Intercepting messeges in attacks on authentication protocols I've recently read about Diffie-Hellman Man-in-the-Middle attack when a third party can intercept messages and thus construt two different symetric keys with both sides. However I still don't understand how the intercepting how the messages works. Does the third party can "catch" messages and throw them away?
perhaps this is a general networking question, rather than security, but I hope I could find the answer here.

To be technical: if A sends some message M to B, I understand how he can read it, maybe alter and to send M' to B, but how does he prevent from he original M to be sent to B?

Lets look at a client server example like a website. The client (browser) communicates with a server (web site). The "Man-in-the-Middle" (MitM) in this case convinces the client that he is the server, so the client thinks it is talking to the website. The "MitM" also convinces the website he is the client. Communication is then completely controlled by the "Man-in-the-Middle".

For a low tech example think about a King communicating with a General centuries ago, by having a messenger carry letters between them. It is not just that the messenger can read the messages, but lets say the messenger can forge the King and General's handwriting. The messenger can then pretend to be the King to the General, and the General to the King. Controlling all communication.

This can happen in many ways (in fact any non-in-person communication should have some measures to prevent MitM attacks), so it is not a "general" networking question.

But for one simplified real example that includes networking: if we are both at a coffee shop, I (armed with some software and a wifi adapter) can pretend to be a wifi access point (AP), and display it as "Cafe X - Guest Wifi (Free)", in hopes someone will connect. If you take the bait, then I can act as the MitM for all your communication -- intercepting and injecting packets.


911 Authentication and Encryption When I talk over 3G without a SIM, for which the only example I see is 911 emergency
calling, is any encryption used?  In other words, can a 3G eavesdropper understand any
content of my 911 call?  I assume the network provider (who provides the link from my
phone to the 911 operator) can understand this content if they wanted to, but am
curious about outside parties.

Additionally, does my phone somehow authenticate the 911 center?  If not, does it
at least authenticate the network provider selected for this emergency link?

(The above questions assume that no SIM is used.  I do realize that SIM protocols
themselves are not perfect,
but am wondering how much weaker encyption and authentication becomes with no SIM.)

Without the USIM application running on your UICC (the smartcard colloquially known as "SIM"), there's no crypto provider, so yes, I think the network and phone must then agree on unencrypted transmission.

So, first of all: whether emergency calls without a SIM are possible or not is up to local legislation. They work in many countries, but not all.

Also note that you'd have to assume you're in a hostile network if you're operating without a SIM, anyway, because there's nothing to authenticate the network. So, even if there was any possibility for basestation-handset crypto, you might be talking through your adversaries channels, so you've won nothing.


How can Alice and Bob prove that they share a file? Carl asks Alice and Bob if they have a file f such that for a secure cryptographic
hash function h, h(f) = K.
Both claim to have f, but they can't show the file.

Carl doesn't believe them. He can ask further questions to Alice and Bob, although
they can secretly talk to each other (note that even if Alice or Bob have f, they

can't show f to each other). Could Carl discover whether both have f?

Could Carl discover whether some of them has f?

Carl can ask Alice and Bob (independently) to calculate hashes of specific fileparts and compare the results. For example C asks A to calc h(f[0-100]) and receives h' then C asks B to do the same and B returns h''. If h' == h'' they both have the same knowledge about this part of f. You can repeat this for different sections of the file.

Notice: If A and B cooperate (and want to trick C) and only one of them has the file there is no way for C to tell if they both have f or of they're just cooperating.


Help on interpretation of FIPS-140 paragraph This is from the FIPS 140-2 standard:

  Cryptographic keys stored within a
  cryptographic module shall be stored
  either in plaintext form or encrypted
  form. Plaintext secret and private
  keys shall not be accessible from
  outside the cryptographic module to
  unauthorized operators   A
  cryptographic module shall associate a
  cryptographic key (secret, private, or
  public) stored within the module with
  the correct entity (e.g., person,
  group, or process) to which the key is
  assigned. Documentation shall specify
  the key storage methods employed by a
  cryptographic module.

I am not sure I can interpret it correctly.
If the keys can be stored in plaintext form does it mean that there is no security expectations for key-storage (as a structure) from FIPS?
Or to reverse the question:if the keys are stored in encrypted form, does the algorithm used to encrypt the keys need to be FIPS certified?If yes why, since they could be stored in plaintext and still be acceptable by the standard.
My interpretation of this is that you can store the keys how you want, just make sure that no unauthorized users can access them.E.g. store them in plain text and "shield" the PC that has the plaintext.  So no kind of e.g. FIPS encryption algorithms are needed.
Any input on this is highly appreciated.
Thank you!

I think it means that if you store the key in plaintext form inside the cryptographic module, then you have to make sure that no one else can access the place where the key is stored in the cryptographic module.  For instance, it needs to be stored in private memory that only the cryptographic module can access, and that others are prevented from accessing.  This means that there are security expectations for key storage.

I think the part that has confused you is the difference between storing a key in internal memory of the cryptographic module (which others can't access) vs exporting the key to the outside world.  There is supposed to be a security perimeter around the cryptographic module that prevents others from tampering with or examining its internal memory.  If the key is stored unencrypted in internal memory, then the internal memory has to be designed so that it cannot be accessed by anyone/anything else than the code of the crypto module.

I don't think it's exactly right say that keys can be stored in plaintext and still be acceptable by the standard.  In particular, I don't think it's accurate to say that you can store the keys however you want.  As I understand it, FIPS doesn't let you store a key in plaintext anywhere you want; it would be a security risk to have an unencrypted key laying around in unprotected storage.


How is the TLS protected against length field of the header being modified? I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes..

Packets in the TLS protocol consist of a 5 byte header followed by data which is encrypted once the handshake is done. The 5 byte header is always transmitted in the clear and it also contains a 2 byte length field.

Now, the MiTM attacker can just modify the length field alone in the header, such, that receiving party ends up waiting for a large amount of data, even after receiving the actual amount of bytes originally sent by the peer side. For Ex: Let's say peer side has sent a packet of 20 bytes, and the MiTM attacker just modifies length field of the header to make it 65535 bytes. Now, if no other data is sent by the peer, then the receiving side will wait indefinitely to receive the 65515 bytes (65535 - 20) which was never sent in the first place.

The TLS includes the header in MAC calculation, so any tampering with the header will result in a failure and effective connection closure. But, how is the case of blocking on socket to receive data resolved?

The receiver can avoid it by using a non-blocking sockets with select(again select should have a timeout) or using timeout with sockets. But, how about the case of blocking sockets? Is there anyway at all in which we can avoid the receiving side blocking on the socket?

An attacker who can modify TLS record headers can actually block packets altogether, thus making the receiver wait "indefinitely". There's nothing that the TLS protocol can do to prevent that.

TLS implementations can use time-out strategies, i.e. if no activity has been received from the peer for some time (e.g. 15 seconds) then the connection can be dropped automatically. This is needed anyway to handle the case of clients crashing: when a machine crashes, it ceases to send packets, but it won't tell that it can no longer send packet, since it is crashed.

It is a generic property of TLS. TLS does not try to recover from a transport failure; it just tries to reliably detect alterations. Attackers can always cut the wire or postpone traffic for arbitrary amount of times. For that matter, the TLS records are considered "transport" just like the underlying TCP connection. The MAC used in records is where detection occurs, and it covers the record payloads only.


Preventing firmware hacking with read only OS Scenario 1:

Attack from Internet, SD-card, USB-stick -->
direct reflash BIOS firmware, without the operating system as an intermediate stage -->
BIOS firmware or any other firmware which is stored on EEPROM can be replaced with malicious code -->
BIOS is infected even after a power cycle

My conclusion then: I can't protect the BIOS/any firmware from being attacked with an operating system that can only read (OS is on a write-protected hardware  device like a usb-stick, flash memory), because the operating system is not a "requirement" for the attack

Scenario 2:

Attack from Internet, SD-card, USB-stick -->
Attack/malicious code doesn't force write operations/events on the operating system -->
BIOS firmware or any other firmware which is stored on EEPROM can be replaced with malicious code -->
BIOS is infected even after a power cycle

My conclusion then: The operating system is a "requirement" for the attack but I don't need to do or force any write operations/events on the operating system. I can't protect against BIOS attack (nesting malicious code) with a read-only operating system (OS is on a write-protected hardware device like a usb-stick, flash memory).

Scenario 3:

Attack from Internet, SD-card, USB-stick -->
Attack/malicious code must force write operations/events on the operating system -->
BIOS firmware or any other firmware which is stored on EEPROM can't be replaced with malicious code -->
BIOS is not infected even after a power cycle

My conclusion then: Read-only OS on hardware write protected device can save the firmware (in this case BIOS) from being attacked.

I always mean the operating system from the victim!

Physical attacks are irrelevant!

This won't work. Malware from, say, the Internet can operate solely in RAM, then tamper with the firmware, bypassing the write-protection on the disk.

In fact, this is used frequently because traditional anti-virus solutions only monitor disk writes and reads. By remaining only in RAM, malware can reduce the risk of detection.

More advanced threats will write itself to firmware, where anti-virus doesn't scan, so it can remain on the system while being very difficult to detect. Therefore, the malware will move between firmware and RAM, without writing to disk or being removed if the computer is shut down or the disk is wiped.

See, for example, this Wikipedia article on fileless malware.


Are passwords in Mozilla products stored insecurely? I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small piece of software has immediately punched me with all my passwords ever used in Mozilla Firefox and Mozilla Thunderbird. A passwords, that up until now I considered safe, since stored in Password Manager.

My world has just collapsed (or I was that naive). It was that simple? I run that program on my office computer. During my summer break, when my boss has access to my computer (inner regulations), he can do the same and get all my passwords.

What am I missing? How can Mozilla product's creators claim, that their software is safe, if it only require to take four steps and thirty seconds to reveal all passwords stored in it?

Have you set a master password? If not you don't even need third party software to view the passwords. Just go to options->security->stored passwords and click show passwords and there they are. Try setting a master password in the security settings and see if the software is still able to list your credentials

Since I can't yet comment on the other answers due to my reputation, the reason why the tool only works for firefox is likly that it's just developed for firefox. There are tools for viewing passwords for other browsers too.
Ohter browsers store there data in different locations in different ways. If a software doesn't check these loactions and files it obviously can't display the contents of this files. +the software must know the decryption algorithm for those files.Mozilla at least gives you the option to set a master password. That is then used for de/encrypting key3.db which contains the key to de/encrypt your stored passwords. With a master password set key3.db can no longer be decrypted with the default key used by those tools and without the key stored in key3.db your stored passwords can't be decrypted as well.


Bettercap 2.x SSLStrip Is Not Converting Links I posted this before. I am creating a new post because of all the changes I would need to [edit] out.

I have the latest version of bettercap. I have the latest version of Kali Linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the latest version of Windows 10 with Chrome version  70.0.3538.110. I have all the extensions removed. I will first start by going over what I think I know and troubleshooting I have done. Bettercap appears to be functioning in the sense that it can grab passwords from normal HTTP websites but not HTTPS websites.

What I THINK I know.

-SSLStrip will NOT convert an HTTPS connection to an HTTP

-SSLStrip WILL, however, rewrite HTTPS URLs to HTTP.

-SSLStrip will not work on anything that has HSTS preloaded

-SSLStrip will only work against non-preloaded HSTS websites if and only if the user is visiting it for the "first" time.

-SSLStrip will work against TLS and SSL if HSTS is not used

-If HSTS is not implemented, A victim doesn't need to do anything specific or be tricked into installing any certs.

What I Want To Do
-Monitor the victim's computer's traffic

-Verify that weibo is vulnerable (it is https://hstspreload.org/?domain=weibo.com )

-Get the victim user to go to http://mediaroom.scholastic.com/socialmedia , scroll to the bottom and click the link to the Weibo website.

-Receive an HTTP version of weibo.com

-Alternatively, I would accept clicking a Facebook link and receiving a "Connection is not private" alert. This is also acceptable.

What I have done

Cleared my victim's chrome cache and deleting the domain security policies for weibo.com

restarted Chrome

I used a typical install method

apt-get install bettercap

I have been following this website

https://www.peerlyst.com/posts/bettercap-2-x-mitm-framework-general-info-examples-cyberpunk-1

I have used these commands once I activate bettercap

» set http.proxy.sslstrip true
» set net.sniff.verbose false
» set arp.spoof.targets 192.168.1.3
» arp.spoof on
» http.proxy on
» net.sniff on

What IS working

-Can successfully redirect victim traffic to the attacking device

-Can successfully grab headers

-Can successfully display the password when I enter it in non-HTTP websites

-When the victim navigates from mediaroom.scholastic.com to weibo.com, the weibo.com link is correctly converted to http in html. Woohoo, progress!!

What is NOT working

-When I actually click the link I still get the HTTPS version.

So guys, I still feel like I'm missing something essential. This sounds too straightforward of a process to fail. So what is it? What am I missing?

Note for mods. The original link is here. I updated this one with the corrections made by the one answer.

Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS)

When I go to the Scholastics page, then click the Tumblr link (specifically the Goosebumps one) I get redirected to HTTP. Many of the other links on the site are HTTP and others are HTTPS. This is the desired result and I did not get the same results with weibo.com. So I guess that means it works right? From this, we can conclude that the absence of HSTS does not guarantee an attacker's success. To further prove this, I went to time.com and noticed none of the links were converted to HTTP like they were on the Scholastic site. I guess it depends on how the site is built? I don't know honestly.


Data categorization: tools? For the purpose of setting in place the appropriate means of securing data,
and to secure this process, I'm asking me the questions:

What are the tools to associate to a document a categorization label
(for example: TOP SECRET)?
Does a tool which prohibit label removal exists?

For example,
one method some may imagine to adopt could consist in:

for text documents place in the
header and footer of every page a centered red box containing in upper
case letter the text: TOP SECRET,
crypt this file with a high grade uniq password and a strong method;
write down this uniq password on a paper labelled TOP SECRET and put it
in a safe,
move the crypted file on a safely erased USB key wearing a TOP SECRET
red label,
safely erase all the disks of the OS where the original Microsoft Word
document was and consequently any visible or hidden temporary file,
only open this file on a safe OS (Windows less, Internet less) within a safe office (tempest and light proof).

But this piece of policy, how heavy and expensive might it be,
won't prohibit the voluntary or accidental removal of the label.

There's no single tool or technology that will do all of that for you, much of that will come from defining policies, and from them create procedures and standards for people to follow. You need to understand what information you are trying to protect and from that figure how many documents you need to secure in that way. That will also tell you how much security you need so you can make sensible choices on strategy, policy, and technology. That will tell you whether you really need specialized tools or not.

You also need to understand your budget limitations, tempest proofing a room is not a cheap undertaking and neither are WORM storage units. Security conscious small businesses can probably get by by simply labelling document classifications in the file name and then making sure they put them into the right places. PGP can be used for secure email transfers, but for intra company emails encrypted hard drives and using TLS on mail connections will do the same thing.

You can throw governance, policy, user training, and loads of money at document classification and storage. It's best to make sure you know what you need before talking about technology.


Struggling to demonstrate/exploit a basic session hijack As part of some basic pen-testing I've been invited to do on a live site, I've managed to access other users' cookies.

The first thing that springs to mind that could be used to demonstrate the extent of this vulnerability would be to hijack the session. However, I'm struggling to identify which part of the cookie is used to uniquely identify the session. Can I expect to see just one session ID field? There are many (arguably too many) different components of the cookie for their site, and multiple of these fields differ from session to session (I've logged in with 2 fake accounts).

I've tried a few ways of setting these cookies ('edit this cookie' in chrome and 'firebug' in firefox) but when I refresh the page - I'm not logged in.

Or is this rather subjective and specific to the site?

To add some clarity to my question, I'm looking for an example of how I can switch session using the tools I've mentioned above (maybe you can give me an example of how I can do this myself on a well-known site given a session ID from one browser used in another?).

Furthermore, more importantly, it'd be great if you could give me an insight into how a pen-tester may identifier the part of the cookie responsible for session identification.

EDIT

One of the things that's complicating it further is what I have access to in document.cookie. Fire up dev tools for this page, have a look at document.cookie, stackexchange doesn't appear to keep the session ID in there. But if I look at the storage options in dev tools, it's in there. That's fine - but how might an XSS attack access this client-side? On further reading, this seems to be a HttpOnly cookie - so then this is a guard against XSS is it? So if my target site employed this, it would not be vulnerable?

Copying the session cookie is the common way to hijack a session. There could be several reasons why it doesn't work in your case:

The session cookie you hijacked isn't valid anymore. A secure web application would invalidate a session as soon as the user logs out - are you sure the target session is still active at the time you hijack it?
The application might bind a session to additional attributes such as the IP address or browser characteristics. That's not terribly common but it would complicate your attack.
You are not correctly applying the hijacked cookie in your browser. It can be fiddly to set cookies manually. Make sure you have closed all tabs when you change cookies so that the site cannot re-add them immediately.

Regarding the last point I would try to reproduce it as simply as possible using command-line tools. That excludes the possibility of any browser side-effects. For example, you could use curl(1) to issue a request (using -b to set the cookie), similar to this:

$ curl -b "user_session=1-mkFXXXXXXXXXXXXXXX" https://github.com/

An authenticated response would indicate that setting the cookie is enough to take over a session.

  On further reading, this seems to be a HttpOnly cookie - so then this is a guard against XSS is it?

The HttpOnly flag protects cookies but not against XSS in general. It only prevents cookies from being exposed to the DOM. For example, on Github the user_session cookie is set in your browser but it remains invisible via document.cookie. There are many more ways to exploit an XSS flaw than just stealing cookies which would work as a good proof of concept.


Is there any reason to block HTTPS? Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'.

This results in some websites being unable to function properly (such as Google's jQuery libraries, which are served via HTTPS).

I also remember reading an article a couple of years ago which said that HTTPS can cause problems with censor filters/proxies, as HTTPS connections cannot be intercepted & the page contents searched for blocked content (I haven't seen this behavior in many filters, but one such software that does this is censornet).

Disregarding educational use, I have also found that a few shared WiFi hotspots also engage in this behavior (of which are unfiltered for the most part). For example I was travelling via Gatwick Airport (U.K) last year & all HTTPS sites were blocked on the official 'Gatwick Airport WiFi' network.

Other than for filtering purposes, is there any reason to block HTTPS? HTTPS is paramount for websites that deal with private information (passwords, emails, etc), so I can't really see a good reason for blocking HTTPS.

Simple: You can't easily filter/censor/virusscan/log the content if the connection is encrypted.

So there's three general ways to react:

install an SSL interception middle box that decrypts, scans, and re-encrypts SSL connections. This requires cooperation from each client PC. (By installing the middle box's CA certificate as trusted.)
block port 443
shrug and give up. Just scan HTTP connections and don't scan HTTPS connections.


How do I tell whether my browser extensions leak personal data? According to the article Warning: Your Browser Extensions Are Spying On You:

Browser add-ons for Chrome, Firefox, and probably other browsers are tracking every single page you visit and sending that data back to a third-party company that pays them for your information.
[...]
Millions of people are being tracked this way and they don’t have a clue.

The BBC recently wrote in the article It is easy to expose users' secret web habits, say researchers:

The information revealed an intimate portrait of the browsing habits of people, said Ms Eckert.
[...]
The pair found that 95% of the data they obtained came from 10 popular browser extensions.

How do I keep myself save in this regard? Is there some white list of friendly browser extensions? To take a specific example, how do I tell whether my uBlock extension is safe?

A technical solution to find out how talkative browser plugins are is to use a network traffic analyzer like Wireshark. The actual traffic might be encrypted, but you can at least tell if your webbrowser suddenly makes requests to unrelated servers it did not make before.

A legal solution is to try to find the privacy policy and terms of use of a browser plugin. In most jurisdictions, companies are legally obligated to notify their users when they collect private information.


Web Application Firewall Rules For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on WAFs, i have some questions ?

Does order of Rules matter ?
How inconsistent rules are handle.
How redundancy is removed from the ruleset
Can rules be bypassed for static application layer signatures

Does order of Rules matter ?

Of course. It's mostly about performance.

Even if your firewall only implements an accept/deny policy (it could, for instance, decide to route the request elsewhere) then the length of time it will take to decide what to do with it will depend on the number of rules it has to process in order to reach a decision and the effort required for resolving those questions. Hence ordering has a huge impact on performance.

Further, most such firewalls benefit from fuzzy rules - a single rule (or even a single web request in session) may not carry enough information to determine whether a request should be processed or not - the firewall therefore maintains a lot more state than a layer 5 stateful firewall.

  How inconsistent rules are handle.

No idea what you mean by this.

  How redundancy is removed from the ruleset

By design.

  Can rules be bypassed for static application layer signatures

Yes, if you configure the rules to allow this.


How can i prevent my phone from spying through sms Recently while reading up a article over here ,The following were the summary :

hacking suite dubbed Smurf Suite, it can hack any mobile by sending
an encrypted text message

So based on the above sentence ,I can imagine the following :
Attacker sends a sms to victim-->victim either opens/reads sms -->once it opened/received by victim -->exploit will run into victim's phone
The following things i could think over regarding it

I cant stop myself from reading text messages since its common human nature to read whatever sms was received

AFAIK there was no method to stop my mobile from receiving message,it might be transmitted through either mobile networks/websites etc

if websites i could contact my telecommunication and ask them to block over it,but again the attacker can send a exploit sms to me through mobile career

Apart from the above things what were the possible stuff i could do prevent myself from spying,Also note that if it's MMS i can stop it by without using internet on the phone[maybe the last solution i could think off]
Looking forward for some precautionary steps which i could do myself to prevent spying over me

without knowing how exactly the message initiates the attack its hard to say how to protect your self against it.

if we assume that it has to first touch your os for anything to happen then what you could do is create a small android application (simple one) which simply runs in the background as a service and isolates the message from you/the rest of the system unless it follows certain rules (i.e its from someone you know/approve)

and then if it passes the tests you set out it will forward the message onto your system and have it as a normal message.

As I said this is a difficult question to answer as smurf is a government application, I would need to know at what point the sms triggers a take over. as soon as it gets to the phone? as soon as it is read? as soon as it gets to the official inbox? its hard to say.


Windows Print Drivers / Security Principal Forgive me if this question seems a little "under the hood", but I think it's important to know from a security point of view.

I see SPOOLSV.EXE runs with print driver DLLs (Type 3 - User Mode, I know) loaded into the process under the security principal NT AUTH\SYSTEM. Doesn't this mean print drivers can pretty much do whatever they want? Is there a way to run them in more restricted context? Think Print Server that doubles as domain controller...

Thanks.

In general, drivers can access hardware (that's their point), meaning that they have enough privileges to do whatever they want with the machine. Some operating systems try to somehow constrain some drivers to only a specific subset of the hardware, but it is hard (e.g. if the hardware can do DMA then it takes some effort and some hardware support to ensure that an hostile driver cannot read or write any piece of RAM that it wishes to access).

This is why recent versions of Windows insists on drivers being digitally signed: the signature does not guarantee the safety, but it allows to lay blame and is therefore expected to prevent most attacks (attackers really don't like it when police forces break through their door at 06:00 AM).


How to check if redirected site like OAuth is genuine? One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site needs a verification token from another site which requires login. (Site A redirects the user to site B with authorization request as parameter. User logs in/authorizes the request at site B. User gets redirected to site A with a verification token as parameter.) A problem arises if site A redirects the user to phishing site C which looks similar to site B and collects the user credentials.

Of course the user could in theory check if this is site B and not C. But in practice there are many problems:

checking every character every time is annoying and will not be done after a few times
there are many similar looking characters (homographs)
authorization sites URLs are sometimes different than the main page and it is hard to remember all of them for different sites (was it my-bank.com / my-bаnk.com / mybank.com / my-bank.org / my-bank-auth.com / auth.my-bank.com ?)

So what is a userfriendly way to check if you aren't entering your credentials on a phishing site when you got there redirected?

All of the advice provided on the question you linked is already sufficient to verify the login process even when an external provider is used. You just have to repeat the process on every page you're redirected to.

If you're worried about homoglyphs or typo-squatters, then you need to just check the certificate in a little more detail. Most web browsers (desktop browsers, at least) have a feature that lets you see all the pertinent details of a website's certificate, most importantly including the organization it was issued to and information about the issuing Certificate Authority.

If the certificate is valid for the given server or domain, issued to an organization you trust, and issued from a reputable Certificate Authority, then you can be reasonably assured that you're not dealing with some sort of spoofed server.

Sure, attackers can use homoglyphs or typo-squatting to make their server/domain look like it has a name your bank might use. But they'd have to go to great lengths to get a verified certificate that actually looks like it was issued to your bank from a reputable CA. If they really can get that far, no amount of verification on your end is likely to spot any problems.

Come to think, nearly every check that you might manually do on the site or it's certificate (at least, any check that would be "user friendly") is already being done by your browser. So, unless your local system is already compromised (at which point it really doesn't matter if you're actually on your bank's site or not anyway), there's not likely anything about an attacker's site that you'd find by doing any extra checks which wouldn't already be red-flagged by your browser.

Just keep an eye on that "lock" icon, make sure there's no warning signs (green "Extended Validation" certificates are ideal, but strictly optional) on every page, and you should be fine.


Why providing many protected zip files will increase the chance of retrieving the password In fcrackzip man they say :

  the more files you provide, the better.

I want to know why. What's the method it uses to retrieve the password?

The full description reads

  fcrackzip searches each zipfile given for encrypted files and tries to guess the password. All files must be encrypted with the same password, the more files you provide, the better.

Looking at the command-line options tells you the different modes how it guesses the password, which are basically either a dictionary attack or brute-forcing with different password specifications. There is no cryptoanalytic deep magic which would benefit from having more cyphertext.

Let's say the attacker has 20 files. They know they are encrypted with the same password, but they don't know which one. When they pass all 20 files at once, fcrackzip would try to guess the password for the first file, and when it found the correct one, it will try the same password on all 19 other files, cracking them all at once. But when the attacker passes the 20 files one after another, fcrackzip will restart the brute-forcing for each file.


Getting a SQL injection past a given regex I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008.  It doesn't really look like it, but I'm wondering exactly what code I can get past it to prove it doesn't protect.

value = Regex.Replace(userInput, "[\n\r\t\']", " ");
sqlCmd = "Select names from mytable where mycolumn like '%" + value + %'";
SQLDataAdapter results = new SQLDataAdapter(sqlCmd, connString);

Now, I've figured out that if I can get a single quote past, I can do something like

a' union all select passwords as names from myusertable;--

The problem is, the regex does catch the single quote, and I haven't a clue how to escape/encode/ect. it to get it past the regex.  I've been looking for something, but everything seems to assume that you can get a single quote past.  Obviously it can't be that simple to stop all sql injection attacks, but I personally don't know what to put to get past it.  Any help?

Edit:

To be a bit more specific, I've heard that one can use unicode characters to slip a single quote past a check in many languages as there are unicode characters that are treated as such by the programming language, but when they get to the database, they are just treated as a quote.  But I've found nothing but theory on this.  When I try to explain it, it sounds like 'Well, people think this could happen, but it has never been shown to actually be a vulnerability' and that doesn't convince the senior individual who programmed this.

For complex regular expressions you should use a regex debugger.  However this regex is dead simple.  In short,  you need to find a query that is susceptible to injection without using single quotes.
lets assume the following query:

value = Regex.Replace(userInput, "[\n\r\t\']", " ");
sqlCmd = "Select names from mytable where mycolumn = '" + value1 + ' and yourcolumn= '"+value2+"';

now this can be exploited using the following PoC:

let value1 = \
let value2 = union select password from myusertable-- 1

This will produce the following query:

Select names from mytable where mycolumn = '\' and yourcolumn=' union select password from myusertable-- 1'

A couple of modifications,  most connection managers do not allow query stacking,  thus ; is just garbage,  the -- comment is actually a three character comment that ends with a  space so -- 1 will ensure the comment is respected even if white-space is truncated.  By replacing single quotes,  this sanitation method is better than addslashes,  as it is not vulnerable to multi-byte attacks see: addslashes vs mysql_real_escape_string


Does this CSS code expose if a message is read, and how long they have been reading it? This email analytics company offers an 'engagement metric' that shows how much time someone spends looking at an email, whether the email is printed or deleted.

They also claim it works in pretty much all email clients, be it web, desktop or mobile.

Looking at an example for the tracking code (first link), I can see how they track prints, but how do they track how long you have been reading the email and whether or not you delete it?

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client.

As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. This assumes that the tracking image will not be loaded until the user actually prints the email.

Length of viewing time could theoretically be tracked by a slowly-loading image. The server would keep the HTTP response permanently unfinished, and it is only terminated when the user navigates away from the email. The server can log how long it took for the client to terminate the connection. However, I haven't observed this slow-load behavior in HTTP. It might be possible to do something similar with TCP sockets, which might be kept open even after the HTTP request completes (since the image is served with Connection: keep-alive), but my initial research suggests that the TCP connections may be kept alive after navigating away from a page that requested that keep-alive resource.

Excluding this possibility, it appears that the code you've included doesn't track time spent looking the email. Possibly time-tracking is a premium feature not enabled for this tracker.

The only other (mildly ridiculous) possibility I could consider is that the /F resource is somehow loaded when a navigation action is performed (i.e., the navigation action causes a manipulation to the document structure that causes the CSS rule to apply). If this (quite out-there) theory is the case, time-tracking will only work on Web-based mail, though.

Finally, they don't have ability to detect deletions. That article simply assumes that a user who has spent less that 2 seconds looking at an email has deleted it.


What does Frank Abagnale mean by "Level 4 security" in his talk at Google? During his talk at Google, Frank Abagnale mentioned the following:

  ...we will be doing away with passwords in the next 24 months. Passwords will leave the world, there will be no more passwords. There is a new technology called Trusona...it is a company in Scottsdale, Arizona that created a technology for the CIA which we have used now for the last few years....it was the ability for an agent to send data back from the field, such as Afghanistan, on their iPhone and that Langley would know 100% that it is the agent on the other end; to 100% identify the person on the other end of the device. That's a level 4 security, so they basically said "What if we brought this to level 2 security and we did away with passwords..."

What is level 4 security in this context?

It is probably the level of assurance that the authentication is correct: https://developer.mobileconnect.io/level-of-assurance

  A Level of Assurance, as defined by the by ISO/IEC 29115 Standard,
  describes the degree of confidence in the processes leading up to and
  including an authentication. It provides assurance that the entity
  claiming a particular identity, is the entity to which that identity
  was assigned.

  At Level of Assurance 2 (LoA2), there is some confidence in the
  asserted identity of the entity. LoA2 is used when moderate risk is
  associated with erroneous authentication. Successful authentication
  will be dependent upon the entity proving, through a secure
  authentication protocol, that the entity has control of an agreed
  credential.

  At Level of Assurance 4 (LoA4), there is very high confidence in an
  asserted identity of the entity. This LoA is used when a high risk is
  associated with erroneous authentication. LoA4 provides the highest
  level of entity authentication assurance defined by this standard.
  LoA4 is similar to LoA3, but it adds the requirements of in-person
  identity proofing.


I found a password with hashcat, but it doesn't work My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0).

I used office2john.py to retrieve the hash, and I removed the file name.

The hash is:

  $oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a

Then I put the hash in hashcat with the following command:

hashcat64.exe  -m 9800 -a 3  s.hash ?l?l?l?l?l?l?l?l -D 1,2 -w 4

hashcat cracked it and gave me the password, but when I insert the password in PowerPoint it says that the password is wrong (iemuzqau).

Did I do something wrong?

The password hashes for MS Office 97-2003 are vulnerable to collision attacks. That is, multiple passwords exist that should be able to open the document.

That also means that the password "iemuzqau" is not necessarily the original password that was set by the author. It is just one of the passwords that should be accepted, because it matches the internal scheme to check for the correct password.

For the $3 type hash that you got, the hashcat methods 9810 and 9820 can be used to create password candidates faster than raw brute-force (mode 9800).
According to the linked thread that should work by first executing the following command:

hashcat64.exe -m 9810 -w 3 s.hash -o hash.rc4 -a 3 ?b?b?b?b?b

The output will be something like:

 $oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a:5ffd0b24bd

Then you take the output of that command and execute:

hashcat64.exe -m 9820 -w 3 hash.rc4 -a 3 ?l?l?l?l?l?l?l?l?l?l --increment

This will then produce the following output:

$oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a:5ffd0b24bd:iemuzqau
$oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a:5ffd0b24bd:cvsfjkwoa
$oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a:5ffd0b24bd:yrmbatnya
$oldoffice$3*1b085471a28011c5348c5f0b8f29d24e*99294d3ebc790cfc325cca851f56d433*9e3556d0775d0aa198060a815be7be4c58e1fe2a:5ffd0b24bd:mzvmxmyke
...

The mode 9820 is a mode that "keeps cracking". That is, it will not stop outputting valid passwords after the first match. This behaviour was changed recently so you might have to specify --keep-guessing on your command line, depending on the version that you use.

That does not explain why your password is not accepted by PowerPoint as only valid candidates should be generated by hashcat. But maybe you can use the described workflow to generate additional valid passwords and try them.


Are web sites with non-https login pages secure? I was looking at weibo.com (chinese equivalent of twitter). I was surprised to see that their login page (http://www.weibo.com/) or forgot password page(http://login.sina.com.cn/forgot/index?entry=weibo) are not secure i.e not using HTTPS. Are these pages really secure? Am I missing something here?

No, such sites can eventually never be secure, since the information which is transfered can always be looked at and it can always be modified on it's travel or on the client side e.g. by malicious browser-add ons or any other malicious software running of the client.

This is particularly true, if the machine is a public "kiosk" mode operated terminal.

The above is true, regardless if authentication and/or encryption (confidentiality, integrity) is considered; none of this can be ensured without encrypting the communication.


Is there a chance USB files once opened by TV, PC etc. have any footprint, backup or residue files left on the hosting device it worked on? Let me first thank you all for the great info. you are providing.
My question is; Do files stored on USB once opened and viewed by TV, PC etc. have any footprint, backup or residue files left on the hosting device? If yes, are the files recoverable from the TV or PC  it was previewed on alone without using or accessing the USB source? I am asking because, I am specifically worried that If I use my TV or even my PC to view or watch my personal and private videos or pictures which are stored in my USB, somebody else through the internet could have access to it and recover it once my personal TV or PC is connected to the internet even that the files not saved or copied to the TV or the PC? Is there any chance for such a scenario to happen? I might be overthinking this, anyhow I hope I am not wasting your time for such a question.

best regards,

"Opening" a file is not magical. This means: running some local application which will read the file contents, and do something sensible with them.

A USB flash drive is a storage device; its purpose is to store bytes and give them back when asked to. When you "open", say, a video file on a PC, the following happens:

The operating system on the PC tries to infer the file type, based on clues such as the end of the file name (the so-called "extension"): if the file name ends with .mp4, then the OS will think that "this is a video file".
The OS launches its video file reading application (e.g. Windows Media Player, or VideoLAN, or whatever was registered in the OS as "the default video file reading application"), giving it as parameter the file name.
The application will then read the file and process it, e.g. playing the video before your amazed eyes.

Now a video player will not normally save a copy of video data in other files; however, it may save some meta information. For instance, when I "open" a video file on my PC (which runs Linux), the default media player begins playing it. If I close the player, then "open" the same file again, the software asks whether I want to "resume playback" at the point I left previously. This can happen only if the player remembers that I played that file before, and where I stopped; this must be written somewhere, and, in particular, it is not written in the file itself, or (apparently) in the same directory. Basically, this means that some information (including, probably, the file name) is stored in a directory in the local hard disk. This answers your question:

Yes, it may happen that the names of files that you play may be stored somewhere on the playing device. It routinely happens for millions of PC.
No, usually, the file contents won't be saved on the playing device, because it is way too large to make this strategy viable.
However, if the video file was downloaded from "the Internet" at some point (e.g. Youtube), what the device saves might be enough to reliably identify that video later on (assuming that the place from which it was downloaded still has it).


Strong PHP hashing without salt The application takes several inputs (notably, private personal informations) to produce a fixed, but non-guessable hash.

Simplified example:

$data = $websiteDomain . $myChildSchool . $myPetName . $etc;

for ($i = 0; $i < 1000000; ++$i) {
    $data = hash('sha512', $data, true);
}

$data = str_replace(['/', '+', '='], '', base64_encode($data));

$result = substr($data, 0, $passwordLength);

The goal is to create a publicly published code, that generates hashes that are then used as passwords. And the important part: the passwords can be recovered, using the public code and the private personal information.

Because of this, I can't use password_hash() because the result is automatically salted so it produces different hashes each time. I can't manually provide a salt as it is deprecated (produces warning, and likely to be removed in future PHP versions).

My main concern is that some of the passwords could be used on crappy websites, that have small maxlength restrictions, and store the user passwords as plaintext. Thus, I'm assuming attackers could steal the hashed data from the website, and use brute force to deduce back the private data.

In the above example I'm using SHA-512 with key stretching. Though, SHA isn't really designed for this, GPUs are incredibly fast on it, and there may exist, now or later, techniques to circumvent all or part of the iterations.

So, how acceptable is the current technique? Could it be improved, and if so, how? Ideally, the solution shouldn't be PHP-specific, and shouldn't require external libraries.

... attackers could steal the hashed data ... and use brute force to deduce back the private data.

There may be some practical issues, regarding how much entropy there is in the input data

$websiteDomain . $myChildSchool . $myPetName . $etc

If some of this info is known to the attacker then those parts have no entropy. The remaining unknown portions could be brute-forced by the attacker if the remaining bits of entropy becomes too low. You should consider:

Bits of entropy of the input data after the attacker has acquired the 'low-hanging fruit'.
How sensitive is the remaining input data, and what are the potential damages of this being guessed?

  The purpose is to be able to recover passwords ... using only my brain and an internet connetcion. I can't remember l33tpa$sw0rd more than one hour, though I can surely remember my parents' names and so on.

Note that every 'secret question' must be answered precisely character-for-character in order for the resulting hash to be consistent. Also add up the bits of entropy to make sure they are sufficient.

Please read this description of the pros and cons of each popular Slow Password Hash with implementation notes. The best options are BCrypt, SCrypt and Argon2, with the former being the best vetted and the latter being the newest one on the market. Personally I would use BCrypt for this project.

  I can't use password_hash() because the result is automatically salted so it produces different hashes each time. I can't manually provide a salt as it is deprecated (produces warning, and likely to be removed in future PHP versions).

This function uses BCrypt by default, which is one of the good options. You would of course need to specify a hard-coded (unchanging) Salt (which in this situation is considered to be Pepper), and it is best if you can set a custom Work Factor. StackOverflow would be able to help you with those two specific requirements to be implemented in PHP.


Using (cat $file; cat) to run a simple BOF exploit Im getting acquainted with Buffer Overflows (BOF) and was replicating a simple attack described by Techorganic. They create a simple C program called "classic", which contains an obvious BOF vulnerability (when it reads up to 400bytes into an 80byte buffer from STDIN), and then create the proper buffer to exploit it, and save said buffer it to "in.txt". Despite it running its course smoothly, once all preparations are done with, they execute the program with the following command:

user@pc$ (cat in.txt ; cat) | ./classic

My first thought was "holy moly, what's going on there?", the original idea was simple, run classic and input the buffer, my intention was to execute it as:

user@pc$ ./classic < in.txt

Just like any other mortal would do. But to my surprise, their way works, and mine doesn't.

Bottom line is: What does the first syntax do and what is the key difference that made their solution work and mine not, despite them being semantically equal (or similar, apparently).

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this command line with a way to feed its own data from the terminal to the program and this way probably to some /bin/sh or similar executed from this program.

Contrary to this just using program < in.txt just feeds the in.txt to the stdin of the program and after this stdin of the program gets closed. This means that no user input from the terminal is fed to the program and to the shell running inside it.


How to securely run Puppeteer / Chromium in a Docker container? Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing.

The problem is that, from my understanding, to run as root, you need the option --no-sandbox, which is rightly decried as being an insecure and bad solution. The problem is that the go-to alternatives seem to be just as bad:

Running the container with CAP_ADD=SYS_ADMIN, which I think I needn't comment further, or
Running as non-root, but to run Puppeteer in a non-root sandbox, you need to enable the kernel option unprivileged_userns_clone, which once I started researching found it was said to

  "open[s] up severe vulnerabilities in the Linux kernel" (link)

as well as

  "Unprivileged user namespaces are extremely dangerous" (link)

I am surprised that doing something as simple and comparatively low level as running a web browser seems to require such wide ranging permissions that apparently open up wide swathes of attack vectors. The kind of warnings I'm reading are what I would expect to read if I were to root a phone or compromise the operating systems security routines.

Am I misunderstanding the situation here, or is to run Chromium in a Docker container tantamount to opening up my server to half the internet ?

It looks like the best option is to use a custom seccomp profile

You can see an example here

Other links to the file you need in case they disappear:

wget https://raw.githubusercontent.com/jfrazelle/dotfiles/master/etc/docker/seccomp/chrome.json

wget https://raw.githubusercontent.com/Zenika/alpine-chrome/master/chrome.json

Sample usage:

docker container run -it --rm --security-opt seccomp=$(pwd)/chrome.json zenika/alpine-chrome


Usablity vs security malicious file upload We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows:

There is a panel where one can launch a program for listing vulnerabilities
Bob launches his program through our web application
Alice reports the vulnerability with malicious file
Bob receives report with malicious file and gets a warning stating that download might have relative consequences
Bob downloads the malicious file and fall as victim for Alice

Now as per functionality/usability my developer argues that.

We can allow malicious file upload to the application as its core feature of the application (Alice will upload vulnerable file as proof of concept)
We were showing warning message, its enough to prevent users from downloading malicious file, since all users would be tech-savy

Now my argument was as follows:

Attacker can user this platform to social engineer the response team (here Bob would get infected)
As a responsible vendor, the clients will trust us and download the file
Also I referred unrestricted file upload

So considering above situation what would be the best bet to prevent my clients from being fallen as victim for attackers.

If you disallow file uploads, researchers will host their proof-of-concepts elsewhere and provide you with a link to the remote resource, leaving you with essentially the same problem.

The common practice varies. The popular platform HackerOne (which provides pretty much the service you described) allows file uploads, but includes an appropriate warning before offering the download. Google's bug bounty program, on the other hand, does not allow uploads on their bug report form.

Either way, your response team should work in a sandboxed environment and open files only if necessary. I disagree that uploads are "a core feature", as many vulnerabilities can be explained without attachments but via plain text and inline code snippets - although your customers might think otherwise.

Hosting the attachments securely is a topic to itself, but most importantly, you should store all user uploads on a server separate from your web application.


What security products are necessary or advised for a home computer running Windows? There is a lot of security related products for home users and it is becoming unclear what the difference is between them.

What is the difference between antimalware, antispyware, antiadware and antivirus and are all of them necessary? Are other security products such as firewall and anti-spam necessary, as they often come bundled in one product?

Malware is a catch-all term for all viruses, trojans, worms, etc. Very few threats fall into a single category anymore, most malware has traits of all three, so defending against one type of threat is of little use. Anything that calls itself an antivirus is really anti-malware, it's just product naming using familiar terms.

All that you really need as a home user on a home computer is one antivirus/antimalware program with a built-in software firewall. Most of the good ones will also have additional features like browser plug-ins and email scanners built in as well. That gives you a simple, one stop shop for home computing security.

As important as having a good security software package is to keep your computer as up to date as possible with security patches and updates. Also having a firewall instead of a modem on your broadband line.


Use delay with a fixed total time to defend against timing attacks Consider this common example used to demonstrate timing attacks:

async def sign_in(username, password):
  user = await get_user_from_db(username)
  if user is None:
    return False  # early return :(

  password_hash = slow_hash(password)
  return verify(password_hash, user.password_hash)

The usual suggestion is to do the same thing on all execution branches. For example, something like this:

async def sign_in(username, password):
  user = await get_user_from_db(username)
  if user is None:
    actual_password_hash = "foo"
  else:
    actual_password_hash = user.password_hash

  password_hash = slow_hash(password)
  res = verify(password_hash, actual_password_hash)
  return res and user is not None

But I wonder if the following strategy is also useful against timing attacks (not considering other types of side-channel attacks), while not wasting computing resources:

async def sign_in(username, password):
  # Longer than what `sign_in_impl` takes normally
  fixed_duration = ...

  _, sign_in_result = await asyncio.gather(delay(fixed_duration), sign_in_impl)

  return sign_in_result

# Awaits a certain amount of time
async def delay(duration):
  ...

# This takes variable time
async def sign_in_impl(username, password):
  user = await get_user_from_db(username)
  if user is None:
    return False  # early return :(

  password_hash = slow_hash(password)
  return verify(password_hash, user.password_hash)

TL;DR
I don't see anything in your provided code that would need to be protected against timing attacks. The purpose of timing attacks is to learn the plaintext secret, but since your code does not handle the plaintext secret (only a hash of it), your code couldn't leak the plaintext password even if it wanted to.
Technically your hash comparison should be constant time, but see below for why I'm not worried about this in practice.

Background on timing attacks
Let's take a step back and ask what timing attacks are trying to prevent. With passwords, as with all of crypto, you are trying to exploit timing differences in the function that is handling secret data in order to learn the secret.
The classic example is testing for equality between a stored password and a provided password using lazy string compare:
boolean compare(String str1, String str2)
   for (i=0; i<len(str1); i++)
      if (str1[i] != str2[i]) return false;
   return true;

Here you can learn the password one character at a time because when you get the first character right, the string compare will take slightly longer.
What about hashed passwords?
What if you are comparing password hashes rather than plaintext? In theory, if an attacker learns the first character of the password hash, they have gained information, so that is technically an information leak. However, in practice, a timing attack against hashed passwords would require the attacker to submit password candidates p where they can control hash(p) one character at a time (ie first a*, then aa* ...). This is hard. In fact, finding a plaintext whose hash has a given prefix is exactly the cryptographic problem that keeps bitcoin and blockchain secure, and that's on SHA-256; doing it on PBKDF2 or Argon2 would be even harder.
Does your code need to be constant time?
Given the argument above about handling password hashes, it doesn't really matter if this line is constant-time or not:
return verify(password_hash, user.password_hash)

It also does not matter at all whether this line is constant-time; who cares if they can learn password through a complex side-channel attack, they just submitted it to you, they already know it.
password_hash = slow_hash(password)

IMO it also doesn't matter whether your DB queries are constant time. The attacker would be learning how full your DB is, how much backend network congestion and server load you have, etc, none of which helps them crack passwords. (if your product security model does want to protect info about backend load, that's a much harder and completely separate question).

Bonus: adding random delays
While not directly mentioned in your question, I've written before about how adding random timing delays increases the number of statistical samples (ie the number of login attempts) that an attacker needs in order to perform the statistical attack, but it's ultimately not a solution.

Can I prevent timing attacks with random delays?


Can the System Admin (the main guy with all the permissions) decrypt confidential data from the server? We have a company Foo, we have user data all encrypted that are stored in some kind of a database.

Correct me if I am wrong, the encryption keys have to be saved in the system.

Now say the admin called bar who is the main guy managing the system who has access to everything decides to go rouge, and he uses the encryption keys and decrypts all the data.

looks impossible, but is it remotely possible to prevent Cypher keys from being stolen by an employee?

Answer to your title = YES

Answer to your body question = NO

as an IT Manager, I can confidently answer your question with a no. It is not possible to prevent cypher keys from being stolen by bar or anyone else who have access to the server.

The only counter measure would be storing the keys on a different server but still needs someone who should keeps an eye on and guard. (which goes in a loop)

So in a conclusion, it's a matter of trust no more - the whole thing.

Extra

Anyone who have access to the specified server can decrypt whatever data on it assuming that the encryption keys are stored there too.
also note that a user who has access to the specified server (with unprivileged powers) can work it around using some local / shell exploits in order to get root privileges/access allowing him/her to manipulate and steal or view sensitive information / data, also can implement a backdoor for later on access.
It is impossible to remotely prevent such thing, because if i'm the sys admin of that server, means i have ssh access to it, means i can use an ssh tunnel to work and do the evil stuff behind the server's IP address, so nor firewalls nor anything can block me or prevent me from stealing whatever i want.


Using a windows partition as a decoy I'm interested in setting up a laptop that dual boots Windows 7 and openSUSE. The plan is to encrypt the openSUSE partition and require a USB thumb drive with the encryption key for it to boot. Where if the USB drive is not plugged in at boot time it will instead boot to an unencrypted Windows 7 partition without looking too suspicious.

So what I'm curious about is whether this is doable and whether it's a reasonable thing to do.

Is this doable? Of course yes.

Is this a reasonable thing to do? It depends on what you goal is. If you only want that your child or girl friend can play winmine with little to no risk for you sensitive openSUSE partition, that is fine. That means a reasonable protection against mistyping on a keyboard without true malice. And if your girl friend is not a computer specialist, it can even be enough to hide the mere existence of the second system.

If you are looking towards plausible deniability, it is no longer reasonable at all. Anybody with standard knowledge on computers will see immediately that:

the windows partition does not use the full disk size
another partition exists and looks bootable - I'm not an expert on openSUSE encrypted partition, but as the goal is only to protect data, I would suspect that it is easy to guess that the other partition contains a Linux system.

VeraCrypt documentation contains a full chapter about it explaining the limits of their solution which is still accordingly the linked Wikipedia pages among the best existing and maintained ones.


What does "unknown" status in nmap mean? scanned my IP number with nmap and I got all "unknown" status ports.

What does that mean?

The "unknown" port status doesn't come up very much, but it can happen when you try to scan your own IP (or 127.0.0.1) on Windows. This is because Windows does not have raw socket support, so Nmap's SYN scan packets have to be crafted at the Ethernet level. This just doesn't make sense for a localhost connection, and there's no way to do it.

To get valid results, you should add -sT to your command line. This selects Nmap's TCP Connect scan, which will succeed. Alternatively, if all you need is a list of open ports, the netstat utility will give you exactly what you need.


Question about transparency I would like to run a web service (based on Node.js) and I'd be happy to be as transparent as possible with my users.

Ideally I'd like to give the users the possibility to verify somehow that my server is running a certain sourcecode. That is, I want the clients to be able to verify that I'm running some code posted online (for example in GitHub) that they can independently verify.

Are there hosting services (Azure, Amazon, etc) offering this kind of possibility? If not, what is the best method?

thanks a lot

A possible idea for this might be a page that calculates a cryptographic hash of the code on your server, and exposing the code that calculates that hash. Then, you can have users verify that:

Your hashing code does what it should;
Your hashing code is the same as the one on your repository;
Your hash matches the hash generated from the repository.

The other alternative is to enable read-only directory browsing on your site, probably through a page that can render any source code file on your site.


What are some well known websites that do not require multiple character sets in passwords? NIST guidelines discourage password policies that require multiple character sets.

  Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets.

It also explains why.

I'm currently lobbying within my company, which is primarily a B2B, to adhere to this guidance but experiencing pushback based on the argumentum ad populum that it is "industry standard".

Just judging from memory I can recall that several websites have required multiple character sets, but right now the only ones I can find are Microsoft and StackOverflow .

What are some major websites that I can cite as examples that adhere to the above NIST guideline of not requiring multiple character sets?

These websites don't require multiple character sets in passwords:

Google Account - Includes YouTube and others
G Suite
Facebook
Wikipedia
Amazon
Reddit
Yahoo
Twitter
Instagram

Unfortunately, this list is sparse when it comes to B2B websites which may be more convincing to your B2B peers. If any readers are aware of big B2B website password policies, please add them to this list. This answer is a Community Wiki.

When possible I have linked to the password policy. When I can't find an explicit password policy, I personally verified their adherence to NIST by creating an account with the all-lowercase password.

Interestingly, although many sites do not publish their password policy, they almost universally publish password guidance recommending the smart use of multiple character sets, as doing this intelligently is sound password security and in line with NIST guidelines.


Can I assume that the Windows profile directory is not writable by other users? Can I assume that the Windows profile directory is not writable by any user other than the user my program is running under and the system administrator (who can access anything)?

More specifically:

The SlipRock library creates a directory ~/.sliprock.  This directory contains temporary files, which in turn contain (among other things) a secret access key.  Therefore, if other users are able to read these files, the result is a security vulnerability.

The directory is created with strict permissions that deny access to untrusted code, but these are moot if another user could rename the directory.  Can I be confident that a user’s home directory (as returned by GetUserProfileDirectory) is a secure directory?

Yes, %UserProfile% is a secure directory in such a way, that it's protected from being read or altered by other users in the default configuration.

It is not a secure directory, in such a way that any system administrator including backup operators, holder of various privileges (SeTakeOwnershipPrivilege, SeTcbPrivilege, ...), anyone who can access the files offline, etc. can read, and in most cases, alter the files.


How to store malware executables? I have been developing a simple honeypot system.

Configuration of the honeypot system is:

Main router R has two parts: part A and B.
Part A is turned off and part B is set as a DMZ with a single PC running on Windows 7.
Part B PC has a deactivated antivirus. Access to hard drive partitions are configured to ReadOnly, except OS partition.

How can I freeze (for analysis) a malware, assuming bots/hackers are sending malware/spyware? I mean how can I store the binary of the virus/malware which has been sending by the attacker before it executes. And how can I log the attacks?

Logging attackers will be highly dependent on how you set up the honeypot system you describe. What methods you expect (or don't expect) attackers to use to acquire access and what they do within the system there.

Secondly you will need a method of identifying malware. How in depth you want to set up logging on the operating system is up to you here. You can log a lot of things... You have to draw the line somewhere.

As for quarantining malware for analysis, the accepted method is to archive or encrypt it. The professional community prefers the encryption method because only the researcher who encrypted it can decrypt it (avoiding the whole "Hey! whats in here?" problem with archives with no password).

Encrypted malware can be safely transported to the analysis machine for debugging and examination. The analysis machine should be a VM. This way once the analysis is complete, the VM is simply nuked from orbit and restored, ready for the next test. The reason we do it this way is to avoid missing a piece of malware somewhere and contaminating a subsequent analysis.

Hope this helps!

EDIT:

I missed the bit where you state "freezing the malware before it executes". You can't. You can use the same heuristics and detection as the antivirus to get known malware before it runs. But then, it's known. Why would you want to analyze these. The unknown ones are, by definition, unknown. Therefore there will be no reliable way to stop them. You will only know after the fact they are malware.

I think a better way to do this would be to replace your windows7 component with a VM in the DMZ, then you can isolate and encrypt the malware through whatever method you wish and then transport it for analysis. Then nuke the DMZ VM and replace it with a fresh version along with your analysis VM. This way, you always revert to the same uninfected configuration. You can also activate the antivirus in the DMZ VM and set it to only quarantine in the case you wish to analyze known malware also.


How do Services recognise 2-Factor Authentication codes as correct? Something about the flow of setting up 2-factor authentication is not clear to me.
This is the flow of setting up a Service* to use a 2-factor auth app**:

Choose setup 2-factor auth in the account security section. This shows up with a long key.

This key is copied and entered when adding a service account in a 2-factor auth app** that allows for having 2-factor auth for multiple accounts of different services.

When it is added, it spits out a time-limited code that is entered back into the service app and 2-factor auth is set up.

Codes like those are then used every time to do 2-factor auth.

What I don't understand is how does the service and a 2-factor auth app know/recognise each other in step 3.
*Instagram, Amazon etc.
**Duo Mobile, Microsoft Authenticator, 2FA

This is done by inference.
The code the app creates is based on the current time and the key. The key is unique to your account on that service.
When you enter a 2FA code (it doesn't matter when), the service checks that code against the key for your account and authenticates you (or, more technically, it authenticates the 2FA app, but that's a side issue).
Step 3 in your process is only a convenience. If the code works, then the service can infer that 2FA was set up properly and can continue the process to mark your account as using 2FA. If this check was not done and something went wrong in setting up your 2FA app, then you could be locked out of your account. However, if the code works once, then the service can infer that all future codes should work, too.
There is no "know/recognise each other" in this process. There is only checking the code against the key by the service.


Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app? Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this audio from being viewable outside of the app.

I've been thinking of encrypting it using AES with an IV and key that are both generated from a pseudo-random function that takes the user's unique ID as input. However, if an attacker found out that this was the way we encrypt our files, and had access to our PRF, he would easily be able to decrypt it and store it permanently. The thing is, I don't have enough background in cryptography or android programming to tell if that's really a concern or not. The attacker has to learn a lot about our cipher in order to break it, but he could gain pretty much all of that from looking at the unobfuscated source of our app.

Is my suggested approach cryptographically secure? What other, better or simpler approaches could I take to solving this problem?

In principle, there is no way to solve this problem.  Snapchat is a lie.  If Alice is motivated and knowledgeable, she can arrange to make persistent copies of any snapchats that she can view.  There are probably dozens of ways to do this: making screenshots, reverse-engineering the app to steal the decryption key, rummaging through memory to find the data and making a copy, etc.

There's no way you can prevent a motivated, knowledgeable user from making a permanent copy.  Trying to stop that is like trying to make water not wet.

All you can do is raise the bar a little bit, so that it's non-trivial to make a permanent copy (i.e., make it so unknowledgeable or unmotivated users are unlikely to succeed).  That's a risk reduction approach.  But nothing will be secure in principle.  As a result, this is not really a question cryptography can solve.  It's more a question about security.  You might want to try asking on Security.SE.


IP cameras are viewable in home Wifi and REMOTE Wifi, but not in 3G? I was in the process of setting up my IP camera port forwarding so I can view them remotely, but to my surprise, it's already working somewhat, but only if I am on a remote/external wifi, not on a non-wifi network such as my iphone data plan.  How is this even possible!??

Here's my set up:

A Google Wifi is hardwired to my u-verse router.  u-verse wifi is off so GWF is the exclusive wifi that my IP cams are connected to at home
I was able to view the cameras when I was at the home WIFI, but not when I am on data (as expected), so I proceeded to set up remote access/port forwarding
Did the static IP on both cameras GUI
Set up DHCP IP reservations and port forwarding on my GWI GUI(for only one of the cameras, just to ensure the first one would work)
Still couldn't see my camera on my iphone when it's on data plan.  Was told by Google support that I would also need to port forward my GWF within the u-verse router, which I haven't done, but will do later tonight.  So my cameras should still be protected, right?
To my surprise, when I am at work, thus using a different, external, and remote Wifi, I could actually see BOTH cameras.  If I get off the work wifi, for example, using the phone's data network, I couldn't see the cameras (as I would expect until I complete step 5).

So how is this even possible?  It's as if it's treating my work's wifi the same as my home wifi, which of course is impossible.  The only thing that would give it away is the static IP and DHCP IP reservations, but why does it only work on wifi but not on data?  Can someone please explain to me?  Is there a security issue with my network? Thanks!

It sounds as though the client application you are using on your phone is only allowing connections over WiFi and not via 3G. Video feeds do use quite a bit of data relative to other phone applications. This may be something you can configure within the app to allow the video feed to work via 3G.

Many phone applications treat their WiFi connections and the telcom network connections very differently in many ways. Not knowing more about your situation I would verify the app's settings and also it's support for streaming video over 3G.

On the security side: When you open this to the Internet you have given the world attack surface on your network. There are numerous bugs and security issues with typical remote cameras. Do be aware that other people may one day be able to access this as well. Likewise, do consider that they may also use this device to pivot into other devices on your network.


How SSL works in SMTP? Whenever I see a red lock icon in gmail, I thought the sender doesn't have SSL configured.

But one person told me only server (gmail in our case) SSL is enough?

Does that mean the sender don't need to configure any SSL at all and can communicate with gmail over SSL since gmail already supports it? Or both party need SSL to communicate in SMTP?

If one party SMTP SSL is enough why do some companies still deliver the message as plain text?

Mail delivery is done hop by hop and not end to end. This means a typical sender in a company delivers its mail via SMTP (or some proprietary protocol) to the mail server which then delivers it via SMTP to the next mail server etc until the final mail server gets the mail and stores it. In some cases this can involves many hops which not only include simple mail transfer agents but also mail filters, firewalls or similar.

SSL can be done at each of the different delivery steps or it can be omitted. If it is done it needs to be support by both the sending MTA (as SSL client) and the receiving MTA (as SSL server). gmail actually does not now about all these steps. The red lock is only shown if TLS was not used on the last step of delivery, no matter if the previous delivery steps used TLS. And it will not be shown if the last step used TLS but some previous steps did not.


Does QUIC really solved IP spoofing problem Many documents indicates that in QUIC solves IP spoofing problem by a server generated token. Specifically, server issues a token so that the client can use it to identify itself, then the server will only respond to those with valid tokens.

But can't the attacker just IP-spoof the initial connection? Wouldn't that achieve the same effect of IP spoofing of DNS or NTP server?

But can't the attacker just IP-spoof the initial connection? Wouldn't that achieve the same effect of IP spoofing of DNS or NTP server?

The problem with IP spoofing in DNS or NTP is not that the reply will go back to the spoofed IP address instead of the real sender because this is also true if you spoof the IP address in a TCP SYN. The problem instead is that often the response is much larger than the request and thus an attacker can use a small bandwidth with spoofed IP addresses to cause a large bandwidth attack against the spoofed IP (i.e. amplification attack).

TCP solves this problem by having only a small response to a small request so that nothing gets amplified. Unfortunately I cannot easily find information about the actual size of the source address token in QUIC but I hope that amplification attacks are considered.

EDIT: thanks for paj28 to point to an article where the problem of amplification in QUIC is addressed in more detail: ...the client hello will always be larger than, or equal to the size of the server response.... This means that amplification attacks as the main problem of IP spoofing will not work.


OpenSSL certificate revocation check in client program using OCSP stapling 2 Pretty much this is request for additional information for the question: https://stackoverflow.com/questions/9607516/openssl-certificate-revocation-check-in-client-program-using-ocsp-stapling

I want to know how OpenSSL actually handles OCSP stapling response. Questions are:

Does the OpenSSL check the signature, issuer key/name hashes of the response?
Does the response include OCSP responses for the whole certificate chain? If so, is there a way to know that one of the validations have failed?
To sum up, can I simply rely on 'Cert Status: good' field of the response? :)

My concern is that hacker may craft https server using revoked (stolen) certificate but during handshake provide valid stapled OCSP response for a random website that was certified by the same CA issuer. Could the OpenSSL handle such situation?

The sample OCSP response can be found here https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html#testing-ocsp-stapling

how OpenSSL actually handles OCSP stapling response

OpenSSL does not do anything by its own in this area. You have to explicitly deal with OCSP stapling in your code, both for signaling that you support stapling and for validating and interpreting the response.

Does the OpenSSL check the signature, issuer key/name hashes of the response?

If the proper functions are used you can do it. Validating a OCSP response is in most ways similar to validating a certificate or a CRL, i.e. validating the trust chain. Apart from that you need to verify that the OCSP response actually is for the correct certificate.

Does the response include OCSP responses for the whole certificate chain? If so, is there a way to know that one of the validations have failed?

This depends on what the server sends and what the client requests (i.e. single OCSP response or multiple). And since you have to implement all the details anyway you have also the information what part of the validation failed.

To sum up, can I simply rely on 'Cert Status: good' field of the response? :)

No, you cannot simply trust any OCSP response sent by the server.
You have to do all the validation of the OCSP response yourself. Apart from the already mentioned parts this involves also checking if the response is stale (too old). And of course the certificate might have been revoked in the last minutes but the response is still valid, i.e. OCSP does not provide real-time information about the status of a certificate.
Note that only very OpenSSL based tools or libraries implement OCSP and/or OCSP stapling at all and even if they do it is usually not enabled by default. This is not much different with other TLS implementations.


Outsmart Google Drive censorship with 7zip encryption I use sometimes Google Drive for sharing large files. Google Drive is fast and user friendly.

I don't wish that Google sees the content of my files and try to encrypt the filename and content. My question is it really secure (Google sees only data trash) or should I optimise my command? I generate a 30-50 character password. I need to use 7zip, because I share files for non-tech-savy users.

7z a test.7z /tmp -p -mhe=on

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,4 CPUs x64)

Scanning the drive:

WARNING: Permission denied
/tmp/cvcd/

6 folders, 6 files, 111 bytes (1 KiB)

Creating archive: test.7z

Items to compress: 12

Enter password (will not be echoed):
Verify password (will not be echoed) :

Files read from disk: 1
Archive size: 534 bytes (1 KiB)

Scan WARNINGS for files and folders:

/tmp/cvcd/ : Permission denied
----------------
Scan WARNINGS: 1

Quote from Reasons not to use Google by the pioneer Richard Stallman.

  Google shut off Alexa O'Brien's Google Drive account, denying her
  access to it, because her reporting on Chelsea Manning's trial
  included copies of al-Qa'ida propaganda that was presented as
  evidence.

It is reasonably secure. If google's censorship is automatic (as I suspect) it doesn't really matter either, as long as google doesn't automatically break the encryption. For 7z, they don't.

The encryption in 7z is good, and I have not heard of any practical attacks. If all you need to achieve is hiding it from automated scanning, it doesn't really matter.

If you're up against an adversary which knows the clear text you may be sharing, you should look into padding it, to hide the size.


does HTTP PUT data get encrypted over TLS (HTTPS)? I am wondering if the "/todo1" part of the below URL

curl https://someserver:5000/todo1 -d "data=Remember the milk" -X PUT

Gets encrypted over TLS/HTTPS, or is the full URL that you're sending your request to visible to a middle man?

Your curl command.first triggers a DNS request to resolve someserver. So even if the whole will get encrypted man can still get this information.

Then a TLS tunnel is created to this server to the port you specified (5000 in your exemple). This would trigger certificate exchange and keys exchange to encrypt the HTTP request itself.

The whole HTTP protocol being encrypted in the TLS tunnel, none of their methods would be available for a man-in-the-middle.

You can verify it by using tcpdump or wireshark while running your command.


Should the access to nearby friends location data and last active time be rate limited? Facebook let you see nearby friends approximate location data and last active time.

It is pretty easy to write a script running 24/7 to monitor, record and plot these info, giving you a complete picture of user activity.

Should security engineers consider to rate limit the access to these data to avoid such scraping tools? (as no real user can be online 24/7)

As of today there haven't been any efforts from facebook to restrict such APIs, mostly because it'll not let people build legitimate products using such features or APIs.

In past people have already developed tools that profile user's activity using such 'leakages'. One prominent tool released last year is fb-sleep-stats. This tools polls user's messenger activity status every 10 minutes and then graphs their sleep patterns.


Can JWT authentication act as an anti-CSRF mechanism? On the Angular single-page application (Angular + REST API) I use JWT authentication. Let's assume JWT tokens are properly generated and really random (you can't predict it).

Is this JWT token enough protection against Cross Site Request Forgery (CSRF)? In the other words, is JWT sufficient as anti-CSRF token as well?

If the JWT is in a header, you should be safe. The attacker can't fool the victims browser into setting the header (unless CORS allow it, or she leverages an old Flash exploit). But lets say the attacker can control the header. Then what should she set it to? She wouldn't know.

On the other hand, if the JWT is in a cookie you will be just as vulnerable as with an ordinary session cookie. So wheater you are vulnerable or not has little to do with what kind of token you use (JWT or session ID) but more to do with where you put it (header or cookie).

Even when the authentication comes with automagic CSRF protection, you may want to consider adding a explicit CSRF protection anyway. There is always a risk that someone changes the authentication mechanism without realising it has double purposes.


How secure is pgAdmin to save database password? When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the database.

I can't find in any document how this password is stored. Is it encrypted? Saved under Windows protection? Plain text?

Does anyone knows the security implications of saving a database password in pgAdmin?

In pgAdmin 4.x the password file location can be specified in GUI whereas pgAdmin III has a fixed path. Both documentations refers to the PostgreSQL libpq (C Library) documentation for The Password File:

  The file .pgpass in a user's home directory can contain passwords to
  be used if the connection requires a password (and no password has
  been specified otherwise). On Microsoft Windows the file is named
  %APPDATA%\postgresql\pgpass.conf. Alternatively, a
  password file can be specified using the connection parameter passfile
  or the environment variable PGPASSFILE.

  This file should contain lines of the following format:

hostname:port:database:username:password

TL;DR: It's unencrypted in a file.


What's the purpose of anonymous Diffie-Hellman key exchange + verification? I attended a lecture where a procedure for solving the problem of passive attackers being able to gain knowledge about the identities of communication partners using an authenticated Diffie-Hellman key exchange was presented.

The solution looks like this: Alice and Bob do a DH key exchange where Alice sends A to Bob and Bob sends B to Alice. They then calculate the secret K as usual. Then, Alice sends Enc_K("Alice", Sig_Alice(A)) to Bob and Bob sends Enc_K("Bob", Sig_Bob(B)) to Alice.

Obviously, this has the property of denying passive attackers to learn the identifies of the communication partners and the property of denying active attackers to impersonate one of the communication partners towards the other one (if everything else like the selection of the random numbers for the key exchange, the encryption and signature functions, the following communication, etc. all is done in a secure way, that is, of course).

When learning about this technique, the question of why the DH key is needed emerged to me. If they already have asynchronous crypto and have exchanged their PKs in a secure way, why doesn't Alice just send a randomly chosen K to Bob? This would mean that the communication can start right away, not only after 2 round-trip times. Going from 2 round-trip times to 0 while making the procedure simpler seems too good to me. So what am I missing?

If you use the partners static authentication key for encrypting a session key, then you have no forward secrecy. Once this key is ever compromised (which is not unlikely since it is a long term static key) all communications can be decided after the fact.

You do not have this risk with a DH established session key and you only need a keypair for authentication not for decryption.


Reseting my computer to uninstall LogKext My friend downloaded LogKext on my computer, so I'm guessing he can see every keystroke, but I've reset my computer so that it's in a condition when I first opened from the box.
Can my friend still see my keystrokes? Is he the only person that can uninstall it?

Theoretically speaking, you cannot trust the integrity of your system anymore. Your friend might have installed a different key logger, or even installed some sort of rootkit.

To install LogKext, one needs to know the user's password (to get into administrator mode, AKA root), or needs to login in single-user mode. In both cases, your friend knows too much and has had too much access to your computer.

Resetting Mac OS X to the factory default only clears the files installed normally by users, such as your /home directory and other related files. So it very likely won't remove certain keyloggers. According to LogKext documentation, you can remove it by executing the script LogKextUninstall.command in your root directory.

I recommend completely wiping out your hard drive and then installing your operating system again.