What technical reasons are there to have low maximum password lengths? I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care about their security.

I understand most people will pick short passwords like "password" and "123456" but are there technical reasons to force this? Using an application like 1Password, almost all my passwords are something like fx9@#^L;UyC4@mE3<P]uzt or other randomly generated long strings of unlikely to guess things.

Are there specific reasons why websites enforce strict bounds on password lengths (more like 8 or 10, I understand why 100000000 might be a problem...)?

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked.

Soon, the chimps learn that the bananas and the stepladder are best ignored.

Now, remove one chimp, and replace it with a fresh one. That chimp knows nothing of the hoses. He sees the banana, notices the stepladder, and because he is a smart primate, he envisions himself stepping on the stepladder to reach the bananas. He then deftly grabs the stepladder... and the four other chimps spring on him and beat him squarely. He soon learns to ignore the stepladder.

Then, remove another chimp and replace it with a fresh one. The scenario occurs again; when he grabs the stepladder, he gets mauled by the four other chimps -- yes, including the previous "fresh" chimp. He has integrated the notion of "thou shallt not touch the stepladder".

Iterate. After some operations, you have five chimps who are ready to punch any chimp who would dare touch the stepladder -- and none of them knows why.

Originally, some developer, somewhere, was working on an old Unix system from the previous century, which used the old DES-based "crypt", actually a password hashing function derived from the DES block cipher. In that hashing function, only the first eight characters of the password are used (and only the low 7 bits of each character, as well). Subsequent characters are ignored. That's the banana.

The Internet is full of chimpanzees.


Firefox refuses to use X509 certificate, complaining "Cound not verify this certificate for unknown reasons" I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1.0.2h:

$ openssl verify -verbose -CAfile Forest\ CA\ 2\ RSA.pem -purpose sslclient yubi-sign-test.pem
yubi-sign-test.pem: OK

Here's its content:

 X509v3 extensions:
    X509v3 Basic Constraints: critical
        CA:FALSE
    X509v3 Key Usage: critical
        Digital Signature, Non Repudiation
    X509v3 Subject Alternative Name:
        email:myemail@mit.edu
    X509v3 Subject Key Identifier:
        75:35:D2:A3:47:A2:A1:20:AC:A3:90:DD:15:C2:A5:96:73:2B:75:9D
    X509v3 Extended Key Usage:
        TLS Web Client Authentication, Code Signing, 1.3.6.1.4.1.311.10.3.12, 1.2.840.113583.1.1.5, E-mail Protection, Microsoft Smartcardlogin
 Signature Algorithm: sha256WithRSAEncryption

Here's the content of the CA:

    X509v3 extensions:
        X509v3 Basic Constraints: critical
            CA:TRUE, pathlen:4
        X509v3 Subject Key Identifier: critical
            BD:1C:AE:9E:49:AE:68:B3:EC:7C:1E:AE:6A:CC:87:CB:F2:49:9E:A2
        X509v3 Key Usage: critical
            Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
        X509v3 Extended Key Usage: critical
            Time Stamping, OCSP Signing
        X509v3 Authority Key Identifier:
            keyid:BD:1C:AE:9E:49:AE:68:B3:EC:7C:1E:AE:6A:CC:87:CB:F2:49:9E:A2

Yet the current stable Firefox (47.0) is giving me that same message, and refuses to use that certificate for establishing a TLS session (doesn't even offer it among the available certs). It shows this certificate (among others) in Prefs->Advanced->View Certificates.

Needless to say, CA that issued this certificate, was imported to "Authorities" and marked as trusted for all the three options.

The only possible thing that I could think of - this CA does not offer CRL or OCSP, so neither it not the certs it issues have pointers to CRL or OCSP.

One suggestion I got was:

  Welcome on Security SE. Do not hesitate to post your question as a new question referencing this one. Details of both the CA and end-user certificates can be helpful. However, before doing so you should try to add the "Key encipherment" key usage to the certificate as a first step. In case it does not help, try to add "Data encipherment" and remove "Non repudiation" (or disable the "Critical" flag on these extensions).

The problem with the above is that we have fairly strict rules on the Key Usage attributes, particularly on certificates that that are provisioned to hardware tokens. So it is not possible for us to, e.g., remove "Non-repudiation" from a Digital Signature cert, or add "Key Encipherment" to it. (Even in the unlikely case that the stupid current-release Firefox would work with such a cert, we wouldn't be able to deploy it.)

I'd appreciate any help.

When using client certificates the server sends a list of acceptable CA which issued the client certificate. Based on this list the browser will select the matching client certificate. If there is no client certificate issued by the CA expected by the server you get the error message. Thus the problem might not be the certificate itself, but simply that the server expects only certificates issued by a different CA.

To check which CA the server expects to be used for client certificate you might connect with openssl:

 $ openssl s_client -connect host:443 -servername host
 ...
 Acceptable client certificate CA names
 /CN=ACEDICOM Root/OU=PKI/O=EDICOM/C=ES
 ...


Is it possible to find out the salt of a MD5 hash? I want to know whether it is possible to find out the salt of a MD5 hash?
For instance we've got two MD5 hashes

helloworld -> fc5e038d38a57032085441e7fe7010b0
goodbyeworld -> b34266c1c9eda200a0ebb833281bb855

Is it possible to detect the salt world by having only the hashes?

Given the hash output, one can always try to get lucky, and injecting random values until a match is found. In your example, any decent password cracker should try "helloworld" and "goodbyeworld" very quickly (like, within the first second of trying) because they are extremely classic password strings.

In a more general case: given a cryptographic hash function h, and the values h(m||x) and h(m'||x) for unknown values of m, m' and x, it is not feasible to recover m, m' or x except by being lucky in the sense of the previous paragraph (attacker tries exactly m||x as input). This holds for cryptographically secure hash function, and MD5, despite its weaknesses with regards to collisions (which are irrelevant here), is still "secure enough" for that.

(Of course, one must be aware that MD5 has no "salt", so any mention of MD5-with-a-salt really means "some custom, homemade, non-standard construction that involves MD5 and a value that the designer chooses to call 'a salt'". Generally speaking, homemade constructions shall be avoided.)


Is it safe to help a stranger login to gmail using my phone number? I was assisting a man at the public library who was unable to login to his gmail account. He typed in his password and was prompted for a phone number, presumably so a code to be sent which would then have to entered in order to proceed with the login.

He said he had no phone and that he borrowed someone else's phone when he setup the account whatever that means. Anyway he kindly asked if I he could borrow the use of my phone number for this one-time purpose of logging in. I said no.

Would it have worked if I agreed and would there have been any implications?

He may have been misleading you into thinking he was trying to gain access to an existing account, when in fact he was trying to setup a new account for some nefarious purpose.

Many email service providers (including Gmail) require a phone number when setting up new accounts.  The service provider validates that the person who is setting up the account is able to receive messages at the phone number provided, using the method that you described in your question.  This prevents people from anonymously setting up accounts.  Then, later, if the account is misused, the provider has a phone number that they can attempt to use to track down the person who setup the account.

If this is what the person that you met was up to, and you had given him your phone number to use, and he proceeded to setup the account and then use it for some illicit purpose - then you may have soon received a call from law enforcement and had some explaining to do.


What is the danger of the "FTP RNFR ././ attempt"? I am analysing an old attack and I got a scenario which does not really make sense to me.

The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as alert with sid 1:1622
I do not understand why attacker does that. His next step is PWD followed by CWD (snort sid 1:1672)

I do not understand the steps and the purpose of them by the attacker, what he was looking for.

The attacker was trying to exploit the CVE-1999-0081 vulnerability of unpatched WU-FTPD installations, where a software bug allows RNFR Rename From commands to overwrite or rename files, even if these commands are violating file permissions and when an unescaped input parameter using relative path pointing to directory root (././) is used. The following commands (PWD Print Working Directory, and CWD Change Working Directory) suggest the exploit attempt was unsuccessful, otherwise the RNFR (Rename From specifying a file to rename) would most probably be followed by RNTO (Rename To) command (probably to rename the root path and remove file permissions on the whole FTP directory structure?). The attacker then retrieved his current position within your FTP directories structure (PWD) and navigated to another location within it (CWD). CWD however takes an argument for the new location, so I can't say what his next step might have been based on information you provide.


SSL handshake failure modes In SSL if the handshake is not successful, does it always end with a handshake alert?
Or are there other ways to finish the SSL connection (acceptable by standard).
I am asking this, because in an HTTPS server configured to require client authentication, if the client does not send a certificate, I see (via network packets) a TLS Finished message from server to client; I was expecting an alert.

A SSL/TLS connection must always end with an alert message of some kind: a connection which is broken (e.g. the underlying TCP socket is closed) without an alert is said to be improperly terminated. The alert message for a normal termination is close_notify.

The handshake is only a part of the connection; a handshake occurs at the start and subsequent handshakes can be played on the same connection. The handshake is usually where errors occur, triggering alert messages, but a fatal alert message does not end only the handshake: it closes the whole connection.

In the case of a server requesting client authentication, the client may respond by sending a certificate and computing a signature; however, this is optional. The client is allowed not to honor the request. The server then chooses what to do. The server may reject the client right away, through an alert message which closes the connection. The server may also decide to continue, and handle the lack of client authentication at another level. A server which sends a Finished message certainly chooses to continue; possibly, the server may decide to report the error as applicative data within the tunnel (e.g., for a HTTPS server, send an HTTP error message once the handshake is finished).

See RFC 2246, section 7.4.6 for details:

   This is the first message the client can send after receiving a
   server hello done message. This message is only sent if the
   server requests a certificate. If no suitable certificate is
   available, the client should send a certificate message
   containing no certificates. If client authentication is required
   by the server for the handshake to continue, it may respond with
   a fatal handshake failure alert.

→ emphasis on "may".


Should users be allowed to login with the same password when a password change is requested but not changed? I have noticed that some sites would not let you login with the old password if a new password is requested, but was not changed.

Example: I forgot my password and requested a new one in the email. Received the email to reset it, clicked on it and then while typing, I remembered the old password. So I cancel the page and go back to the login page. However, it would not let me login with the old password as I have requested a password change.

What compromises are made possible if we let the users login with the old password, instead of making them change the password?

Yes, you should allow users to log in using the old password until they have changed the password. Otherwise it would be possible to lock users out of their account by requesting a password reset for them.


How often should secrets be regenerated for token-authentication? When implementing token-based authentication, is it recommended to regenerate secrets on a periodic basis? This is assuming the tokens generated have expiration.

The general guidelines here is; access to secret keys need to be highly restricted.  For example, if this is a hard-coded secret, then any time someone with access to source leaves the company, then the secrets need to be rotated. Clearly hard-coding secrets is bad practice, and if secrets were properly stored in an HSM/KSM/CloudHSM then there is less pressure to rotate. Keep in mind, Yahoo stored the keys to the kingdom has a hard-coded secret in source control, so that anyone with access to source could then hijack 32 million email accounts (slow clap for the Yahoo security engineers).

tldr; rotate if you ever have reason to believe that the secret has been compromised.


With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing? I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount"

That being said, it seems to really be getting popular. Now there are extremely fast ASIC miners out there that are capable of over 60,000 Mhashes/s

Although they are probably rather specialized for bitcoin, I assume it wouldn't be impossible to put them to black/gray-hat use and employ their bruteforce power to find a password from a salt and hash. Because of this, should SHA256 be considered a risky algorithm to trust passwords to?

Ability to compute a lot of hashes very fast with dedicated hardware is a problem for password hashes, but not a new problem. Before the advent of ASIC specialized in SHA-256, we were already taking FPGA into account (see for instance this research machine, from already five years ago). An ASIC can roughly be clocked at two to three times the frequency of the equivalent FPGA; mass production further lowers costs. This does not qualitatively changes the situation, but it sure gives a boost to the attacker, something like, say, 3 bits or entropy.

Of course, a simple SHA-256 for password hashing is not a good idea; it is way too fast even when the attacker has "only" classic PC; I assume we are talking here about PBKDF2, a construction for slow hashing which relies on an underlying PRF, usually HMAC, which itself is built over a hash function such as SHA-256.

Theory already says that, all other things being equal, password hashing should use the underlying hash function that is most efficient on the hardware which will process it in the "honest system", i.e. a PC. That's the point of hashing functions such as bcrypt or scrypt. If you want to stick to PBKDF2, using SHA-512 would be a good idea, because SHA-512 uses a lot of 64-bit arithmetic operations, something which a modern PC is very good at, but which GPU suck at. ASIC specialized in SHA-256 do not change that recommendation.


packets characteristics (src,dst ports) of a DDos amplification attacks In a DDoS amplification attack, say NTP flooding, an attacker uses a botnet network in order to query multiple NTP servers on port 123, spoofing the source address using the address of the victim/target.

To which port is the reflected traffic from these NTP servers sent? Does the attacker target a specific service on the victim host (chosen after the reconnaissance & scanning phases)? or, is he simply sending UDP traffic to the victim and doesn't care much about the port to which that traffic is being sent?

More generally, what are the ports involved in a DDoS amplification attack?

For an up to date list of protocols used for DDos applification attacks, see UDP-Based Amplification Attacks

Currently the list is

+------------------------+--------------------------------+------------------------------+
|        Protocol        | Bandwidth Amplification Factor |      Vulnerable Command      |
+------------------------+--------------------------------+------------------------------+
| DNS                    | 28 to 54                       | see: TA13-088A               |
| NTP                    | 556.9                          | see: TA14-013A               |
| SNMPv2                 | 6.3                            | GetBulk request              |
| NetBIOS                | 3.8                            | Name resolution              |
| SSDP                   | 30.8                           | SEARCH request               |
| CharGEN                | 358.8                          | Character generation request |
| QOTD                   | 140.3                          | Quote request                |
| BitTorrent             | 3.8                            | File search                  |
| Kad                    | 16.3                           | Peer list exchange           |
| Quake Network Protocol | 63.9                           | Server info exchange         |
| Steam Protocol         | 5.5                            | Server info exchange         |
| Multicast DNS (mDNS)   | 2 to 10                        | Unicast query                |
| RIPv1                  | 131.24                         | Malformed request            |
| Portmap (RPCbind)      | 7 to 28                        | Malformed request            |
| LDAP                   | 46 to 55                       | Malformed request            |
| CLDAP                  | 56 to 70                       | —                            |
| TFTP                   | 60                             | —                            |
| Memcached              | 10,000 to 51,000               | —                            |
+------------------------+--------------------------------+------------------------------+


Firewall topologies (Screened Host vs Screened Subnet vs Dual Homed Host) I'm wondering, if I enable access to an internal web server through my home router / firewall via port forwarding. Which firewall architecture corresponds to this setup?

Screened Host, Screened subnet, or Dual Homest Host?

To me, Screened host makes most sense. But I vaguely remember our teacher saying it was the Screened Subnet architecture. However, I doubt that as the screened subnet architecture uses 2 firewalls. Any thoughts?

Look at this wonderful documentation.

Your scheme is not one of the three you said because I guess between your server and your other internal machines there is no firewall between them. So, your topology is very simple and is Screening router corresponding to this picture:

As they explain there, your topology is the cheapest (and least secure) setup. Anyway is very normal to have this at home.


How to make sure that only files I generated pass? I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are:
-> What is the best way for the server to make sure that only pdf-files and jpg-files arrive?
-> What is the best way for the server to make sure that only files generated from the app arrive, and no user generated files? If the user can generate his own files, he can add malicious content which I don't want to have on my server.
My app is running on a possibly open phone (rooted/jailbreaked), so I don't can be sure that no one has access to the storage folder of the app.
How can I solve this problem?

As a rule, you can't make sure only app-generated files arrive. If the user has access to the app, storage folder access is the least of your concerns -- the attacker can reverse-engineer the code to acquire any cryptographic key and any communications protocol you embed. It is generally impossible to give a person code to do something on a device they control, while preventing them from doing that exact thing themselves. The best you can do is prevent malicious content from being able to do damage; you can never actually just trust data received from a user's device.


How do I deal with a compromised network device? I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?

This answer is based on How do I deal with a compromised server, but adapted for embedded devices and home/SoHo users. I still suggest you read that answer when you have time, but here's the (somewhat) short version.

First steps, to be done as soon as possible

Isolate the device from the network. Disconnect all Ethernet cables, turn off Wi-Fi at the hardware level if possible (note that removing antennas isn't safe as the device may have internal ones as well) or at least make all your devices disconnect from its network. That would at least prevent the malware from doing more damage (such as launching denial of service attacks, being a command and control server, or hosting a questionable site). It will also mean a human operator can no longer see what you're doing in real time and evade your actions, nor laugh at your failed attempts.

Now, you need to consider any computer or data exposed to the device to be potentially compromised. The device may have attempted to exploit other computers on the network, which is very advantageous as the attacker is now inside your network, past any firewalls. Your computers may trust the local network so they are at a higher risk.

Did you browse HTTP sites through a network connection provided by the router? The page may have been tampered with to include evil stuff, the binaries you downloaded may have been replaced with malware, or the router logged the data you submitted on there (passwords, etc) and forwarded it to the attacker.

Does your device include a storage drive? Consider the data on it compromised as well. Your PDFs may include exploits, your binaries may have been replaced by malware, and your nude photos may have been uploaded somewhere. Notify anyone who had their data on there about the issue so they can take proper action.

Does your device do wireless? The encryption key is compromised and should be changed on any other access points that host the same wireless network with that same key.

Finally, the administration password of the device is compromised and should be changed everywhere you reused it. If other devices on the network used the same password they could've been compromised just by logging in as administrator and asking nicely to install this new firmware "update" which is the malicious version.

Examine the issue

Now, the affected device has been taken offline and shouldn't do any more damage. You should now try and understand how the attacker got in to make sure this does not happen in the future.

Take a look to see the attacker got in - was it a vulnerability in the firmware (sadly way too common in such devices) or a default admin password?

On an up to date machine and browser, try to connect to the device and take a look through its web interface for clues. Was the web interface accessible from the outside (often called "remote management") ?

Try to see the extent of the compromise. I'm not saying a web interface that looks normal means everything's fine, but that for example if you see malicious DNS server addresses in the DHCP settings you can be sure that this malicious DNS server was indeed offered in all DHCP replies coming from this device. You can also gather info by looking into port forwarding entries - the attacker may have forwarded some ports to your internal machines to be able to connect to them - in that case those machines are compromised as well.

Take a look at your other devices themselves - is there anything out of the ordinary, like abnormal traffic coming from them (DoS attack), strange tampering with unencrypted data (injection of malware or ads into HTTP pages), etc?

Backup the configuration

If you do not have any documentation on how the device was configured, browse the web interface and copy/paste the important values somewhere, like the PPPoE login, DHCP assignments, and port forwards, if any. Make sure to review the settings so that you're not accidently keeping settings made by the attacker designed to ensure access to your network.

Do not use the built-in configuration backup feature. Most of them export the configuration into an obfuscated/encrypted binary file (human-readable JSON sounds too convenient according to the firmware's developers), and you would have no way of examining it. The code that imports the file may have a vulnerability, and the attacker may have planned for that by making the device return a malicious configuration backup file that would compromise replacement devices where you import this configuration again.

Recovery

You understand how the attack happened and how to prevent it in the future, how do you recover this particular device though?

Network equipment is often quite different from the computers and servers we are used to - their bootloaders do not allow us to easily access a trusted environment before the compromised OS takes control so that we can make them boot onto trusted installation media and overwrite the compromised OS like we can on computers by inserting a disc and making the machine boot from there. As a result the procedure is more complicated and greatly differs between manufacturers.

Why isn't a factory reset sufficient?

A lot of people would recommend just resetting the device, but this approach is flawed.

Resetting is controlled by the OS. If you do the reset from the device's web interface or reset button, nothing guarantees it will actually reset as the entire web interface is now under control of the compromised firmware, so it can very well "fake" a reset by erasing the configuration and rebooting the device, while leaving the malware alone.

Reinstalling the firmware, or the right way to do it

Reinstalling the firmware is the correct solution, but again, where with conventional computers we can just make them start from known good installation media (thus not loading whatever malicious OS may be on the computer), we can't easily do that with embedded devices such as routers.

Reinstalling from the web interface has the same issues as the reset, as malware could either disable the feature, fake it or do it properly and tamper with the new firmware image on the fly to embed itself into it before installing it, so that even though you are indeed running new firmware it'll still have a little present in it.

Reinstalling from the bootloader itself would work assuming you trust the bootloader. It can be tampered as well, but just like with computers the risk is often dismissed due to the complexity of such an attack, as the malicious bootloader would only work on that particular model and revision, making the attack not cost-effective and would require the attackers to invest in buying the same devices for testing (where as a malware binary would merely require a virtual machine for the device's architecture, and would be portable across all devices sharing the same architecture).

There are multiple ways you can access the bootloader and reinstall directly from there, without loading the malicious OS. They vary from manufacturer to manufacturer, and the documentation often doesn't specify it - the manufacturer may have used an off-the-shelf bootloader and didn't even realize it had that recovery feature. I would recommend searching the OpenWRT table of hardware to see if they have an entry for your device. Chances are it describes how to access the bootloader via TFTP or serial and load a firmware image. You can use this procedure to load either the manufacturer's image, or OpenWRT if it supports your device well enough.

Programming the flash chip, but seriously just buy a new device

When everything else fails, and for some reason you can't buy a new device, there is a way to program the flash chip from a trusted machine, completely bypassing the malicious code that could be on there. The correct procedure varies by manufacturer and model, requires special hardware to interface with the chip (often they use an SPI or I2C interface), and you'd have to get the partition layout right as the firmware files provided by the manufacturer often include only a single partition, or are in a custom format that should be decompressed properly before it can be written onto the flash.

Make sure it doesn't happen again

First off, do not put the device online until all other devices on the network have been cleaned, otherwise you risk having your malicious devices compromise the clean device, and the cycle repeats.

Now, understand how you can protect yourself in the future, based on clues gathered before on how the device was compromised in the first place.

If it's human error (bad password, web interface accessible remotely, etc) make sure it doesn't happen again and check your other devices to make sure they don't share the same flaws.

If it's an exploit, check the manufacturer's website for a firmware update. Consider using alternative firmware such as OpenWRT, as it's better maintained compared to the official firmware which is notorious for being awful on most consumer-grade devices.

If there are no updates available, consider switching vendors. Choose one that has a good security track record. If you're a home user consider investing into enterprise devices which often have better firmware. Or invest into a device that is supported by good alternative firmware such as OpenWRT or PFSense. Or build your own. The truth is, for most home and SoHo users, an old desktop computer with a Linux distribution would do wonders as a router and can be maintained and kept up to date just like any other server.

Plan for it to happen again

I would be fairly confident to say that this incident took you by surprise and that you suffered several hours of downtime. The next one shouldn't be this way. Bookmark this page, make sure to document everything, have the configuration settings at hand, so that in case this happens again you can set up a replacement device a lot faster.


Given a hash, salt, charset and password length, how do you get the password without brute-forcing it? I got that question on an exercise and I'm not sure what to answer.

Without conventional brute-forcing and without a rainbow table, how could I find out the password?

An improved brute-force algorithm is acceptable, but how could I improve it?

Assuming a decent hash function, the only way to find the password in this situation is to guess it. This is true for any cryptographic hash function: it's the meaning of the preimage resistance property. This is true for any cryptographic hash; password hash functions have additional properties (salt and slowness) that make it more expensive to verify guesses.

Rainbow tables work by precomputing the hash of many passwords and storing them in a way that allows quickly finding the password from the hash if the password is in the precomputed set. In other words, you make a lot of guesses in advance.

“Conventional brute-forcing” is an ambiguous term. It may refer to trying passwords in a naive order (e.g. by increasing length). But you're free to make guesses in any order. For example, it makes sense to try 123456, password and iloveyou before quszoy and nyoktw. So make sure that you try guesses in an intelligent order.

You cannot find the password in any other way by computational means, but you may be able to find it by external means, such as:

Snooping: wait until the user enters their password and watch over their shoulder, listen to their keystrokes, …
Spyware: plant a keylogger (physical or software) on the user's computer and wait until they enter their password.
Data leak: read the post-it note on their monitor, or crack the bank safe and open the envelope.
Man-in-the-middle: listen to the communication between the user's computer and the password-protected server while they're typing their password.
Phishing: pretend to be the server system administrator or other authority figure and get the user to type their password on your computer instead of the legitimate one.
Social engineering: offer the user a lot of money or a bar of chocolate. If it fails, apply wrench cryptanalysis (or a rubber hose if you're a stickler for tradition).


Are there any severe concerns of sending the user's login and password with each HTTPS request? Due to certain requirements/constraints, I'm wondering about sending user login and password with each request.

This somehow doesn't feel very good to me, though I think for my particular case, it could make sense: it would reduce the number of HTTP requests , reduce the latency and simplify frontend code.

Here is the situation:

Traffic to server comes from a mobile app
All the traffic goes through HTTPS
We keep user credentials encrypted in the device storage to log users in automatically on each app boot
Server side session timeout is very low (few minutes) and is beyond my control
The DB is beyond my control; I can not add anything to the DB easily and quickly (it would be quite a challenge to get a DB field if e.g. I wanted a long-lived session token)
The traffic in the app usually happens in batches
The typical traffic batch within the session timeout is just a few HTTPS requests
Since the traffic comes from mobile app, sending "keep session alive" requests is not always possible; if the user kills an app and relaunches a few minutes later (or minimizes for a few minutes), there's no possibility to keep the session, and I need to relogin the user.

So, the typical traffic pattern currently is:

#USER OPENS THE APP
POST /autologin    -> response: [ok, here's the new sessionid]|[auth failure, maybe the password changed since]
#SUPPOSING AUTH WAS OK; USER BROWSES AROUND THE APP
POST /someAction1
POST /someAction2
POST /someAction3
#USER IDLE FOR A FEW MINUTES
POST /keepSession
...
#USER MINIMIZES THE APP
#USER RELAUNCHES THE APP, MAYBE SEVERAL MINUTES LATER, MAYBE NEXT DAY
POST /someAction4  -> response: sessionTimeout
POST /autologin    -> response: [ok, here's the new sessionid]|[auth failure, maybe the password changed since]
#SUPPOSING AUTH WAS OK; USER BROWSES AROUND THE APP
POST /someAction4
...

So anyway, on average, I have to send the login request quite often once the session expires; significant percentage of requests are login requests.

If I send login and password in each request, I can

get rid of /autologin requests at the boot
get rid of /keepSession requests every few minutes while user is active
get rid of /action -> /autologin -> /action combo in case of session expired; down from 3 request to just 1

I could just always send both the sessionid and login+password, then on backend reuse sessionid if still valid, otherwise create a new session using the login and password, and do whatever I wanted within the same HTTP call, without the need to play ping-pong between frontend and backend.

To sum up, from my perspective:

Cons:

I'd have to take care on backend to not accidentally log user credentials in multiple request handlers, not just a one (login handler)
it could increase the number of requests with login and pass in payload maybe by a factor of N =~ 4,

Pros:

overall number of HTTP requests done by server decreased by some 20%+
no need for frontend logic to maintain the user session; just shoot every request with credentials. If it fails due to auth issue, log out the user.

Knowing that the traffic is HTTPS encrypted, are there any severe downsides to my always-send-login-and-pass aproach?

Unless you build in your own security mechanism (which is generally ill-advised) you'll be relying on the security of SSL to protect the authentication.  Generally this is done with some form of token that if captured can be used to replicate the login.  So an attacker that can break SSL can also capture your session key, and take over your existing session.

There's a couple differences between a session key, and a username/password. The first is that the session key will eventually time out, while a username/password lives for a much longer time.  Generally this is considered a minor security advantage because an attacker merely has to be timely in using the captured session key.  A larger difference is that the password can be used to authenticate again when a critical action is taken, such as transferring money in the account, or changing the password.  In this case capturing just the session isn't useful, since the attacker would need to capture the password as well.

Even in a session key secured scenario, the username/password is still sent once per session.  If the attacker can completely break the SSL session, then he can capture the initial username/password exchange.

Now, breaking SSL doesn't have to mean a complete break.  There are potential partial break scenarios where a break of SSL might be more vulnerable to sending the username/password many times vs just once per session.

The bottom line is that using a session key is a bit more secure (if done correctly) than sending username/password every time.  You need to balance this security with the rest of your backend needs.  But understand that no matter what you're doing, you're still relying on the security of SSL.


Are bookmarklets safe with facebook data? I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page?

I was just wondering if it was possible that they're stealing my friends' info from Facebook and selling it on to advertisers?

A bookmarklet is basically a snippet of Javascript that runs on the website. As such, it has access to all your data on the site. Most bookmarklets don't do anything with your data, but it is certainly possible and you should always be careful.


Do I need a bachelor's degree to break in information security? First of all,
I have a college diploma in computer networking. I tried to get a job as network admin, but because of my lack of experience in that field I did not succeed. So I returned as a help desk technician (I already had 2 years of experience in this).

So here I am, 4 years of tech support and I do not like it anymore. I know I can do something more interesting to me.

I'm really interested in malware reversing and vulnerability research. I have some books that I read, and I would really like to work in that field.

My question is, do I really need a Bachelor's degree in computer science to perform those jobs ?

Because getting this degree won't teach me how to perform malware reversing and vulnerability research. Certifications like GIAC GREM or Offensive Security Exploitation expert is more likely to help me.

There again, 0 experience in the field of information security, so how would I get a job ?

The Bachelor's degree will make me a good analyst and programmer, but is that necessary ? Is someone with a degree is more likely to be hired ? I have tons of questions.

Thanks

No degree guarantees a job, and almost ALL employers will look for experience in the field.  @Andre Daniel mentioned free-lancing and participating in open source projects.  This is probably the best way to gain experience in the field you're looking towards, and they look great on resumes.  They are experiences that you can point to and say "I contributed to this".

While it's great that you can learn things on your own, there is still value to having a degree.  But I would not recommend getting a bachelors degree.  If you already have a degree in Computer Networking I would suggest going for a graduate degree in Computer Security.  Graduate degrees still hold some weight, and can put you above other applicants.  However, you only get what you put into it as far as degrees go.  You can learn a lot or a little, it depends on the amount of effort you put in.  Sadly some things on paper still look better, and this will help set you apart from others.

I've known people without any degrees who were passed up for jobs because they didn't have a degree.  I've known people who have degrees and no experience who were also passed up on jobs.  You should have have some blend of both.  Like Schroeder said, if you want to do malware analysis then just do it.  Put on your resume that you do freelance work.  They'll ask you in-depth questions to get a better feel for how much you know, and that's where you can impress them.  But getting through the initial resume scan I think you need a blend of both education and experience.


Stateless secure token that can expire? I want to generate a link that will be given to a user. On this link, as a parameter, I will add a token that will be valid only for a few days. So after that time, the server will check the token, see that it's not valid anymore, and disallow the download.

What I would like to do is create a token that doesn't require any server side state, i.e. that doesn't require me to create a table with the token/expiration date association.

I'm wondering is there any clever algorithm that would allow me to do that? Basically a token that cannot be decrypted after a given time (assuming that the decryption algorithm on the server is using the real, current, time).

You could use an encrypted token consisting on a prime number and an expiration date. For encrypting the token just use a symmetric algorithm such as AES.
You would need to keep track of

The difference between the number of tokens generated and the number of tokens validated, d
The last prime number generated, p
The product of all primes generated, t

To generate a token

Increase d
Calculate the next prime p and return that (this can be done efficiently).

To validate a token

Check that the token has not expired
Check that t is not divisible by the prime number

If the token validates

Multiply t by that prime number
Decrease d

This way, you automatically invalidate the token so it cannot be used anymore (next time you try to validate that prime, t will be divisible by it so it will return false).
Every time the number of tokens validated equals the number of tokens generated (d=0), you can also reinitialize all the variables (p=1,t=1) so that the size of t does not grow indefinitely.


Could the unused Mali GPU in the Libre Tea Computer Card be a security risk? The Libre Tea Computer Card is a single-board computer that comes without any proprietary software (at least that’s the goal, it’s currently in crowdfunding):

  […] all firmware and kernel sources are GPL-licensed and will always remain so, and have been vetted in advance and do not contain any copyright violations or proprietary license-violating blobs (an extremely common practice nowadays).

It uses the Allwinner A20 as SoC, which uses Mali400 as GPU. There doesn’t seem to exist a working free/libre driver for Mali400, so this GPU will (by default) not be used in the Libre Tea Computer Card:

  […] it turns out that the MALI GPU is entirely memory-mapped.
  if you try to do "lsusb" or "cat /proc/cpuinfo" or any other kind of
  exploration from userspace, if you haven't compiled up mali.ko you
  LITERALLY cannot even SEE the MALI GPU from userspace. guess what we
  will not be doing? :) we will not be adding CONFIG_MALI=y to the
  linux kernel build process. thus, it becomes literally impossible for
  the average end-user to accidentally end up installing the proprietary
  non-free MALI 3D GPU code.

(This is probably enough to get the FSF "Respects Your Freedom" certification.)

Let’s assume the user does not intend to use the Mali GPU, so the user does not add support for it when compiling the kernel.

Is there any security risk in having this "dead" GPU?

Could it contain and run code that does something on its own (e.g., reading/manipulating/sending the user’s data), or has the OS full control over it?

A GPU is a secondary processor which accepts compute kernels, small bits of executable code that it runs many times in parallel on graphics data. The GPU is controlled by the operating system and by the firmware. Many GPUs do have the ability to perform direct memory accesses (DMA), which can be a security issue if it has been compromised. There are PoCs available which can do this, however to insert the malware and compromise the GPU, the operating system must be compromised in the first place. As a result, there are only two circumstances where one can be risky:

The GPU ships with compromised firmware, being "backdoored" from the get-go.
The operating system is compromised, which offloads malware to the GPU for stealth.

This means it is not likely for an unused GPU to be a security issue. If it is still a risk within your threat model, some systems have an I/OMMU, which can be used to isolate the memory regions a device can access. This can prevent a compromised or malicious GPU from performing DMA attacks.


Wildcard SSL Cert and Client Authentication I have a wildcard SSL certificate (from GoDaddy.com) deployed to several Windows 2003 servers. I used IIS management console to import the certificate. The problem is that only one of these servers enables the certificate for client authentication. As a result, our custom application can access SOAP service only on a single server.

Question: what can I do to enable client authentication on other servers?

Client authentication in SSL is not correlated with whatever is in the server's certificate. That the server certificate is wildcard or not has no bearing on whether client authentication will be used or not.

Client certificates will be used only if the server asks for them. Then, the server must be able to validate the certificate (make sure that the certificate is genuine, and comes more or less directly from a trusted root), and then to extract a notion of identity from what is in the certificate. In the IIS / Active Directory world, this is called mapping. See this page for some details.


Bypassing Trustwave NAC I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network.

I would like to know if there are any possible ways to bypass this. Client is putting a lot of faith in their implementation (with good cause so far), but I would like to be able to bypass it if possible to demonstrate, if nothing else that reliance on a single security technology is not a good solution.

Short of trying to DOS the device (I have permission to try this), I'm not sure what could be attempted.

This device does is not simple port security. It uses ARP poisoning to hide the actual gateway, and puts all devices in a quarantine LAN until they are authenticated against an Active Directory server. Spoofing a MAC of someone else in the quarantine LAN will not help, unless I can also trick the NAC device into think I was a device that had previously authenticated against AD.

Looking for known techniques, academic papers, conference presentations etc.

Based on what you are asking (testing physical access with NAC), I would suggest pwnie express' pwnplug (if you can afford it, I think the powerpwn is even better https://www.pwnieexpress.com/penetration-testing-vulnerability-assessment-products/sensors/pwn-power/).

As to how they are bypassing NAC, here is their explanation:

First, the Pwn Plug is placed in-line between an 802.1x-enabled
client PC and a wall jack or switch.
Using a modified layer 2 bridging module, the Pwn Plug transparently passes the 802.1x EAPOL
authentication packets between the client PC and the switch.
Once the 802.1x authentication completes, the switch grants connectivity to the network.
The first outbound port 80 packet to leave the client PC
provides the Pwn Plug with the PC’s MAC/IP address and default
gateway.
To avoid tripping the switch’s port security, the Pwn Plug
then establishes a reverse SSH connection using the MAC and IP
address of the already authenticated client PC.
Once connected to the
plug’s SSH console, you will have access to any internal subnets
accessible by the client PC. As an added bonus, connections to other
systems within the client PC’s local subnet will actually appear to
source from the subnet’s local gateway!

Source: https://www.pwnieexpress.com/support/product-documentation/

Disclaimer: I have never used the NAC bypass functionality of the pwnplug.

Hope that helps!


Real-world use of restricted shells I've been reading various articles about escaping restricted shells, e.g. rbash. I’ve been speaking with friends working in different Linux environments (small, mid-size and huge) and none of them is using restricted shells.

Are restricted shells really used that often or is it more for demonstrative purposes described in various writings?

No. In my experience, they are (almost) never used.

There used to be an idea that, if you could restrict the shell, you could limit the user's access to the system. However, for a determined user, the restricted shell does not pose a real hindrance.

It could be (and was in the past) used to limit users that have little computer knowledge, to prevent them from doing inadvertently something horribly wrong. However, nowadays, these kind of people do not log in to a shell, but most of the time, they will use a web interface.


What elliptic curves are supported by browsers? I Wireshark'ed a Firefox 3 request, because I couldn't find the curve names documented:

Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)

What are the supported curves for other browsers? Does someone want to extend this list?

You can view your supported curves here (search for "Elliptic curves" "Named Groups").

When software (browsers, Web servers...) supports elliptic curves at all, you can more or less expect support for the two curves given in NSA suite B, i.e. the P-256 and P-384 curves which are specified in FIPS 186-3. These are the same curves as the "secp256r1" and "secp384r1" which you list. The 15 standard NIST curves (from FIPS 186-3) are actually a subset of the curves specified by Certicom in SEC 2.

Some software implementations go further and support other curves. For instance, OpenSSL supports all 15 NIST curves (code was contributed by Sun and is believed not to infringe on any patent -- which explains why OpenSSL does not implement acceleration of Koblitz curves through the Frobenius endomorphism). But if you want to maximize interoperability with existing browsers and servers, stick to P-256 and P-384 (I think these are the only two which will work with Internet Explorer, for instance).


What is the meaning of 'adaptative' and 'over time it can be made slower' in the context of the bcrypt algorithm? I'm reading the wikipedia definition about bcrypt but I don't understand the meaning of 'adaptative' and 'over time it can be made slower'. Can someone explain what they mean in this situation?

One of the inputs to the bcrypt algorithm is the number of rekeying rounds that will be used when calculating the hash. As time passes, and the CPU power available to potential attackers increases, you can simply increase this parameter to keep up -- you'll have to find some way to re-hash all of your old stored passwords, of course.


Are common passwords at particular risk? The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are weak but because they are common.

Rather to my dismay the security side of the argument seems focused on but if you ban them, users will use other weak passwords which is a partially valid argument, but surely actually using one of the most common passwords on lists like 25 Worst Passwords are significantly more at risk simply because they are common rather than the actual time it would take a brute force hack to guess them, right?

Is it realistic to assume attacks will focus on common passwords before brute force? In a world of rate-limited password entries and captchas, it seems likely that you'll only get 1-3 guesses at a password; guessing all 5 letter combinations isn't feasible, but guessing "password", "123456" and "qwerty" seems like a valid possiblity.

Some UX specialists says that it's not a good idea to refuse a password. One of the arguments is the one you provide : "but if you ban them, users will use other weak passwords", or they will add random chars like 1234 -> 12340, which is stupid, nonsensical and will then force the user to go through the "lost my password" process because he can't remember which chars he added.

You have two options. I like them both (I explain why in each) :

Let the user enter the password he wants. This goes against your question, but as I said, if you force your user to enter another password than one of the 25 known worst passwords, this will result in 1: A bad User Experience, 2: A probably lost password and the whole "lost my password" workflow. Now, what you can do, is indicate to your user that this password is weak, or even add more details by saying it is one of the worst known passwords (with a link to them), that they shouldn't use it, etc etc. If you detail this, you'll incline your users to modify their password to a more complex one because now, they know the risk. For the one that will use 1234, let them do this because there is maybe a simple reason : I often put a dumb password in some site that requests my login/pass just to see what this site provides me.
Add some rules, like "At least one number and one special char, must be a minimum of 8 long", etc. This will go against the worst password. On the other hand, if the user has a quite complex password that doesn't match one of your rules, it will result in a bad UX.

Finally, you have to choose between a good User eXperience or an improved security. Now it really depends on which kind of project you're building : if it's a basic website to upload pics of puppys, maybe you don't have to set up a complex security system. But if you're the next paypal, you should.

Regarding your question about brute force, it depends on how you set up the password storage. If you add a salt and pepper, brute force can be made against the database. If you add a captcha in the login page, or increase the time between tries and errors, brute force won't be possible.

It's possible that the attacker use the worst password first, but I'm not sure it would be quite efficient. Even if he choose the first 3 (regarding your rules about captcha and 1-3 guesses), this will greatly reduce the probability of hacking into an account.


Is my network configuration is efficient for security? I enabled the "Guest Wifi Network" from the router configuration menu.
Now I have two different wifi networks on my router (with different IP address).

The first one is for "trusted" devices - my professional computer and my smartphone. Only thoses devices are allowed (MAC address filter).

The other one is for "untrusted" devices - all other devices where I can't be sure that they are not infected.

Is this level of security efficient to protect my devices from the first network? For exemple, to prevent a virus to spread over the network.

sounds pretty solid, a MAC address filter does not add security though and you might want to disable it, as it can be quite inconvenient for home usage.

So far, this sounds pretty good. But MAC addresses can be easily spoofed in many operating systems, so any device could pretend to have one of those allowed, unique MAC addresses.
MAC addresses are easy to get, too. They’re sent over the air with each packet going to and from the device, as the MAC address is used to ensure each packet gets to the right device.

Which pretty much would defeat it as a safety mechanism.

Guest network
Use for Internet-only devices that don't need local LAN access to other electronics, enable guest isolation.

Another useful thing to do would be to add Google  DNS ( 8.8.8.8 ) and/or OpenDNS ( 208.67.222.222 )
As your ISP's DNS might go down every now and then. In terms of stopping ISP tracking it does little, as they can reverse the IP you're sending requests to.
Sources:
Why you shouldn't use mac address filtering
decentsecurity.com


sniffing with wireshark on wireless network In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ?

If it sniffs all the packets in the air, can someone explain or give me a book or a tutorial that explains how wireshark can do this ?

Wireshark attaches to an interface, it may be your wireless interface or even loopback. Then it intercepts every packet in that network.

If your interface is in promiscuous mode then it will capture everything in the network that this interface is connected to, but not everything in the air, just what goes on in that network and in that interface.

Edit suggested by AstroDan:
The official WireShark documentation includes a section about Promiscuous mode that is worth reading


Key distribution advice I have been thinking for days about that problem! The application is based on a student system management. I am implementing database encryption on a column level and The encryption occurs at the application level.

The administrator sets the columns that are to be encrypted in a win app I will make. Aes encryption is used to encrypt the columns. In the win app, I use RSA public key to encrypt the aes key, and store the encrypted key in the database. I then store the private key in a flash drive. The authorized user will use the private key file to decrypt the aes key and hence decrypt the columns.

My problem is this:

Suppose I have more than one user who needs access to these sensitive columns, then my plan does not seem very productive because how can I store the private key to many flash drives at the same time, say 10 flash drives??
Also, if i decide to add a user to access the columns, how to give him the private key? Or if I remove one user, thrn I should change the private key of all the rest of users.....

Please help! I have been thinking about that for days!

For the specific situation you are alluding to, using a symmetric key and RSA keys is the right path. Namely:

Data is encrypted with symmetric key K (with AES or some other algorithm which does the job).
Every user who should have access to the data has a RSA key pair. Each user has his own key pair, distinct from that of any other user. Let's call Pu the public key of user u (and Su the corresponding private key).
K is asymmetrically encrypted (RSA) with the public key of each user. This means that the database contains several values EPu(K) (encryption of K with the public key of user u).
When a user wants to access the data, he uses his own private key Su (from his flash drive) to decrypt his value: DSu(EPu(K)) = K. With K, the user can access the encrypted data.
When you want to add a new user v, you generate the new key pair for that user (Pv, Sv) with the private key stored on a new flash drive which you give to the user. You also encrypt K with Pv and add the new EPv(K) to the list of such values in the database.

Removing a user is tricky, because of a general fact: you cannot enforce forgetfulness. Any user who had access to the data at some point could have grabbed a copy of the whole (decrypted) data and still remember it. The best you can do is to make sure that the removed user will not have access to the new data added after the eviction of that user. There are thus two methods to revoke user u data access:

The fast but incomplete method is to simply remove EPu(K) from the list of stored values. This will be sufficient to deny subsequent access from user u if that user is honest and did not keep a backup of EPu(K) (or, simply, a backup of K).
The thorough method is to generate a new master key K', decrypt all the data, reencrypt it with K', and encrypt K' with the public keys of all users except u. The database will then contain EPv(K') for all users v except u. This effectively locks out user u from any new data element.

The system described above can accommodate smart cards in lieu of "flash drives". There is not need for any entity other than user u to actually access the private key of user u.

Note: all of the above is about controlling read access to the data. Controlling write access, detecting alterations, duplications or suppressions is another matter.


Proxy over pptp VPN in a TMG server Our Company is using a TMG (Threat Management Gateway) server to grant the employees access to the internet. It's not strict and users can make VPN connections and use the proxy extension of Chrome as well.

If a user uses a VPN connection to access another server outside through this TMG server and uses the Chrome proxy extension would it be possible for a server admin to log the visited URLs of the user?

A HTTP proxy server doesn't hide the content of the connection, it simply makes the request on behalf of the requester.  Now, if you're tunneling that through a VPN before it reaches the TMG server then your traffic should not be readable by the TMG (assuming the VPN is configured correctly e.g. DNS leaks, WebRTC, etc.).

With that in mind, it's usually pretty easy to tell that a VPN connection is being used on the network, and if that's against policy you could get in trouble for that.

There could also be additional software that was installed on your devices (assuming these are company devices) which are logging your browsing.


CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible? Sorry if this is a very amateur question.

I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting http://blog.opensecurityresearch.com/2012/08/bypassing-captchas-by-impersonating.html

Now,

this attack redirects the request from the Server(which is the client for the CAPTCHA provider) to an attacker controlled server.

If I'm using a cURL(or something) to post my request internally this cannot be detected by my Client PC right? So, is it even possible?

This can only be done if somehow you intercept the server traffic to the CAPTCHA provider. It can be done by compromising the server itself, its network, or the DNS server it is using. Every method requires the invasion of the server or one of the systems it rely on, you cannot simply detour a server's traffic from your PC home without achieving something like that first.


Can I trust public socks4 proxy when using only HTTPS? I am using a socks4 public proxy for more speed/bandwidth. I am currently using it for downloading file. Now I want to use it for social media or daily day usage. I know that they will get my all traffic. I use DNS over HTTPS in firefox. So, I think that they won't be able to redirect a phishing site or something like that. But, what about other things like, my password? And I also enabled HTTPS mode in firefox. So, my question is can I use it for daily usage?
[Extremely sorry for my broken English]

As long as you are using TLS (HTTPS), you will be safe from tampering and sniffing. But beware that it could read and tamper with data from any site that does not use properly-configured TLS. The proxy will also be able to see what sites you visit and for how long, but won't be able to view what you send.
For the purpose of evading censorship and simple throttling, you could also use an encrypted VPN.


Buffer overflow - Print "hello world" I'm wondering what the shellcode would be to simply print "hello world" to the console. When testing for vulnerabilities, I think it would be very useful to have shellcode to test if the exploit works.

In addition, a simple explanation in how to compile shellcode from C in a usable format (ex. backslash + hex characters) would be fantastic so that I can easily generate the shellcode to execute for the payload.

Any helpful information, relating to the main question or not, is greatly appreciated!

If you want to get shellcode quick and dirty, use msfvenom. If you want to learn something and become a wizard, I suggest the following:

1. Write a small assembler program for your platform.

You will realize that you need to code in such way that no NULL bytes will be produced. This can be done by creative use of XOR and other tricks.

;hello.asm
[SECTION .text]

global _start

_start:

    jmp short ender

    starter:

    xor eax, eax    ;clean up the registers
    xor ebx, ebx
    xor edx, edx
    xor ecx, ecx

    mov al, 4       ;syscall write
    mov bl, 1       ;stdout is 1
    pop ecx         ;get the address of the string from the stack
    mov dl, 5       ;length of the string
    int 0x80

    xor eax, eax
    mov al, 1       ;exit the shellcode
    xor ebx,ebx
    int 0x80

    ender:
    call starter    ;put the address of the string on the stack
    db 'hello'

2. Use objdump to get the opcodes for the instructions:

hello:     file format elf32-i386

Disassembly of section .text:

08048080 <_start>:
 8048080:       eb 19                   jmp    804809b

08048082 <starter>:
 8048082:       31 c0                   xor    %eax,%eax
 8048084:       31 db                   xor    %ebx,%ebx
 8048086:       31 d2                   xor    %edx,%edx
 8048088:       31 c9                   xor    %ecx,%ecx
 804808a:       b0 04                   mov    $0x4,%al
 804808c:       b3 01                   mov    $0x1,%bl
 804808e:       59                      pop    %ecx
 804808f:       b2 05                   mov    $0x5,%dl
 8048091:       cd 80                   int    $0x80
 8048093:       31 c0                   xor    %eax,%eax
 8048095:       b0 01                   mov    $0x1,%al
 8048097:       31 db                   xor    %ebx,%ebx
 8048099:       cd 80                   int    $0x80

0804809b <ender>:
 804809b:       e8 e2 ff ff ff          call   8048082
 80480a0:       68 65 6c 6c 6f          push   $0x6f6c6c65

3. Then your shellcode will be:

char code[] = "\xeb\x19\x31\xc0\x31\xdb\x31\xd2\x31\xc9\xb0\x04\xb3\x01\x59\xb2\x05\xcd"\
              "\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\xe2\xff\xff\xff\x68\x65\x6c\x6c\x6f";

4. Profit


How is password information stored and used on Android accounts? How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device?

On Linux shadow passwords are stored as hashes but these are only used to check inputs (they are never transmitted over the network). I wonder how Android implements account security here (perhaps special hardware supporting accounts and passwords)?

Android uses AccountManager to store the passwords. By rooting a phone you can access the encrypted store. What happends now depends on the password you use to lock your phone (from which is derived the encryption key for the store).

As you can imagine, a 4 digits PIN is not going to resist long. A fingerprint (or other mechanism with large entropy) will not be cracked.


How secure is it to use port forwarding for VNC? I am following this tutorial that explains how to use a VNC client to logon to an Amazon EC2 instance. After a few steps, it asks me to login to the instance using port forwarding using this command:

 ssh -L 5902:localhost:5902 -i amazon.pem ubuntu@ec2–52–90–172–228.compute-
 1.amazonaws.com

Afterwards I need to use a VNC client to connect to localhost:5902 (I have to use a password that I defined when setting up the VNC server on EC2). Now, I know nothing about security, but how safe is it to use port forwarding like this? What is the possible risk, if any?

The port forwarding is done over the encrypted connection of SSH. So any data that you sent over this connection will be encrypted.

SSH will accept connections on localhost port 5902 and forward those connections to the other host through the SSL tunnel. The security risk of this is particularly that other users or processes on your computer can also connect to localhost port 5902 to make use of this forwarding. If you are on a multi-user system or have a compromised system this can be a problem.

SSH only listens on localhost by default, so other people on the network cannot piggy-back on the port forwarding.


Is using an old Android phone for 2-factor authentication safe? I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start.

I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting there. Would it be safe to use it as just a device for accessing Google Authenticator? If not, please explain why not. I understand the risks of potentially losing it/not having it with me.

It's perfectly safe if it's off the network. Something like that is an excellent use for an old device that's completely off the network -- as long as it stays in time sync.


Can malware attach itself to user files? Recently my AV has been detecting Trojan backdoors, Rootkits and Worms quite often. Some go unnoticed (I've checked suspicious files in VirusTotal a few times and they indeed turned out to be malware without the AV detecting them).

I've tried cleaning up, but in the end I decided to do a clean Windows reinstall.
Since I have no other way to back up my files, I'm uploading them to cloud storage. My question is, is there a chance of the malware attaching itself to these personal files (pictures, videos, notes, etc) and once I download them to the new system to end up infected again?

Usually a non-executable file can not contain a virus. Only executables can cause damage. But there are two cases where a non-executable document can cause the application which opens it to act as malware:

The program you open the file with has an unpatched security vulnerability which can be exploited by a specifically manipulated file to cause the program to do things it is not supposed to be doing. When a  good(!) software company gets notified that their software contains such a vulnerability, they will usually update their software to fix the problem ASAP. So this problem can usually be mitigated by making sure that all software you are using is always updated to the latest version.
The program you open the file with allows documents to include script-code which allows implementation of virus-like behavior ("macro viruses"). The Visual Basic Scripting in MS Office documents is a prime offender for this. Later versions of MS Office now ask you before executing macros. Do not allow this in files which you got from a suspicious source or from a compromised system.

Also keep in mind that executables on Windows can come with many more file extensions than just .exe. So when you aren't sure what a file extension means, do not double-click the file.


Is it possible to stack encryption algorithms with SSL? SSL supports a number of ciphers, but is it possible to stack/nest the ciphers, and process the plaintext in stages?  My adversary may be able to easily crack one or more of the stages, but to decode my message, they need to crack them all if I can use multiple ciphers.

For example:

ciphertext = Encrypt(plaintext, key, alg=[1,2] )
           = Encrypt1(Encrypt2(plaintext,key2),key1)

If I want to establish a connection protected by Blowfish, elliptic curve, a weak substitution cipher of my own making, and 3 rounds of 3DES with different keys, can SSL do this?

Since all of the ciphers may have unknown weaknesses, using all of a wide selection of possibly secure ciphers will require my advanced persistent threat to be proficient in all of them.  If just one of the ciphers holds up, my message remains secure (provided the ciphers do not share key information).  I wish to transmit an enigma, wrapped up in a mystery, etc.

SSL/TLS is a protocol for sending "application data" as a bidirectional stream of bytes, so you can send through it anything that can be encoded as bytes, i.e. anything that fits at all in the memory of a computer. If you want to apply extra encryption layers of your own, nothing will prevent you.

Now believing that such cascading of encryption algorithms will do any good to your security is a known delusion, unfortunately quite common. Encryption algorithms, when used properly (e.g. as they are used in TLS), are not the weakest part of the system; they are the strongest part. When you are attacked, it won't be through breaking the algorithms. Adding extra algorithms won't help. Actually it will probably hurt, if only because the extra complexity will kill your performance and induce you not to use TLS at all in some cases, because of that gratuitous overhead. See this answer for more discussion on the subject.

Believing that your homemade algorithm will also help is also a common delusion. The main part of training as a cryptographer is to learn that nobody can build by himself an algorithm which will be reliably secure. Thus, professional cryptographers don't create algorithms that way; instead, they publish candidates, to be inspected by their colleagues. If none of these well-meaning other cryptographers found anything bad to say about the new algorithm after a few years, then we may begin to imagine that the algorithm might be quite robust after all. This is the only known method for designing secure algorithms. You cannot do it by yourself, all alone, by definition. I cannot either. Nobody can.


exploiting Open redirection vulnerability in java Open redirection how to exploit?

document.location.pathname and passed to the 'open()' function of an XMLHttpRequest object via the following statements:

url=document.location.pathname;
url=url.substr(0,trimPosition);
xhr.open(method.toUpperCase(),url,this.options.async,this.options.user,this.options.password);

GET /cdsfsd/foo.js HTTP/1.1
Host: fo.exemple.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

Maybe it is a false vulnerability?

Open Redirect happens when the application takes user supplied URLs or paths as parameter value and redirect to them without warning the user.

Scenario:

Step 1: The following get request takes a URL as a parameter value.

GET /thengakola.asp?&returl=http://pappadam.com
Host: mangatholi.com

Step 2: So by sending the following link to anyone, I can fool a user who trust mangatholi.com to land on malicious website pappadam.com

http://mangatholi.com/thengakola.asp?&return=http://pappadam.com

Find out if you can device a scenario to redirect an unsuspecting user to land on another website from the link. The application is vulnerable to open redirect then.


Could an attacker spoof a whitelisted IP to access the network? There is a network that is protected with a firewall and only one IP is whitelisted.

Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed IP to access the network?

Nothing prevents an attacker from getting at least one IP packet through to a destination IP address behind a firewall if the hacker spoof's a whitelisted IP address for the packet's source IP address.
SO

The attacker won't get any packets back, because any response IP packets will be routed to the spoofed IP address (where they might flood the network connection for the host with the spoofed IP address); and

Depending upon what kind of packets the attacker is sending using the spoofed IP address and the frequency of these spoofed packets, the firewall might apply security policies that either block or throttle this spoofed packet stream.

e.g. A SYN Flood is a situation where DDoS protection would throttle IP traffic from the spoofed IP address. see Cloudflare SYN Flood
Regardless of what the firewall's security policies are, at least one UDP/IP packet or at least one TCP/IP SYN packet would get through using the spoofed whitelisted IP address.


Incremental charset with no duplicate adjacent letter I'm using John the Ripper and the following charset in the creation of a word list:

[Incremental:Upper8]
File = $JOHN/upper.chr
MinLen = 8
MaxLen = 8
CharCount = 36

The command:

john –stdout –incremental=Upper8  > wordlist.txt

I want to create a wordlist using uppercase letters only, of strings only 8 characters long, but never should any adjacent letter be duplicated.

Example:

ABCBBAAA - this should not happen as there are 3 adjacent A's and 2 adjacent B's
ABCBABAB - this is fine as there are no duplicate adjacent letters

Any ideas on how I might accomplish this?

Managed to get it working with crunch. This will be over 1 TB....

./crunch 8 8 -f charset.ls ualpha -d 1@ -o wordlist.txt

8 8 = Set the minimum and maximum length both to 8
-f charset.ls ualpha = Set a character set of uppercase alphabet
-d 1@ -  Will print all combinations with 1 or less adjacent uppercase duplicate.
-o = the output of the file.


Someone updated my friend's twitter profile after an internet forum abuse I'm doing a security investigation for a friend of mine, working a bit of a Sherlock Holmes here... Trying to figure out a possible hack scenario for the following:

My friend receives a "screw you and your Twitter profile" message on a vBulletin-powered message board, where no one know who she is.
After a while she notices someone changed her profile picture on Twitter.

The message board does not use any Twitter oAuth connected accounts or anything similar, her forum username was some unreal "abracadabra" nonsense name, which is not "personally identifiable". Her forum profile is empty. The only real thing in the profile was - her email.

The only possible scenario that comes to my mind is:

Someone used an exploit on vBulletin to get her real email
address or otherwise accessed her account (via Brute force etc)
Figured her Twitter account by email address (for instance, by
generating a Gravatar picture out of email and then performing a
Google search "by image")
Used some well-known (in the underground circles) exploit for some Twitter "app" she had connected in her account.

Do you see any other possibilities?

PS. Too bad Twitter has no login audit...

PPS. I'm not searching for instructions "how can you hack someones' Twitter", I'm trying to find (based on the scenario), how can we secure her other data (if he hacked Twitter - who knows what else can be compromised).

PPPS. Some background info about the person to rule out the obvious: she' a software engineer and CEO of a small software shop, not your average "Nancy homemaker", she's on a mac (not windows), uses 2-factor on most account (gmail, amazon-aws etc, but not twitter), uses a pwd manager with 2-factor. Her forum pwd was really weak (6 letters), her Twitter pwd was kinda strong.

I do not know of a way to retrieve who did this short of asking Twitter. As to prevention, demanding on availability you could tell your friend to enable 2 factor authentication
This will make any login attempt more noticeable due to getting a sms.

More about security on Twitter you can find on
Twitter Security Center

We can only guess what happened without twitters assistance. But a short list of possible attack vectors are

session hijacking / stealing
password / account guessing
xss attack

Most likely if she used a link on the forum it was a xss injection through a remote script.

Session hijack or stealing is likely if the forum itself was compromised (and added malicious scripts to the pages to enable this)

Password / Acount guessing is most likely in the other cases. (This includes brute force)


Wifi Educational Hacking - Aircrack-ng wpa vs wpa-psk I have a question about the max amount of dictionaries need to crack a wpa2 or wpa2-psk password

I am using aircrack-ng on ubuntu

Is there any possible way to calculate the maximum amount of dictionary files need to crack the wpa or wpa-psk password solely based on the information from the encryption?

I recently learned about hash collisions and they can guess the amount of hash collisions that will occur with a hybrid of the birthday algorithm.


Exposure risk of knowing only social security number? Up until recently I was under the impression that the social security number was insufficient information to perform identity theft, and that in practice you will at least need the victim's SSN and name.

However, recent events and stories have made me start questioning this assumption. Is knowing only the social security number sufficient enough for someone to steal an identity? Would it be possible (or realistic) if you also took into account potential social engineering attacks, presumably against state agencies, which could reveal additional private information through leveraging the known SSN?

Absolutely!

The thing to remember is that a social engineering attack, when played out well, can be successful given no personal information other than a name or a role or a position.

The more information an attacker knows about a target, the easier it is for them to build a convincing scenario, but SSN's are trusted as a key piece of your identity in the US, so they are very vulnerable.


Microsoft PKI CRL expired In a 2 tier environment, if the Offline Root CA's crl is expired, What is the impact on the intermediate CA and users ? What can i do to minimize the impact ? And if the intermediate CA is now offline, how can i make it online (without making the CA online)?

The impact is negative. Any certificate in the PKI tree will fail revocation checking and most applications will reject your certificates.

What you have to do is to turn on your offline root CA, generate new CRL and copy it to CRL distribution point. You have to start your root CA whenever the following condition occur:

root CA certificate is near to expire and CA certificate renewal is required.
a new subordinate CA certificate must be issued or renewed.
suborinate CA certificate must be revoked.
root CA CRL is about to expire and must be updated.


Unable to upload a file on xss vulnerable page I was wondering, if I have a php script, which could upload a file, What if I inject it in a page which is vulnerable to Xss. So, I created one and Here is the code of index.php

<html>
    <body>
    <form action ="" method="GET">
    <input id="name" name="name">
    <input type="submit">
    </form>
    </body>
    <?php
    if(isset($_GET['name'])){
        echo $_GET['name'];
    }
    ?>
</html>

And, Here I have a Php Script, which I made to upload an Image on the server.

<html>
    <body>

    <form action="" method="post" enctype="multipart/form-data">
        Select image to upload:
        <input type="file" name="fileToUpload" id="fileToUpload">
        <input type="submit" value="Upload Image" name="submit">
    </form>

    </body>

    </html>

    <?php
    $target_dir = "./";
    $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $imageFileType = pathinfo($target_file,PATHINFO_EXTENSION);
    // Check if image file is a actual image or fake image
    if(isset($_POST["submit"])) {
        $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
        if($check !== false) {
            echo "File is an image - " . $check["mime"] . ".";
            $uploadOk = 1;
        } else {
            echo "File is not an image.";
            $uploadOk = 0;
        }
    }
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    // if everything is ok, try to upload file
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
            echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded.";
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
    ?>

Now, My question is: What if, I inject this script in a Page which is vulnerable to Xss?

P.S : I tried doing so, But I was getting redirected to a page and its URL was data:, I am unable to figure out the exact Problem. And, If not the way, I am doing, Is their any other way to do so ?

What if, I inject this script in a Page which is vulnerable to Xss?

That's not how it works. XSS means that you inject JavaScript code, not PHP code. If you would inject PHP code, and it would execute, it would be code execution, not XSS.
XSS is a vulnerability that happens client-side. It allows you to steal data that is known to the users browser - eg cookies -, to perform CSRF and thus do anything the victim can do, and so on. Everything a website can do with JavaScript, you can do with XSS.
But you cannot change what happens server-side via XSS.
Of course, if the server does provide an image upload functionality, and it is vulnerable to XSS, you could upload a file via XSS, as you can send requests to the server via JavaScript. But in that case you do not change how the server works. You could just as well upload a file using a browser. The advantage here is that you may get someone else with more privileges to upload a file for you via XSS, via the already existing upload functionality.


MySQL brute force attempts from localhost We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL.
When I check the MySQL logs I see constant failed attempts to log in from root@localhost.
does this imply that I have malware in the same box or some attacker can pretend to be the localhost?

From our conversation in the comments, it looks like someone (either at the IP that you posted, or proxying through it) may be trying to compromise your system by exploiting your phpmyadmin.  If you are not using phpmyadmin, you might want to uninstall it or disable it.  If you need it, you might want to follow the steps described here to better secure it.


Is it possible to LUKS require both password and key file? My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in secure place and restore it after critical situation. I tried add key file using command # cryptsetup luksAddKey /dev/<device> but I didn't achieve what I want. I want to cryptsetup require both key file and password, not to boot system if one is provided. How can I achieve this in cryptsetup?

LUKS does not support requiring both a keyfile and a passphrase to decrypt. The encrypted volume can be decrypted as long as you provide satisfactory credentials to any one of the configured keyslots. That's not to say that it's impossible to get what you want. You could use a detached LUKS header (where the encrypted master key and other key information is not kept on the same partition as the actual encrypted data) and treat that as the key file. The detached header for your hard drive could be kept on a USB flash drive. Decrypting the hard drive would require knowing the correct passphrase and having the flash drive with the header. Destroying the flash drive and thus the header would render your hard drive unreadable.


Which strategy to encrypt data accessed by multiple users? I need suggestions to design my database architecture (in the context of a web application) on the particular point of its encryption ; knowing that the following elements must be respected:

1- Data must be securely encrypted in the database

This is to secure against attackers, and mainly for the users to know that even the staff cannot access their data, hence the keys must not be accessible by the tech team.

2- Data is scoped to user accounts

(meaning: each user has his own set of data, linked to their user ID)

Therefore I thought using the user's password as the encryption key, but this causes one problem: When the owner of the data decide to change password, the data must be re-encrypted and this would be too much demand in server-power.

3- The owner of the encrypted data must be able to give access to his data to other users

(meaning: there is an invitation system, and part or all of a user's data can be accessed by other invited users)

Which make impossible to use the user's password to encrypt the data because we don't want to share our password.

So I thought about a private/public key encryption, but the private key has to be stored somewhere. Storing it in the database is just rendering the whole encryption useless ; and storing it on the client side is not possible either because it would limit access to the application from the only computer(s) where the private key is installed.

4- Other users can be revoked from this given access

Meaning that, if we consider the private/public key solution we must be able to delete the private key that was given to the user being revoked.

Any suggestion on how to architecture such a system, or any idea I could get inspiration is greatly welcomed. Thanks

Update

Seems up to now, the best approach would be to encrypt the data with a asymmetric key (I call it the data-key), then to encrypt the private part of the data-key with a symmetric key (which is the user's password).

It seems a good solution; however there are several issues I can think of:

When a user logs-in, his clear password must be memory-stored on the server-side while the session is open, because we will need for each request to decrypt data. This is a security hole because a hacker could access all open session and their users password stored in clear.
When the data is shared (i.e a owner gives access to an invitee), the data-key is decrypted using the clear password of the owner, then encrypted using the clear password of the invitee. The problem is that owner and invitee are not necessary logged-in at the same time, hence the server won't know the clear password of the invitee at the time the invitation is done, and won't be able to encrypt the data-key.
When a user loses his password and request for a new password generation, he loses all his data that cannot be decrypted anymore

TL;DR: Generate a data-key pair, encrypt the private part with the public key of all users that have write access, encrypt the public part with the public key of all users that have read access.

Let's tackle this one by one:

  Data must be securely encrypted in the database

  This is to secure against attackers, and mainly for the users to know that even the staff cannot access their data, hence the keys must not be accessible by the tech team.

Given this requirement, the most important property you need to consider is that under no circumstances that the server can obtain the information necessary to encrypt or decrypt the data. This implies that all encryption/decryption must happen on the client side. Since web-based system is inherently insecure when you need to do end-to-end encryption, due to the ability of the server to inject JavaScript code-on-demand; the more security conscious users would want to control the client software used to access the service, so they would want this implemented as a desktop application.

  Data is scoped to user accounts
  The owner of the encrypted data must be able to give access to his data to other users

These two constraints means that multiple users will need to be able to decrypt the data. This means that the secret to decrypt the data needs to be shared to the other users.

  Other users can be revoked from this given access

  Meaning that, if we consider the private/public key solution we must be able to delete the private key that was given to the user being revoked.

To revoke access you need to reencrypt the data with a new key. As other answers have discussed, you cannot enforce forgetfulness.

The best way to describe this, is perhaps by way of an example.

Notations:

P(x) is the private key named x.
Q(x) is the matching public key for x.
e = E(d, Q(x)) means e is the result of encrypting plaintext d with public key x.
d = D(e, P(x)) means d is the result of decrypting the ciphertext e with private key x.

Suppose that Alice wants to share data to Bob, Charlie, and Dave. Alice wants to allow Bob to be able to read and write the data, Charlie can read the data but not produce a valid data, and Dave can only write but not decrypt what others have written (essentially it is a drop folder to Dave).

All users have user-key pairs. P(Alice), Q(Alice) is Alice's user-key pair; P(Bob), Q(Bob) is Bob's user-key pair; P(Charlie), Q(Charlie) is Charlie's user-key; and P(Dave), Q(Dave) is Dave's user-key pair.

The system has a registry of user-key where users can share the public part of their user-key. How a user can securely retrieve and authenticate another user's user-key is beyond the scope of this answer and is left as an exercise to the reader. Most users may simply put some faith on the access restrictions that you put on your server, but the more security-conscious users would need to do something similar to a GPG key signing party;.

All users are expected to keep the private part of their user-key a secret for themselves. How to do this in details is beyond the scope of this answer, but you definitely don't want to store the private user-key in the server unencrypted. Instead what I suggest can encrypt the user-key with a symmetric key derived from the user password and a salt, then store the encrypted user-key and the salt on the server.

To store the data "Hello World" securely, Alice starts by generating a data-key pair: P(data), Q(data). Alice then encrypts the data with the data-key public key:

plaintext = "Hello World"
ciphertext = E(plaintext, Q(data))

Given the properties of public key cryptography, we know that ciphertext can only be decrypted by someone that knows P(data). (Note that the notion of private and public for a data-key is just a matter of convention, both P(data) and Q(data) must be kept private from everyone that doesn't need them, like the server)

Alice wants to allow Bob and Charlie to be able to read this data, so Alice retrieves Bob's and Charlie's public key Q(Bob) and Q(Charlie) and encrypts P(data) with them, additionally to allow Alice to decrypt the file in the future, possibly from a different machine, Alice does the same operation with her own public key:

alice_read_key = E(P(data), Q(Alice))
bob_read_key = E(P(data), Q(Bob))
charlie_read_key = E(P(data), Q(Charlie))

Alice wants to allow Bob and Dave to be able to write data that can be read by Alice, Bob, and Charlie. Alice also wants to be able to update the data in the future. To be able to do this, Alice encrypts the public data-key Q(data) using Q(Alice), Q(Bob), and Q(Dave):

alice_write_key = E(Q(data), Q(Alice))
bob_write_key = E(Q(data), Q(Bob))
charlie_write_key = E(Q(data), Q(Charlie))

Alice then sends all of encrypted_key, alice_read_key, bob_read_key, charlie_read_key, alice_write_key, bob_write_key, and charlie_write_key to the server.

Since the server/attacker is never in possession of P(data) or Q(data) and since the server also do not have the private key to decrypt any of the read_keys, the server would not be able to decrypt ciphertext.

When Charlie wants to retrieve the data, what he does is he needs to download both ciphertext and charlie_read_key and decrypts charlie_read_key with his private user-key to obtain P(data) and then use P(data) to decrypt ciphertext:

P(data) = D(charlie_read_key, P(Charlie))
plaintext = D(ciphertext, P(data))

Now Charlie is in possession of plaintext. However, as Charlie does not have a write-key, he does not have a Q(data), so he would not be able to update data in the system in a way that others would be able to successfully decrypt.

Next, Dave needs to be able to add to the data. He cannot read the ciphertext but he can append to it by decrypting his write-key to get the Q(data):

new_plaintext = "New Data"
Q(data) = D(dave_write_key, P(Dave))
new_ciphertext = E(new_plaintext, Q(data))
updated_ciphertext = ciphertext + new_ciphertext

Now Dave can send updated_ciphertext to the server.

(Note that in most asymmetric encryption algorithms, you cannot simply concatenate two ciphertexts and expect to be able to decrypt it, so you may need to store some metadata that keeps the ciphertext blocks separate and decrypt them separately)

This leaves us with only revocation. To revoke access, you need to have at least P(data) to decrypt the ciphertext back to plaintext, generate a new data-key pair: P'(data), Q'(data), and reencrypt the plaintext with the new data-key pair:

plaintext = D(ciphertext, P(data))
new_ciphertext = E(plaintext, Q'(data))

and then you'll need to update everyone's write-keys and read-keys.

To add a new user to an existing file, all you need to do is just create their write-key and read-key. Only people that themselves can decrypt their read-key can extend a read-key to a new user, and only people that themselves can decrypt their write-key can extend a write-key to a new user.

If you do not need the fine-grained permission permission in this system, (IOW, if all users that can read the data can also update it); or if you use other ways to enforce fine-grained permissions, then you can replace the asymmetric data-key with a symmetric data-key (Trivia: the system with symmetric data-key would be similar to how multi-recipient PGP-encrypted email works; so you may want to investigate that).