Dragnet TEMPEST Surveillance? Just something I considered recently -- TEMPEST attacks are pretty well known; basically you intercept EM leaks from a computer to discover compromising information (i.e. encryption keys, what's being displayed on the screen, what's being typed, etc).

Could a three letter agency potentially create a "TEMPEST Dragnet" of sorts, similar to the NSA's Xkeyscore?  Would it be possible to use, say, cell tower antennas to listen to EM emissions and record what's being displayed on thousands of peoples' computer screens, or record everyone's PGP or SSL keys, and create a Xkeyscore-like database?

Theoretically, that would provide them with near total access to peoples' computers -- whoever did it would be able to know exactly what they were doing, both online and offline, and decrypt anything they sent over the Internet.  But would it actually be possible?

I'm not an expert on this... can anyone determine the feasibility of such a thing?  I suppose the largest concern would be interference -- it would be difficult to tell which emissions belonged to each individual.  Would it be possible to filter out or segregate emissions?

Given current technology, no, I don't believe this is at all practical. The problem is there is a lot of EM out there and you would need a way of being able to make sense of all that noise. The techniques you refer to normally require close proximity to a specific target and the technique normally needs to be tuned to that particular target because different types/brands/models of electronic equipment have different EM signatures.

Think of a busy room full of people talking. You can't easily hear and understand all those conversations - they are just noise. However, if you focus on a specific conversation, then you may well be able to pick up understandable content. However, you will be limited to those closest to you - it isn't easy to filter out all the closest speakers and just focus on someone across the room. If you wanted to pick up all the conversations, you would need to have nearly as many people as conversations and theyw ould need to be spread throught the room. So, you would need lots of resources and then, for this information to be of any use, you would need to post-process the data you collect.

Of course, this doens't rule out someone finding a way in the future where they can isolate the signals and increase the distance you are able to pick up the signals - so it may be possible in the future, but I don't believe it is practical now.


Android verified boot within the boot sequence I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process.

From what I gathered so far I get that in Android devices the verified boot process is supported using dm-verity, which checks signed hashes of the memory blocks in which the OS to be loaded is located.
Also, most (if not all) of current ARM processors based devices has the TrustZone feature which is used to create the so called "Secure World" and "Unsecure World".

What I'm trying to understand is how all this is wrapped up:

When in the Android boot process does dm-verity run?
Does the dm-verity run from within the "Secure World"? If so how the "Secure World" OS loading is verified?
When in the boot process is the first time that the TrustZone "worlds" feature is accessed/activated?

AVB is enforced by the bootloader and dm-verity is enforced by the kernel. Both run consecutively in android boot flow.
In factory:

OEM constructs hashtree of /system,  /vendor, product and ODM partitions. Hashtree is not constructed for /boot and /vbmeta partitions.

In vbmeta partition, OEM writes hash descriptor of boot image which contains hash of boot image. OEM also writes hash descriptors of other partitions which contains root hash & salt of hashtree.

OEM signs vbmeta using OEM private key and appends its signature to vbmeta image itself. The OEM public key is hardcoded in android bootloader (ABL) at build time.

On boot:

ABL verifies signature on vbmeta using OEM public key.

ABL calculates hash of boot image as it loads and verifies it with the one stored in vbmeta.

After boot.img (contains kernel) is verified, the kernel is loaded and kernel starts dm-verity.

Kernel reconstructs hashtree of every partition except /boot and compares their root hash with the one stored in vbmeta.

If all hashes match, device boots to lock screen.

Chain partition is used for delegate authority like in case of enterprise devices and carrier devices. If an enterprise wants to include additional partitions, vbmeta for chain partition is stored in the footer or if there are multiple chain partitions, a separate vbmeta_enterprise that verifies all chain partitions can be created. It is signed by the private key (key1) of enterprise. The public key (key1_pub) is then stored in original vbmeta partition. This delegate authority can be easily revoked by simply updating original vbmeta image with new descriptors of the chain partitions and removing the public key key1_pub.
The chain of trust for AVB starts from ABL so it's possible to replace OEM public key with your own and re-sign vbmeta by following the same process as done by OEM. To protect ABL from tampering, production SoCs enforce secure-boot. To enable secure boot, production devices have their eFuse blown in the factory and it's irreversible. Fastboot unlock and unlock_critical commands do not turn off secure boot. Even a fastboot command can blow the eFuse of prototype devices which permanently enables secure boot of SoC.
fastboot oem SecureBoot EnableFuse

In Qualcomm Snapdragon SoCs, ABL is verified by Xtended Bootloader (XBL) and XBL is verified by Primary Bootloader (PBL). PBL is burned on CPU die and its public key is stored in eFUSE and thus making it tamper-resistant. Trusted Execution Environment (TEE) is not verified by AVB. It is verified by XBL_SEC (Xtended Bootloader Secondary) which is another bootloader verified by PBL. TEE image is double signed by the chipmaker and OEM. TEE is awaken by XBL_SEC at the same time when XBL loads ABL as shown in picture.

Android Verified Boot 2.0
Android verified boot 2.0 vbmeta data structure analysis
Analysis of Qualcomm Secure Boot Chains
Qualcomm’s Chain of Trust
Secure Boot and Image Authentication (pdf)


Resellers and web admins and email privacy Maybe I'm missing something, but this is "my problem".

If you ask some company to create some domain for you and several e-mail account with that domain and forward that information to your gmail account.

How do you forbids that the developer company/reseller can check all your mails?

Practical example: I create employee@mycompany.com at godaddy.com.

I can always check all the mail from that employee.

Is there any way to work this out?

I do not really understand, ANY web developer can check all mails from any client, or Am I missing someting?

If you ask some company to create some domain for you and several e-mail account with that domain and forward that information to your gmail account...I do not really understand, ANY web developer can check all mails from any client, or Am I missing someting?

In a way your question is funny: you fear that the domain provider might intercept and read your mail when it gets forwarded to your gmail account but you don't fear that somebody is reading the mail at the forwarded account itself, i.e. the mails which are stored at google's servers outside of your control. The mail can be read in both cases and it will at least be done if these providers get a warrant because law enforcement needs to get access to information in thus mails.

If you make decisions to give somebody else such level of control over your data you have to ask yourself how much you trust this company. This is the same question you have to ask yourself with your telecom provider, because both land lines and mobile calls can be intercepted by the provider and this will be done if law enforcement requires it. And the same is true with your internet access.

Thus in your specific case you need to trust google to not read your mails or at least don't use any information in these mails against you. And you have to trust your domain provider to not read the mails when forwarding and also to set up the interface for forwarding in a way which can not be hacked by someone - because then the mail could get just be intercepted some yet another party. And there is probably more trust involved.

  How do you forbids that the developer company/reseller can check all your mails?

The only way to be sure that no third party is reading your mails is to encrypt them. This does not mean TLS which does only hop-by-hop encryption between mail servers but the mail is available in plain text at the mail server itself. Instead you need to use end-to-end encryption like PGP or S/MIME. But of course end-to-end only works if sender and recipient use this kind of encryption. And meta data like sender, recipient, time and size of the mail are still visible even if the mail content itself is encrypted.


Fake users in database for compromise detection I have read of sites* adding fake users to their databases and then monitoring their usage. One of these fake users being used or even attempted login may mean database compromise etc.

This sounds like a good idea for detecting issues after they occur, and I plan on doing this myself. Is it actually a good idea though?

Would it be useful to scan the web, using google alerts etc, for the fake users password hashes and email addresses, and possibly unique strings inside the codebase?

*Sorry, I can't remember where. Linode perhaps.

edit: For clarity, 'users' being those who log into a website. I could add users similar to johnfakeuser@fakedomain.com with a dictionary type password. If that user is logged in, then investigate and reset all user passwords etc. If it is only an attempted login, then it is a flag of something to investigate further, but maybe just a lucky hit.

Regarding web monitoring, I could monitor pastebin etc and look for the password hash for those users or unique strings found elsewhere in my code/db. This could be independent of the fake user idea, as I could just monitor for real hashes (e.g. a low level admin account).

Creating a honeypot is a common used technique in information security, though probably not the best of ideas for a production environment. Apart from the fact that you add potentially new risks to your application, there may not be much need for such a trap.

Failed logins can be monitored by most applications (and/or server daemons) which should give you more than enough insight without putting your application at risk.

To state the obvious; brute force attacks are (unfortunately) a common phenomenon and are likely to hit your application anyway.


Invalid certificate name on go,microsoft.com About 1 times out of 20, going to go.microsoft.com displays this page:

The certificate is for www.holidaycheck.de which doesn't make sense. (Note: I'm Canadian, not Deutsch.)

The other 19 times, I go to the regular go.microsoft.com website with a correct certificate.

I did a little research and according to WHOIS IP, both go.microsoft.com and www.holidaycheck.de are handled by Akamai.

I'm trying to find an explanation of that weird behaviour. It only happens with Chrome for one of my computer.

Thanks.

The routing system in your region's Akamai server is malfunctioning.

After HSTS 307 redirect to the HTTPS site, the Akamai server seems to give your browser a wrong site that they serve.

It's their problem, as the certificate seems to be valid for the other site. If the certificate is gibberish, you might be under attack.

Interesting, though.


Hiding sensitive data in URIs This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often.
Background
When implementing RESTful services the standard approach is that the URI contains the information required to identify the resource in question.  While I am not a restafarian there are a lot of advantages to this approach over that we wish to take advantage of.
Problem
We are subject to regulatory requirements around protecting certain types of information.  Some of these protected elements will end up in resource paths if we follow the basic REST formula.
TLS will cover most of the concerns about because the URLs are encrypted.  However, there are a few places where they may be stored in the clear.  Notably they are often written to access logs (which is useful) by default and if people use browsers for this, they can be stored in the clear in their browsing history.
Approach
Assuming this is an issue and we want to use such an approach it seems there is one prime contender for the solution, which is to encrypt parts of the URI or all of it.  Hashing does not seem to be an option since the data is highly predictable and calculating the entire set of values is easy.  Encrypting the entire URI will limit a lot of the advantages of the approach.  Symmetric encryption requires distributing a secret key widely and therefore defeats the purpose.  The option that seems the best is to encrypt on the sensitive data with a public key.
As I understand it, your encrypted output needs to be at least as long as the modulus.  So if we go with a 2048-bit key, each the data will need to be at least 256 bytes.  This will result in some fairly long URIs but I think that should be OK for a while anyway and that limit may not really apply to our solution.
Does this approach seem valid and/or is there anything else I am missing?  Would it be valid to use the same key-pair that would be used for TLS?  There probably needs to be some other information in the encrypted portion to avoid replay attacks or mapping an encrypted value back to given key, correct?
NOTE: I should mention that for my specific problem, only authenticated parties would be able to call.  This is not something that we mean to be expose on the public internet although mistakes can happen.  All parties involved are legally-bound to protect the data.  I think it's worth exploring more general usage of such an idea because of the growing popularity of RESTful services.

it seems there is one prime contender for the solution, which is to
  encrypt parts of the URI or all of it. Hashing does not seem to be an
  option since the data is highly predictable and calculating the entire
  set of values is easy. Encrypting the entire URI will limit a lot of
  the advantages of the approach. Symmetric encryption requires
  distributing a secret key widely and therefore defeats the purpose.
  The option that seems the best is to encrypt on the sensitive data
  with a public key.

Your logic is sound.

I know of one product that does exactly as you suggest; sensitive data is encrypted in the end-users browser by Javascript code, and an HTTPS GET request is made in which some of the 'key=value' parameter pairs have a public key encrypted, base64 encoded string.

The advantage is that these requests can be passed across networks with multiple TLS endpoints without the sensitive data being subject to decryption, and any web server logs or proxies in the middle won't have access to the sensitive data.

  Does this approach seem valid and/or is there anything else I am missing?

It is valid, but here are the things you don't want to miss:

You need to have a client with enough intelligence to perform the encryption for you.  That means Javascript, or a custom app, or something.
Don't roll your own crypto.  Use a solid, reputable library and get a code review of your app.
Key management.  You need to generate keys, publish keys, rotate keys, and retire keys... and you need to do it carefully, because to do it right means to balance between losing control of the data and losing access to the data.

  Would it be valid to use the same key-pair that would be used for TLS?

I would recommend against it.  Aside from the general rule-of-thumb of "don't overload cryptosystems," there are some situations where that key isn't "trusted".  One that I've run into is that DDoS mitigation services often like to have a copy of your web certificates and keys if they're fronting your traffic during an attack.

  There probably needs to be some other information in the encrypted portion
  to avoid replay attacks

That depends; if the REST transaction you're working with is idempotent, then it's not that important.  If it does change something, then yes, replay protection is more important.

  or mapping an encrypted value back to given key, correct?

Yes, it's not absolutely necessary - depending on how many keys you use and how long their OUP and RUP tail is - but it's much easier not to have to guess which key :)


Parallel HTTPS connection remote and local host Let's assume we've a architecture like this:

[HTTPS JSON API] <-- INTERNET --> [Single-Page-Webapplication using XHR] <---> [Locally installed HTTP Server]

The users browser would refuse the connection to the local HTTP because of Mixed Content policy. So how would we implement the communication in this case?

Due to the same-origin policy,  JavaScript running on a remote site cannot use an XHR to access content running on another domain.  Cross-Origin Resource Sharing (CORS) is one solution to this problem.

The server running on localhost, can define a CORS header which permits JavaScript running on a specific domain access to the server.


How do you securely give access to a Java App interactive console (Linux/GNU)? I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.

How do I securely give access to an external person (outside the network) to the console and nothing else?

I was figuring using ncat --ssl -e java filenamehere

And setting a firewall rule for the port used to only allow packets from one origin:

iptables -I INPUT \! --src 1.2.3.4 -m tcp -p tcp --dport 777 -j DROP  # if it's not 1.2.3.4, drop it

But is that secure?

In theory, IP spoofing can be used or are modern mitigation methods built into the OS? I tried setting nospoof on in the host.conf file but it seems that it's obsolete.

I was thinking of giving reverse-shell but that probably is a bit too much and insecure in my opinion. What is your opinion?

Since IP addresses really aren't suitable for authentication, you should implement something else to do the job. A simple example in your scenario would be to write a wrapper script (executed by netcat or socat) that prompts for credentials. If the credentials are correct, it can then exec your Java program. This could be done in a few lines with a Bash script, e.g.:

#!/bin/bash

CORRECT_PASSWORD='h7a0&7;ngIl1+'
MYPROG="java filenamehere"
echo -n "Enter password: "
read -s pass

if [[ "$pass" == "$CORRECT_PASSWORD" ]]; then
    exec "$MYPROG"
else
    echo Password incorrect
fi

You could run this in an endless loop with:

socat openssl-l:1234,reuseaddr,fork,certificate=cert.pem,keyfile=key.pem exec:/usr/local/bin/myscript

You do not need to worry about IP spoofing when using TCP in most cases, so whitelisting allowed addresses can be part of a defense-in-depth solution for your application.

Now, this is all assuming you fully trust the other person to use your application and your application is otherwise sufficiently locked down.


Can you bruteforce a SSH password without alerting the server owner? What happened?
This is a live event that a friend of mine is working on, a company's systems were breached by a Threat Actor (TA), when the Cyber Sec company was called in and tried to regain access they could not, as SSH authentication would fail.
What I suggested
I suggested the use of Hydra, as he mentioned SSH authentication was performed via passwords. The server configuration is unknown to me.
The Goal
The problem is not alerting the Threat Actor who has access to the server to the brute force attempts. Generally, failed authentication attempts will pop up in access logs. Attempting to restore access to the system will/may alert the Threat Actor.
What I think
To my knowledge, there isn't a silent way of bruteforcing something while staying stealthy. Nor do I think, at this stage, trying to stay stealthy will do much, as SSH access is long gone.

Sure, you use the techniques used by attackers: you hire a botnet to try to bruteforce the password. This doesn't mean that the attempts won't be noticed. It means that the attempts will get lost amongst all the other botnets doing the same. And if detected, you just switch bots. The attacker won't know it's you.
If the attacker has access to the logs, and is looking, then any connection, let alone login attempt, can be noticed.
One other idea: if you can determine if there is traffic to the server, then you can know when the attacker is logged in. You could try to time the bruteforce attempts when they are not active.
But, it is unlikely that you will bruteforce the password. Attackers don't use super long random passwords, but they don't use password123 either.
So, this whole thing is an academic exercise and likely futile. Gain access some other way.


Name of security system This is a security system that I would like to know the name of, here is a description:

I have heard that some people will use a separate computer for decrypting messages. When they revive a message they will put it on a thumb drive and then they will carry it to a separate computer that is not connected to the internet, they will then decrypt the message and read it.

I want to know the name so that i can learn more about it.

The system doesn't really have a name. But several aspects of it do:

An "air gap" is where two devices intentionally isolated such that they can't touch, and that terminology is also used in security to describe carefully maintaining one system or network physically disconnected from another.

As far as using some storage device to transfer data between two machines, we used to call that "sneakernet"; a bit of a tongue-in-cheek reference to using humans to form the critical link ferrying data on foot between machines, though the term is less popular than it used to be (probably because the concept is less popular than it used to be).


Secure way to save the local credentials? In the network administration world, normally we configure the network devices to use an AAA server (Radius or tacacs+). As a backup, in case the AAA server is not reachable, we configure the network device to use its local database (local username and password).

I am looking for a way to manage the local credentials for the network devices. Any suggestions?

Enterprise password managers offer you the ability to store these types of things in a central store for admins to use.

You can restrict access, log when people request credentials, and some interface directly with the device and change the credentials once used or act as a 'wrapper' so you ssh through the password system in order to get to the end device.

Lots of options. A quick vendor search will reward you with rich results.


Sending secure information from app with ssl I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just an HTML / jQuery form that the user fills out to reserve my clients service. Having heard a lot about phonegap, I decided to try it for the first time, along with jQuery mobile. Everything worked fine with the phonegap build, and after testing both iOS/Android work.

Although, part of the form requires users to enter their Credit Card information, so my client can book them with their own system. The card is never processed through the app, the information is just gathered and sent (via e-mail) to my client who uses their own payment gateway.

Since I used phonegap to build the app, I simply used action="https://www.my-website-with-ssl.php" on the form. Like I said, both iOS and Adroid are sending the e-mails(to my client) fine. But is this even secure?

Sending credit card info via e-mail is very bad and likely a violation of their merchant service agreement.  Credit card details must be protected in transit and e-mail leaves it flapping in the breeze.

The SSL connection to the server or not for transmitting form data is irrelevant unless the server is somehow encrypting the e-mail to protect it and even then it is really not a very good channel to use compared to storing the information protected in a database (still likely requires PCI-DSS compliance) or simply having it directly relay the user to the payment gateway itself to sidestep compliance issues entirely.


How does SFTP work? Please help someone We run a system that automatically sends a swift message at the end of a process. But this messages are sent using FTP. We feel the FTP process is too prone to MITMA and wish to change the sending medium to SFTP. How can this be achieved? Remember we want it to be automatic. No interactive session. It would be more like;

if XXXX conditions are met

echo "BBBB"

then

(message sends over to the swift sever, THROUGH SFTP)

SSH File Transfer Protocol(SFTP) uses the Secure CoPy(SCP) command to only allow file transfer to a remote server over an Secure SHell(SSH) like connection. This is good because it's fully encrypted end to end.

If you prefer the ease of FTP though and you want encryption you can use File Transfer Protocol Secure(FTPS) to use FTP over an encrypted connection to the server. If you validate the SSL certificate or use a pinned one this becomes just as secure, if not more so, than SFTP with the added benefit of not opening up your SSH port.

So in reality you have two options:

SFTP is great if you're in complete control of everything
This opens your SSH to the clients. You need to be certain you're in control of that. If it's remote and under someone else's control it's actually better to not use this method.
FTPS is great if you don't want to open your SSH connections and would prefer it handled on a different service through TLS.


Storing sensitive, sharable data I'm building a intranet solution for a company using PHP.

One of their desired functionalities is storing payrolls, absence and personal information. They need this to be accessible for the employee himself/herself and to the management, but this is a tech company - with tech savvy people - so they need it to be impossible to recover from the database without the private key, even with root access to the server

What i'm thinking is using RSA to generate a key pair and store the public key for each person in the database, and then when information is added by a employee they share the data with the desired people using their public key (duplicating the db rows for each person with access). The private key could then be encrypted with AES and stored in the db.

Is this a good solution?
Is it possible to pair this with a hashing function so they can use a password and not the entire key to decrypt?
Any PHP Classes (with examples?) that i can work out from?

Any suggestions and tips are most welcome.

Why not use a CA and limit authorization by certificate? Then you can harden your server and let the CA handle whether or not a given certificate is valid. You can then use the "management" certificate to sign the "minion" certificates. Then you have strong two-factor authentication if you add a username and password as well.

To limit access to the server, you should require a key to gain access, and store the key on a USB stick (or two) and store them in a dual control location. You could also use this method to store the super-secret private key if you go with your scheme.


Running Selenium Jenkins, through OWASP ZAP, before scanning I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated.

I am attempting to run both Selenium and OWASP ZAP in the same job in Jenkins. Essentially, I want Jenkins to start ZAP, run the Selenium tests while using ZAP as a proxy, and then start a ZAP scan using the locations provided by Selenium.

I found some instructions, which appeared like they would be a helpful, on the Jenkins site at https://wiki.jenkins.io/display/JENKINS/Execute+ZAP+as+part+of+a+Selenium+Build .

Unfortunately, the article says in two apparently opposing things in two separate places. First, "The Selenium build step must be placed before the Execute ZAP build step." Second, "Run [ZAP] as Pre-Build Step". So do I start ZAP first or run Selenium first?

It seems obvious that I must first start ZAP, leave it running while Selenium does its thing, and then perform the scan. Unfortunately, the "Execute ZAP" step from the "Official OWASP ZAP Jenkins Plugin" appears to execute only as a discrete step. After it starts, it must finish before any other steps are executed. Is there a way I can get ZAP to keep running until after Selenium completes?

I solved my problem. There is a way to start ZAP in Jenkins, then run the selenium process and then perform the ZAP scan.

The instructions explained how. I just misread them.

It was correct that I was supposed to place Selenium before Jenkins. What I was supposed to do was to start the Selenium tests in the "Build" section. I then add "Execute ZAP" as a "Post Step". In the "Execute ZAP" settings, however, there is a "Startup" section. In that section, I check "Run as Pre-Build Step".

That simple. Jenkins sees that I checked "Run as Pre-Build Step" and executes the ZAP startup as a pre-build step, but performs the actual commands as a post-build step.

So, the documentation said it exactly as it should have been said. I just misunderstood it, going so far as to quote the misunderstood sections in my original question.


Does higher range wi-fi mean less secure? On TV a lot of the ISPs are offering wi-fi with longer and more powerful range. One company using a helicopter to emphasise the reach.

A friend of mine mentioned that longer range is less secure due to it being more accessible to more people.

Is this true, and if so, why are they selling it as a bonus?

Technically, the WiFi network is no less secure with a stronger signal.

What your friend might be referring is that with a stronger signal, it will invariably increase the amount of people trying to hack into the WiFi network.

I haven't seen these ads but the "bonus" these ISPs might be referring to is to reduce the need for a wireless repeater to get the a stronger signal throughout a property.

Although unlikely, the ISP's might also be selling this as a method to create a wireless mesh network.


What's the difference between HMAC-SHA256(key, data) and SHA256(key + data) Is there anything different about how secure these two hashing algorithms are? Does HMAC "fuse" the data and the key in a special way that's more security-aware?

Yes, HMAC is more complex than simple concatenation.

As a simplistic example, if you were to simply concatenate key + data, then "key1"+"data" yields identical results to "key"+"1data", which is suboptimal.  HMAC will yield different results for each.  There are other flaws with simple concatenation in many cases, as well; see cpast's answer for one.

The specification for HMAC is called RFC2104, which you should read if you have this level of interest.

In summary, to implement HMAC, you should first:

Create "ipad", which is 0x36 repeated BLOCKSIZE times.
Create "opad", which is 0x5c repeated BLOCKSIZE times.

Note that BLOCKSIZE is 64 bytes for MD5, SHA-1, SHA-224, SHA-256, and 128 bytes for SHA-384 and SHA-512, per RFC2104 and RFC4868.

Then HMAC is defined as:

HASH(Key XOR opad, HASH(Key XOR ipad, text))

or, in detail from the RFC,

  (Pretext: The definition of HMAC requires a cryptographic hash function, which
  we denote by H, and a secret key K. We assume H to be a cryptographic
  hash function where data is hashed by iterating a basic compression
  function on blocks of data.   We denote by B the byte-length of such
  blocks.)

(1) append zeros to the end of K to create a B byte string
    (e.g., if K is of length 20 bytes and B=64, then K will be
     appended with 44 zero bytes 0x00)
(2) XOR (bitwise exclusive-OR) the B byte string computed in step
    (1) with ipad
(3) append the stream of data 'text' to the B byte string resulting
    from step (2)
(4) apply H to the stream generated in step (3)
(5) XOR (bitwise exclusive-OR) the B byte string computed in
    step (1) with opad
(6) append the H result from step (4) to the B byte string
    resulting from step (5)
(7) apply H to the stream generated in step (6) and output
    the result


How to set up two YubiKeys to have the same secret? A lot of services offer authentication with FIDO2, such as Twitter, but only allow the user to set one "security key". This is problematic in case the key is lost or breaks. The ideal solution would be to allow a user to set up multiple keys, similar to how Google does, but that's not something the user can influence.
As such, my solution would be to set up two or more keys in an identical fashion, so that either of the keys can be used when authenticating. This would allow the user to keep one key in a "useful" location (e.g. on their person), and one key in a "safe" backup location, such as a safe at home.
Is it possible to set up two YubiKeys to have the same secrets, so they can be used interchangably?

FIDO2/WebAuthn relies on a public-key cryptography. The private key is stored on your security token. By default, you can't clone the private key, see https://www.w3.org/TR/webauthn-1/#credential-loss-key-mobility:

In general, it is expected that a credential private key never leaves the authenticator that created it. Losing an authenticator therefore, in general, means losing all credentials bound to the lost authenticator, which could lock the user out of an account if the user has only one credential registered with the Relying Party. Instead of backing up or sharing private keys, the Web Authentication API allows registering multiple credentials for the same user.

So the service provider (aka Relying Party Server) must allow registering multiple security tokens for backup purposes.


post-disk-wipe computer security I have a standard Dell or Asus-motherboard based computer.  it is a hard-disk or RAM.  it was hacked remotely.  I suspect that they were sophisticated.

I am happy to reformat the disk and/or throw it away altogether.

alas, because the computer was hacked, I wonder where else attackers could have hidden rootkits that will run even after I got myself a new disk---motherboard BIOS, video BIOS, perhaps even a variety of other devices in my system.  I don't even know whether an Intel CPU has some internal storage that could have been corrupted.  I am worried about a lower layer attack that starts up before it can ever be detected.

advice appreciated.

/iaw

Just an interjection from someone who has been living with this type of attack for quite a while now. Don't forget computers aren't the only devices with ROM/firmware! My prior generation Netgear firewall/router had it's firmware overwritten. Expensive mistake after a couple of new builds.
Also the kit I was attacked with immediately disallowed BIOS reflash by floppy etc. I believe it encrypts the base code fs and then mounts everything as a VM, based on numerous tests. Also had an early Vizio DVD player featuring "updateable firmware" bricked while connected to a projector/pc chain.
Suggest reading BIOS Disassembly Ninjutsu Uncovered ISBN-13: 978-1-931769-60-0 or ISBN-10: 1-931769-60-5 if you can find a copy. It convinced me I wasn't going crazy despite what others said. Funny thing is by all of my tests/observations it appears to be a EFI based root/bootkit and the timeline kind of follows the EFI development timeline. The attacks began a few days after I was falsely accused of commercially using counterfeit m$ software, but never charged.
I'm not in IT but taught myself Linux just so I could get back onto the internet after fresh installs of fully licensed winders failed to boot. The locked firmware forces the use of older drivers for general use, ie SCSI drivers replacing the NV sata drivers while rewriting the HD geometry just as a brief example. Also, bare metal formats are blocked. Luckily lean versions of Linux allow me to keep running my old AMD socket 939 machines until I feel I can build a new machine and configure it and a dedicated router sufficient to withstand this kind of attack. Verizon FIOS is of no help whatsoever, since they don't support Linux and probably couldn't deal with this anyway. I just turned 60 and wrote my first code in BASIC in 1972, but I'm getting too old for this kind of BS. mustermark


How to create a secure nonce for WSSE I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important.

I found very different implementations:
* http://www.orocrm.com/documentation/index/current/cookbook/how-to-use-wsse-authentication
* https://gist.github.com/borisguery/3792855
* https://dev.emarsys.com/suite/get_started/authentication_php.html
* https://stackoverflow.com/questions/18117695/how-to-calculate-wsse-nonce

$nonce = 'd36e316282959a9ed4c89851497a717f';
$nonce = uniqid();
$nonce = base64_encode( hash_hmac('sha512', uniqid(null, true), uniqid(), true) );
$nonce = base64_encode( substr( md5( uniqid( gethostname() . '_', true)), 0, 16));

What do you think would be a good choice?

I read Insufficient Entropy For Random Values and now I think non of the given examples provide enough entropy. gethostname() is not secret and uniqid() and even mt_rand() is a Pseudo-Random Number Generator.

I will use

$nonce = base64_encode(bin2hex(openssl_random_pseudo_bytes(16)));


Can Snort be configured as HIDS? I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS.
I want to know is there any way I can configure Snort as an HIDS? If I am updating variable HOME_NET to my IP, it'll log all ingress and egress traffic but is there a way to make it log all application and events occurring in a system?

Thank you in advance.

No, Snort is not designed to log all application and events occurring in a system.  A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts).  Snort doesn't even try to do any of that.


How to reuse a rewritable DVD from an unknown source? I have a used rewritable DVD that I want to wipe and use to store new data. The DVD has been written to before by someone I don't know and can't necessarily trust. Is there a safe way to use the disc? I can do this in either Windows 10 or Ubuntu and am just looking for general best practices rather than NSA-level protective measures.

Best practices
For best practices, rather than for defending against a highly sophisticated adversary, it should be enough to just disable autoplay/automount. This will prevent any malicious content on the DVD from being processed by the operating system, but will still allow you to write a new image to it.
There is some informational data that is read unconditionally whenever a new disc is inserted into a reader/burner. This data identifies, among other things, the make and model of the disc, its capacity, and various burner features that it is compatible with. This data could, in theory, be maliciously designed to trigger a security bug in either the drive firmware itself or an operating system driver. Utilizing this as an attack vector is, however, quite difficult and would only be a risk to a high-priority target due to the level of sophistication required to pull it off.
But to answer the heart of your question... You work in a highly competitive field and have access to corporate and government data, as well as sensitive new research. You have found a disc just lying around in your new office. These are all red flags: Don't insert the disc!
This should be sufficient as an answer, but if you want to know the details, read on...
Risk of reading the disc
If the disc is malicious and is designed to compromise your system, it will most likely try to do so through contents on the disc itself rather than metadata. This relies on the assumption that you'll be curious about what was written to it. Possible attack vectors include:

Corrupt filesystems - The filesystems for discs is typically UDF, a simple filesystem with only basic feature support. However, mounting a device causes your operating system to process the filesystem, which comes from an untrusted source. I have actually seen this used as an attack vector in the wild against a Linux system, where a malicious disc filesystem was used to attempt code execution in the kernel via an iso9660 0day (which may or may not be fixed).

Icons or previews - Many operating systems will display previews of files that it finds in a new mount point. The decoders that read the icon information embedded in the file, or which read the file contents itself to generate a preview, may contain security bugs. Exploiting these bugs can result in code execution with the privileges of the previewing software.

Autoplay and autorun - While this is not a common issue for modern systems, older versions of Windows would automatically open a disc and execute the file specified in autorun.ini. However, although new systems are not going to do this, they still may be configured to open the disc and play video or audio data if present. Video and audio decoders parse complex data formats in unsafe languages, making them a prime target for exploitation.

All of these exploitation vectors are mitigated by disabling autoplay and automount. This will prevent your computer from viewing anything contained in the disc's filesystem or the filesystem itself. It will not, however, prevent the drive firmware from checking the disc metadata and related information and sending that information to the operating system, which could still be exploitable.
Risk of reusing the disc
The metadata information is automatically read by the drive and delivered to the operating system. Typically, it is burned in by the manufacturer and cannot be changed by an end-user (though a sophisticated attacker could still provide you with a disc with customized metadata). An example of what the data looks like as reported by wodim when burning a disc:

Device type    : Removable CD-ROM
Vendor_info    : 'MATSHITA'
Identification : 'DVD+-RW UJ8C7'
Revision       : '1.00'
Drive id       : 'WQ36  064543'
Driver flags   : BURNFREE
Supported modes: TAO SAO

All this information is read unconditionally as soon as the disc is inserted into the drive. This is also the reason why the disc spins up the second you insert it, even if you do not read or write to it immediately. It's a result of the drive trying to understand what has just been put in it. I am not aware of any specific vulnerabilities that could be exploited this way, but that does not mean they do not exist.
Analyzing your situation
Regarding your recent comments answering whether or not you work in a competitive industry:

I work in academia as a research math. So probably not competitive in the sense you are thinking. I found it in my office among a the random stuff left by the previous office user.

Research can be extremely competitive, and the fact that you saw this disc left over in your own office could be a red flag. If someone wanted to compromise your computer to obtain valuable information, one of the easiest and most common techniques is to leave media "lying around", since chances are, the target will take the device and use it. This is most commonly done with flash drives, since no one can resist plugging in a random flash drive (or inserting a random disc) just lying around.

I have access to the data of a large corporation, which is the most sensitive data available to me. Also some official-use-only data from the government, so it is conceivable that someone would want it.
As for ideas, there are one or two hot ideas that are developed in some of my files that I am keeping quiet about until I publish.

This makes you a prime target. You say you just want best practices and do not need to defend against an NSA-level adversary, but the kind of information you possess could be extremely valuable. You may have to defend against highly sophisticated adversaries near the level of a nation-state. You should always be weary of tempting devices lying around, as this could very possibly be an attack.


Best login form practices So i'm in the process of making a login form for users, and I'd like to make things as secure as reasonable. It's a consumer site, not a financial site, but seeing how I myself like things to be secure when I login to a website, I try to keep things as secure as possible in my form.

Steps I have taken so far:

The site has a ssl certificate with server set to support strongest encryptions whilst still allowing the bane of the internet to access our site(we have some aged customers, fine year)

The password is hashed with bcrypt.

For the login form i'm using a csrf_token generated by hasing bcrypt from

hostname
user ip
session_id
user_id

user id is generated for each user that visites on the basis of GUID when they are not logged in yet, this is stored in the session on first site access and not visible to users.

The csrf is not re-generated for each for each page request because of history issues and like stated, we are not a financial institution and for any plugin it's trivially easy to harvest any csrf tokens. So that's a step I don't need to take to secure the page(what i've read on this site anyways)

cross site scripting is disabled.

added X-Frame-Options: SAMEORIGIN headers

The question:
Are there any other steps I can take/need to consider that will secure the login/user interaction process?

Long password with compensation of number, alphabet and symbol.
User-names should be unique
Restrict the number of failed login attempts to prevent brute force attack and temporary block the user for verification
Don’t allow error message in case of failure to give use or hacker hint
Credential should transmission in secure connection
Secure the change password functionality
Generation of CAPTCHA Image


Tor exit node as CentOS mirror Today we saw traffic going from CentOS servers to a Tor exit node. This caused some raised eyebrows and led us to investigate what was going on.

In the end it turned out that this exit node also acts as a CentOS repository mirror and yum decided that is was our fastest mirror.

Now that we know it should cause no harm, I wonder if others also noticed this type of behaviour.

How should we treat this mirror? Should we blacklist all known Tor exit nodes?

Assuming the connection was legitimate (originated from Yum/Dnf over the expected protocol and port) there is no problems - even if the repo started serving malicious packages they won't be installed as the package manager checks signatures locally.

Just make sure the connection is actually legitimate and that your Yum/Dnf binary isn't compromised - it looks like a pretty good hiding strategy to put the malware in the package manager and have the server act as a package repo to trick unsuspecting admins into thinking it's just the package manager doing its legitimate thing while in fact it's talking to its C&C server.


How can I intercept Android application's SSL traffic where SSL pinning is used? I want to capture the SSL traffic of an Android Application which I think uses SSL pinning.

I've tried running an app which says it uses VPN Tunneling and a Root Certificate to capture the SSL traffic, and it is able to capture the traffic from Chrome and some other basic apps, but when I run the app that I want to capture traffic from, the app works fine but the capture app shows Can Not Capture.

Is there some step-by-step guide or an easy solution?

SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the certificates installed in the device trust store. Since the implementation is the client side implementation, it can be easily bypassed using the following techniques:

Automated Approach

Xposed modules such as SSLUnpinning 2.0.
FRIDA(Dynamic Instrumentation Tool)-Universal SSL Pinning Bypass Script.
Inspeckage-Android Package Inspector

Manual Approach

I feel this is the last, bit complex and the most reliable solution for bypassing SSL Pinning. The following are the steps to perform the same.

Understand the implementation of SSL Pinning. You can refer to this Medium blog which explains the implementation of SSL Pinning using different network libraries such as OkHttp, Volley, Retrofit etc.
Analyze the responsible method and map the same with the SMALI code.

Once the responsible method is analyzed and identified, we can use the following approach for bypassing SSL Pinning:

Tampering Application

Tamper the SMALI code to bypass SSL Pinning.
Re-Build the application using APKTool.
Resign and install the application and capture the traffic.

Reference: https://samsclass.info/android/codemod.html

Runtime Hooking
Once the responsible method is identified use runtime hookers such as FRIDA, JDB to hook the method and change the implementation.


Buffer overflow: Why does the ESP Register change its value after access violation Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's running in the Immunity Debugger, so the data at the program's stack during the moment of the crash can be analyzed, and exploited.

Problem:
Then according to the researched tutorial videos and blog posts, the next step is to find the offset in the corrupted string that contains the data that is overwritten in the values of ESP and EIP registers. This is done so we can find a JMP ESP instruction in the exe and overwrite the return address (EIP value) using the memory location (w/o bad characters) of the said instruction.

Question:
All of the above were done to be under the assumption that the stack pointer (ESP) is pointing at the memory block that contains the payload right after the overwritten and the access violation. So tl dr my question is: How can the ESP be pointing at the payload if it's always supposed to be pointing at the top of the stack?

Visuals, please help explain: Sorry for the smaller size picture. But the picture came from the great Professor Vivek of securitytube.net's SPSE class.

Additionally If someone can please help explain what the ESP value was before and after the crash, and why would the value of ESP be changed to be pointing our payload? is it because of the function creation/death of strcpy, and if it is, how does it play a role in the changed ESP value?
The source code is set up like such:

#include <stdio.h>
#include <string.h>

void vuln_func(char* inputstring)
{
    char* buf[100];
    strcpy(buf, inputstring)
}
int main()
{
    // gets input_string
    vuln_func(input_string);
    return 0;
}

Update:
The comment by @gameOver within his answer asked about what the 4141 was in the visual given. Here is a better explanation: 41 is hex for the ascii character of A. Which is what the corrupted string contains. And what the corrupted string contains up to the EIP (returned address) offset is completely arbitrary, in this case was a string of "A", then the return address offset is written with the memory location of JMP ESP, and after that the corrupted string contains the payload to be executed. (Which is where the ESP is pointing at during the crash) Hence my question, why was the ESP pointing at the payload when it was supposed to be pointing at the top of the stack?

As you correctly pointed out ESP always points at the top of the stack. Also stack overflows occur due to an overflow of a buffer on the stack (not due to an overflow of lets say a malloc-allocated buffer). So when you do:

char* buf[100];

you are actually allocating some space on the stack for your buffer. To illustrate this:

This buffer's initial state/contents, before it gets overwritten with our input, is unknown and can be observed using a debugger, like gdb. So if you go and overflow that buffer with your input, you will overwrite everything that exists on the stack (check the above image to see in what direction the overflow will occur), so you will overwrite EIP to point to whatever you want it to point to. Now, when a function returns (most of the times using RET instruction) it pops EIP and also performs: add esp, 4. In this way ESP will point to the last parameter pushed on the stack when the function was called, in your example/picture this parameter is Arg 1 (since arguments are pushed on the stack in reverse order). So the picture you posted is correct and shows the state of ESP when the function returns. So if you find an instruction like jmp esp etc... you can directly jump to the location of your payload.

But that is not the only exploitable case. So, its a good practise to use a debugger and observe if any register points to your payload, and if it does search for a jmp reg instruction. For example, in this post, you can see that both ESP and EDI point to the payload.


How to share passwords *only* after death? I am looking for a modern, password manager-based way to share my passwords with certain parties (partner, executor of my will) within a week or so of my death, but no sooner.
The scenario I wish to avoid is the loss of my assets and/or breach of my privacy during my lifetime. My threat model includes betrayal of trust and physical access (as in thieving roommate, not the NSA) to my personal papers, keychain, hardware security key, and password-protected phone/laptop. I use 2FA (some with security key, some with phone-based Authenticator apps) for all my accounts.
Regarding betrayal: I accept that someone I'm concerned will betray me in life could just as well betray me after death. While I hope that doesn't happen, that's between them, my intended beneficiaries, and the legal system -- I'm looking to protect my interests while I am alive. So handing someone my passwords on a plate as recommended by e.g. Wirecutter is a nonstarter.
I reject solutions that rely on:

Physical security, e.g. printed out master password or safety deposit box key (thieving roommate)
Trust, e.g. sharing the password with someone and hoping they don't use it until I die. (I do trust established entities like Apple, Google, Dropbox, 1Password, etc., but not random third parties like Joe's Password Manager or https://www.deadmansswitch.net/)
Keep-alive toil, e.g. weekly "click to confirm you're not dead yet" emails
Shoddy facsimile of a password manager, e.g. maintaining my own encrypted list of passwords outside of a password manager
An attorney: I don't have one, and they are much more expensive than a password manager

Ideally, I would have a password manager that lets me designate a list of allowed requestors. If any of them requests access, I have (say) 14d to approve/deny the request (during which time I'll be aggressively pinged), after which I'm presumed dead and the request is approved.
Non-Solutions
A very similar question was previously asked in 2013, but none of the proposed solutions meet my requirements:

Use a lawyer (explicitly ruled out)
Encrypt the passwords; give party A the passwords and party B the key: This is an awful solution, ticking both the 'shoddy facsimile' and 'trust' boxes.
Google's Inactive Account Manager: This has a minimum 3month delay, and doesn't reveal passwords. Maintaining a doc/email would again be a shoddy facsimile.
Dead man's switch email service: Keep-alive toil, and sketchy 3rd-party
Written down password and/or safety deposit box: physical security
"Estate Map", a defunct service that amounted to "use a lawyer"

I’d like to point out that there is an epistemic inconsistency in the reasoning here: you’re willing to trust large tech companies like Apple or Google but not a bank and its safety deposit box product. I think that’s an inconsistency that cannot be overstated. Personally I would be far more inclined to trust a safety deposit box from a large, multi-generational bank than a tech company.
Safety deposit box access usually require two things: access based on proof of identity for an authorized individual and possession of the box key. These can be two separate people, by the way: you can authorize a person with the bank for access that is different from the person to whom you give the key, so as to implement a two-person rule.
As well, the bank cannot open your box without drilling the lock, so you would know if the box was ever opened without your permission.
Putting an encrypted secret key in the box (or even better, a physical key like a yubikey) could allow you to implement a three-person rule: one is authorized to access the box, one has the key to the box, and one knows the PIN to unlock the secret key on the yubikey. They must all co-operate and agree in order to access the password manager or encrypted file that stores the actual passwords.
If you can’t find true trust amongst at least one of three people in your life, you’re focused on the wrong things.


What is the purpose of including time as a part of random in TLS Client & Server Hello messages? RFC 5246 Section 7.4.1.2 states that the 32 bytes of random required in the Client and Server Hello messages should be 4 bytes of time and 28 bytes of random.

Why can't it be 32 bytes of random?
What is the purpose of including    time value in it?

The Spec also says that clocks need not be set correctly for the TLS protocol and as we can this time value is not used for any other special purpose and the entire random value (full 32 bytes) is as such used for Master Secret Derivation.

  The ClientHello message includes a random structure, which is used
  later in the protocol.

     struct {
         uint32 gmt_unix_time;
         opaque random_bytes[28];
     } Random;

  gmt_unix_time
     The current time and date in standard UNIX 32-bit format
     (seconds since the midnight starting Jan 1, 1970, UTC, ignoring
     leap seconds) according to the sender's internal clock.  Clocks
     are not required to be set correctly by the basic TLS protocol;
     higher-level or application protocols may define additional
     requirements.  Note that, for historical reasons, the data
     element is named using GMT, the predecessor of the current
     worldwide time base, UTC.

  random_bytes
     28 bytes generated by a secure random number generator.

I'm not a pro nor am I working with this but I assume it might be something with a duplicate.

I mean if you just use 32 Bytes of random data the chance increases with time that you get the same random data.

But if you use 28 bytes of random data and 4 bytes of time the chance that someone gets the same 28 random bytes at the same time you get your 28 random bytes.

If im wrong please correct me since this is a pretty interesting question.


Is it necessary to scan users' file uploads by antivirus? Web application allows users to upload files. Is it necessary to scan those files by antivirus?

I'd want to hear answer in two scenarios:

Type of file isn't checked when uploading. They are stored in folder that isn't directly accessible from the internet. Files don't have permissions to execute. Then user may query some url, and files will be returned with Content-Disposition: attachment
Type of file isn't checked when uploading. It's contents is parsed with some HTML/XML/JSON/etc. parser. After parsing file isn't stored at server

I see no reason to use a virus scanner in the second case. The chances of a code-execution vulnerability in an anti-virus seem larger than that of a vulnerability in my parsing libraries. Especially if the parsing libraries are written in a memory safe language.

In the first case I'd use an anti-virus, since offering virus files for download doesn't sound like a good idea. Both people and automated website reputations systems(for example google safe browsing) might associate virus downloads with your website hurting its reputation.
I might still offer such a file for download, but only after an explicit warning and user confirmation. Preferably a confirmation that prevents bots from downloading it.


GnuPG warning for a signed key with trust level 4 When encrypting a document with a public key I got a warning:

$gpg --encrypt -r 6B7F10E4 file.pdf

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N)

I set the trust level to 4 and signed the key:

$ gpg --edit-key 6B7F10E4
gpg> trust
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu

Your decision?

4 <Enter>
gpg> sign

Are you sure that you want to sign this key with your
key ... (8F3A3A54)

Really sign? (y/N)

y <Enter>
gpg> save

But I still get that warning when encrypting documents with that key. What else do I need to do to remove it?

The message says GnuPG could not validate the key issuing a correct signature. With other words, you know that the signature was indeed issued by a given private key, but are not sure who actually issued this key.

Trust in GnuPG is only relevant when validating keys based on certifications in the OpenPGP web of trust, also read up on "What is the exact meaning of this gpg output regarding trust?". The trust level defines how much you put trust in the key owner's certifications on other keys, but requires already validated keys. For example if issued on an already-validated key, trust level four ("full trust"), by default defines all keys certified by the valid and fully trusted key to be also valid.

"Ultimate trust" (level five) is special: it is used as introducer when validating keys, thus makes the key validated and always considers other keys certified by this key as validated. This should never be used on keys not issued by yourself, gpg --edit-key and sign other's keys instead of issuing trust (after verifying the key in fact belongs to that party). If you do not want to issue a public certification, there's also lsign for issuing local signatures that GnuPG does not export when sharing a public key.


Exploit SQL injection in OWASP ZAP? I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, without using SQL map myself?

Short Answer:

No. (at least not in the versions I have worked with)

Longer Answer:

ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false positive.

If this is a legitimate security assessment, what's wrong with using SQLmap or trying to exploit it manually?


PDF.zip file password forgotten and need to reset I have an old PDF.zip file that is password secured. Naturally I can't remember it.
Is there a way to change it or disable it?

Some Zip archives use the old PKZIP encryption, which uses a weak homemade stream cipher. The attack is described here (implementing it is a nice exercise for crypto students, by the way). Tools which apply that attack exist (use Google to find some). Windows XP inherent abilities at "Zip password protection" use this weak algorithm; see this answer for some details.

Other Zip-aware tools rely on AES encryption, which won't be as easily broken. If that is the case, then your only hope is to try some brute force on the password, in case it was chosen by a human being and thus possibly in range of a dictionary attack. This may fail if the password is strong enough.


Which BCP/DRP sections are solely related to the software vendor? In a software project, a software vendor is responsible to deliver a piece of software. Everything else, including the infrastructure setup, database and application server installation/configuration/maintenance, etc. are not the responsibility of the software vendor.

Contractually, the software vendor is to provide BCP (business continuity plan) and DRP (disaster recovery plan) documents.

The question is, which sections in these documents are the responsibility of the software vendor? In other words, which parts of the BCP/DRP documents are solely related to the software delivered, rather than the infrastructure setup/installation/configuration/maintenance?

Read The Contract.

You didn't say whether you are the vendor or the buyer. If the contract wasn't drafted well enough to protect you, fire your lawyer. (For legal advice consult a licensed attorney.)

I don't see how any complete DR plan can possibly be written without knowledge of the infrastructure, operating environment, etc.

If you find yourself in a position where you are the software vendor, and you are stuck writing these documents, you will have to elicit the relevant information from your customer. You might want to CYA and fully document all contacts with the customer so that, if you are unable to obtain the information you need, you will have a record that you tried.


How do you validate that someone signed something with a private key So I'm currently trying to understand a soup to nuts path of how public private keys work.

So far I think I understand how the keys are generated and how messages can be encrypted with them.

The thing I'm having trouble finding info on though is, how does one validate that something was signed by someone else's private key with their public key? I thought that you encrypt with the public key and decrypt with the private key.

Can someone point me at some material to understand how you can validate a signature?

This question comes from an attempt to understand how you can validate that someone signed a blockchain transaction with their private key.

Signing is different from encryption (well, you still use encryption, but anyway)

For RSA (Thanks Michael):

To digitally sign, you make a hash of the data and then use the private key to encrypt the hash. You then send this along with the message you signed.

The recipient can confirm it was signed by you by decrypting using the freely available public key and comparing the hash to one they generate from the message.


How secure is end-to-end encryption using user password? When symmetric encryption is used, usually at least 256-bit key is generated. That corresponds to 32 bytes -> 32 chars (which is quite generous, as most users will never use more than ~70 of the most common chars from the 256 in ascii).

How secure can then be services like Pushbullet that use your password for encryption? Even if they don't steal your password from client, shouldn't it be fairly easy to brute force the key on server if needed?

Yes it is weaker and it has bigger risks

If a background service uses your password as an encryption key then that means they have an on demand access to your password. This is a bigger risk (you mentioned it too). It is not uncommon for people to have the same password across various services. Pushbullet doesn't actually do that. It derives a key when you enter your password and uses that key for it's encryption.

If a system uses a user generated string as a key to it's symmetric encryption scheme, then it would likely be a smaller key compared to say a random 256 bit key. Not only do smaller keys have a smaller search space for brute force but user generated keys are also susceptible to other ways of attack like predicting the modification or same key as some leaked key.


Redirect malware in BIOS or MBR can't remove it I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play some music, all is working well. I wanted to install Atmel studio 7 and clicked on the link to download it, while that is happening another tab opens and redirects me to a fake site and asks me to download adobe flashplayer but the site in not by Adobe. This keeps happening every time I click any link on the website. I tried other websites with the same result. Same result in Google Chrome as well.

Now the really fun part. Getting rid of this adware or malware.

Restoring the PC to state I got it in, nothing changed, same problem.
Resetting the PC! Didn't get rid of the malware. (Multiple times)
Downloaded a separate Window 10 ISO burned it USB drive and Installed with
keep Nothing option. Didn't work either
Formatted the entire HDD and installed Windows 10. This as a fresh as it
gets, still no joy. (Multiple times)
Tried Ubuntu without installing (There is an option for that), opened Firefox
and went to the Atmel site again. Surely the redirect malware can't work here
right? Wrong! It still opens another tab and redirects me to another fake
website.

Where is this malware hiding to avoid a complete nuke of the system? Is it in the BIOS or the MBR. I read that these malware can survive in these places even after completed nuking of the system. The redirect happens through "onclickrev.com" to a fake website for adobe or some ads about stupid weight loss methods. I used MalwareBytes, Kaspersky to scan for any boot or root kit in the MBR. Couldn't find one that checks BIOS.

I remember that the Laptop crashed with BSOD during an update install by Dell. That was the only weird thing that happened before the adware/malware started showing up.

What should I do? How can I remove it? Is replacement my only hope? I can't trust this computer at all for any type of online payment or banking.

TL;DR: A redirect malware infected my new laptop. Tried almost every method to get rid of it! Are there more methods?

EDIT: Apparently the onclickrev.com is redirect virus of some sort, found some people experiencing the same problem (None of them tried OS reinstall). Some of the solutions provided by websites (the sites appears to be not trust worthy either) to remove this virus looks suspicious. I can't figure out how this thing can still be in the system after a complete reinstall. Google search 'onclickrev.com removal' and see what comes up!

The redirect url for this advertisement virus or malware is http://onclickrev.com/afu.php?zoneid=1220488

As @ByteCommander stated in one of the comments this Ad you are seeing is most likely coming from either the router you are connected to or (directly or indirectly) from your ISP.

Things you could do to test/fix this issue:

Setup an SSH or VPN tunnel to a server you trust (or possibly even use TOR).
Switch out your router (if it is yours and you are not "borrowing" internet from someone else.
Change your computers DNS settings to 8.8.8.8 (google dns)

I seriously doubt this has anything to do with your MBR or BIOS.  You are correct in suspecting something outside the OS because the issue persists on your Ubuntu Live CD ... however, if your BIOS was infected the code would most likely be targeting windows (quite difficult to write a cross compatible root-kit in C/C++ with limited ROM space).


How do companies track employee usage on corporate computers? For companies that needs to monitor computer usage by employees, what systems are usually set up to do so (monitoring software, hardware, etc.)?

What are the financial costs involved in setting up such a system?

This depends widely on the type of monitoring that is desired. Logs can be collected and reviewed. Proxies can be used to limit access to specific ips or domains. IDS devices can be used to monitor and if the devices are inline even reset connections that are a result of a violation of policy. Such as IRC,Facbook etc.. I think more details would be necessary to answer your question in a more effective way.


Best Practices for Security Questions When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other websites.

Should I choose the most obscure questions that are difficult to guess? Or should I just enter a gibberish password and save that in addition to my regular password?

The best practice by far is to chose any of the questions but enter random text as the answers.

As others have said in the comments, it is far too easy to discover the answers to most of the well-used questions now.

Of course, this requires you to carefully keep track of the answers and be able to get hold of them when required.

Generally I use Keepass as a password store and this supports additional QA security as well as the enter n characters from a password type entries. It is well tried and trusted and has 3rd party versions for pretty well all platforms including mobile ones.


One time password over SMS - exposing the Authentication Server to the internet Consider a Internet Based Website which does authentication. The Web Application can do the authentication by calling an Authentication Server which is not connected to the internet. The Authentication Server is not in the DMZ. However if 2 Factor Authentication needs to be done via One Time Password over SMS then the Authentication Server (which triggers the sending of the SMS) needs to be connected to the internet (to access the external SMS Gateway).

So how is this need taken care of? Is a proxy used - if yes, what kind of proxy?

In a situation like this, all you need is a firewall. You should certainly not have a DMZ, and have no need for a proxy, but simply a firewall.

As with all your machines, the webserver should only be accessible on ports which are intended to be public-facing. The authentication server can be allowed only to egress packets on the SMS protocol, whatever that may be.

So your firewall set up would look something like:

NEW INGRESS:
* -> webserver:http   ALLOW
* -> webserver:https  ALLOW
* -> *                DROP

NEW EGRESS:
auth -> smshost:sms   ALLOW
*    -> *             DROP

ESTABLISHED:
* -> *                ALLOW


If I seed a CSPRNG with a truly random number and call the output, does this make the number more, less or equally "random"? If I have a JavaScript CSPRNG such as isaac.random(), and I seed it using a truly random number T as such: isaac.seed(T), does this make the result of the CSPRNG more, less, or equally random?
I would imagine that with a CSPRNG such as isaac, (Which has passed TestU01)  that the result would not add any randomness since isaac produces numbers indistinguishable from truly random values.
The concern I have is if this would cause less "randomness".

Since without user-seeding, the JavaScript isaac implementation uses Math.random() as a seed, you would be better off using your own seed. You cannot derive security from an insecure input. If you replaced that call with a CSPRNG input like crypto.getRandomValues(), you would have a better output. But why not just use the built-in CSPRNG if you are using it anyway to seed a less-reviewed algo? Don't roll your own crypto.


Difference between key generation and key agreement Please excuse my ignorance as I am new to information security.

Could someone please explain in simple terms what the difference is between key generation and key agreement. In which situation would I use which.

Keep it simple please.

Key agreement is a sub-case of key generation.

Key generation is about moving from a World where there is no key, to a World where there is a key. A "key", here, is some value with the correct structure for some cryptographic algorithm (e.g., an AES key is a sequence of 128, 192 or 256 bits; a RSA key is a set of a few big integers which fulfil some specific relations). Since keys have value by being unguessable by third parties, key generation necessarily involves using source data which is unknown to other people; in general, this "source data" will be random values obtained from a suitable source.

Key agreement is when the key generation must be such that, at the end of the process, two specific entities will know the key, and only them. A prime example is the Diffie-Hellman protocol where both parties use randomness to produce some data elements, exchange some of these elements with each other, and do some computations, which end up with both of them obtaining the same result at the end, while keeping external observers completely nonplussed.

A common method for key agreement is asymmetric encryption: Alice generates a key K for some algorithm (say, a sequence of 128 random bits), then encrypts it with Bob's public key, and sends the result to Bob. Bob decrypts it (with his private key), and thus obtains a copy of K. At the end of the day, Alice and Bob both know the same secret key K, so that's key agreement. If we look at the details, we see that the key agreement begins with a key generation, which is done entirely by Alice. That "local-generation-then-asymmetric-encryption" method is how most SSL connections are done on the Internet; note that Diffie-Hellman cannot be described that way, so one should not assume that all key agreement works that way.


Is DNSSEC really useless if TLS is properly configured? I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but the more I thought about it, I realized I couldn't think of a counter example.  Granted I only have a cursory understanding of DNSSEC, but he seems correct. Am I missing something?

TL;TR: In some use cases like HTTPS (web) DNSSec is not really needed. In other use cases like SMTP (mail) DNS spoofing will not be noticed by TLS, that is man-in-the-middle is possible if DNS can be spoofed even if TLS itself is properly used.

Details:

When used within HTTPS (web) and the currently established CA system you don't need DNSSec, because the browser checks the name in the URL against the name in the certificate and validates the trust chain using a locally stored (pre-trusted) root-CA. But note that the proper issuing of the certificate itself might be affected by DNS spoofing (see below).

With SMTP (mail transport) the situation is different. To get the next hop within mail delivery a mail transfer agent (MTA) must know which server is responsible for which recipient domain. This is done by looking up the MX record in DNS. If this record can be spoofed (which can be done without DNSSec) then the MTA will deliver the mail to the wrong mail server. Even if delivery is done with TLS the sending MTA will not notice if the MX reports the attackers server as target server, because the hostname of the attackers server and the name inside the certificate will still match. A mechanism similar to MX for mail exists for SIP (VoIP) in the form of SRV records and it has thus the same problems.

Apart from that there are other protocols which rely on secured DNS. The most prominent is probable DANE which tries to replace the currently used but broken CA system with a system where the expected certificate is stored at the same place as the hostname, that is inside the DNS. The same way you could also store SSH host keys.

Also, in the current system with public pre-trusted CA most of the identity checks done when issuing a domain validated certificate can be forged if the attacker is able to do DNS spoofing at the right place. This includes the case where the domain validation is done with mail or where the validation is done by accessing a specific file on the site with HTTP only (because the site has no HTTPS yet). While in the first case the MX record will need to be spoofed you need to spoof A/AAAA or CNAME records in the second case. And once the attacker has got the certificate for the site in question the MITM attack against the site will not be noticed any longer.


vulnerability scans on machines not on the network? Is it possible to scan laptops of users who are not on your network (e.g., consultants) before giving them access to resources?

Can you also explain the reasoning behind why/why not?

Thank you.

It depends on what you are trying to scan.

You can easily scan for open ports, OS version, etc. with tools such as this online nmap scanner


Path traversal via filename Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?

For example, naming a file "../test.txt" (if it's possible at all) and uploading it to a website. If the website does not validate the filename, it could save the file to the parent directory instead (assuming folder permissions allow this).

You wouldn't be able to name a file ../test.txt as no filesystem (that I'm aware of) allows forward slashes within the filename.  (Certainly all POSIX filesystems do not.)

That being said, for an attacker, it doesn't matter.  The filename is sent as part of the HTTP POST data, which is of course subject to tampering by an attacker:

--------------------------d74596066958873e
Content-Disposition: form-data; name="formfield"; filename="file.txt"
Content-Type: text/plain

filecontents
--------------------------d74596066958873e

So an attacker can easily specify something other than "file.txt" for the filename field.  Whether your application server or application code will accept a filename containing is what will determine if you are vulnerable to a directory traversal via the filename.


What happens if an OpenPGP subkey gets compromised? In my GnuPG keyring, I have a primary key for creating keys and three subkeys: two for encryption and one for signing. All of then have the same password. If a subkey gets compromised, is it possible for the thief or whatever to revert my subkey and discover my password? That happening, I would have to change the password of my primary key, right?

If a subkey gets compromised, is it possible for the thief or whatever to [...] discover my password?

The passphrase is used to encrypt the private keys (both primary and subkeys) using a derived session key and symmetric encryption. The symmetric encryption algorithms used by OpenPGP are all strong considering known plain text attacks; thus when the attacker only gets hold of the unencrypted private key, he will not be able to conclude back to the session key, nor the passphrase.

  That happening, I would have to change the password of my primary key, right?

Probably an attacker will rather also get hold of the passphrase. This obviously means he will be able to decrypt the other private keys in case he gets hold of a copy encrypted with this very passphrase (so without any surprises, changing the passphrase after the keys have been compromised will not bother an attacker at all, as he already has copies of the keys encrypted with the old passphrase).

So yes, changing the passphrase might be reasonable, but also make sure to verify whether the attacker might have got hold of copies of your primary key encrypted with the old passphrase. If so, consider your primary key compromised and better revoke it, either.

  If a subkey gets compromised, is it possible for the thief or whatever to revert my subkey [...]?

Getting to the most relevant part of your question: subkeys can only be used for their very specific purpose, usually signing (documents, messages and code), encryption and/or authentication. Subkeys are never allowed to perform certifications (signatures on keys); this includes those on other's keys, but also on your own keys. Given the fact that all key management operations like issuing new subkeys, user IDs, changing revocation dates, revoking keys, ... includes issuing self-signatures, this means an attacker getting hold of your subkey cannot change your keys (not even revoke the subkey), he can only use the key for the purpose it was created for.

Revoking the subkey is another self-signature issued by the primary key, so even if you lost control over the subkey, you can still revoke it (given you have access to the primary key).


I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration? I want to send out SMIME certificates with my emails, and want to deploy the following PKI

Root01  (All EKU, All Constrants, No Restrictions)

PolicyInt01 (Internal applications, not trusted by 3rd parties...)
PolicyExt01 (Name constraints = domain.com, EKU=Message signing)

IssueExt01 (Issues certificates for PolicyExt01)

My intent is to ask external parties to trust PolicyExt01 and add that to the trusted root store.  Since it is constrained, and limited in use, I think that most intelligent 3rd parties wouldn't have an issue with this.

Question

Is this an acceptable configuration for deploying trusted SMIME certs outside our organisation?
What changes would you make in order for you, yourself as a security admin, to this process?
Is there any risk of this certificate pkipolext01 cross-signing/chaining another certificate, causing unexpected escalation of rights?  (name constraints/EKU)

I would recommend using a completely separate root for the external and internal certificates, to prevent any information leak about internal hosts or users, through Root01, but also prevent any implicit trust by broken software. By using 2 separate root for external and internal use, theres no possible for any trust to leak from External to Internal certificates, regardless how broken the software is.

Normally, if we have certification paths that looks like this:

Root01 --> SubCA01 -> Cert01
Root01 --> SubCA02 -> Cert02

And SubCA02 is imported as trusted. In a valid PKI implementation, Cert01 should not be trusted. But as you know with lazy coding, broken software, and hacky parsing of certificates, theres is possible for trust to leak over from subCA02 to Root01 and thus leaking over causing Cert01 to be trusted by someone that shouldn't trust that cert, if the PKI implementation is very broken and, for example assumes any higher cert as trusted automatically. Yes its far fetched, but better account for any broken software by using completely separate roots instead.

I would also add a PathLength=0 Basic constraint, preventing the CA certificate from being used to sign other CA certificates, in addition to the name constraint.

As you might know, there is lots of broken software out there, and a privilegie escalation attack (as you call it when someone manages to sign a certificate in violation with the constraints) can happen, for example if the said PolicyExt01 certificate is used to sign a subordinate CA, that in turn is signing a S/MIME certificate.

Some broken software only checks for example naming constraints "1 level Deep", and adding a Pathlength constraint would then cause longer chains to fail instead of being accepted as trusted.

So I would do like this:

Root01 (Name constraints = Email=@domain.com, PathlenConstraint=0, EKU=Message signing)
Root02 (Internal applications, not trusted by 3rd parties...)

And then sharing Root01 cert with those third parties that should trust it, while installing both Root01 and Root02 in all Company-internal computers.

Both Root01 and Root02 is then self-signed root CA certificates.

When using Namingconstraint, I would only put a Email=@domain.com Naming constraint, and then put every other naming constraints (IP, DNS, UPN, URI) as wildcard excluded, to prevent a certificate from being used as for example a website SSL certificate, if a broken browser or SSL implementation would be unable to parse the key usage flags.

A good idea is also to test your setup, preferable by exporting the root CA certificate and private key to a secure offline computer, and then attempt to sign "invalid" certificates with this. Then test the "invalid" certificates with common client software to ensure the constraints are kicking in and marking the certificate as untrusted.

I do not personally know any explicit configuration that would cause such a "privilege escalation" attack, but as you know, theres lots of broken SSL implementations and PKI software out there, so better be safe than sorry and restrict the certificates as much as possible, and also use separate roots to prevent any trust leak between the certificates by VERY broken software.


Client side encryption of user data with user password I've narrowed down on a scheme that would allow my application to encrypt user data client side and transmit that data to the server, with no chance of our server ever being able to decrypt the data.

I want to ensure there are no obvious flaws in this scheme.

Method

Note: every step below happens on the client side.

Precursor:

Upon login/registration, generate global key gk = SHA256(user_password) and store gk in a cookie localStorage. (The reason for this is to not store the user's password plainly.)

Encrypting:

For every file, generate a random key fk.
Encrypt file with fk.
Encrypt fk with gk to get fk'.
Transmit encrypted file and fk' to server for storage.

Decrypting:

Receive encrypted file and fk' from server.
Decrypt fk' using gk to get fk.
Decrypt file using fk.

When user changes password:

For every file, decrypt fk' using current gk to get fk.
Generate new gk using new password.
Encrypt fk with new gk to get fk'.
Transmit new file fk' to server for storage.

When user forgets password:

Out of luck. (Unless?)

What flaws exist in this procedure?

Update

One flaw is that if the user authenticates login with a password, then technically, I can easily compute and store gk on the server, thus compromising the promise of client side encryption.

A solution to this:

Generate pw = SHA256(SHA256(user_password)) and send this to the server as the user's password. The server then receives this password, and encrypts it again before storing it.

So as far as the server is concerned, it's just receiving a regular password. But this way, gk cannot be computed server side.

Flaws?

The biggest flaw in this scheme is that it depends on javascript code that will be transmitted to the client by the (a) server.

So, what's to keep the server (or a man in the middle) to send the client modified javascript that circumvents all the security measures? How would the client, or, for that matter, the user ever know? All the code that you write to check fingerprints, checksums, digital signatures etc can likewise be circumvented.

A related problem is other, malicious javascript code running in your Browser that can't be reliably isolated from your security-related javascript code.

This is impossible to fix. In-Browser Javascript is currently not a secure platform and all browser client-side cryptography suffers from this gaping security hole that can't be closed.

Summary of the discussion in the comments regarding the updated question

Calculating pw = sha256(sha256(user_password)) strikes me as a bad idea for several reasons.

The first one was already mentioned by AgentMe: Don't use simple hash
functions such as sha-whatever to hash passwords. These hash functions were designed to be implemented efficiently in hardware and are much, much
too fast; to hash passwords, you want slow hash functions. See AgentMe's
answer.
With this scheme, pw can be calculated if you know gk (which is just sha256(user_password)). So when someone steals your localstorage, you give him access both to the master encryption key and to the authentication/authorization token he needs to download the encrypted files. It would be better to keep the two secrets independent of each other, so if one is compromised by a third party, it's not enough to calculate the other one and break the confidentiality of the encrypted data.
Finally, you're not salting your user_password with this scheme. This means that identical passwords across your whole userbase will yield identical hash values (and there are already large rainbow tables for unsalted sha-hashes out there containing the few million most common passwords).

You suggest an alternative, e.g. gk=sha256(user_password) and pw=sha128(user_password). While this solves point 2, it doesn't address 1 und 3. Also I wouldn't recommend it because I could imagine that this needlessly provides additional information to an attacker (the same password hashed to two different hash values), even though I don't know how to exploit it.

I suggested using gk=hmac(user_password, n) and pw=hmac(user_password, m), where m and n are known, but different for each user. How you arrive at m and n is irrelevant, as long as they're random and sufficiently large to make them unique across your user base with a high probability. You could create them on the client and submit them for storage at the server, indexed by the username so they can be retrieved on other clients. Or you can have the server generate them when the user first creates an account. The values don't need to be kept secure; they're worthless without the user_password. An improvement improvement would be to use  gk=hmac(bcrypt(user_password), n) and pw=hmac(bcrypt(user_password), m) to make brute force attacks harder.

Now, I'm not convinced that this suggestion is a good idea, since hmac is designed for message authentication, not for creating authentication tokens or encryption keys, so I'd take that suggestion with a grain of salt. But it seems to solve all three points I raise, so it seems like a better solution than chaining the same hash function or using two different hash functions on the password.


Forensic analysis of file metadata Suppose I have received a file (doesn't matter what it is - document, image, video, audio, etc). I know that the operating system and also programs that create the file like Office, and even hardware like digital cameras, etc. store a lot of metadata in the file.

Some of these files like MS Office contain some of the metadata in the file itself, while others it seems that Windows "knows" metadata about the file that is not contained in the file. Eg. I create a notepad document and it knows creation date, last access, etc.

I understand that some of this information is kept in the file system itself, but there are many things that I don't see where they are kept.

I have three questions:

What are the different places that metadata is stored about a file?
Is there a free/open source tool that can extract metadata from basically any file you give it (like VLC plays basically any media file)?
Suppose I am doing a forensic analysis of a file, what are the steps I should follow to make sure I get maximum information about the file (especially from metadata)?

Where metadata is stored will be up to the OS and the file that created it (as you say about Notepad and Word docs). Some file types even create a separate file just to hold the metadata.
Because of #1, there is no free "give me all the metadata" tool. There are tools that can find the metadata of a wide range of well-known file types, though.
Because of #1, it would take too long to try and lay out all the steps required to find the "maximum" amount of data.


will all instrusion dectection will become host-based? Will all intrusion detection become host-based once all network packets have been encrypted?

If I understand your question correctly, then yes.

If you use network-layer encryption on all traffic, for example ipsec or SSL/TLS, then any network-based IDS/IPS will have limited ability to detect application-level (or any upper layer) attacks on your hosts, because it's encapsulated/encrypted. If this is the case, then having some form of a host-based protection is your best bet.


Pros/Cons to OpenVPN vs "VPN over OpenSSH" What are the major differences between using OpenVPN and using VPN over OpenSSH?

Does adding a virtual tunnel interface to a SSH connection offer the same benefits of OpenVPN? Can PuTTY be used on Windows to use the "layer-3 IP-in-SSH tunnelling" protocol described in the article? The article states there are no Windows clients that use this protocol.

Motivation:
I'm looking into remotely connecting to a home server and attempting to learn about the necessary security measures. Within the LAN, I'm used to logging into the server from my laptop via SSH. Outside the LAN, however, I would like to connect to my server and have my traffic be encrypted.

Thanks!

I don't see any security issue there. SSH is supposed to be secure and all the data are passed thru the SSH tunnel. So, yes, I believe it is secure enough. The only issue I see is efficiency. SSH is TCP protocol. TCP traffic is passed through an another TCP protocol. The packets are double "acknowledged" by the 2-layer of TCPs. Better protocols are built on UDP or even IP.

I've never used SSH tunnel like this. I have only experience with SOCK V5 protocol (ssh -D), and I haven't realised any significant network speed degradation issue.

Sorry for trolling, but I can't help myself... Unsupported windows platform isn't an issue for me, since I don't use any window :-)


How to convert this .NET cryptography code to openssl command? how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below?

using System.Security.Cryptography.Pkcs;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography;

static public byte[] SignMe(X509Certificate2 rsa_cert, Byte[] message)
{
    ContentInfo ci = new ContentInfo(message);
    SignedCms scms = new SignedCms(ci, true);
    CmsSigner signer = new CmsSigner(rsa_cert);
    scms.ComputeSignature(signer, false);
    return Convert.ToBase64String(scms.Encode());
}

The following should perform the same effect for you, where rsa_cert_private.key is the private key in your keypair, and sign.txt is the message you wish to sign.  The result will be a new file sign.txt.sha256 that is the signature based upon the sha256 digest of the original message.

  openssl dgst -sha256 -sign rsa_cert_private.key" -out sign.txt.sha256
  sign.txt

but at this point the signature is in binary form, to get that over to base64 you'll then want to

  base64 sign.txt.sha256 > sign.txt.sha256.txt

which will create a 2nd new file (sign.txt.sha256.txt) that is the exact same signature content but in b64.

To verify the signature you would first need to get it back into a binary sig

  base64 -d sign.txt.sha256.txt > sign.txt.sha256

but it is easier just to leave it in binary the whole time instead of taking the extra steps and (admittedly minuscule) extra space to store it in base64.