X.509 algorithm identifier parameters vs. extension values From the X.509 specs:

AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }
                                -- contains a value of the type
                                -- registered for use with the
                                -- algorithm object identifier value

Why isn't Extension defined similarily?  Here's how it's defined right now:

Extension  ::=  SEQUENCE  {
     extnID      OBJECT IDENTIFIER,
     critical    BOOLEAN DEFAULT FALSE,
     extnValue   OCTET STRING
                 -- contains the DER encoding of an ASN.1 value
                 -- corresponding to the extension type identified
                 -- by extnID
     }

Why is it not this?:

Extension  ::=  SEQUENCE  {
     extnID      OBJECT IDENTIFIER,
     critical    BOOLEAN DEFAULT FALSE,
     extnValue   ANY DEFINED BY extnID
     }

Nominally, the contents of the extension (the extnValue) could be any sequence of bytes. The "value bytes" are to be interpreted relatively to the extension ID; each extension is free to define its own syntax.

The extension which are defined by X.509 itself all use ASN.1: for each "standard" extension, the syntax for the corresponding value uses ASN.1, so the extension value, to be stored in the OCTET STRING, shall be the DER encoding of some ASN.1-based object. Hence the comment. However, extensions can be, by definition, arbitrary, and X.509 uses an OCTET STRING so that other standards or implementations may define their own extensions which are not necessarily based on ASN.1 (I have seen that in the wild).

There is nothing really profound here. X.509 could have defined the Extension type as you suggest, with an ANY; in which case people who want to use non-ASN.1 extension values would have had to encapsulate them in an OCTET STRING. The discrepancy between Extension and AlgorithmIdentifier just shows that these structures were defined by distinct people, and the whole ASN.1 ecosystem is known never to have exhibited tremendous consistency. Also, for backward compatibility, decisions such as using an ANY instead of an OCTET STRING (or vice versa) tend to stick for a long time.


Is it safe to set rejectUnauthorized to false when using Heroku's Postgres database? I am trying to put some fields in a Postgres database hosted on a Heroku app and it keeps returning this error:

Error: self signed certificate
code: 'DEPTH_ZERO_SELF_SIGNED_CERT'

I have tried adding a key, certificate, and CA bundle but to no avail

Many StackOverflow questions with the same error say to set the variable rejectUnauthorized to false when making the http server. My question is how safe is this with a Postgres database on Heroku and would it pose any threat to the security of the database?

If the information helps I am using a node.js script to send the query to the database.

Heroku does not support client-side certificate validation to its Postgres databases unless you are using Private Spaces or Shield:

  Unless you're using a Private or Shield Heroku Postgres database, Heroku Postgres does not currently support verifiable certificates.

My understanding is that in this case, the best you can do is:

Your connection is encrypted and you are protected from eavesdropping
Not protected against Man-In-The-Middle (MITM) attacks

ssl: {
  sslmode: 'require',
  rejectUnauthorized: false,
}

This is the highest level without certificate validation, according to the table here:


How does Google Authenticator interact with apps on an iPhone? I am clear on how Google Authenticator works when logging on to a website and I am clear on that.
However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the Instagram app etc thus not bothering much for the web interface.

So my question is this: does Google Authenticator protect these apps too?  I am about to start using Google Authenticator but I don't understand how it will keep me safe when I am using the Twitter app or the Facebook app. Could somebody please explain, in simple terms because I'm not technical at all, how Google Authenticator protects my social media account when I'm using the app?

For example, if someone somehow finds my Twitter password and installs the Twitter app on their smartphone wouldn't they get instantaneous access to my Twitter account? So how exactly does Google Authenticator on my device stop the hacker from accessing my account when they are not going to access it over the web in the first place? (Say they'll use a "burner" phone).

I would really, really appreciate any answer on this because I've spent the entire day trying to find it on the Internet and there is absolutely nothing available (or I'm just too dumb and couldn't figure it out when I read it).

Thank you very much.

For example, if someone somehow finds my Twitter password and installs the Twitter app on their smartphone wouldn't they get instantaneous access to my Twitter account? So how exactly does Google Authenticator on my device stop the hacker from accessing my account when they are not going to access it over the web in the first place? (Say they'll use a "burner" phone).

Twitter will require a second factor for authentication everywhere, including on the web, app on the phone and so forth. So to log in you need your username, password and 2. factor.

Google Authentitcator (or any other TOTP-generator) doesn't have to be on the same piece of equipment as the app. It does not directly interact with the app in any way.

The 2. factor is derived from a shared key and current time. The shared secret key must be kept secret from an attacker, but the time-based codes generated will not reveal anything about the code.

In case you use third party apps that does not support 2FA, many services lets you generate app specific passwords, which is more secure as they often are rather long, and not entered more than once, making them less susceptible  to phishing attacks - and they can usually be invalidated with a single click.


Is there a way to hide HTML source code yet keeping it effective? I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP):

<form action="mailto:someone@example.com">
    Email Adress:

    <input type="email" name="email_address" value="" maxlength="100" />

    <input type="submit" value="Submit" />
</form>

I would like to hide that mailto:someone@example.com from all HTML source codes that include it, so that users would not be able to find the email address even in source code directly;
This way, generally only customers who have sent me an email and got a reply --- would know the email address (unless the user undid the hiding operation).

Is there a way to hide HTML source code yet keeping it effective?

Update

From reading all answers calmly, it seems my question had a false assumption: I missed big time that mailto will always eventually show the email as is in a user's email client pop up (and maybe also before that in preview in the bottom-left edge of the browser screen port); I think I missed that because a cognitive bias of the combination of replies suggesting source code obfuscation and an redundant-in-my-opinion sentence such as The question doesn't even make sense on a conceptual level; which I tried to remove in an edit (which was partially approved, sadly). I now understand that whatever I'll do, no matter how I'll obfuscate the source code; the email I putted in mailto will always eventually appear in a user emails client applied to a browser (if there is one - if not, there would just be no email sending effect).

You cannot hide HTML and expect the browser to be able to interpret it. The browser needs full access to the HTML in order to display all parts of the site. As soon as the browser has access to it, the user can also gain access to it.

On a further note, JavaScript is also not able to "hide" the content of the site and still make it accessible to the browser, and thus the end user, for the exact same reason.


AEAD and nonces explained in layman's terms (Symmetric encryption example using Libsodium) After almost 4 days of work, I've finally gotten Libsodium crypto_aead_xchacha20poly1305_ietf_encrypt to work and produce the same result in JavaScript and PHP.

But I'm confused.

The PHPDoc describes the parameters as:

* @param string $plaintext Message to be encrypted
* @param string $assocData Authenticated Associated Data (unencrypted)
* @param string $nonce Number to be used only Once
* @param string $key Encryption key
* @return string

While JSDoc asks for these parameters:

/**
 * @param {string | Uint8Array} message
 * @param {string | Uint8Array} additional_data
 * @param {string | Uint8Array} secret_nonce
 * @param {Uint8Array} public_nonce
 * @param {Uint8Array} key
 * @param {uint8array} outputFormat
 * @returns {Uint8Array}
 */

My questions:

It seems like a nonce is a type of salt of a specific size that can only be used once because otherwise replay attacks can happen. Can you help me understand this further? Wikipedia and other sites got too complicated.
To a layman, how would you describe AEAD and how to use the "Authenticated Associated Data (unencrypted)" parameter?
In the PHP function (which I copied from https://paragonie.com/b/kIqqEWlp3VUOpRD7), does using the nonce not just as a nonce but also as the "Authenticated Associated Data" reduce the security compared to some other approach where the sender would add some value here and communicate offline to the receiver what the receiver should expect this value to be?
Why would the JavaScript version accept different parameters? JS asks for a secret_nonce separate from a public_nonce, and in order for the results to match PHP's function, I need to supply identical values for secret_nonce and public_nonce. So what's the point?

P.S. Here are the functions:

JavaScript:

/**
 * @param {string} message
 * @param {Uint8Array} key
 * @returns {Uint8Array}
 */
function encryptAndPrependNonce(message, key) {
    let nonce = sodium.randombytes_buf(nonceBytes);
    var encrypted = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(message, nonce, nonce, nonce, key);
    var nonce_and_ciphertext = concatTypedArray(Uint8Array, nonce, encrypted);
    return nonce_and_ciphertext;
}

PHP:

/**
 * @link https://paragonie.com/b/kIqqEWlp3VUOpRD7 (from the `simpleEncrypt` function)
 * @param string $message
 * @param string $keyAsBinary
 * @return string
 */
public static function encryptAndPrependNonce($message, $keyAsBinary) {
    $nonce = random_bytes(self::NONCE_BYTES); // NONCE = Number to be used ONCE, for each message
    $encrypted = ParagonIE_Sodium_Compat::crypto_aead_xchacha20poly1305_ietf_encrypt($message, $nonce, $nonce, $keyAsBinary);
    return $nonce . $encrypted;
}

It seems like a nonce is a type of salt of a specific size that can only be used once because otherwise replay attacks can happen. Can you help me understand this further? Wikipedia and other sites got too complicated.

A nonce is required to make sure that the ciphertext doesn't leak information. Such a nonce or IV is required for any CPA secure cipher as repeated plaintext may otherwise leak information.

For stream ciphers - as used by most if not all AEAD constructions - a unique nonce is required otherwise you will leak all of the plaintext. It may also compromise the (internal) hash key, leading to a full compromise of the authenticity property (!!!).

  To a layman, how would you describe AEAD and how to use the "Authenticated Associated Data (unencrypted)" parameter?

The AAD can contain any data that needs to be authenticated but doesn't need to be - or cannot be - kept confidential. For instance: it may be a good idea to protect the recipient field of a message in a protocol, but if it is hidden then the network may not be able to get it to the destination in the first place.

  In the PHP function (which I copied from https://paragonie.com/b/kIqqEWlp3VUOpRD7), does using the nonce not just as a nonce but also as the "Authenticated Associated Data" reduce the security compared to some other approach where the sender would add some value here and communicate offline to the receiver what the receiver should expect this value to be?

Adding the nonce to the AAD never increases security, because AEAD ciphers already include it into the calculation of the authentication tag.

How much "some value" adds to the security depends of course on the protocol and possible attack vectors. Note that a nonce must be unique, but your protocol may not use it against replay attacks. In that case adding data to the AAD may help prevent such attacks.

Note that AEAD already requires a secret key and a nonce; there is no need to add another key or nonce (to secure the cipher itself). Adding the identity of the sender / receiver odes generally makes sense.

  Why would the JavaScript version accept different parameters? JS asks for a secret_nonce separate from a public_nonce, and in order for the results to match PHP's function, I need to supply identical values for secret_nonce and public_nonce. So what's the point?

The JS library doesn't actually use the secret nonce parameter called nsec. If you read the documentation you will always find:

  nsec is not used by this particular construction and should always be NULL.

Note that poly1305 requires two keys, of which the second "key" is handled as a number. However, the second key - usually denoted r - may be generated pseudo-randomly as specified here.

Generally it is preferred to use a single key for the cipher alone, so implementations will probably not support the dual key version and generate r internally. But I think that is why the nsec parameter exists in the first place.

For the GCM / GHASH the key is universally created internally as well.


Firefox Flash plugin malware? I am running firefox 11 on ubuntu 10.04 and every time I close the program it continues to run in the background. What worries me even more is that the flash plugin is also running in the background:

ps aux | grep firefox
userxx     99999 11.4 10.3 689152 105696 ?       Ssl  22:33   0:30 /usr/lib/firefox-11.0/firefox
userxx     99998  0.0  2.8 333912 29064  ?        Sl  22:34   0:00 /usr/lib/firefox-11.0/plugin-container /usr/lib/flashplugin-installer/libflashplayer.so -greomni /usr/lib/firefox-11.0/omni.ja 13568 true plugin

Is this normal behaviour, or even just an innocent bug? Should I be worried about malware reading and writing to my personal files?

It's not a bug, it's a feature. It might be abused for evil purposes, or misused by developers.

Install NoScript addon, no flash plugin will fire itself up without your consent. This is why firefox will always be more secure than Chrome, alternatives are not up to the task yet and for some reasons it takes time for google developers to provide the necessary interface to NoScript developers in order to easily port it fully. Anyways, they do a great job and keep up with every known abuse of web browsing technology. A must have if you mind about security.


User-friendly public/private manual authentication protocol I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance).

In the course of using the application, I would like to request re-authentication.

For instance, when attempting to perform a secure operation. (For example, banks require re-authentication when request a money transfer).

How do I re-authenticate without requiring them to Re-SSH?

Is there any simple manual authentication protocol I can use?
Give the user a challenge, they compute the result with their private key, etc.?
Are there any reasonable command line tools/libraries to simplify the task?

I guess you use SSH-keys as authentication? Reauthentication and key exchanges happens all the time during the SSH protocol, so having a Active session is secure enough.

Another thing is confirmation, eg, you want that the user really wants to commit a action that might be irreversible. Lets say deleting something.

To solve this problem, I would suggest you simply show a random 6 digit code on screen and ask the user to retype it to signify a "YES". (and treat as "NO" if the 6 digit code was incorrect or no code is written.)

Like this:

Are you really sure you want to delete the database records_2013.db?

If NO, just press ENTER now.
If YES, type the following code - 193619 - here, and press ENTER: _

This then solves your problem perfectly, since the SSH server/client would make sure it has a valid authenticated Connection to the server, which means a malicious user cannot hijack a authenticated SSH session, and the random confirmation code, then ensures the user does not, by mistake, commit to a dangerous operation.

Note that this code is not considered to be a captcha, so it wont hinder automatic submissions. But reauth by ssh-keys wont solve that either.
The code is just there so the user stop and Think really carefully if he want to proceed Before proceeding.

The reason banks use some reauthentication scheme, is that sessions can be hijacked since HTTP/HTTPS is a stateless protocol (Connection are closed after the page are sent, making it hard to use the underlying protocol to do session authentication), but also for the second reason, to prevent users from by mistake, sending Money somewhere they did not intend.


How revocation status of delegated OCSP responder is verified at the client side? If the OCSP signing is delegated explicitly to another entity and that delegated OCSP responder is compromised, how to revoke the certificate and convey the revocation information to a client? We need CRL for this?

OCSP signing certificates are not normally revoked.  Clients are made aware of this requirement using the non-critical id-pkix-ocsp-nocheck extension.  To reduce the effect of a compromise of these certificates they are normally issued with a short lifetime.
However, this isn't the only option.  OCSP signing certificates could be revocable and checks could be carried out using a CRL or any method described in RFC 5280's Authority Information Access. Note that this only defines OCSP as an option, in which case it would need to be a different OCSP responder to be meaningful.
Details are in RFC 6960 Section 4.2.2.2.1.


To sufficiently protect against KRACK is patching the client, the AP, or both, required? Following on from this question, I am unclear on which of the following steps are sufficient to protect a WPA2-based wifi connection from the KRACK flaw:

Patching the AP (e.g. router)
Patching the client (e.g. mobile device)
Patching the AP and the client

The currently most upvoted answer, citing https://www.krackattacks.com states:

  Both clients and access points are listed in the paper as being
  vulnerable.

and:

  implementations can be patched in a backwards-compatible manner [...]
  To prevent the attack, users must update affected products as soon as
  security updates become available. [...] a patched client can still
  communicate with an unpatched access point, and vice versa.

But this seems to leave open the question of which combination(s) of patches would be an effective fix. It's clear for example that if I were to patch my phone, it would still be able to communicate with an unpatched AP, but would that communication be secure?

This is an important question, because while it is relatively easy to make sure my clients are patched once the patch is available (since the number of OS vendors are relatively small), ensuring all routers are patched (particularly in public wifi APs) seems like a much harder task due to the number and size of the vendors, and the lack of control over third party hardware.

To fully protect your network, both the device and the access point will need to be patched:

  Source: https://www.krackattacks.com/#faq

  Finally, although an unpatched client can still connect to a patched
  AP, and vice versa, both the client and AP must be patched to defend
  against all attacks!


GnuPG - connecting to specific card reader when multiple reader available Currently I can use
$ gpg --expert --card-status

to interact with smartcards that run the OpenPGP applet. Through trial-and-error, it seems that only the first card reader will interact with gpg. Using options that pass to scdaemon seem to be deprecated:
$ gpg --reader-port  1 --card-status
gpg: WARNING: "--reader-port" is an obsolete option - it has no effect except on scdaemon

Is there a way to interact with an OpenPGP smartcard that is not connected to the first card reader?
Edit: After some more research, I found a blog post from the author of the libccid library https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html that mentions:

Tell GnuPG to use PC/SC
Another solution is to make GnuPG and pcscd collaborate to work together. Luckily it is possible to do that using
the scdaemon option --disable-ccid
From the documentation:
--disable-ccid

  Disable the integrated support for CCID compliant readers. This
  allows falling back to one of the other drivers even if the internal
  CCID driver can handle the reader. Note, that CCID support is only
  available if libusb was available at build time.

With this option
scdaemon will use PC/SC to talk to the smart card and the conflict is
solved.
It is possible to tell scdaemon to always use this option by editing
the scdaemon configuration file. By default it is
~/.gnupg/scdaemon.conf and it should contain the line:
disable-ccid

Edit 2: With these configuration adjustments:
$HOME/.gnupg/scdaemon.conf
pcsc-driver /usr/lib/x86_64-linux-gnu/libpcsclite.so.1
disable-ccid
reader-port <reader-string>

I'm able to restart the agent with systemctl --user restart gpg-agent.service in order to use the different reader. This works!
Is there any way to pass the reader option to gpg or the scdaemon instead of editing a on-disk file & restarting? If a shell script is needed, is it possible to send a signal instead of file/restart workflow?

You should put this instruction into $HOME/.gnupg/scdaemon.conf, not pass it directly to gpg.


How does (Py)NaCl work exactly? At the moment, I deal with PyNaCl (Docs) and have a question about it:

My situation is that I want to create a server that interacts with clients. Both the server and the client will have a long-term private key/keypair.

So, the situation will be that the client will send an encrypted request to the server and the server decrypt it.

The encryption process (by the client) is relatively easy:

encrypted = client_box.encrypt(message, nonce)

And the server can decrypt it with this way (the Docs say):

plaintext = server_box.decrypt(encrypted)

Now to the question:

For the encryption a 24-byte nonce is used for better security. But what I don't understand: Does the server have to know this 24-byte nonce too? In the Docs the decryption is done without a nonce it seems.

But the Docs say that I can also use a nonce for decryption (link) so that it looks this way:

plaintext = server_box.decrypt(encrypted, nonce)

But in the example in the docs they don't use the nonce in the decryption process.

Can, please, somebody explain me when I have to use the nonce and which nonce I have to use then?

Wow, I am very unimpressed with that PyNaCl doc page that you linked to; Among other things, they don't explain what this nonce is being used for internally. That makes it hard to answer your question. That said, the example code has some comments that give some hints about what it's doing inside, so I think we can puzzle through it.
Usually, a "nonce" is a random string that you insert into the message before hashing / signing it to make the hash unique each time, and prevent replay attacks. You don't usually see nonces with encryption functions.
The actual documentation lists both encrypt and decrypt as follows:

encrypt(plaintext, nonce, encoder)
decrypt(ciphertext, nonce, encoder)

with no evidence that nonce or encoder are optional, and no explanation of why an encryption function needs a nonce, but then the example code goes and does this:
# Encrypt our message, it will be exactly 40 bytes longer than the
#  original message as it stores authentication information and nonce
#  alongside it.
encrypted = bob_box.encrypt(message, nonce)

...

# Decrypt our message, an exception will be raised if the encryption was
#   tampered with or there was otherwise an error.
plaintext = alice_box.decrypt(encrypted)

So:

It appears that both encrypt and decrypt can be used with 1 or 2 parameters missing. It would be nice if it explained exactly what the behaviour is in those cases, but no matter.

The nonce will be stored inside the ciphertext, so you shouldn't need to send it separately.

The comment "an exception will be raised if the encryption was tampered with" leads me to believe that the ciphertext is MACed, which would explain why they need a nonce - it's for the MAC hash.


Firewall and Torrent I use my university internet network and all incoming connection is blocked on every port.(they use netasq firewall) They have no other restrictions which stops me from using a torrent client. Using torrent is NOT against university network policy but they restrict all incoming port just for security reasons.

Is there any way, I can use torrent in this situation?

can VPN be a solution here?

can SSH be a solution?

Mainly, I need to know, can torrent work if all incoming connection is blocked? Is there any way to initiate the session beforehand so that I get a open port in NAT table?

Netasq has a firewall feature that targets specific applications using deep packet inspection not just basic port blocking. In order to bypass the firewall you would need to encrypt your traffic by using a VPN or similar. I good vpn client is called OpenVPN. To accomplish this through ssh(using linux) you would ssh -D 8080 user@example.com you would then need to run ssh -L 1234:127.0.0.1:8080 user@example.com The first command sets up a proxy(socks) service on port 8080. Then second command binds a local port to the remote port on the server where proxy is running. After a while ssh session will drop due to no data being sent over the connection. To keep connection alive you would need to add

ClientAliveInterval 120

TCPKeepAliveyes

to the ssh daemon config file usually located at /etc/ssh/sshd_config on the server. If you don't have access to the sshd config file you can also use

ssh (commands here eg. -D or -L) -o TCPKeepAlive=yes -o ServerAliveInterval=60 user@example.com

The command above would have the same affect keeping the connection alive.

If you are using putty(ssh client) click connection on the left panel you will see seconds between intervals and a text box enter 60 in the text box this will keep the connection alive and stop it from dropping out. Putty also has port forwarding options under Connection -> SSH -> Tunnels. To create a proxy on the server you would need to enter -D 8080 user@example.com under Connection -> SSH where you see remote command. This will setup a proxy(socks) on port 8080 on the server. After setting up port forwarding and proxy you would need to configure torrent client to use the proxy listening locally.
A torrent client will still work if the firewall does not allow incoming connections to ports.


Is Intel AESNI supported by Xen in VPS/Cloud hosting environments? I'm having trouble determining whether when using a hosting company that uses Xen virtualization and Intel processors with AESNI embedded encryption, I would have access to AESNI (i.e., is it an available hardware resource in such environments).

At the command line type:

cat /proc/cpuinfo | grep aes

If it's there, it's supported; if it's not, it's not.

To answer your question though, Xen 4.0.1+ support AES-NI instructions in guests.


Concrete figures on password cracking in the wild While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.

It's easy enough to test online password guessing attacks by opening a honeypot, and they mostly focus on trivial passwords and don't even target default passwords that much. But online guesses are quite different from offline guesses when a password database has been exposed.

Have there been studies or at least cases showing how strong a password has to be in order to resist guesses by run-of-the-mill attackers? How “sophisticated” does an attacker have to be to use tools such as John the Ripper?

APT and security researchers are outside the scope of this question.

(Context: is Jeff Atwood's assertion that strong passwords are useless because attackers will stick to the “low-hanging password fruit” realistic?)

There are essentially two types of attack: targeted attacks (APT, high value targets, personal attacks) and attacks of opportunity (low hanging fruit).

So, you're interested in offline attacks against leaked databases of passwords: the answer is that SOMEBODY will bother to put JTR, OCL Hashcat, or similar tools against that database.  And that person/persons/group is looking to sell the retrieved credentials en masse to spammers, bank account hijackers, etc.

If you want an example: http://blogs.computerworld.com/20272/hackers_crowdsource_help_to_crack_nearly_6_5_million_leaked_linkedin_passwords
http://nakedsecurity.sophos.com/2012/06/06/linkedin-confirms-hack-over-60-of-stolen-passwords-already-cracked/

After all, why else leak the password DB if you're not going to crack them?


Secure data transfer to internal network I need to transfer data originally from the internet that is first transported to a DMZ, then from the DMZ into an internal network. The data is basically real-time data that is needed on the internal network for further testing, nothing confidential though.

My question is what protocols is best to use to transport the data from the DMZ back into the internal network? I know since wannacry SMB is a very bad word to use so I was wondering what would be a secure and performant protocol to use in this case?

SMB is fine in general as long as you're using SMBv2 with SMBv1 disabled, although in this scenario I wouldn't use SMB because it involves opening port 445 on a Windows box into the DMZ, and that offers up quite a large attack surface.

I'd personally use SCP. There are tools for it on almost every OS in existence, it's based on SSH, it's standardised, it's fast, and you can secure it with an SSH key rather than a password. You could also use rsync over stunnel, but that's a bit more complex. In both cases you can easily set up a firewall rule for TCP connections from the DMZ host IP on any port, to the internal host on port 22 (or whatever you've got your stunnel port set as).


is x509 certificate signed by ca valid? I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today (2015-07-01) 'sample cert' is valid and can be used to validation of sign or not?

Another way as I understand you can form this question is "Can CA have more than one root CA with the same DN record"?

It depended on the root CA's and it's connection with another CA's. However generally in client authentication, you show your certificate to it, it will check this certificate parent's since it get the root CA. And what happen if the root CA certificate not valid?
I think you should report this problem to support team of that CA.


Ability To Change Root User Password (Vulnerability?) I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation.

How is this not a glaring security vulnerability? Shouldn't the ability to change a root user password not exist? I get that you need to have physical access to a machine (which makes it harder to implement) but why even have a password at all if it can just be changed like this? Is there a way to disable this 'feature' so that it cannot be changed from GRUB like this?

Can you do this in all other Linux distros as well? Or is this a Redhat exclusive ability?

You pretty much hit the nail on the head when you said that you need physical access to the machine.

If you have physical access, you don't need to go through the official steps to reset the root password, as you can flips bits on the hard drive directly, if you know what you're doing.  I.e., you can boot up a recovery OS from a DVD or flash drive, and mount the drive that way to gain complete read/write access to the entire disk.

Disk encryption will mitigate the risk, but doesn't remove it entirely* but makes attacks much more complicated.  It is best to assume that an attacker with physical access will be able to influence every aspect of the device in time.

Since it's assumed that attackers with physical access will always gain privileged account access eventually, there's little point in putting the legitimate administrators through extra trouble if they lost their password.

Every Linux distro that I have used has had this feature, though it's possible that some of the distros aimed at a more paranoid audience could disable this.

In addition, it's a standard feature in BSD Unixes, was tested for on the CCNA exam at least 15 years ago when I took it for Cisco devices, and it's fairly trivial to reset passwords on a Windows machine if it isn't explicitly secured.

* The attacker could for example add a backdoored kernel or initrd in the /boot directory, that needs to be unencrypted because the bootloader must be able to read the kernel and initrd files.


What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled as a follow-up to this question Can you get virus just by visiting a website in Chrome?, I've read these pages:

http://www.straightsectalk.com/?p=47
http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php
http://dev.chromium.org/developers/design-documents/sandbox

And I want to know that if I'm using the latest version of Chrome (i.e. 11.0.696.68) and I've got flash disabled (about:plugins >> disable) can i safely say that i can right-click any link to an infected webpage >> "open in new incognito window" and be 100% sure that:

the website cannot use my email and send spam mails to my contacts
there is no virus / damage to my system

You can assume that:

My system is not already infected with virus / trojan
This question is targeting windows 7 / windows XP / windows Vista

I am aware that the url may inform the hacker that my email is an active email but I want to be sure that with that info, the worst he can do is:

Send me more spams
Publicize my email
sell my email address to bad people (whom btw is also limited to these 3 activities)

First of all, except flash you have to disable all other browser plugins, the most obvious one is Java. Java has been a target in browser exploitation as much as flash has been.

the website cannot use my email and send spam mails to my contacts

If you open it in incognito mode a malicious website can't steal your cookies or other data because those data are not available to it so you should be fine, but noone can say you are 100% sure. In the case of a new browser exploit, even if it doesn't escape the sandbox but only exploits the browser, in theory it could steal data - but I've never seen something like that.
If you are still worried, you could also disable html5 rendering, as there have been browser exploits lately based on this vector, and also disable javascript (or run noscript).

there is no virus / damage to my system

If you disable plugins and run the latest chrome you are as safe as you can be when running a normal browser against those things. If you want better solutions, you go into the realm of malware researchers and running locked down browsers in virtual machines.

Of course all the security a browser can offer does not compensate if the problem is between the keyboard and the chair. If a user is tricked into downloading and running an executable, all bets are off.


What's the standard way for server to server integration (cross internet) authentication Let's say I have two servers in different data centers. They need to talk to each other, how to protect the security? TLS is a must. For authentication, we are concerning to use credential since if it get stolen anyone can use it to do the integration call. Then we start to think about to use Mutual authentication based on client certificate. However, my understanding is client certificate can also get stolen. Then is it really much stronger than username/password?
In addition, if we do IP restriction, will it make the integration much safer?

Looking forward to your advice.

Thanks!

ssh includes by default peer server authentication: each server has its own private key that only lies in a root only readable folder, and all collaborating machines have the list of their peers public keys.

A common configuration then allows ssh to pass the calling user name, and the callee does trust that user name because it has been authenticated on a trusted  peer. This normally does not extend to the root account but is commonly used for unattended remote servers collaboration with dedicated accounts.


How to detect malicious JavaScript in a PDF file? Is having any JavaScript in a PDF file by definition dangerous or is it only dangerous when specific functions (for example eval) are used inside a PDF, in which case, what JavaScript functions are dangerous in a PDF?

In other words: When should JavaScript in a PDF file be considered dangereous?

I did some additional searching and found an interesting research-paper (easily readable and just 12 pages). The research is called Detecting Malicious JavaScript in PDF through Document Instrumentation.

In their research-paper they introduce a context-aware approach to
detect and conﬁne malicious JavaScript in PDF through static
document instrumentation and runtime behavior monitoring.

The following quotes and figure give insight in how their developed detection system approached malicious PDF detection.

Detection architecture

  Our system consists of two major components, front-end and back-end,
  working in two phases. In Phase-I, the front- end component statically
  parses the document, analyzes the structure, and ﬁnally instruments
  the PDF objects containing JavaScript. Then, in Phase-II when an
  instrumented document is opened, the back-end component detects
  suspicious behaviors of a PDF reader process in context of JavaScript
  execution and conﬁnes malicious attempts.

Phase-I Static Analysis and Instrumentation

  For suspicious PDF, the front-end
  ﬁrst parses the document structure and then decompresses the objects
  and streams. A set of static features are extracted in this process.
  When a document has been decompressed, the front-end will instrument
  it and add context monitoring code for JavaScript. In some cases, if
  the document is encrypted using an owner’s password, i.e., a mode of
  PDF in which the document is readable but non-modiﬁable, we need to
  remove the owner’s password. With the help of PDF password recovery
  tools like [28], this can be done easily and very fast.

Phase-II Static Runtime Detection

  The back-end component works in two steps, runtime monitoring and
  runtime detection. When an instrumented PDF is loaded, the context
  monitoring code inside will cooperate with our runtime monitor, which
  tries to collect evidence of potential infection attempts. When
  Javascript executes to the end or a critical operation occurs, the
  runtime detector will compute a malscore. If the malscore exceeds a
  predeﬁned threshold, the document will be classiﬁed as malicious.

The original URL to this research-paper (PDF) is https://cs.gmu.edu/~astavrou/research/Daiping_dsn14.pdf, also referenced from in the beginning of this answer. A mirror/copy of this document can be found here http://www.pdf-archive.com/2016/07/25/daiping-dsn14/daiping-dsn14.pdf.

Credits to: Daiping Liu and Haining Wang from College of William and Mary and Angelos Stavrou from George Mason University.


Using intranet SSO to access sites hosted on public cloud We are thinking to move some of our intranet sites to public cloud.

Is there any way to keep using company SSO to authorize access to those sites from the company intranet?

Sure it's possible. What you want to do is called Federation. How you set it up really depends on the applications and platforms you run though. There are a variety of protocols out there that can do what you want; e.g. SAML, WS-Federation, OpenAuth (to a degree), etc.

The applications need to be able to support the federation protocols though.

In theory you could also set up a VPN from the cloud provider to your intranet too.

If you are running an Active Directory domain you can use Active Directory Federation Services (v2) from Microsoft (http://msdn.microsoft.com/en-us/security/aa570351), and that will let you federate using SAML or WS-Fed to applications that support the protocol. If you are running another directory service there are a few other providers out there like PingFederate (https://www.pingidentity.com/). You could also use a product like (Full disclosure: I work for the company) AuthAnvil SSO (http://www.scorpionsoft.com/).

The questions you need to ask:

Do the applications support a federation protocol or do you need to set up a VPN?
Which option is more secure? This really should be threat modelled.
How do you lock it down so only intranet users can access it?
Do you allow users outside the intranet to access the application?
How do you protect the external endpoint if you do allow external users?


What is the difference between https://google.com and https://encrypted.google.com? Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?

In terms of security what were the benefits of browsing through encrypted Google search?

Note that this is not a question about HTTP vs HTTPS. These are two Google services.

According to Google, the difference is with handling referrer information when clicking on an ad.

After a note from AviD and with the help of Xander we conducted some tests and here are the results

1. Clicking on an ad:

https://google.com : Google will take you to an HTTP redirection page where they'd append your search query to the referrer information.
https://encrypted.google.com : If the advertiser uses HTTP, Google will not let the advertiser know about your query. If the advertiser uses HTTPS, they will receive the referrer information normally (including your search query).

2. Clicking on a normal search result:

https://google.com : If the website uses HTTP, Google will take you to an HTTP redirection page and will not append your search query to the referrer information. They'll only tell the website that you're coming from Google. If it uses HTTPS, it will receive referrer information normally.
https://encrypted.google.com : If the website you click in the results uses HTTP, it will have no idea where you're coming from or what your search query is. If it uses HTTPS, it will receive referrer information normally.

The same topic was covered in an EFF blog post.

EDIT: Google dropped encrypted.google.com as of April 30 2018. According to Google, this domain was used to give users a way to securely search the internet. Now, all Google products and most newer browsers, like Chrome, automatically use HTTPS connections.


Is my DNS being poisoned? Today I was greeted by this error in Firefox:

It was happening consistently for a minute or two, and reverted back to normal. I confirmed that it happens on another browser and that other HTTPS sites open up properly. I wasn't able to check what happens on other devices on my network before it went back to normal, however I did ssh to another machine outside of my local network and attempted to curl google.com (all OK).

I'm on a home network behind a NAT using a wireless router (Cisco EPC3928) that my ISP (Vectra, PL) is remotely controlling.

What are the possible causes for what I'm observing? I don't suspect it's Google's fault.

I wasn't able to find any info about the domain xn--ngstr-lra8j.com that shows up in the cert.

EDIT: I am leaving my previous answer for people who wonder about the same question but without the exact same symptoms. However, I have made a mistake. This is not an attack, it is simply an error. The URLs in question are legitimate and this problem is widely known. Thanks to schroeder for pointing that out in a comment.

Previous answer:

There can be several reasons for what you are seeing, to name a few:

There appear to be some vulnerabilities for the router you have. Since you mention your router is being managed by your ISP, I don't find it hard to believe that your router is not completely up to date. So It is possible that your router has been exploited remotely, and is now trying to redirect you to malicious sites (googlevideo.com instead of google.com, for example).
Someone has infiltrated your network in some way and is now trying to redirect you to a malicious site using DNS poisoning.
An attacker has modified your host file locally to redirect google.com to another IP. This is possible through compromising your own machine.
Some technical error that is not malicious, or has not originated from your network (for example, an error with your ISPs DNS server).


Is this a good way to manage Incident-Response I m trying to find a good way to deal with incidents.
For now these are my thoughts:

x Join Logs and analyse with splunk (and alert with rsyslog, splunk is too expensive),

x Configuration-Management and automatic Re-Deployment (puppet, capistrano),

x Forensic via File-System-Mounting (compare with clean hash-db), Analyse Memory-Dumps for Rootkits (volatilitux)...

I would really appreciate some comments, that help me improves.

Assuming that this is your complete process, not a subset where other decisions have already been made, I would suggest that your first decision point is not whether or not there is an intrusion but whether or not there is a business service impact.

Alert -> Check Logs -> Business Service Impact?

After you've determined the business service impact you can use that to drive the rest of the incident response. If your service is impacted you need to engage the correct people in the business (which should already be documented) to notify them of the impact, providing an early overview of the problem.

Business Service Impact? -> Yes -> Notify Business Incident Manager

Once the business has been notified you can move on to determining the exact nature of the problem and working through the rest of your process flow.

If there is no business service impact you still move on to problem determination.

Business Service Impact -> No -> Intrusion?

My next point would be that, even if the event is not an Intrusion it may still be a security event which you wish (or need) to perform actions as a result of.

For example, you detect some form of automated or manual scan of your web applications. You may decide that you wish to block the attacker's IP address. This is just one simple example.

Such a decision may require authorisation from appropriate business or technology representatives so again, the necessary hooks in to the business must be reflected in your process flow.

In summary then, my feedback points are:

Don't forget you're defending a business application, ensure your incident response process reflects the needs of the business, not just detailing the technical steps required.
An intrusion is obviously worst case but don't discount actions required for other security related events. It may not just be mis-configuration.

HTH!!


Corporate IT support for client-side cross domain requests I have an API and a web application that exist in different domains. I can activate CORS on the API to allow for the web application to interface with the API cross-domain.

However it has been brought to my attention that some business, for corporate IT reasons, will opt to block cross-domain requests from their installed browsers for security reasons. If this is the case it is beyond my control. Can anyone comment on this? Has anyone working in corporate IT, or supporting web applications used by them, encountered such an issue before?

I would say that your issue has two sites:

POLICY

Apparently InfoSec/ITSec department in you company decided to block by default cross-origin domain requests. It can be somehow rationally justified. It minimises the risk of data leakage between applications. I have seen once similar approach, so your company is not the only one.

TECHNOLOGY

If you are unable to request servers via CORS you can always proxify your traffic from web browser via your app/web server. I don't know which operating system you use, but in case of Linux you can try to use i.e. Squid. The assumption is that there is connectivity between your app/web server and this second domain server.

Squid (proxy in general) is not difficult to configure, and it will certainly work. However, it is better to consult this solution with your business/InfoSec/ITSec.

I hope I helped somehow.


Are there any known exploits against bluetooth mice or keyboards? Most wireless mice are not bluetooth.  There are known exploits that take over wireless mice and use them as a keyboard.

Are there known exploits that can remotely inject malware directly over bluetooth RF, read what is being typed or type on the keyboard to download a malicious script?

How would one possibly audit for this since it would require constant intrusion prevention scanning of Radio Frequencies?

Is there proof that BlueTooth is safe?

It's going to heavily depend on your version of Bluetooth supported.

Here's the latest NIST paper with the state of Bluetooth security and recommendations organizations can take to remediate their risk.

That's a good place to start.

Page #37 of the report lists all the Bluetooth vulnerabilities known at time of publication, sorted by the version the vulnerability was discovered in.


Safe way of accepting customer-supplied private keys? We run a software as a service application that is used by medium to large companies. One part of our application is a messaging service that integrates into the customers own infrastructure.

At the moment, we manually generate a private/public key and hand these off to the customer to use for authenticating the requests, however we are looking at what's involved in letting our clients provide their own keys for use.

Our basic situation right now is:

Generate a key pair
Install the private key in the Windows Certificate Store
Send the public key to the customer

What we would like now is:

Customer generates key pair
They upload the private key to our system
We install their private key in the Windows Certificate Store
They use their own private key

This key is then then applied to their IIS website, amongst other X.509 things.

We are still in the planning/thinking about stage of this, and I'm concerned about how we can receive the clients private key safely. My initial though process is something like:

User uploads a password protected PFX
Using a pre-defined email address for the customer, we generate a unique link and send them an email asking them to use that link. That link then lets them enter their password to the PFX
We install the PFX with the username/password into the Windows Certificate Store and delete the PFX. We do not store the password for longer than is needed to install the certificate

OR

User uploads a password-protected PFX and enters the password on the same page
We install the PFX and then throw it all away, without storing the PFX for longer than it takes to get it installed

I am not however much of a security guy, so I'm hoping you can advise me if this is a bad plan, or if there are better ways of doing this.

One of the cardinal rules of X.509 is that private keys do not need to transit between entities ever.  They can, certainly, and encrypting them is the correct way to do this safely (password-protected PFX files are encrypted using the passphrase to generate a symmetric key; OpenSSL exchanges encrypted keys in a similar manner but lets you explicitly choose the cipher).  Exchanging the passphrase is tricky and needs to be done offline, if you don't trust the medium of transmission with the cleartext private key.  Sending a cleartext private key and sending it encrypted alongside its key are exactly equivalent.

I think there is certainly a better way to do what you need to do, but it's going to be a bit of a shot in the dark because I don't understand what your service is doing with the certificates.

Generally, there are a couple goals in a setup like this:

Mutual authentication between two endpoints
The ability for one party to certify new users

It looks as though you want mutual authentication to be done using certificates in both directions (client certificates).  You can do this without sharing a private key!  The certificate your servers present only needs to be trusted by the other endpoint, not shared.  So, you can exchange the fingerprint, or you can have them certify a certificate request you (automatically) generate.  Or, you can generate a self-signed  certificate they can trust.  That's all you have to do - the certificate request, fingerprint, and certificate without key can be exchanged safely with very little risk.

As for the other side, the client can send you a CA certificate that will issue credentials.  You don't need the private key to accept them, because you can validate the client's certificate against the CA certificate with which it is signed.  Generally this CA certificate should not be trusted for any other purpose.  This done, the client can sign all the certificates they want into authenticity, and you can either use the subject name to infer the existence of a user, or create an association between the certificate and a user in your own way.

They can safely send you the client certificates without the private key.  In fact, they do this every single time they use one to authenticate.

If you do this, you create a disjoint PKI.  The server authentication certificates and client authentication certificates aren't signed by the same CA; this works fine.

The clients and your servers must install the client CA and your server certificate or CA.  The latter could easily be signed by a well-known CA, saving one step; installing the client CA (the CA which issues the client certificates) is standard procedure when using client certificate authentication and is probably already done in your implementation today.  If you like, you can drop this down to one CA, by having a third certificate sign both those CAs (you don't need to exchange private keys to do this either; just the CSRs, containing only the public key).  Then, everyone can trust that CA (again, they only need the public key to do this).

As a general simplified rule, the only time you need the private key for a certificate is if you are signing something with it ("I sent this request", "this is the key you can use to talk to me", and "I attest to the authenticity of this certificate").  Validation can always be done without the private key.

There is something funny about the way you are using X.509 here.

If a protocol depends on the client presenting your public key to authenticate, it's little better than a static (and cleartext) passphrase.  In fact, it's worse, because your public key is something that is routinely disclosed.  For instance, when your browser visits an HTTPS website, the server sends its public key (in the form of a certificate) to your browser.  The whole point of public-key authentication is that you cryptographically sign the communications (you sign the MAC, message authentication code, which is generally a hash of the message) in a way that only you could.  The client then validates that the message was signed with the private key corresponding to your certificate by checking it against the public key (in RSA they have the same modulus, but different exponents) and that the certificate is valid.  Presenting the public certificate is only a small part of this.

But, then, that you are using the windows crypto API implies that perhaps you are in fact using SSL correctly, and just have the private key installed in places you wouldn't need it if you used two certificates.

All that said, you can safely exchange private keys as long as you trust the medium, which in this case I don't believe you do.  You could transfer them using TLS, though that of course has its drawbacks (the key is probably of sufficient value that an attacker might actually put in the effort to recover it, breaking the conditional security assumption that the cost of recovering your information is more than its value to the attacker).  If you can't trust a TLS encrypted channel for transferring it, you also can't trust the same encryption to keep it safe over the same medium in PFX (eg. AES-256 at best).  Really, the safest option is to toss it on an encrypted flash drive or something and courier it.  Exchanging public keys is a lot cheaper and faster and safer.

Sorry for the long rambling.  TL;DR: redesign your implementation to use two CAs, one for your stuff, and one for their stuff.


Test the XSRF patch on a GWT application We have a huge GWT application, which was never tested for security and now we would like to patch it with some of the "best practices" we have found on the GWT website.

One of those patches is related to the RPC XSRF token, so we applied the code so any call in the application will sue the token, and everything "looks" fine, but now I would like to test it against at least a basic attack, just to be sure that "something is working somehow".

The problem is that the request payload seems to be serialized in some custom way, and there is no evidence of the rpc token.

Is there a simple method for testing this vulnerability? I'm thinking about forging a request with postman, or making a form in another server to make a call, but a basic approach to those solution seems not to work.

I've managed a very dirty way to test the functionality, once the setToken was invoked. I've added a new token string (directly in the code), and the exception is been thrown successfully, so this thing somehow it is working.

Having a way to test it in the wild should be appreciated.

I've managed to test it with POSTMAN.
the tricky thing to notice is setting all the headers, especially the Content-Type that must be set to: text/x-gwt-rpc; charset=UTF-8.
I've taken a payload from a recent request, and then I done the same request with postman, the server answer with a legit peyload.
Then, I changed the rpc token in the payload request (I've taken it from the XSRF request during the loading of the app).
The served answered with a XSRF Token Error.

So, without a proper Token, no request can be done on the app.

One thing to nice is that the xsrf token is just the md5 of jsessionId, so another way to test it is to change the jsessionID in the chrome console or its md5.


Best practices: Use of a single private key as a person, or multiple to identify self across domains? Similar to the question here, I'd like to apply the same question to a person.

For example, I have implanted a chip in my hand that holds an encrypted private key that serves as my personal unique identifier. As it is tied to my person physically, I have just a single origin for the key it holds.

I currently use this key to authenticate with my own servers. What I'd like to do is register this key's public component for use at work.

What vulnerabilities does this expose to my key and the servers I use it with, assuming that the key itself is adequately secure?
Should I consider creating additional private keys to identify me?

The problem with this approach is that the same identity is used by every destination, so sites can swap notes to see where you've been and draw correlations that you may not want to expose.

There are several ways to solve this issue, such as the one used in the FIDO U2F security key. In this case, the device contains a symmetric key (not an asymmetric key pair) and the necessary crypto hardware such that the secret key never needs to leave the device.

On site enrollment, the device creates a new public/private key pair and sends the public key to the server along with a "key ID" for that key. On authentication, the site sends to the browser the "key ID" for that user and expects the response to be signed with the corresponding public key.

But instead of storing the private key corresponding to each key ID, the ID is itself the private key encrypted with the device's secret symmetric key.

There are additional features to the protocol to make phishing impossible, but those are beyond the scope of this answer.

Note that this is only safe because the secret never leaves the hardware. The same principle is true for any hardware security token; it's the fundamental difference between a true security key and something like a thumb drive; a storage device can be copied. This is at odds with human-implanted keys because the hardware necessary to do actual crypto calculations while being powered by NFC requires too much area to comfortably fit under the skin.

Using a protocol like this one gives you the added advantage that it's already supported by other peoples' sites, so all you have to worry about is your local implementation. But it's not so good for SSH keys and such. If you're going to use it as an SSH key, you've got to get it to somehow communicate with your key agent (which probably means writing a new key agent).


Is using online SQL prettifiers considered safe? From time to time when debugging SQL queries, we use online SQL prettifiers (e.g. this one) that reindent and properly format the queries to increase readability.

Can this potentially be a source of a schema or data security leak? Should we stop posting SQL queries to online services and, possibly, switch to offline tools?

A quick test shows that it is indeed sending queries to the server (unencrypted as well) rather than formatting locally with JavaScript, so yes, you should stop using it for anything you want to keep secret. Even if it were entirely JavaScript based I'd recommend against using it since it could be changed at any time.

Whether or not it's necessary to keep your schema secret is debatable (see here and here), but just because it's not necessary to keep something secret doesn't mean it's a good idea to go around telling random people. If you don't care if everyone knows your schemas and queries then go ahead, but if there is even minimal reason to keep them private I'm sure there are alternative offline formatters.


How restrict is an Asp .Net Web App with ipSecurity enabled? The IT department of my company refused to host an ASP .Net Web App on our intranet. For security reasons that would be the best solution. Right now I'm considering other options. One of those is to use ipSecurity on the web.config file in order to only allow people inside the organization to access it.

Since every computer in a office branch have the same IP address I'm wondering if the following code is enough to block the access of anyone outside our organization.

<system.webServer>
  <security>
    <ipSecurity enableReverseDns="true" allowUnlisted="false">
      <add ipAddress="123.123.123.123" allowed="true" />
      <add domainName="out1.mycompany.com" allowed="true" />
    </ipSecurity>
  </security>
</system.webServer>

In your opinion what are the security risks involved? Can this not be enough to restrict the audience that can use the web site?

From What I understand, this web server will be placed outside the intranet. Have your IT department considered placing this web server in a dedicated VLAN?

the above code will only allow access from one particular IP address(the Public IP of your network)and make sure that the Domain Name matches with the IP address. Typically you are turning your web server into a firewall. IIS(with proper setup) is sturdy, but the risk of a DDoS is still there.

The reverseDNS lookup may slow things down. even Microsoft warns about it.

As long as you have HTTPS enabled along with Client authentication, so that all the traffic gets encrypted - this setup will work. But better yet, Use a VPN(or SSH tunnel).


How can I prevent modsecurity from logging binary data In my modsecurity auditlog there is a binary file logged as text:

How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?

You can use @validateByteRange to look for those characters that may cause you issues to drop the request body C part from the auditlog but do that after doing your basic filtering (OWASP CRS + positive filtering) so you can make sure you are not dropping important logs.

SecRule REQUEST_BODY|ARGS "@validateByteRange 9,10,13,32-126,128-255" \
    "id:666,\
    phase:2,\
    pass,\
    t:none,t:urlDecodeUni,\
    msg:'Invalid character in request (non printable characters) dropping request body',\
    severity:'INFO',\
    setvar:'tx.msg=%{rule.msg}',\
    ctl:auditLogParts=-C"


Must the distinguished subject name of an issued SSL Certificate match that of the generated Certificate Signing Request? For example:

from Issued SSL Certificate:
CN = abc.com.my, OU = Room, O = House, C = MY

from generated CSR:
CN = abc.com.my, OU = Room , O = House, L = KL, ST = KL , C = MY

Is it legal for a public CA to change the distinguished name when issuing the SSL certificate, or must the distinguished name exactly match what I provided in the CSR?

Or do only some required fields need to match in both, such as the Fully qualified Domain Name (FQDN)?

It is legal and possible for the CA to take a CSR and modify the DN it finds there before issuing the certificate.

For instance, with StartSSL free certificates they ignore the DN provided and issue based solely on the public key, the domain name requested (CN), the country (C), and email of the requester (E).  And according to the user interface, everything but the public key comes from the interactive request process, not the CSR itself:


Why does the ★-property rule of the Bell-LaPadula Model allow information to be stored in objects with HIGHER sensitivity labels? I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-LaPadula Model.  I understand the mechanics of it and that it protects against accidentally downgrading information.  It makes sense for use-cases where a subject wants to write information to an object of equal sensitivity labels.

What I don't get though is why the rule allows information to be written to objects with a HIGHER sensitivity label than the subject.  Can someone provide a practical example of when this might happen?

I guess I don't understand how/when/why someone would ever need to write to an object they would never be able to read?

Can someone please elaborate?

Sure.  Here's an example.  Suppose we want to have a system log manager, which collects logs from all processes.  We'll run the log manager at system HIGH.  We want every process to be able to send log records to it.

With your proposed rule, processes running at LOW would not be able to send log entries to the log manager.
In contrast, the ★-property allows all processes to send log entries to the log manager.

As far as a practical example, well, Bell-Lapadula isn't very practical.  If you're looking primarily for practical stuff, I wouldn't spend your time looking at Bell-Lapadula; I'd recommend looking at more recent work on systems security -- it'll be a better use of your limited time.


Academic/Campus WiFi Security - Setup: Open At CERN the WiFi used, is not using any encryption. This means that it is a plain, standard Wi-Fi network with no authentication.
However, it is mandatory to register each device when first connecting to this internal network, for security purposes. Obviously, the device model, name of the owner, MAC address and the MAC/IP address of the access point from which one registers such a device is recorded.
How secure is this setup? Doesn't this setup allow for a "malicious", but registered on the campus network device to capture unencrypted traffic, between a third party device and any  WiFi access point?
Also even if a connection is encrypted like on the  https://security.stackexchange.com,
such an attacker could see the IP address requested, is that so?

At the front end, it may not seem very secure. All that is used for verification is the MAC, and that is easily spoofed. An unregistered device on the campus should be able to sniff the network traffic as well. But you need to be on location (or close by).
CERN has explicitly chosen to offer just a bare level of security on the network. Or, to put it in CERN's own words:

At CERN, the individual users are in first instance responsible for securing their computers, networks, data, systems & services.

(CERN Computer Security Announcements)
and

As the “CERN” Wi-Fi network security mode is “open”, no specific settings are required (no WPA, no 802.1x options, etc…), but please note that this also means that the traffic you send over the Wi-Fi network is not encrypted. You should ensure that any sensitive data is encrypted at the application level (SSH, HTTPS, SSL, VPN, etc.).

(CERN WIFI Service FAQ)
On the other hand, most traffic is encrypted anyway (SSH, HTTPS etc.)
In addition, CERN does quite a bit of security monitoring.
So, is it safe? For CERN, safe enough. Would this set-up work in other areas, like financial institutions? Probably not.


Why would you use random algorithm for CSFLE if you can't query the inserted data? I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following:
"Encrypting the personal_information and phone_numbers fields using the randomized encryption algorithm encrypts the entire object. While this protects all fields nested under those fields, it also prevents querying against those nested fields.
For sensitive fields that are used in reading operations, applications must use Deterministic Encryption for improved read support on encrypted fields."
The guide mainly talks about using a randomized algorithm vs using a deterministic algorithm. I think I understand the differences, using a random algorithm would create different outputs for the same input, and using a deterministic algorithm creates the same output for the same input all the time. But why would you want to store anything that you don't want to or can not query later? Why would you then use the random algorithm?

But why would you want to store anything that you don't want to or can not query later?

It looks like you are mixing up "querying against those nested fields" with "retrieving data from the database". The first is about doing a query to find records matching specific criteria, i.e. get the user with a specific email address.  The latter is about being able to retrieve a full object back from the database.
With randomized encryption each instance of a specific email address will have a different encrypted value. It is unknown what value this will be without known the random initialization vector used in encrypting the object. Since it is impossible to know the expected encrypted value it is impossible to efficiently search for it. Instead the whole database would need to be scanned, every object decrypted and only then one could check the email address inside the object.
With deterministic encryption all instances of the same email have the same encrypted value though. That's why the encrypted value is known and it is possible to efficiently search using the encrypted value, i.e. no need to decrypt every object in the database first.


If I change any character in a private PEM, should the public PEM be different? I'm generating a public PEM-format key from a private PEM-format key. I noticed that if I change a few characters near the end of the private PEM that the public PEM generated from the modified private PEM is exactly the same as the result from the unmodified private PEM.

For example, this private PEM

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCAAZXj8YAEQya8jF8l6Hy56BcRBgplxPd8ZM5LIAWm0w1k/CgB
gvrI28W+5orOyqST2gC4EBEGmLw9s3NC8McL3qqFIQvd6SpWzCJEiI9n+wCkJLYf
715t6BwZo8F82AdqRHwL1lL0T4JeakgcFO5zno2l/NYKpZtS78vIq2F8pwIDAQAB
AoGAIAdFh+lPTMG4mYjN7eBEBQgrbVkDlP85pWhbrbRvdZRtT41APVCWi1diHSf2
J1PQ5iWv9F4gxHPG9fFGr8MrKk+jCM0/rDJsN7yC1yiSerS9zNvoSWu4D1cizRn2
ZOFi+TJZVHAoVvuh1vJdsFLkDmfoXelR6v6ojQxp6IftblECQQD7W4F92yHVIkRt
ZEz5TMYxtFF2d5uwi6XA/1MDuWpK0dK20a7DUGmgQ8faNfSZ/Dr1JmLx0OK/+Ocg
5HnzNo5NAkEAgl7Wa/Lr0TUH5h4L3SsJ1aeYUC6CbzJHBpNTvhuC7YEcs0AJL2k3
qYSM8VpU7q9iGHvfQhnKH9eBXlQbJBt4wwJBAJ1Pj6Ns2afCYoD0HRiJbCD/cVxr
Tw0W2Q4IvbO+/z8EQpQYdv/V+8VJpnJzAjq9GUkEVThyOvdal4yGcaw9oKECQC8V
/a+jXxSCaMXuGC7bOoQWMebTxXxP1mNDlr1UxmbteOYsvKSJBfeNzjHlhENoyK87
HhmLovr5JNpi2iKiYW0CQDyniRLXCyBVayJd3QkuMFKVNUuOytXUFWNXTpLA1Nbb
2K+leKb2KSyyEmRFC2X+QwF9ZBP1C3b0lgBBlBVbpWQ=
-----END RSA PRIVATE KEY-----

and this private PEM

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCAAZXj8YAEQya8jF8l6Hy56BcRBgplxPd8ZM5LIAWm0w1k/CgB
gvrI28W+5orOyqST2gC4EBEGmLw9s3NC8McL3qqFIQvd6SpWzCJEiI9n+wCkJLYf
715t6BwZo8F82AdqRHwL1lL0T4JeakgcFO5zno2l/NYKpZtS78vIq2F8pwIDAQAB
AoGAIAdFh+lPTMG4mYjN7eBEBQgrbVkDlP85pWhbrbRvdZRtT41APVCWi1diHSf2
J1PQ5iWv9F4gxHPG9fFGr8MrKk+jCM0/rDJsN7yC1yiSerS9zNvoSWu4D1cizRn2
ZOFi+TJZVHAoVvuh1vJdsFLkDmfoXelR6v6ojQxp6IftblECQQD7W4F92yHVIkRt
ZEz5TMYxtFF2d5uwi6XA/1MDuWpK0dK20a7DUGmgQ8faNfSZ/Dr1JmLx0OK/+Ocg
5HnzNo5NAkEAgl7Wa/Lr0TUH5h4L3SsJ1aeYUC6CbzJHBpNTvhuC7YEcs0AJL2k3
qYSM8VpU7q9iGHvfQhnKH9eBXlQbJBt4wwJBAJ1Pj6Ns2afCYoD0HRiJbCD/cVxr
Tw0W2Q4IvbO+/z8EQpQYdv/V+8VJpnJzAjq9GUkEVThyOvdal4yGcaw9oKECQC8V
/a+jXxSCaMXuGC7bOoQWMebTxXxP1mNDlr1UxmbteOYsvKSJBfeNzjHlhENoyK87
HhmLovr5JNpi2iKiYW0CQDyniRLXCyBVayJd3QkuMFKVNUuOytXUFWNXTpLA1Nbb
2K+leKb2KSyyEmRFC2X+QwF9ZBP1C3b0lgBBlBVbpWdddddddddddddddddddddddddQ=
-----END RSA PRIVATE KEY-----

both result in the same public PEM being generated:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCAAZXj8YAEQya8jF8l6Hy56BcR
BgplxPd8ZM5LIAWm0w1k/CgBgvrI28W+5orOyqST2gC4EBEGmLw9s3NC8McL3qqF
IQvd6SpWzCJEiI9n+wCkJLYf715t6BwZo8F82AdqRHwL1lL0T4JeakgcFO5zno2l
/NYKpZtS78vIq2F8pwIDAQAB
-----END PUBLIC KEY-----

I thought that changing one character of the private PEM would result in an entirely new public PEM. Am I missing something, or can some characters in fact be modified without affecting the public PEM result?

The JavaScript library I'm using to generate the public PEM from a private PEM is rzcoder's node-rsa, which uses Tom Wu's jsbn crypto library.

The PEM format is a remnant from an old, forgotten standard called Privacy Enhanced Mail (it was never widely adopted, but served as inspiration for ulterior protocols, in particular S/MIME and PGP). A private RSA key in PEM is really the Base64 encoding of the DER encoding of an ASN.1 structure which looks like this:

RSAPrivateKey ::= SEQUENCE {
    version           Version,
    modulus           INTEGER,  -- n
    publicExponent    INTEGER,  -- e
    privateExponent   INTEGER,  -- d
    prime1            INTEGER,  -- p
    prime2            INTEGER,  -- q
    exponent1         INTEGER,  -- d mod (p-1)
    exponent2         INTEGER,  -- d mod (q-1)
    coefficient       INTEGER,  -- (inverse of q) mod p
    otherPrimeInfos   OtherPrimeInfos OPTIONAL
}

(This is taken straight from PKCS#1, the most used RSA standard.)

What must be noted here is that a private RSA key consists in numerous fields, and among them the modulus and public exponent. This means that the public key can merely be "extracted" from the private key.

With your extra characters, you did two things:

You "damaged" the coefficient value. This is the inverse of q modulo p, where p and q are the prime factors of the modulus. It is used for private key operations, specifically the ones which are implemented with the CRT (a nifty trick which quadruples speed of private key operations).
You added "garbage" after the ASN.1 structure. DER encoding has explicit length headers, so the decoder knows very well where the main structure stops.

In your case, the PEM/DER decoder which you use appears to simply ignore trailing garbage (some other libraries would reject the key with an error; e.g. that's what OpenSSL does). Since public key extraction does not use the coefficient, you get the same public key as with the undamaged private key. However, if you try to use your modified private key, chances are that you won't get proper results (depending on whether your implementation uses the CRT or not).


Security of reading articles via an RSS reader Would a site or blog owner know who is reading their site if the visitor is reading it with an RSS reader? Can they get the IP of the person? Say I had a Netvibes account with RSS feeds, can the site owner know which IP or RSS reader is viewing their feeds?

If they have trackers or codes on their site or blog, can they tell who is reading their site via RSS feeds?

And would the images from their site I view in the RSS reader act in a way as remote images in emails which can expose a person's IP?  All this talk lately about webrtc got me thinking.

Yes, most commercial RSS feeds do place beacons in RSS articles. They track your IP, and transfer it to their analytics service providers. You can test for yourself, by going to a feed by Feedburner, and examining all the tiny images that are loaded. You can also read the source code of the RSS feed to see for yourself that the link to "Full article" often includes a tracking parameter.

Accessing feeds' articles (not just images) reveals your IP anyway. But beacons make it easier for analytics service providers to infer the degree of your interest in particular topics by comparing times of access for the images from your IP.

Solutions:

disable images in RSS feeds;
nag RSS reader developers to add support for adblocking plugins;
use Tor or anonymous proxies;
live with being tracked.

To clarify:

There may be RSS readers that report back on your reading patterns, I don't know what they are.
Bloggers may or may not be interested in your IP.
Advertising and analytics companies, such as Google, learn your IP and correlate this information with all the other stuff they know about you and your browsing habits.


Detecting access point model Is there any way to detect the model (brand, reference, ...) of a reachable wireless access point without having to connect to it?
Sniffing packets with Wireshark or others does not give any info, but I remember once using a tool like reaver I saw my AP model (I was cracking it) in output.
Is there any network reconnaissance packet I can send to the AP that does the job? How did reaver detect my AP model?

If it's using WEP you can try to crack it and sniff a DNS traffic. That's why : almost all AP's have a DNS proxy functionality, and it's frequently in use. Do you can try to detect a DNS server version build and by fingerprinting it with MAC-guessed vendor and firmware image you can obtain some matches. The same one can be used with DHCP. But I don't think that AP's in infrastructure mode will have it enabled : usually in properly configured networks wireless clients are just pumped into VLAN and are talking to central DHCP, DNS and other services.


Is unused before domains' whois info being scraped automatically on registration? Suppose registrant's whois details go public (can be retrieved with whois) for a relatively short amount of time (less than hour) after domain registration, before being redacted or hidden with a privacy service/registrar function.

Should this domain registrant's privacy be considered compromised 'for sure'? Are there services or software that do 'blanket' scraping for e.g. ranges of domain names? What usually are the rate/requests per IP limits for whois requests?

As far as my understanding goes there is nothing preventing this from happening.

Correct. Information that can be seen, can be copied.

Your scenario portrays some amount of time where the information of the registrant that was submitted to the domain registration service is available publicly before being privacy-preserved with pseudo-fake data.

Since you do not control these scrapping services nor you know them all, and even if you do, anyone can still issue a query and collect the data, you are exposing the personal information for that (brief) amount of time.


Is SHA-3 used in a Password creator like this safe to use? I currently use the SHA-3 Hash Algorithms to create passwords through a given Set of Characters.
The User Flow:

User enters his Masterpassword (M), Sitename (S), Password length (PL) and choose the Characters the password should have (C).
sha(sha3(M+S+C)+PL)
the binary Result will then mapped to the choosen Characters.

if the Characters from 'a' till 'z' are used a 0000 0000 Byte will be a 'a', a 0000 1111 Byte would be a 'p' and a 0001 1010 Byte will be a 'a'

Is this use of SHA-3 safe to use or will I created a Loophole which can be used to "guess" Passwords or much worse: get the Masterpassword.

Here a Link to the Sourcecode

From an information security perspective, you should consider your scheme public, as per Kerchkoff's principle, even more so since you disclosed your source code. Thus the security of your generated password are reduced to the security of their input. The algorithm chosen is irrelevant as an attacker would choose the input and use your algorithm to generate the password.

So let's evaluate the security of your inputs:

Master password: If an attacker find it, all your passwords are compromised. Do not reuse your passwords.
Site name: This is public knowledge, it doesn't increase security.
Password length: Contains very few entropy. It's almost useless.
Available characters: I guess you always use the same ones or use all the characters allowed by the website, as doing otherwise would be very inconvenient. Thus it is equivalent as a second small master password.

So, basically your scheme hash public information with a master password. An attacker only needs to successfully brute-force one of your generated passwords to recover your master password and then be able to easily find the other generated passwords.

A better solution would be to randomly generate your passwords. This way, they cannot leak information about the others. You could then save them in an encrypted file or database. You would only need to remember the master password of encrypted database, without having to remember the password length or how the website was called before they changed their name. Password managers allow you to do just that.


Risks of letting user know if the username is invalid? I notice most websites simply say "user name or password is not correct", however some will tell you if the user name does not exist.

Are there any security risks letting the user know if they entered an invalid user name versus just telling them the combination of user / password was incorrect?

If you start with the assumption that usernames are or can all be public, then there are no security risks in revealing invalid usernames. However, this assumption is not typically the case, and as such revealing the validity of usernames will make brute force attacks easier.

As a ridiculous example, some movies will show someone using a device to crack a password of a digital safe or door code. Perhaps the lock has an 8 digit password and you can see the digits getting solved one at a time on the special device. If that mechanism worked, you would only have to do 10 attempts per digit, for a total of 80 attempts to brute force the password in the worst case. Compare this to 10^8 = 100 million attempts in the worst case for the normal way digital locks actually work. (Which is you attempt a password, and the lock unlocks or it doesn't.) Along those same lines, separating guessing a username until you hit one, then guessing the password for that username would be easier for the same reason.

That being said, it doesn't necessarily mean this is a bad practice. It usually is the case that usernames can be easily guessed anyway, particularly on a popular site, so the amount of entropy lost by revealing username validity may not be enough to warrant worrying about it.


Can secrets be made safe in memory? Say, I am running an application on a cloud server such as AWS. Suppose I supply a key at run-time (so its not stored anywhere alongside/inside code), is there a way to secure this key in memory?

So if an attacker gets access to the remote server at a later time, he still should not be able to extract the key from memory. Are there any ways to achieve this? Or is it known to be theoretically impossible?

The technique discussed here, transparent runtime security, is claimed to make it "difficult", but it may still be computationally feasible.

EDIT: Hardware based solutions are also ok.

I answered a similar question here.  For a normal hardware solution, a hardware security module (HSM) does this.  For software, .NET offers the Secure String mechanism to encrypt and protect sensitive data in RAM. Other platforms may offer something similar.  For an AWS solution, Amazon offers CloudHSM to do pretty much what you are asking for, I think.

From AWS:

  HSM is short for Hardware Security Module. It is a piece of hardware —
  a dedicated appliance that provides secure key storage and a set of
  cryptographic operations within a tamper-resistant enclosure. You can
  store your keys within an HSM and use them to encrypt and decrypt data
  while keeping them safe and sound and under your full control. You are
  the only one with access to the keys stored in an HSM.

  The AWS CloudHSM service brings the benefits of HSMs to the cloud. You
  retain full control of the keys and the cryptographic operations
  performed by the HSM(s) you create, including exclusive, single-tenant
  access to each one. Your cryptographic keys are protected by a
  tamper-resistant HSM that is designed to meet a number of
  international and US Government standards including NIST FIPS 140-2
  and Common Criteria EAL4+.


Is it possible to forge email info in header? I recently received an email from a guy making me a job offer for a big government company and stating that he works there.

However instead of using the domain of the company, he is using GMail.
Additionally I checked the header and it says

mail-wi0-x22a.google.com (mail-wi0-x22a.google.com. [2a00:1450:400c:c05::22a])
        by mx.google.com with ESMTPS id at5si30958044wjc.111.2015.09.21.06.30.27

Which seems to be from Ireland (and I am located in Canada).
So now I am thinking of asking him to contact me using the domain of the company messaging system.

Thus I have a question: Will he be able to obtain gov.on domain email or fake it, and fake ip to be from Toronto Canada?

And as a side note. Should ignore the guy completely and not give him any personal info?

When your MX receives the message, it should write a line in the message headers showing the timestamp for this delivery, and the hostname and IP of the SMTP server that delivered this message to your MX.  This line would be difficult for the sender to forge, because it is your MX that writes it.  However, there may be a number of previous lines in the headers, denoting previous deliveries to various other SMTP servers that the message may have passed through en route to your MX.  These lines can easily be forged by the sender.


Websocket connection hostname check I am testing an application that uses both regular http rest requests and websockets. Burp cert is installed on the device I am using for the tests. I can intercept the encrypted traffic using Burp. If I change Burp options to generate a "CA-signed cert with a specific hostname" during the normal operation, all the rest requests generate a connection error (due to hostname verification failure) but the websocket keeps working fine. I am not familiar with websocket internals. Is it normal for a websocket or is it a bug?

Does the websocket protocol  check for the host name only on start or is it controlled for each message? I cannot start the app with custom hostname configuration because the initial rest requests will fail and the web socket connection phase will never be reached.

Edit:
These are my test steps:

The app is a native Android app and all the traffic is encrypted using TLS. App uses both rest/http requests and websocket messages.
I installed Burp CA to the device.
I opened Burp with default settings and configured Android phone to use Burp as proxy server.
I started the Android app and used it for a few minutes. I can see HTTP traffic under Proxy->HTTP history tab and websocket messages under Websocket History tab.
Then without closing the app, I go to Burp Proxy->Options tab, on Proxy Listeners field select the active interface, click on edit, move to Certificate tab. On tthis window I select Generate a CA-signed vertificate with a specific hostname and set the hostname to foo.bar.

I continue to use the app wtih this setting. From this point forward all the rest requests generate an error, both on UI and Alerts tab of Burp. But websocket keeps working. I can intercept the messages and edit them.

The questions are:

q1. is this the intended behaviour or a bug?

q2. If this is supposed to happen because the ws connection checks the certificate only at initial setup, can an active attacker mitm my web socket traffic? For example after the connection is made, if the app is presented a trusted certificate like nsa.com, can nsa read the messages?

WebSockets are an upgrade of a HTTP request: they start with a "normal" HTTP request containing an Upgrade header field and after the server send a matching response the connection switches from HTTP to the WebSockets protocol.
The WebSockets protocol itself does not contain any verification of the peer, including no verification of the hostname. Thus any such verification need to be done at the HTTP level (there is none on the client side) or in case of HTTPS/WSS at the TLS level.

  Does the websocket protocol check for the host name only on start or is it controlled for each request?

Based on the information above there is no client-side hostname check for ws:// and there is only the check at the TLS level for wss://, i.e. the same check which is done for HTTPS. These checks are only done at the beginning of the TCP connection - there is no "requests" in WebSockets but there are only messages (i.e. no one response matching one request as in HTTP).

  Is it normal for a websocket or is it a bug?

It is not clear what exactly is going on but it might simply that ws:// is used and not wss://. Only wss:// contains the hostname check (during TLS handshake).


Nmap indicates that "telepathstart" and "telepathattack" are listening on ports 5010 and 5011 of my Linux box. What are these? I have a linux box on my network which, according to Nmap, contains two services called telepathstart and telepathattack listening on ports 5010 and 5011.

From the same box, I am receiving inbound requests to my computer on port 113, which my firewall is blocking.

This page lists both of these services listening on these ports as Solo and OOTLT, is this accurate? Should I be concerned?

The name of telepathattack is what gave me cause for concern, has anybody heard of this? What does it do?

Thanks

The references on that page are explaining that Solo is known to use TCP port 5010, which is officially reserved for the TelepathStart protocol, and ditto for TCP 5011. If you look thru that list you'll see that lots of malware uses ports that are reserved for other services.

TelepathStart and TelepathAttack are properly listed with IANA as using those ports, so I would expect them to be benign. Let's investigate what runs on those ports. IANA writes:

Ports: 5010 / 5011
Service names: telelpathstart / telelpathattack
Descriptions: TelepathStart / TelepathAttack
Assignee: Helmuth Breitenfellner

I suppose the contact's email address was hbreitenf@vnet.ibm.com at the time.

A Google search for [ helmuth breitenfellner telepath ] leads us to discover that Helmuth Breitenfellner ported the code of the messaging platform (TelePath) of IBM FlowMark (a workflow-management system) to AIX RS6000.

Sandy Kemsley writes that FlowMark was later rebranded as MQSeries Workflow, and is now WebSphere MQ Workflow.

Is your box running WebSphere MQ Workflow?

If not, then here are three thoughts:

Today is a good day to run some malware scans.
You might want to poke at nmap's options a little, and see how much confidence it's service detection has about what's listening on those ports. Maybe use --version-intensity 9, for example.
You could also try the old sysadmin trick of blocking it, and seeing what breaks.


Monitoring and filtering of arbitrary outgoing data I would like to be able to not just centrally monitor but also filter any organizational data moving out our edge routers, regardless of the sender application and regardless of the protocol/port used by the sender application.

For example, the sender application could be an ssh/sftp client, a browser (http/s), email client(??), or even a from-scratch handwritten TCP socket-based client/server program.

If the outgoing data happens to be encrypted (say, as in case of https/ssl, ssh/sftp), I would still like to be able to decode it via an MITM-like pattern (as employed by a program like Squid) and reject or allow the data to pass through based on the decoded content.

For example, if a large file was sent out by a user, I would like to be able to extract and assemble the file into a single logical unit (from the IP packets?) and then be able to run further checks on this assembled file to decide whether or not to allow it to pass through.

Given a Linux-based environment, which (FOSS) tools and techniques should I employ to achieve this? I'm new to this area, and don't know how to proceed further. Hence the question.

First you need to decide how you will identify this data - this is probably going to be the biggest issue and it is not necessarily technical.

Do you aim to tag all documents and files with a rating? This works for organisations that do tag ever single piece of data, as the gateway then just looks for the tag and acts accordingly.
Do you set a blacklist of data to block? For example sequences of 16 digits can be blocked as they may be credit card numbers. You'll get false positives, but it can work in some environments.

If you have that sorted, the gateway aspect is relatively simple - force all devices to connect through a proxy that acts as an SSL endpoint. As you stated, this is effectively a MITM. Many proxies, including squid, will let you prevent or allow traffic based upon various criteria, but in the FOSS space you may be limited in the complexity level possible. Those two options above should work though.

You may find that trying to run deep analysis of packet streams in order to do this real time may be beyond the reach of FOSS (Have a look at next gen firewalls such as Palo Alto for some options here)


Getting a certificate warning for one email but not another When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private".

Here are the messages:

Good:

Bad:

What's going on here? If you need more info please say so in the comments.

What I can see, is that the main difference is not about "SHA1" but about the certificate chain. See the icons. Both "SHA1" messages are locked with a green icon, but the part about about the identity of the website is different.

GOOD: *.mail.live.com . Certification owned by Microsoft, verified by Symantec Class 3.

According to digicert.com, no error or warning was found in the certificate. Not sure why no warning is displayed about the use of "SHA1".

Issuer: (Extended Validation : EV)

Symantec Class 3 EV SSL CA - G3
VeriSign Class 3 Public Primary Certification Authority - G5

BAD: outlook.live.com . Certification owned and verified by Microsoft. Probably the certificate is not correctly set or recognized by Chrome (see issuer).

According to digicert.com, it found 1 warning: SSL Certificate uses a deprecated signature hash.

Issuer: (Organizationally Validated: OV)

Microsoft IT SSL SHA1
Baltimore CyberTrust Root

So I strongly think that there is a small recognition problem of the chain issued by Microsoft itself.


How authentication using md5 works in this ospf example? I am trying to understand how md5 authentication works between this 2 cisco routers. The password is cisco in both routers. In the output in the field Auth Data: the hash is different in every packet. Is this the result of a salt? Whats the reason of the field auth crypto sequence number? Does each router has a counter and after initial synchronization both routers increase this counter?

Cisco allows only for max 8 character password so perhaps is using some 'other' algorithm. It is stated that the algorithm is md5 when you issue the command. After some quick queries in some online cracking websites (with rainbow tables) i was not able to reverse the hash. Is this some security by obscurity ?

Is this the result of a salt?

That's part of it, but the PRNG (link) is also part of the reason why you're seeing different values on there.

  After some quick queries in some online cracking websites (with
  rainbow tables) i was not able to reverse the hash

You better not be able to.  Cryptographic techniques like salting should defeat rainbow table attacks on the hashes.


How do I set auto check to override exploit in metasploit? I was trying to run the bolt CMS exploit.
Bolt CMS 3.7.0 - Authenticated Remote Code Execution | php/webapps/48296.py (taken from searchsploit) and it wouldn't work because automatic check which happens before the exploit is actually ran returned a false result.
I've tried a lot of combinations like set auto check to false and no auto check to see if I can override it but nothing seems to work.
I got it to work once with a different case but I don't remember how.

i found out you can set auto-check false