be online at the same time as described here. The key exchange is happening asynchronously.
Signal also solves a couple of other issues, like out-of-order decryption and preventing metadata to be leaked through cleartexts.

This sounds to me perfect as a replacement for PGP, which is lacking Forward secrecy (PFS) and some other issues.

What problems would have to be thought through, when creating a mail client plugin (like Enigmail for Thunderbird) that uses axolotl encryption instead of PGP?

Neat idea, good question, but there are a couple issues that make axolotl not a good drop-in solution for existing email clients and/or servers:

1)  The asynchronous part of TextSecure requires help from the server that email servers don't provide.  Specifically, TextSecure/Signal servers distribute ephemeral public keys for offline users.  Email servers don't.

2)  Axolotl clients are necessarily stateful, tracking the key ratchet for every conversation.  It is (again) just not a function that email clients are built to provide, and it makes having more than one email client hard, because it necessitates synchronizing that state between one's email clients.  E.g. your desktop email client must get all the keys generated by your smartphone email client.

It could, however, be a good email replacement.  If you want to work on that problem, check out the web client in development for TextSecure, or Pond.  Textsecure/Signal needs a desktop client, and Pond needs a mobile client.

While the axolotl ratchet is brilliant and offers some great security properties, there is an argument to be made that the security guarantees that axolotl provides are not worth the state-maintenance hassle for a lot of use-cases.


Antivirus constantly detecting tmp files as threats Recently my antivirus has been constantly detecting threats and it's always tmp files. I delete maybe 50 of these files each day. A few days ago it detected a trojan. Last week it detected many '.json' files from AppData/Local/Google/Chrome/User Data/Default/Extensions.

I scanned with Avira, Bitdefender, Malwarebytes, CCleaner and tdsskiller today. The scans have only detected tmp files. I d/l many torrents recently, d/l java and used it in internet explorer, and I once enabled javascript on a shady site.

I tried googling the problem, but I haven't found too much info specific to my situation. I disabled the search and indexing services.

Could it be an attack similar to the one explained here?
how can an attacker use a fake temp file to compromise a program?

Edit:
I have Adblock, BeelineReader, Ghostery, Google Cast, Google Dictionary, HTTPs Everywhere, Lastpass, Password Alert, Session Buddy, WOT, and StayFocused. But I've had all these for months. I deleted all my browsers cache / everything in the temp folder using CCleaner and rebooted many times.

I can't comment yet, so i'm posting this as an answer:

This looks like a Trojan which is running in memory. Please, include your TaskManager process list from all users (or preferably with Process Explorer) and try to find a process running from a weird place (like C:\Users\YourUser\AppData\Local\Temp\ ). Kill the process and delete the file. You can try to catch it by monitoring your running tasks for disk writes with both programs.

Also use Autoruns to find which programs are automatically executed when you turn on your machine. Disable those which are completely rare (just be careful not to disable a useful program).

Also you can try to log on "Safe mode" and run Disk Cleanup (sometimes trojans are stored on temp folders). You can manually clean temp folders too (C:\Users\YourUser\AppData\Local\Temp\ and C:\Windows\Temp\ )

If all previous fails, uninstall and reinstall Chrome. Hopefully that will delete the autorun tasks Chrome might have.

After all, if your problem persists, try using another web browser (like Firefox or Opera). Sometimes trojans can setup autorun tasks based on a specific browser.

Also try to include the name of the trojan/virus your antivirus is detecting.

Sometimes it's an art to catch those pests and delete em.


Run native code from shell on read-only filesystem I'm researching an embedded device running Linux, busybox, and a few custom services. I've found a way to obtain unprivileged shell access, and trying to see if it's possible to escalate privileges.

The kernel is old and looks vulnerable, however the biggest obstacle is that the entire filesystem is read-only (including /tmp and /dev/shm), i.e. 644/755 and everything is owned by root.

What are some possible ways to execute custom native code on a read-only filesystem, having only shell access?

Some possible avenues I've tried:

Get the system to mount your filesystem (requires root or physical access)
Get the system to save an ELF binary somewhere on the filesystem, then run /lib/ld-linux.so.2 with it (couldn't find a way to do this)
Run /lib/ld-linux.so.2 with a pipe or /proc/self/environ (doesn't work, ld-linux requires the file to be mmap-able)
Use dd of=/proc/self/mem to clobber dd's stack (the kernel is pre-2.6.39, where writing to /proc/self/mem is disabled)
Find a program with a vulnerability in handling command-line or environment arguments (nothing so far)
Find a scripting language capable of making syscalls (the only scripting facility is busybox's shell)
Write to a UNIX socket and get the service listening on it to do something (no utilities exist on the filesystem which would allow sending arbitrary data to UNIX sockets)

Have I overlooked anything?

Find a program with a vulnerability in handling command-line or environment arguments (nothing so far)

This is probably the most promising avenue.

In my case, I've been finally able to find a buffer overflow in the handling of an undocumented parameter of a custom proprietary utility.


Do some IoT devices connect to your wifi without you knowing it? I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work around?  Are there any IoT devices that are not connected to your WiFi and are those of any security concern besides possibly becoming part of a botnet?

The owner normally has to manually configure the device to connect to their wifi, since (a) the IoT device can't automatically figure out which wireless network belongs to the device's owner, and (b) even if it did, it can't connect unless it can figure out the password.
MechMK1 mentions the possibility of the device connecting automatically to open Wifi Access Points. Although this is possible, its unlikely for an IoT device to be configured to do so, since as MechMK1 mentions, this would probably be illegal.

are those of any security concern besides possibly becoming part of a botnet?

Of course. There is a lot an attacker could do after compromising an IoT device, depending on the devices capabilities. For example, if you have a home security system connected to the internet, the hacker could use any security cameras to spy on you. Or the consequences could possibly be more lethal. For example, a hacked internet connected smart oven could perhaps be used to start a fire.


Authentication even with incomplete password When one enters a password to access one's online account, one has to type out the complete password, and submit it to be authenticated. If the password is very long, and if the account is accessed regularly, it will be very tiring to type out the full password over and over again.

Are there any schemes where the user types in a long password, and at every keystroke, the server checks whether or not the password provided so far is satisfactory? If it is satisfactory, the system logs the user in before the user finishes typing the password.

Do such schemes exist?

Not sure I understand exactly what it is you are proposing. But unless I misunderstand you completely it would be a security disaster:

If the server gives any kind of indication (if only just in the time it takes for it to respond) if an individual character was correct or not it makes the password much easier to brute force, since you can just do it letter by letter. You end up having to make l*n attemps instead of l^n, where l is the length and n is the size of the alphabet.
If the server lets you in after just half a password you have negated the whole benefit of having a long password. As techraf comments: Your scheme is called "a shorter password".
You can not hash the passwords if you want to be able to check them character by character. That makes safe password storage an impossibility. (Well, you could hash them a ltter at a time but then we are back at the brute forcing problem.)


Can CDN contents be decrypted by officials in new Telegram security design? Recently Telegram announced using CDN in some territories where they don't want to place main servers.
Although the internals are not explained, according to provided diagram and information, a key is passed from Telegram server to Telegram user which CDN is not aware of.

Since the file/file segment is encrypted before being uploaded to CDN, I'm assuming encryption algorithm is of symmetric-key type.
Now, even a new key is used for each file/file segment, that key is the same for everyone (Otherwise each file should has an encrypted version for each user which is not practical).
No matter how the key is sent to Telegram user (i.e. end-to-end encrypted) at the client side that key could be extracted by every client, including the one in control of the officials. So,

What's the point of encrypting CDN contents and pass such a key directly to the Telegram user?

First, AES-256-CTR (as labeled on one of the squares) is in fact a symmetric cipher. No assumption required.

A more important aspect of this scheme is really preventing the CDN from changing files in an undetected manner.

The link between the client and Telegram server is presumably trusted, and information to verify the legitimacy of files in the CDN is transferred (ie. key and hash). If the CDN changes files, the trusted hashes will no longer match the malicious files.

This CDN scheme is only used for publicly shared files on Telegram, so the file can be considered to be at least quasi-public. The CDN host might obtain the key using Telegram which would also allow them to re-encrypt the file, but there is still no way for them to make the hash of the modified file match.


How can I be attacked by opening a corrupt MS Office document? When opening a corrupt Microsoft Office document, I get a prompt that says something along the lines of:

  Excel [or Word/PowerPoint/etc] has found unreadable content on 'filename.xslx'. Do you wish to recover the contents of this document? If you trust the source of the document, click on Yes.

Why does Office tell you to click yes if you trust the source? What are the dangers of clicking Yes? What attacks can be done via this feature?

Edit: this is for a file without macros, before allowing macros to execute, since the prompt appears when opening the file. This can happen with files that don't end with *m

There are many reasons to why a corrupt MS Office document could attack your computer when it is opened.  The first reason is Macros, which is typically coded in Visual Basic.  The code of the macros could have malicious outcomes.

Although macros are majority of the time the cause for attack to occur from opening an MS Office document, there are other things as well.  Another major attack vector from corrupt or malicious MS Office files are ".pst" files.  PST files are files that contain archived calendar, messages, emails, etc. from MS Outlook.  From just the name of the office product one can just guess what the attack vector is.  The attack vector being that if a malicious email that had an internal malicious JavaScript, image, etc., was archived. Later opening up the ".pst" file and opening the email, it could start attacking the device that is opening the archived email in the ".pst" file.

Another attack vector (although old) is a malicious ".xll" file.  A ".xll" file contains C, C++, ".dll", and FORTRAN executable code that could be malicious.  A ".xll" file is considered by MS as a legacy Excel format now.

The last thing I can think off is a malicious ".maq" file that is used by MS Office.  It is a regular shortcut, but when opened it can automatically run a query on a database preconfigured or specified in the query.  If the query is malicious (ex. DROP DATABASE PASSWORDS), it will be attacking, or should I say modifying the data in the database machine/environment.


Cordova's APP_SECRET discovered in config.xml file What is the security implication of the APP_SECRET being discovered in a Cordova Mobile app? Steps on how to get the APP_SECRET is described here but there appears to be no clear guidance on what the risk is if it gets exposed.

I am looking at a number of Cordova mobile apps at the moment, and almost every single one of them appears to have the APP_SECRET hard-coded in the Cordova config.xml file. Is this a major risk? Or it is just a unique ID for Microsoft to be able to report analytics data back to the App Centre for the developer to review - so it is not a significant security risk, if exposed?

I am looking at a number of Cordova mobile apps at the moment, and
  almost every single one of them appears to have the APP_SECRET
  hard-coded in the Cordova config.xml file. Is this a major risk?

Microsoft does not consider it a major risk (neither do I), since the APP_SECRET value is used to map the app to an user account in App Center, and the App Center itself is only used for reporting of Analytics, Crashes and Push Notifications.

Configuring the APP_SECRET value in the config.xml is a Microsoft requirement. From the App Center SDK for Apache Cordova GitHub page:

  To get it working in your app you will need to add some configuration
  values to your app configuration in config.xml file. See list of
  available parameters below

  APP_SECRET - (required) App secret which enables App Center to map this app to the right user account

A threat model would better define the risk and impact of this scenario, and with the Microsoft official documentation confirming this is the correct setup, and knowing the App Center does not handle sensitive or critical information for the app, one can argue having the APP_SECRET value in the config.xml file, portrays a low risk with a low impact.


Using EnCase to recover InPrivate browsing history I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible?

If so, suppose that a computer has been shut down right after usage of InPrivate browsing in IE (e.g. there are tabs opened, and users just shut down the whole computer without shutting down windows.) How much would history be likely recovered?

There are various differences in the implementation of inprivate browsing for IE based on which version of IE you are using. IE 8 inprivate browsing was was supposed to be quite good, whereas IE 9 reportedly had many issues.

Encase is just a piece of software that can do advanced forensics. Since It can read deleted files off the drive (depending on the circumstances) and since IE inprivate browsing writes files to disk, it is possible to recover these using a piece of software such as EnCase. then its simply a matter of creating the forensic timeline to piece together the information your after from the extracted files.

There's a few relevant links i've found here and also here


Virtual machine protection Let's say I have VirtualBox or Vmware Workstation on a Windows 10 Pro host, hosting Windows or a Linux distribution such as Ubuntu or CentoS). If I have an antivirus or Internet Security software on the Windows host, could it protect Windows or Linux VM's?
Can any consumer, SOHO, or small business version of Norton, Avast, BitDefender, Kaspersky, McAfee, or other security software, protect virtual machines while the security software is on the host operating system?

The answer is bit of yes and no, but in some cases, it is a definite no.  It really depends on what security software you are using, and what type of virtualization software you are using.
A traditional antivirus program that just scans a host computer cannot protect your VM.  The reason being as @schroeder said, "An AV on the host cannot access the memory or filesystem in a VM."
If you are using an internet security software that has a HIPS (Host Intrusion Prevention System) feature that acts like a network firewall, the answer is bit of yes and no.  The yes part is if the VM program tries to send a request (considering that you are using a browser inside a VM, like VirtualBox), thru the host to access a website.  In the scenario that the HIPS detects the destination of the request or source address of the data received listed in a global or local blacklist, the HIPS would drop the data.  In that case, the VM would not receive anything.  The no part is related to the fact that the security software would not be able to access the memory or the filesystem of the VM to scan for viruses.


How do programs prevent data from being leaked? There are many programs out there that offer encryption and key management.

From what I understand when a file is saved on a hard drive, then there will sometimes (often?) be copies of the file in the memory and maybe even other places on the hard drive. When one enters a password/key phrase in a program to unlock a database I guess that the password will live in the memory for at least a short period of time. I had heard about the audit of VeraCrypt and that one problem was the use of memset when clearing sensitive data from the memory (page 9 here).

My general question is: How do programs like VeraCrypt, 1password, keepass, GPG, LastPass, AES Crypt, and many others deal with these issues of multiple copies of files and having a copy of the password/key/data in the memory or other places of a hard drive? Are these things even a security concern?

Like, we VeraCrypt, is this a general problem that shows up in audits?

(I am just asking out of curiosity.)

You are mixing separate things here, namely encryption software and password managers. For both tho, there is no way around storing the key in memory and the problems can be reduced to one:

If you want to store passwords like in KeePassX, you have to unlock the password database once and keep it open (so you can autotype them via hotkeys).
If you encrypt files, you have to enter your master password once and keep the files open.

In either case the password will be in memory for a finite time and you need to overwrite it after using it in order to make sure it doesn't stay there. If you simply reallocate the memory, it's not guaranteed to be overwritten ever.

memset can set a memory block to whatever you want it to be, so it could help us here. Problem: If you use compiler optimizations, the compiler might think memset is useless and remove it for more efficiency.

This is why for example VeraCrypt includes special functions like RtlSecureZeroMemory and its wrapper method burn to ensure memory will be reset, like this:

BootArgs = *bootArguments;
BootArgsValid = TRUE;
burn (bootArguments, sizeof (*bootArguments));

Of course this doesn't make deletion 100% guaranteed, because now you have to ensure that there is no possible execution path that forgets to call this function.

In the latest audit of VeraCrypt it was revealed that there is one occasion where burn is called after a code segment where a TC_THROW_FATAL_EXCEPTION can be thrown, thus leading to sensitive data remaining in memory.

This is generally one of the problems in designing safe and secure programs, if you implement methods to prevent memory leaks you have to ensure there is no way to prevent them from getting called.


Can a WiFi operator track local hostnames? Is the local hostname a data point that can be collected by WiFi access points after connecting to them similar to how MAC addresses can be collected?

Most certainly, however WiFi itself is nothing more than a network bridge between clients. Hostnames are send in by protocols that operate on top of LAN, for example DHCP, and are no different than connections over an ethernet cable.

MAC addresses are sent in the ethernet layer, even when there is no connection, for example to identify neighbors, or to send probes. If your device is setup to connect to any open network, the router could catch the hostname from the DHCP request. Keep in mind that a MAC address might prove more usefull when it comes to device identification.


Am I someone else's vector? I have a site that is open to the public, that exposes no resources that need authorization.  I have a use case that should support return URLs.  In some cases, the site will redirect the session to a return URL after interaction with my site.

The return URL poses no risk to any of my resources.  The session can browse around a bit and then leave.  I could see, though, that somebody could construct a request with a return URL, POST it to my site, have it redirect to that URL.  Even though I am not harmed, what have I exposed?

You've exposed the reputation of your site. If your site is used as part of a phishing or other attack where you redirect users, your domain may be blacklisted.

This may prevent you from sending or receiving email on that domain.

Your domain may be blocked by corporate filters if it's linked to malicious activity.

Google might mark your site as malicious and warn users.

There are indirect costs associated with being used in malicious activity, and while it may not directly be your fault you still may pay the price.


What is the best way to detect when a user circumvents logging by temporarily embedding a YouTube video into PowerPoint? The school has a few security measures in place to ensure students are not going to inappropriate sites based on content. In this day there are more students being sent to YouTube to watch educational videos that are assigned by the teacher, so YouTube is not blocked. However, the issue that is students have figured out that in PowerPoint if they click "Insert" a "Video" they can search for whatever videos on YouTube and watch them within their slide, then delete them (or save them in their own PPT and share with their friends. The school has a web content filter that parents can monitor their child's internet history, but these videos do not show up. Additionally, it does not show up in the browser history. Is there something that can be done to at least detect these and have them logged in the browser history at least? I have done a lot of searching and the most that I found was setting a GPO that disables inserting videos in PPT, but that does not work because the students make presentations in PPT and have to post videos of themselves or other things in them. We are just trying to figure out how to detect it and go from there.

When a video is embedded in a document, the browser is the document application, here PowerPoint. So it is perfectly normal that it does not appear in the browser history. But if you use an outgoing proxy, it should appear in the proxy logs, with a reference to the machine that downloaded it. From there on, it should be possible to detect unexpected videos and who whatched at them.
It is often enough to explain students that they are not anonymous when whatching videos and that their parents will be informed to have them stop it... Additionally, explaining them that anonymity in Internet is not as trivial as they think, and that not only the schoool but others like their future employer could search their past activity would be very profitable.


What header & footer to use when storing RFC3161 token in PEM format The RFC3161 (https://www.ietf.org/rfc/rfc3161.txt) specification states
3. Transports

   There is no mandatory transport mechanism for TSA messages in this
   document.  The mechanisms described below are optional; additional
   optional mechanisms may be defined in the future.

It lists a few examples such as
3.2. File Based Protocol

   A file containing a time-stamp message MUST contain only the DER
   encoding of one TSA message, i.e., there MUST be no extraneous header
   or trailer information in the file.  Such files can be used to
   transport time stamp messages using for example, FTP.

   A Time-Stamp Request SHOULD be contained in a file with file
   extension .tsq (like Time-Stamp Query).  A Time-Stamp Response
   SHOULD be contained in a file with file extension .tsr (like
   Time-Stamp Reply).

I would like to attach a timestamp token in PEM format (=base64 econded) to a document. What I wonder now is whether there are any already standardized header/footer lines for this? maybe such as
-----BEGIN TST-----
[...]
-----END TST-----

or
-----BEGIN RFC3161 TOKEN-----
[...]
-----BEGIN RFC3161 TOKEN-----

or should I just use default PKCS7 header/footer?

Pick whatever you want.
The label only serves humans to be able to identify what the data is, without having to decode it and parse the DER data. As such, labels like -----BEGIN TIME STAMP RESPONSE----- would work perfectly fine.


Should I ignore the BEAST SSL exploit and continue to prefer AES? Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4.

I am wondering if it wouldn't be better to continue using AES instead for the following reasons:

To exploit BEAST the attacker has to get the client to execute their javascript code. If they can do this then you have an XSS vulnerability in your site. If this is the case wouldn't it be much easier to just hijack the user's session or grab data from the browser window itself and send it that way instead of trying to use BEAST?
RC4, which is what everyone is recommending seems to me to be more vulnerable than AES. It is what is used in WEP. Is the implementation used by browsers more secure?

EDIT

I looked at the link in Jeff's answer. To make this exploit work the attacker must be able to make the client communicate with the site for which it wants to decrypt the traffic. SOP should stop this from happening. An XSS vulnerability on the site or a vulnerability in a browser plugin (such as Java, Flash, Silverlight) can be used to bypass the SOP limitation. In the paper they use a vulnerability in Java to do this.

In summary: SOP should protect you against this, but may not. If you have an XSS vulnerability in your site then this is the least of your problems.

EDIT 2

Thomas' answer applies here: What ciphers should I use in my web server after I configure my SSL certificate?

1) This is not exploited through XSS, but through a client visiting a malicious site. The targeted website does not need to exhibit any flaws at all. Details: http://vnhacker.blogspot.com/2011/09/beast.html

2) RC4 in WEP was vulnerable because of an implementation flaw. AES in TLS 1.0 / CBC mode... exactly the same kind of problem. They're still strong algorithms, they just had an error in how they were used.

Browsers are adapting by sending one-byte packets at the beginning of connections. This makes the remainder filled with random padding and thus negates the ability to use chosen plaintext based upon the CBC initialization.

Should you change ciphers? Well, RC4 defeats the attack, does not present a known new attack surface, and Google seems to be doing quite well with it. For those reasons, I personally would change it.


Is this a DDOS attack? I lost my internet connection for about 15 minutes and I checked my netgear router log and found these 3:

  [DoS Attack: ACK Scan] from source: 114.77.184.189, port 44822, Tuesday, March 24,2015 19:08:15
  [DoS Attack: ACK Scan] from source: 91.135.35.51, port 80, Tuesday, March 24,2015 18:53:17
  [DoS Attack: ACK Scan] from source: 193.66.251.213, port 80, Tuesday, March 24,2015 18:51:31

My connection is slow and I lose internet completely from time to time, but I've never checked the logs before. Is this an attack?

Based on the timestamps (1min 46sec & ~15min gaps between events), this is not a DDoS.  This is about par for random DoS attempts against an exposed device on the Internet, such as your Netgear router.

A DDoS would show many events flooding in at the same time... you would get lots of logged events per second, or at the very least hundreds per minute.


Using INTO OUTFILE with INSERT I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and write a textual file to the directory. The service in the background is checking is file written.

I did find administration panel password but not by using SQL injection over SELECT statement but through connecting to a network with port that resolve the username and password. Now, as far as I know, if there was SQL injection vulnerability over SELECT, I could easily INTO OUTFILE particular column to the data file, but this time, I'll have to use INSERT as the input is sent through admin panel to the mysql query. I'm interested is there equivalent command or payload to INTO OUTFILE using INSERT or any other way around. I'm thinking about using MySQL LOAD DATA but I can't wrap my head around it.

The call shall be made like this:

LOAD DATA INFILE 'foo.txt' INTO TABLE t FIELDS  TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"' LINES TERMINATED BY '\n' IGNORE 1 LINES (name, address, city, @skip, state, @skip, ...) [ SET col = <expr>, ... ]

One more thing, I successfully loaded the file from the file system using load_file('filename') so I have granted user account at least for reading.

Other information:
Machine: Linux RS x11 CERT UTIC (Testing lab)
Database: MySQL 5.x
Application language: PHP

Thanks and kind regards.

By looking at the MySQL select syntax,  you can see that it support into outfile at the end of a query.  If you look at MySQL Insert Syntax,  you'll see that there is no reference to into outfile.   There is a good reason for this,  insert is modifying the database,  and a select is obtaining data,  and the into outfile is a modifier of where that data goes.  From a developer's perspective is no reason to give insert the ability to write to files.

However,  all is not lost. The ability to insert data opens the door for second-order code injection.


What method could a white-box attacker use to track the deletion of memory / files? A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory.

If recognized, the malware would copy parts, which are not deleted yet, to other locations, which already have been deleted and thus effectively reverse the deletion process.

My questions are: how could a malware notice that a delete operation was initiated. And could the malware somehow recognize the addresses of the deletion process?

Of one considers deletion in terms of overwriting existing memory with a constant value (0 or 1), deleting a big file should lower the entropy of the memory contents. However, I believe this is not a reasonable approach.

There have been more visible instances of "memory only malware" and I think from a practical perspective you would drive yourself bonkers trying to find that needled in the haystack. What could you possibly look for? Page_Execute_ReadWrite calls? Mutexes? Not only that problem (which calls to look for), but when malware begins hooking into other processes, you would be seeing a lot of conflicting issues with legit processes duped into doing something (false positives) along with trying to consistently analyze running (changing) memory calls, routines, subroutines, opens, closes, etc

So you ask: "how could a malware notice that a delete operation was initiated" and I pose: "this would vary, every malware writer is different, there could never be a static method to do this." An attacker could chain multiple variables to ensure they're always going to run without having to worry about whether someone is going to delete it. E.g.:

(pseudocode)

home=c:\Users\someone\appdata\hidden_folder\here

if [ $home >= 0 ]
   then
       call this other {app, dll, cab, zip, etc}
       run other
fi

"Check to see if I exist, if I don't open something to put me back home"

This would live outside of the active process in another minimal application/call. There would be no need to program it into the malware itself. Sort of like a dropper. A dropper isn't the malware itself, only a means to an end (go out and download the malicious file).


Single and double Encoding of parameters to bypass security filters I was practising some labs to get better at XSS and SSRF. I found that sometimes I just encode characters once and the security filter is bypassed and occasionally I have to encode it two times.

How does the filter work in the backend? Can someone explain with a scenario?

It depends on particular implementation. The simple ones check one level only. The  normal ones decode the request as many times as it was encoded: Check, decode, check, decode, etc., until the result of decoding is equal to the input of decoding.


How can I see ISAKMP packets via Wireshark on a client computer? I am trying to learn more about the IPSec and VPN. I am using TunnelBear on Firefox. When I start VPN service, I only see TLS connections on Wireshark but not the ISAKMP or other IPSec related packets. I did another trial with the Cisco AnyConnect client and connected to my school. Still I see TLS connections but nothing about IPSec related messaging. In my test setup I am using my Windows PC and the required VPN software. The servers I am trying to connect should be VPN servers.
Do these programs use another method to connect to those servers? Why do I only see TLS connections? Thanks.

There are several other VPN protocols apart from IPSec. Specifically Tunnelbear and Cisco AnyConnect always use or can optionally use the OpenVPN protocol, which means you will not see any IPSec traffic in this case.


Is there any good reason to move files outside webserver document root? Let's say I create a website (with apache for example) and my php pages get some sensitive information from a file on disk (a .ini file, a SQLite db or whatever).

I thought two ways to prevent users from getting to this information:

separate document folder (/var/www/html) and data folder (/var/www/data) where to put these sensitive files
put sensitive files inside the document root folder (/var/www/html) and prevent them access with .htaccess files

Is there a noticeable security risk with using one method or another? Or are they equivalent?

I think that by including it in the webroot, you may leave yourself vulnerable to some bypass if you do not write the .htaccess correctly.

If you keep important files outside the webroot in a directory such as /opt or /etc/web_program_folder/data, there's no way they will be able to access that data without a local file inclusion vulnerability as apache or nginx (whatever you're using to serve the application) will not allow them to traverse up into the /opt, /etc directories.


Make online payments anonymously? Is there a service/company which allows you to make anonymous payments online ?

This is how i want the service to work - Just like a credit/debit card. When you make the payment online, instead of entering your real name and real address, you enter the name-code and address-code issued to you by the service. To the receiver of the payment, it should appear as if the payment came from the service and not you.

If such a service does not exist, then is there any similar alternative ? I had a quick look at escrow. But not sure if enables one to pay anonymously.

Why I want this service ?
I think that the receiver of my payment gets to see my personal info when i enter it in their website to make a payment. I don't want that to happen.

END OF QUESTION.

As an aside, we can have some features -

If the receiver has some genuine legal reasons to request for the real name and address, the service should allow him to find the real person behind the codes. Once the real info of a person is revealed to the receiver and courts determine that he has done nothing illegal, then this person receives a new code.

Bitcoins, and merchants which accept them, are inherently anonymous. It isn't exactly what you want, but it is an anonymous currency.


When pasting sensitive links or text on Google Chrome bar - does Google store it? When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google.

Does Google store all of them, including that sensitive information?

The simple answer is "yes". Search engines store whatever is typed in the search bar. It has no way to determine what is sensitive or a password. It is all just text to the search bar.

In Google, not only will it be stored in their logs, but what people put in the search bar (not attributed to specific people) can be queried by other people.

In Chrome, whatever you put in the URL/search bar is stored locally in your account so that it can be provided to you as a short cut if you try to search for it again.

To help answer this question, I searched "what do people search for?" in Chrome, then started typing that search again:

So, as you can see, whatever is entered is stored, sorted, and categorized for later retrieval.


Why is pastebin considered a high risk service The company I work at uses zscaler to restrict access to certain websites.
Earlier today, I tried to visit pastebin.com, but got the error message in the picture below:

Trying to google why pastebin is considered a high risk service, I didn't really find much, except this one blog post which talks about certain hacker groups pasting sensitive data to the site.
This alone doesn't seem like a very strong reason to block the site, as there should be a multitude of other options for making information public. What am I missing here?

This depends on your company's risk management strategies and security policies and, therefore, is entirely environmental rather than Pastebin being publicly rated as a high risk service.
Information Security SE might be a high risk service, too: after all you are able to share potentially confidential details on your company's security policy here. Likewise, Pastebin allows leaking information like source code or configuration files and make it publicly available. From this perspective, the decision seems reasonable and possibly even experiential.


How to protect the Shadow Stack? I found out that many protection mechanisms are used in computer security to ensure control-flow integrity, one of these mechanisms is the Shadow stack:

The principal is very easy it ensure the integrity of return address of functions. In fact the return address located in the stack is compared to the one pushed in the shadow stack.

There are several implementation of the Shadow stack, one of them consist of modifying the function epilogue and prologue(to make it write in the Shadow stack and load from it for the check).

The question is: If the functions in user space are allowed to write in the shadow stack, how can we prevent the attacker to write/modify the Shadow stack?

It can't be protected completely, but that is not the purpose of the shadow stack. The shadow stack prevents modification of stack by a buffer overflow in local variable (variable on stack), not by arbitrary code. If the attacker already can execute arbitrary code, it is game over.


Can I safely use my own statistics to assess password strength on number of times a password is used? Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be based on "there are already more than N users with the same password" (for N maybe 100).

So aside of the state-of-the-art multiround salted hashed password stuff I naively store a big table with password:counter pairs (and maintain it through password changes) and tell the user his password is bad when that counter reaches N. Now of course this defeats my good password hash management: whoever gets that table has all the possible passwords and can just try them trivially. I could hash them, which would just add some time factor far too small to be secure.

So how can I (if at all) maintain any statistics that will allow me to have these counters (or something similar enough with not too many false positives) without the statistics data being more of a security risk when exposed than the table of password hashes?

As @aviv pointed out, revealing to a user that some other user also has the same password is a problem.

If you really intend to maintain such statistics, then you have another inherent problem: the "statistics engine" can only help any attacker, since it outputs a list of passwords that are in use. Even a reduced form which merely says "this password is already used by somebody else" allows the attacker to break passwords much faster, for the following reason. Good password hashing uses salts so that attackers cannot try to break 10 millions of passwords in parallel. If hashing is unsalted, then the attacker can hash a potential password once, and compare the resulting hash value against all 10 millions hashes; in that way, the attacker breaks 10 millions of passwords for the cost of breaking one. Salts prevent that. Salts are good.

Now suppose that you have a statistics engine which can tell you, when a user enters his new password, whether that password is already used by somebody else or not (even without telling how many users have chosen it). Then an attacker, who could get a copy of your database (you hash passwords precisely because you fear that scenario), can run the same "engine" on his own computers. Thus, he can "submit" a potential password to the engine, and learn whether it is used by one of the 10 millions of users or not. This allows him to prune his huge list of potential passwords down to the ones that are really worth the effort: instead of trying one billion passwords on each hashed value, he will try only the 1000 or so passwords for which he got hits from the statistics engine. You've just made the attacker's task one million times easier.

The only way out of this problem is to make sure that the attacker will never be able to access the statistics (which, in turns, implies that they won't be shown to the users themselves). This suggests the following:

When a user chooses his password, the password is hashed as usual (with bcrypt or anything similar).
The password is also asymmetrically encrypted with a given RSA public key. Asymmetric encryption is randomized, so the encrypted results don't allow for dictionary attacks. A 2048-bit RSA key is enough to encrypt data elements up to 245 bytes, which ought to be enough for passwords.
The corresponding private key is kept on an offline machine (thus presumably immune to remote attacks). At regular intervals, the "statistics officer" gather the encrypted passwords from the server, transfers them to the offline machine (with a USB drive or something similar), decrypts them, and runs statistics.


PHP | Security for allowing user uploads My Situation:

I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I have successfully built the html and PHP side of things and users are able to successfully upload files onto my server. I am using windows server 2012 R2 with IIS as my server.

My Question:

As far as I am aware, There is little to no security in place (both script and server side) to avoid security/attack vulnerabilities on my website or yet worse, on the server its self. I am aware that attackers could potentially upload and executed files that can hack my server. So, What steps can I take to try and eliminate these issues.

Things I Am Aware Of:

Due to the research I conducted, it is to my understanding that I could potentially do the following to strengthen my self, however these are all theories, and I have no idea how to actually put them in place (hence why I am asking):

Restriction on file types (Yes I could potentially block .php files, but as an example - I cannot block common .exe's as the user would most likely scan a executable) What is the correct balance for this sort of service, as limiting too many file types just removes usability
Storing uploaded files in a different drive - My site directory is in the C drive and I have an empty D drive I could use. How do I disable the server from executing anything in the specific drive? How do I stop Hackers from navigating to that drive and executing the uploaded files?

Things I have Tried:

I have Created a function to rename the file uploaded to a md5 hash of it, with a unique ID at the beginning, so therefore the user cannot identify the file easily.
Limited file type to remove .php uploads? Perhaps there are others which would be valid for my purpose?

Conclusion:

So essentially, as well as answers to the minor questions above. I am looking for a list of actions I can take to strenghten the application and server, to eliminate any possible threats. Thanks

Code:

As a side note, below you can see my code. Just in case you spot anything serious in there. Or there are extra security which can be added to the code:

PHP:

$upload_directory = "uploads/";
    $uploaded_file = $upload_directory . basename($_FILES["file"]["name"]);
    $upload_ok = 1;

    $image_file_type = pathinfo($uploaded_file, PATHINFO_EXTENSION);

    // check for files bigger then 8mb
    if($_FILES["file"]["size"] > 8388608){
        print "your file exceeds 8mb";
        $upload_ok = 0;
        exit();
    }

    // only allow certain file types
    if($image_file_type != "jpg" && $image_file_type != "png" && $image_file_type != "jpeg" && $image_file_type != "gif"){
        print "invalid file type";
        $upload_ok = 0;
        exit();
    }

    // upload it
    if($upload_ok != 0){
        move_uploaded_file($_FILES["file"]["tmp_name"], $uploaded_file);
    }

HTML:

<form method="post" action="index.php" enctype="multipart/form-data">

    Select Desired File

    <input type="file" name="file" id="file">

    <input type="submit" name="submit" value="Scan File">
</form>

When it comes to allowing user file uploads, you must be very careful. This is just a list of things to start with, off the top of my head:

Ensure that files cannot be executed by users

Set up your PHP in such a way that it will not consider using the PHP file extension in the folders where PHP files exist.
Make sure the permissions for the files are set correctly. If there's no need for uploaded files to have execute permissions, then why should they?

Preventing users from grabbing arbitrary files

Unless you really want them too, a user should not be able to enumerate all the files uploaded to your service. In fact, based on your description of the service there is no reason they should ever be able to download the file again.

Provide hard to guess unique ids in the file name. Many sites uses long, complex filenames for things as trivial as pictures in order to provide metadata, and prevent enumeration.
Make sure your that your system is configured to detect enumeration. A user should not be able to make thousands of incorrect guesses at the name of resource. You can do this through i.p tables, fail2ban, IDS, application, database. Depends on a lot of things and lots of ways to go.
If the users don't ever need to retrieve said file from your server, make sure that it is brought to a place where it cannot be accessed directly (like outside webroot.)
Consider hosting your files on a different server than other application parts (like the business logic and such.)

Ensuring that files do not cause issues directly for your system

You describe your service as a virus scanning service. What you are trying to do may be dangerous. It is not inconceivable that a virus might leverage the AV itself to escalate privilege.

Do some basic scanning to determine the validity of the file before sending to AV. Users should not be able to send severely mangled files which may crash the AV.
Check the headers.
Use programs like fileinfo.
Check against known file type information.
scan the file for obvious mangling/fuzzing attempts. For instance, a file filled with 10 thousand A characters might be testing your system.

Ensuring that the AV will not cause an issue

make absolutely sure you are using a trusted AV software which is fully patched and up to date.
Ensure that the AV software has the proper rights, and does not expose unnecessary ports.

Isolating the system in case of breach

Again, insure that the system holding the files has minimal rights.
Try using a container/jail/sandbox of some sort to limit the effectiveness of an exploit attempt.


What logs to retain for PCI-DSS? I am using Splunk to centrally collect all of my logs for PCI-DSS. I'm running into my licensed volume limit and I need to know exactly what needs to be retained for regulatory compliance.

I am picking up a bunch of kerberos ticket events, mostly event 4769. Is there a specific reason these need to be retained? What about event 4672, special privileges assigned to a new logon?

I also have web servers which send in their IIS logs. These servers are sitting behind a Forefront TMG box which sends a more detailed version of the same data. Is there any reason that the IIS logs specifically need to be retained?

I would love some pointers on these events to what PCI requirement means they need to be maintained.

Generally, the most conservative answer comes in the form of something easily understood, and approachable by the general populous.

Ignoring the hyperbole of that kind of response, there are two things you must really take into account.

What logs should I retain
How long should I retain said logs

Log Retention

The answer to 2 is simple and well defined by the standard. Logs must be retained for one year and the last three months must be easily accessible. So let's translate that statement into my own recommendation

Implement a centralized logging system, e.g. a single purpose system acting as a syslog receiver
If storage is available on central system, then retain all logs from PCI scoped systems for 1 year
Otherwise retain all logs from PCI scoped systems on central system for 3 months, rotate all  logs older than 3 months to long term storage (such as tape/VTL/papyrus). Expunge logs on long term storage that are older than 1 year.

Events to Log

The answer to the first point is a little less well defined. The standard wants you to keep events and details for all PCI scoped systems. So assuming you have determined every system that is in scope, the only question is what what events you want to log. This is much harder to answer, because it would largely depend on your environment and what applications are running. The easy answer is to ask your QSA. To be conservative I would recommend adding *.*  @logserver to your syslog config files, or perform the Windows equivalent. Make sure that any non-syslog applications on those machines also find a way to get their logs out. This would include web server, fat clients, etc. At minimum make sure any authentications, successful and unsuccessful, are logged. If possible full audit logs of data access on applications would be nice. For web apps, this would be standard in your httpd logs, but fat clients may not be as granular.

In the end, since your QSA decides whether or not you are compliant, they are your best bet for answering these questions.


Could free VPNs with public credentials be decrypted by ISP? This is a question I could not answer by googling so far.
I was experimenting with Vpnbook VPN. The question may apply to any freevpn with public credentials.

Here goes: when I connect to one of their VPN servers, my ISP knows where I connect to, the free VPN server. Knowing that, they can easily identify that server as a vpnbook server, then go fetch the username and password credentials which are made public on the www.vpnbook.com web page. Then with this information, they should be able to decrypt my brownsing if they want to.

Is this true?
Ron

The username and password are only used for authentication of the client against the server and have no function in the encryption process itself. They are only used to restrict who can use the service but not for protecting the data transfer. This means that everybody knowing these credentials can use the VPN service for themselves but not that they can decrypt the connections of others which use the same credentials. This is not only true for this VPN service but for example also for HTTPS connections.


Why is system32/ntoskrnl.exe blocking port 80? Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application C:/Windows/System32/ntoskrnl.exe is using port 80. My OS is Windows 7 Prof. SP 1.

Has anyone an idea why this application is blocking port 80? Testing ntoskrnl.exe on https://www.virustotal.com/ has found no infections.

I've found out that there was an instance of IIS running on my system (not the developer version that is started by Visual Studio, but the standalone version that can be installed via "Turn Windows features on and off"). This causes ntoskrnl.exe to use port 80. Sorry for the false alarm ;)


How does authentication work if the password provides a different salt on every login? How does an application authenticate a users password if every time he provides his password to access his account the password provides a different salt?

The premise of your question is incorrect. A different salt is not used every time the password is provided.

This is how password based quthentication works:

Upon registration, the user sends her password to the server. The server generates a random salt, and stores the salted hash and the salt.
Upon login, the user again sends her password to the server. The server retrieves the stored salt for that user, rehashes the password with it, and compares it to the stored hash.


How does blacklisting an IP using a firewall protect against DDoS attacks? I just read that to protecting a server against a DDoS attack involves blacklisting IP addresses.

What does the term blacklisting mean?
What does it mean for a firewall to drop a connection?
How does this protect a server against DDoS attacks?

Please keep in mind that I limited experience in firewall configuration.

It's possible for blacklisting an IP to protect a server from a DDoS attack.  A lot would depend on the firewall, the network, the system and the type of attack.

Blacklisting means you tell your firewall to take a special action against traffic from that IP or network range.  You could tell your firewall to ignore traffic from that IP or reject that traffic.  If your network and firewall can handle large amounts of traffic but your server cannot, that may stop the attack assuming the attacker doesn't change source IPs.  It might be a useful short-term mitigation but usually isn't a long-term fix.
To "drop a connection" probably means to ignore it.  The remote server would send (assuming TCP) a syn packet and your firewall would accept the packet, examine it, find that it matches a rule and then execute that rule.  If you are dropping packets from that source then your firewall would do nothing further.  Keep in mind that in order to find the rule it had to accept the packet and examine it which consumed a small amount of resources.  Multiply that tiny resource consumption against a million packets and it starts to add up...
How would this protect a server?  If the firewall and server are separate devices then the firewall takes all of the traffic load and the server doesn't have to deal with junk traffic.  If they're on the same system then hopefully the firewall layer handles the traffic and it doesn't have to be processed by the application layer.

Blacklisting IPs at the firewall is a case of "enumerating badness" and in many cases doesn't scale well.  Do you want to spend the next week of your life pouring through logs and adding firewall rules each time an attacker gets a new IP?  In the long term there are better approaches:

Whitelist known-good IPs - if possible, only allow traffic from your
trusted partners and block everything else by default.
Implement a system that can automatically review traffic and filter out the unwanted traffic
Build a system that can scale to meet your expected traffic load as well as spikes of unwanted traffic.  This would need to happen at all layers: network, firewall, application, etc.


Is it ok to email someone their password from a newly created account? I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons.

In order to mitigate the increased risk of inputting a wrong password by mistake, is it ok to send the password in the welcome email to the user? This would happen in the code that handles the form response. The password is then hashed (bcrypt) and stored, so cannot be retrieved in future.

My reasoning is that an attacker who has gained access to the user's email account can reset the password on this service anyway using the standard password reset tools, so storing a copy in their inbox is not any more of a security risk than having email-based reset.

Is there a flaw in my thinking?

I see an issue in the fact you are sending their password in plain text across an unencrypted link. Anyone monitoring data transmission at any point between the users PC and your site would be able to capture their password.

If you sent a 1 use password that they then had to change when they logged in then that would be better.


At what length does a password stop making sense? I'm going to recommend that our users start using a password manager and start creating strong random passwords.

Though I don't know what size of a password to recommend. Is it possible for a password to be so strong that it stops making sense?

I want them to have passwords that are strong, random, and long enough so that even if the hashed password table were stolen, that no brute-force or rainbow attack will ever* be able to guess it.

Where ever* is something reasonable. Of course with sufficient time and resources any password can be brute-forced. But at some point in password strength, I think it must stop making sense. I don't want to sound like I'm going overkill and protect their password from a 4th dimensional being or something.

Oh and a 64 character websafe alphabet is what I'm thinking about recommending.

Armed with the knowledge that a search space of 128 bits is more than sufficient for the foreseeable future; with 192 bits being ridiculously high; and 256 bits being something that is unimaginably impossible to cycle through, and assuming that your character set is alphanumeric upper and lower case English, randomly-generated, then we can say that:

A password of 22 characters is more than sufficient for the foreseeable future.
A password of 33 characters is ridiculously long .
A password of 46 characters is just... I don't know what to say.

So, to put it in one line: With an alphanumeric upper/lower character set, it starts making less sense after 22 characters. When does it stop making sense? Somewhere between that and 33 characters, very early.


Secure password management I've recently begun using Keepass for my personal password management.

I am setting it up to sync between my home PC, work PC and mobile device using dropbox.

I'm going "all the way", and have changed my passwords to 32 character mixes of letters, numbers and special characters.  Even for stuff I commonly use, like my primary email, I've changed to a long complicated password.

My one concern is a Total Loss Scenario.

If in some bizarre twist of fate I were to lose my home PC, my workplace PC and my iphone all in one fell swoop, I would have no idea how to login to any of my accounts - email, dropbox, etc.  Thus making my ultra secure password database file inaccessible, even to myself!

Should I have one "entryway" for myself - setting my personal email or dropbox password to something that is complicated, but that I can commit to memory?

Any other suggestions on how to be both ultra secure, and to be safe from cutting myself off from my own passwords?

edit:  Some people even suggest keeping an unlabeled holdout password written on a card in my wallet.

The situation you're proposing is quite unlikely and worrying about it is time-consuming. What you have here is a pretty good off-site data protection plan for your usage. You have a copy that's almost always on you, a copy that's always in your home, and a copy at your workplace.

Since you're already worried about it, I'd say write your Dropbox password down. Yes, write it down and keep it in a physically secure place; keep it in your deposit box, in your money safe, or at your parents'/grandparents'.

In the rare case in which you really have no place to keep your Dropbox password, then simply choose a long, well-generated, and memorable passphrase. Nevertheless, I'm almost certain you'll forget it because you're most likely never going to use it.

Like Lucas suggested in the comments, it's also a good idea to keep a periodical backup on a securely-stored USB stick just in case.


Should http basic auth passwords be stored hashed serverside? HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the backend for comparison on receipt?

Passwords in general should be stored hashed on the server, no matter if they are transferred within some HTTP POST body as a result of a form submit or if they are transferred in the HTTP header as in Basic authentication.