If I try to log into the wrong host with FTP do they now have my credentials? Say I make a typo in the host name.

Are my credentials now somewhere in the wrong hosts server log?

Should I go about changing my credentials just in case now?

Yes.  There are two risks.

Risk #1. The credentials are sent in the clear to whatever host you type.  If you mis-type the host, you've sent your credentials to some other host entirely, which is not so good.  The risk is probably fairly modest in the grand scheme of things, because odds are that most typos in the domain name will not resolve to any real host, but still, there is a risk there.

Risk #2. The credentials are sent in the clear.  Let me emphasize that again: in the clear.  Yup, that's right.  Your username and password is not encrypted.  This means that anyone who can eavesdrop on your traffic can capture your credentials, even if you type the hostname correctly.  This is bad, and is arguably much worse than Risk #1.

Sending username and password in the clear is not a good idea.  For this reason, you should not use FTP (except for anonymous FTP).  If you need to transfer files between hosts, I recommend using SSH, a network file system, or possibly connecting to a web site via HTTPS and downloading the file from there.


Which self assessment questionairre should I use for PCI DSS compliance My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via Paycorp's API (Paycorp is PCI compliant). The up stream system is a different vendor, and they are handling their environments PCI compliance assessment.

Our application receives this data, and then transmits the credit card numbers to Paycorp.

We do not store any card data, log, or record any CC information. We only transmit.

I am having a hard time working out which self assessment questionaire to fill out.

I feel as thought it doesn't fall into any category outlined here
https://www.pcisecuritystandards.org/pci_security/completing_self_assessment

But I also don't feel like that justifies it being SAQ D. So which SAQ fits my circumstance?

Unfortunately for you, because the raw card data transits your servers in cleartext, you have to use SAQ D, and because you aren't the merchant yourself, it would be SAQ D for Service Providers.

There may be entire sections of the SAQ that don't apply to you and can just be marked N/A, but you still have to fill out the whole thing.

If you could get the upstream system to encrypt the card data in a way that only Paycorp can decrypt (public key cryptography is good for this), you'll no longer have cleartext card numbers, and can probably use a shorter SAQ - or at least be able to mark even more of SAQ D as N/A.  But if that's not an option, you're stuck with it.  Sorry.


Is there any methodology to detect smart deauthentication attack? I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.

Whenever I sent De-Auth frames continuously to APs  for limited time I got detected by IDS. But When I sent limited frames randomly I was not  detected. I am curious to know if there is any methodology to analyze this kind of smart attack using techniques like machine learning/ wavelets/signal processing etc.

Can any one please suggest papers to read on Wireless IDS for detecting the attack if attack is done randomly or periodically  (when attacker sends limited frames less than or equal to the threshold value of detector).

Thank You.

Sending De-Auth frames in the manner you have mentioned - randomly or periodically which remain under the threshold value of detector, may be considered an adversarial attack against intrusion detection systems that could be using machine learning or other methods to be detecting intrusions.

Sending the frames randomly could be considered a form of perturbation, there is a lot of research currently in adversarial attacks against IDS in many different fields, most notably malware, email spam, network attacks etc.

I don't have any papers that come to mind for this specific problem however reading about adversarial attacks against IDS may help you as there are plenty of papers that suggest methods of defending against these adversarial attacks.  A good paper that may give you an overview of this area is the following:

Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues
https://www.sciencedirect.com/science/article/pii/S0020025513002119

It is quite heavy however even if you grasp the general principles, it may help you.

I have been researching adversarial attacks against NIDS and one of the attack methods is to slow down packets or send them much more randomly to avoid detection.


Security issues using iframes We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.

Our website is rendered through SSL and the user may need to click on the links also on SSL from our site.

Is it possible to open it in a completely new browser and still have
no security issues?
What are the things we should keep in mind to
make sure our site remains secure while using iframes?

Assuming the iframes have the same origin so that you do not have to remove the X-Frame-Options: sameorigin header, or that Clickjacking is not an issue in them. (There is a allow-from token specified, but older browsers don't support it).

The main remaining issue with using frame is, that you might end up displaying untrusted content, while the user still sees your domain in the address bar. For example there may be a link that is missing the target="_top" attribute or you might want to display foreign content intentionally.

This foreign content may for example display a form "Your session has expired, please login again" with your layout. The address bar will show your domain.


Is there a strong challenge to be made against the startup executive that believes security must be delayed? A common statement start-up executives make regarding security is that they are in a race to market and if they consciously choose to build in security from the get-go it may slow them down so much as to take them out of the race.

Hence they choose to do little to no security early on (or for several years) – accepting the risk in the hopes that the business first makes it.

Is there a strong challenge to be made against this line of thinking?

As I commented originally in the other question, Security cannot be the primary, or even a principle concern. Sometimes, during certain phases of the startup, you really need to focus on rapidly developing the features needed to drive the product, and patch security as necessary. Security can easily get in the way of operations, employee productivity, and slow down development. Although if yours is a security-related product or business, you might certainly need bulletproof security from the beginning, you really can't generalize and say that all businesses should focus on security from the beginning. (Sony, being large enough, needs to learn a lot of lessons about software development in the new century, not just about security.)

That said, security practices and practical security should be a factor on the mind of all technical employees. Where can you add security without getting in people's way? There's no such thing as 100% secure, so how much security is enough?


Understanding risk analysis and threat modelling in practice I am doing research in the security of cloud computing.

The purpose of the following questions is to understand the relationship between "risk analysis" and "threat modeling":

Do we usually analyze the risk before making the threat model?
The concept of threat modeling is a bit vague to me. Can I get an example of an existing threat model?

Both terms are very slippery.

There are multiple risk analysis methodologies and they use different vocabulary and different assumptions.  FAIR and the tire swing analogy are a good introduction, and if you can find Tony Cox's video, that is another good source.  NIST 800-37 is an alternative methodology.  OWASP has another.

Threat modelling is going through a renaissance - I did a google search and turned up the OWASP link that @Limit provided (and Limit deserves the credit because that is your best, first source) and a half dozen others.  But there are NIST threat models, and some really creative thinking about a hierarchy of indicators of compromise. (You'll have to search the blogosphere - Bloor, OpenIOC, Chuvakin - I can't find the one I want that clearly shows a hierarchy diagram).    The summary here is that we are at a tipping point - we now can collect enough data and do enough analysis to leverage threat intelligence to produce real gains in security. A decade ago, threat modelling was mostly theoretical and didn't have as strong an impact.

Personally I do risk assessment & analysis first, but I have to do a preliminary threat model during the risk analysis.  My tech lead does the opposite, but he has years of doing advanced threat modelling.

I can't give you an example of a threat model - threat models are expensive to produce and we don't give those away.  But if you know that 30% of the malware coming into your network use one malware toolset, you can configure your defenses to take advantage of that.  Or if you know that across all the different malware campaigns, 70% of them attempt exfiltration as the payload/mission, then that will influence how you invest and configure your defenses.  Threat models tell you what your adversary wants; if you know what the adversary wants, you have the opportunity to more effectively deny the adversary.


How does using an auth server for mobile app and not storing API keys on client add security? I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for authentication and not store any API keys on the client app.

How does that work? How do you authenticate to the auth server without storing any keys? I don't get it.

How does this add security?

Here's my breakdown of the hackernoon.com articles you link to.

Threat model

They are trying to protect against these attacks:

Sniffing the traffic between your app and the server (possibly because the Android device is compromised)
A hacker gets the binaries for your app and reverse-engineers it to extract any secrets / keys.

Techniques they recommend

Rather than putting your API key in an auth header, use some kind of symmetric or asymmetric cryptography so that the secret itself is not sent over the network.
Obfuscate secret strings that you include in the app binary.
Build a proxy server that handles all 3rd party API requests on behalf of the clients / apps.

Proxy server in more detail

The example they use is this: you have an Android app which loads images from NASA over their API. The NASA API requires you to register for a developer API key which they use for billing or wtv; every request to the NASA API needs that API key included.

They are suggesting that you do not include the NASA API key in your app binary because if you do then anyone who reverse-engineers this key out of your app binary can start making request to NASA that go on your credit card.

Instead, they suggest that you build a "proxy server" where the client / app can say "Hi proxy server, can you fetch this image from NASA for me?". With this approach, the NASA API key that's attached to your credit card is stored on the proxy server, not in the app binary. Of course, an attacker who reverse-engineers your app can still make requests to your proxy server, but now **you* (rather than NASA) have full control over:

1) The authentication mechanism between your client / app and your proxy server, so if you want to do some stronger auth mechanism, you can.

2) Which of NASA's API endpoints the attacker can access through your API key. For example, maybe your API key would let an attacker access the full archives of high-res telescope images or other scientific data, all billed to your credit card. But if your app only needs to picture of the day, then your proxy server adds a point where you can enforce this restriction.

I hope this is helpful.


If you accidentally install a malicious OS disk image in a VM, can it cause any harm? I just downloaded a disk image. After trying to install in a Virtualbox VM and seeing that it wasn't successfully booting into an installer, I checked into the md5sum. It seems the md5sum that is said online differs from my downloaded version. In fact, there are a variety of mirrors with a variety of recorded md5sum values. If it is the case that I downloaded a malicious disk image, can it have done any harm to my host OS from my VM?

Whilst there is some isolation from the host, your VirtualBox VM may well have established network connectivity on your local network, which may have exposed your local devices e.g. unsecured file shares or insecure router with vulnerabilities or which uses default credentials.


LDAP vs MySQL for Usernames and Passwords I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?

Privilege Separation Principle

This is a classic case where isolation of your content database from your user database provides a security advantage.

The Application Server knows the users password for the short time until it is compared against the password in the LDAP Server, where it is discarded and only the session and username information is kept for the life of the users session.
The LDAP Server validates the password and delivers the user information to the app server.
The Content Database has less critical information accessed through the app server.

The LDAP Server is not more secure, but it has a limited purpose, and thus the surface area for attack is much lower, as opposed to the typical user table stored in a content database which can be retrieved directly in the case of a injection exploit.

The LDAP Server and the Content Database are hidden (in some architectures) by the Application Server so that direct access is not required and only pass through attacks are possible, further reducing the possibility of compromise.

These multiple services do introduce a complexity that has costs and issues, but they constitute a pattern that encourages/forces the designer/developer to keep separate these specific accountabilities/concerns rather than collapsing the implementation into an insecure system.

Another way of thinking about it is that mistakes are always made when designing / developing / deploying  a system, and without this separation of accountabilities, mistakes made in one domain can bleed into and compromise the other domains.

Note: Through a quick reading of the LDAP protocol, a password is a field in the LDAP database, so if that field is hashed (best practice) then the LDAP database doesn't need to know the plaintext password, and as a commenter notes there are special API's for avoiding issues with password authentication.


How does a function certificate work? Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication both from client to server and from server to client? Or do I have to install one certificate for the client as well to get encrypt in both directions?

One thing is that a certificate ensure who you are talking with another is to encrypt the communication.

First, you don't "encrypt with a certificate". You encrypt with a protocol which may or may not use certificates for public key distribution. The most commonly used protocol for protecting bidirectional data channels is SSL (now known as TLS). In SSL, there is a client and a server, which need not correspond to the "client" and "server" at the TCP level: the SSL "client" is the one who begins the SSL handshake, i.e. who sends the ClientHello message.

In SSL, the server normally shows its public key as part of a certificate. The client validates the server's certificate (it checks that it is issued by a trusted CA) and verifies that the certificate indeed contains the intended server name. This means that the client has some guarantee that it is talking to the right server. On the other hand, the server does not know who the client is; the server just has the guarantee that it is talking with the same client during the whole connection.

If the server must know who it is talking to, then some sort of client authentication must be applied. SSL supports client certificates for that. Another method, very often employed in a Web context, is to have the client show some credentials (a login and a password) inside the SSL tunnel (since the client has some guarantee that it talks to the right server, then it can send the password to the server without fearing interception by an attacker).

SSL also supports some certificate-less connections, e.g. the PSK cipher suites, in which client and server authenticate each other with regards to a shared secret value; if, in your situation, you can arrange for client and server to know a common secret key, then this will avoid all the certificate business. If the shared secret is a low-entropy value (e.g. it is a "password" that a human user will be able to remember and will accept to type occasionally), then SRP cipher suites are the way to go. PSK or SRP support in .NET may require some extra libraries, though (e.g. OpenSSL bindings for .NET).


Android boot sequence - verified boot security After some research, my current understanding of Android's boot sequence (at least on a Qualcomm device) is as follows:

PBL --> XBL (replaces SBL) --> Aboot --> Kernel

PBL:

Primary Boot Loader (sometimes called bootROM).
First piece of code executed after device is powered on (therefore PBL is the Root of Trust)
Built and distributed on the SoC by Qualcomm themselves
Truly is ROM (Cannot be updated)
Contains a public key that is used to verify the integrity of XBL. The corresponding private key is in Qualcomm's possession.
Has access to a device-unique 256-bit auth-key that is required to write to the RPMB partition (link)

XBL:

Extended Boot Loader
XBL supersedes the older SBL (link)
Proprietary Qualcomm solution (i.e. provided by, and signed by Qualcomm)
In some cases, it can be customized by OEM for a price (link)
Lives on the eMMC (in the boot0 hardware partitions?)
Contains a public key that is used to verify the integrity of Aboot
Can be updated
Since it lives on the eMMC, a user with root privileges can modify it and potentially brick the device:

  http://trac.gateworks.com/wiki/MMC

    Note that the BOOT partitions by default are read-only as they are
    typically used for sensitive boot firmware. To write to them you can
    disable force_ro in sysfs

Aboot

Android Boot Loader
Provided by the OEM
Depending on the OEM, can be partially open source, or closed source (e.g. Samsung) (link)
Must be signed (I'm assuming by the OEM and not by Qualcomm, which means that the public key in XBL must be the OEM's public key?)
Lives on the eMMC (in the boot0 or boot1 hardware partition? Or perhaps in the User Data hardware partition)
Contains a public key that is used to verify the integrity of the kernel/OS (aka ROM) before loading it. However if Aboot is "unlocked" any ROM can be loaded)
Can be updated
Since it lives on the eMMC, a user with root privileges can modify it and potentially brick the device.

Questions

In addition to the questions I sprinkled above.

Is it safe to assume that millions of Qualcomm devices all have the exact same public key programmed in PBL?
The public key in PBL cannot be changed. Correct?
If Qualcomm's private key was somehow compromised, verified boot could no longer be trusted on all affected devices permanently?

I can't speak to Qualcomm or Android in particular, but any time that you're doing code signing, the client needs to begin its chain of trust somewhere. And an immutable, non-upgradable, non-revocable public key pinned in firmware is as good a way to do that as any.

A non-upgradable root public key makes sense (proof by induction)

You asked:

  The public key in PBL cannot be changed. Correct?

Proof sketch:

Any software component that needs to be field-upgradable needs to be able to verify the integrity and authenticity of its software prior to running it.
Verifying software integrity and authenticity is typically done via digital signatures.
The device must have or be able to obtain the public key that performed the digital signature.
If this public key is itself contained in a field-upgradable block of code or data, then the integrity and authenticity of that must be verified via digital signature.
The device must have or be able to obtain the public key that performed the digital signature.
If this public key is itself contained in a field-upgradable block of code or data, ...

This becomes an infinite stack of turtles (or in this case, public keys), and the only way it can terminate is if there is some root public key which is not field upgradable, ie we have absolute trust in that key and do not need to verify its integrity and authenticity.

QED.

Answering your other two questions (in backwards order)

  If Qualcomm's private key was somehow compromised, verified boot could no longer be trusted on all affected devices permanently?

Pick any PKI  structure (the public HTTPS PKI, the DNSSEC PKI, the Windows Code-Signing PKI) and there will always be an analogous doomsday scenario about the topmost root key being compromised. That's just how PKI works.

To protect against this, Certificate Authorities invest ludicrous amounts of time and money into HSMs, network security equipment, and human policies to protect the root keys. But at the end of the day, we sortof rely on good old fashioned word of mouth (ArsTechnica, Twitter, Reddit, etc) to tell us if one of these root keys becomes compromised.

  Is it safe to assume that millions of Qualcomm devices all have the exact same public key programmed in PBL?

Some companies will keep separate code-signing PKIs for separate product lines so that one product line can be revoked without affecting the others. Realistically though, if they have a massive breach on that scale, then nobody's gonna trust anything anyway, so why bother?


What can an attacker do with an exploited program? If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

I think your question is much broader than you realize, but I'll try to give some sort of answer.

  If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution where an attacker can get the application to execute code that the attacker wrote. Think about this like the attacker is re-writing the code of internet explorer while it's running; they are literally turning IE into malware.

  Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

You basically just answered your own question. Yes, the attacker could get IE to do anything that a program is capable of doing - reading / writing files, sending stuff over the internet, making operating system calls (exploiting OS vulnerabilities if there are any), planting other malware and executing it, possibly modifying the registry, etc.

Since browsers are the most visible attack surface on an end-user's computer (it's the application that actually makes contact with malicious web sites), more and more browsers are running themselves in a sandbox so that if something malicious does get in, the damage it can do is minimal. Here's a nice article by How-To-Geek talking about sandboxes for your apps.


Firewall - Allow WMI internal network I am not totally sure if this is the correct stackexchange to place this question, so just let me know if it should be somewhere else.

I am looking into IT asset management systems and for these systems, in order to allow remote management for computers, they need to have access through the firewalls to WMI.

My question is, is this secure enough to allow for an internal network? Or is there a more secure way of enabling an IT asset management system to have remote management to computers without having to install a client on each computer?

WMI can be secured to be safe for internal networks following some configuration steps:
https://msdn.microsoft.com/en-us/library/aa393266(v=vs.85).aspx

Confidentiality

The most immediate issue (to me) is requiring encryption in transit to mitigate snooping (excerpt of above):

  An administrator or a MOF file can configure a WMI namespace so that no data is returned unless you use packet privacy (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy as a moniker in a script) in a connection to that namespace. This ensures that data is encrypted as it crosses the network. If you try to set a lower authentication level, you will get an access denied message. For more information, see Requiring an Encrypted Connection to a Namespace.

Least Privilege

The next most important thing is least privilege via RBAC.  You should limit the asset management product's account to read-only WMI operations and if possible limit what it can read to what is needed.  This is achieved via Namespace Security and is described further here:
https://msdn.microsoft.com/en-us/library/aa393613(v=vs.85).aspx

You may need to allow certain write privileged if the asset management software also performs actions on the endpoints rather than just auditing.  Press the vendor for a least privilege configuration.

Strong Authentication

Once you have that you should generate high entropy random values (using all the characters and maximum length the asset management tool will work with) for both the username and password.  These credentials should be stored in a secure password management system like Thycotic Secret Server or a local secure password manager such as KeePass for which you maintain backups.  You can probably use a non-random username, but that does increase risk somewhat if it's easily guessed and using a random username given how infrequently you need to manage it gives you a free security boost.

Network Security

After all that you should set Windows Firewall with Advanced Security to allow the DCOM connections needed for WMI only on the port it is running on and only from the host (or hosts if you are doing HA) running the asset management software.  This is the final layer of the defense in depth here and makes it harder for attackers to exploit even of they have the credentials.

Single Purpose Single Server/VM

The asset management software should be run on its own on a dedicated server or VM.  The firewall whitelist is far less useful if it's on a misc app server with all the other junk a network needs.  Running it with other software or services also exposes it and the credentials to unnecessary local attack risks.

You may be able to bake those steps into a GPO.

Alternative solution: PowerShell

An alternative (though incompatible with you asset management product) is PowerShell Remoting.  It uses TLS and GSSAPI authentication integrated with AD so I'm very comfortable with it.  We use it in production.

Once you have PowerShell remoting you can log into a system remotely with Enter-PSSession %MachineName%.  You can also use Invoke-Command with -ScriptBlock to run a command remotely and get results centrally for coordination.  Your WMI commands could be run that way.

Here's a guide on enabling PowerShell Remoting:
http://blogs.technet.com/b/heyscriptingguy/archive/2012/07/24/an-introduction-to-powershell-remoting-part-two-configuring-powershell-remoting.aspx

Conclusion

The challenge with either of these is transitive trust and lateral movement.  Be careful that the accounts allowed to make this jump between machines have very strong passwords.  We use per-person 100 character full ASCII random generated passwords for this that we rotate every 90 days.  We use KeePass to autotype these as they aren't practical to type by hand.


SSL what's the client write key used in application layer? I've used wireshark to watch serveral SSL3.0 traffic and decrypt the messages transfered between client & server.

And what I've just found is very strange :

AFAIK, the encryption-key, MAC and encryption algorithm used in calculating client-Finished and application-data sent by client are exactly the same.

But, when I use the same client-write-key used to encrypt client-finished (Derived from MasterSecret) to encrypt application data, I get the different result from what the client (firefox) calculated.

The odd behavior also happened with server: I can use server-write-key (derive from MasterSecret) to decrypt successfully the "server-finished" message, but failed to decrypt any other encrypted message from server.

So, can you please tell me what happened to the client-write-key & server-write-key ? Did both client and server changed their write-key after "finished" message sent?

PS: I forced client (Firefox) to use SSL V3.0, cipherSuite = TLS_RSA_WITH_RC4_128_MD5

I found out the answer myself : the function RC4 I've used didn't save the cipher state, while SSL stream cipher required that. I've used a RC4 class and problem resolved!


Are the bytes within a Sha256 cryptographically random relative to each other? I've seen some answers here talk about truncating a sha hash... does that also mean that the individual bytes/words are random relative to each other?

Well, if SHA-256 hashing exposed non-random patterns in the resulting byte sequence, that would indicate a remarkable design flaw. No such flaws are publicly known which is why truncating a SHA-256 hash is fine (as long as you consider that you end up with a shorter hash, of course).

That said, cryptographic hash functions are no random oracles and you should still be careful when using one as a PRNG.


Sql map Manual Vulnerability Assessment I am trying to do penetration testing for one of my client.
The platform is Code ignitor.
There is an endpoint /find/1
The function queries the vehicle table where vehicle ID is 1 with no sanity check.

Now I tried Acunetix scanner and it found both blind SQL and normal SQL injection on the website.
I need to show my client there is actually a flaw so I used sqlmap with various options

Like I know the backend DB is mysql, —skip-WAF

Ok endpoint /find/1*
Which means to inject at positive of asterisk.

Sqlmap performed detail evaluation however couldn’t exploit the vulnerability. I did the risk and verbose to see the queries myself as well.

What I noticed that * is marked as non permitted character in config of code ignitor which prevents sqlmap from making select * from... etc queries.

My Question:

Shall I assume that the website is safe? Since I can see in the code that sanity check has not been performed on the “input data”.

It depends on what you mean by "no sanity check" is performed on the input parameter. If this means that the application takes the parameter, concatenates it into a SQL query and sends it to the database, the application is vulnerable for sure. Only blocking * is not enough to protect against SQL injection.

Never assume the site is safe, if you have doubts about it! Even if you are not able to create a working exploit, you should recommend implementing database queries using prepared statements (or similar mechanisms). It is considered best practice and there is usually no reason not to use them.


Frequent flyer number security risk or not? Many booking websites or tickets "re-sellers" expose in plain view for the current authenticated user the commonly used "Frequent flyer number".

Should this be considered a security risk? Can this number be used with malicious intentions?

On United States legal fields and privacy laws, PII (Personally Identifiable Information) should be protected and should not be disclosed. PII is any information used to identify a person and your frequent flyer number is unique to tag you.

In this ground, yes exposing your PII is a security concern (If this is visible in public).


Email security on a Windows phone Let's say I set up a Microsoft account on a Windows phone and use the associated built in email client. If I send an email, would it be send in plaintext. On wifi, if someone is sniffing the traffic, will he be able to see the contents of the mail?

This would depend on the e-mail server that you're connecting to as opposed to being a function of the Mobile Phone operating system.

The (old) default was to send outgoing mail over port 25/TCP using the SMTP protocol.  Traffic over this port is, by default, unencrypted.

Many modern e-mail services do not make use of this port and instead will use an encrypted version of SMTP over port 465/TCP or 587/TCP (more info. here)

If the encrypted version is used then someone on a wi-fi network would not be able to see your traffic without additional measures to defeat the encryption (which are much more complex than simple traffic sniffing)


VLANs, Subnets and a sensitive database server I have a sensitive database, and two categories of employees Category A and Category B. Category A does not require access to the sensitive database while category B does require access to the database.

Initially I was thinking let's simply create 3 VLANs.

Vlan - 1 - Category A

Vlan - 2 - Category B

Vlan - 3 - Sensitive database

But this has an issue: Category B cannot communicate with the sensitive Database, because VLANs preclude VLAN 1 talking to VLAN - X. So, lets introduce a Subnet.

Place the sensitive database into a subnet and add a router. At the router, allow VLAN 2 to communicate with the subnet where the database exists, and tell the router to not allow VLAN 1 to communicate with the subnet where the database exists.

Question:  Does this achieve the objective of allowing Category B to communicate with the database and preventing category A from communicating with the Database?

You can put the switchs ports of your database in trunk mode and allow the vlan B and "sensitive database" and exclude vlan A of this trunk.

Edit

If yours vlans are on differents subnets you could allow the vlan Database with the VLAN B and not the A by using ACL in yours switchs L3.


What are requirements for a cookie authenticating an user? At my company we can't use session to keep users logged because the website is splitted between node and PHP backends. We thought of generating the user a token after he logs in and store both this token and its ID in a cookie so he can be authenticated on subsequent requests. But I'm really lost here.

First is this a good way? Can't we just store the token if we can make it unique across our users?

These data looks critical to me, is there a need to encrypt them? Is there a need to sign them too?

Someone mentionned JWT but I'm not sure it's the right tool for the job (the header would be useless eg.)

To sum it up: what would be the most secure way to store data authenticating an user in a cookie (it won't necessarily be sent over ssl)?

Won't necessarily be sent over SSL

There is NO secure way to do this at all if this is the case. Fix that and you have your choice of client based sessions or server side sessions, but BOTH methods will require that session data is only EVER sent over SSL, otherwise sessions are worthless.

Server Side Sessions

In a database common to both backends set an entry in a table with a generated unique session ID, session data, and other maintenance fields that would be useful(time of last activity, etc.)

The table should look like the following:

id ( text, 40, not null ), data ( jsonb ), lastCom ( timestamp )

These sessions are often used because without special server side code a session can be remotely terminated purely by deleting the entry of the session in the database.

Client Side Sessions

Often used because with proper SSL and backend invalidation logic these are JUST as secure as Server Side Sessions. However they require backend logic to invalidate sessions otherwise the session isn't secure because there is no remote way for an admin to terminate the session. The user owns the cookie, and just because it failed once doesn't mean they can't retry with the EXACT same data. This is because ALL maintenance on the session is done on the user side, so server side validation is also still required, but doesn't mean you need a database. It just means you need to send an updated cookie with each request(changing the maintenance data inside, like a validity time stamp)

Both methods are plenty secure and can be implemented any number of ways( JWT, passport, etc, etc), but it's up to you to choose which method you'd like to do. Just remember, session data should only EVER be sent over SSL


How to secure API (private key) for mobile apps I am building a web service that has to be only accessible for iOS apps.
In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems.

Now, I have everything working through an API. my users can register, search companies, order products from those companies, and track their orders. It's not active yet, but it's working..

I am facing one major problem: how to secure this?

For the last few days I have stopped coding, and I have constantly been busy with searching the web, StackOverflow, and Information Security for how to do this. I have found that the way Amazon secures their API would be the best solution for me. The way Amazon secures its service is explained here. I have tweaked it a little bit for my service:

User registers and gets private API key + public (identification) key
User enters credentials and taps "log in". App creates hash out of the variables + private key. App sends variables + time stamp + hash + public key to API
API looks up public key in database, finds private key belonging to that public key (if public key is valid). The API then creates hash the same way as the app did. If the hashes are the same, the request (log in in this case) is executed.

This way of securing a service makes sense to me, and I can code most of it. but I have a major problem and I can not find any solution to it:

The user gets a public & private API key when an account is created. The public key can be sent from the server to the user device, because that is not necessarily a secret. Since the private API key can never be sent over the wire, how on earth can I make sure that an account logged in on a user's device knows the private API key that is created on the server?

Does anybody know how to solve this problem?? any help would be highly appreciated!!

Why do you want the clients to have their own private keys? I'm trying to understand how your scenario is supposed to work but am a bit confused about what you're trying to achieve.

In general here are a couple of comments that may help:

HTTPS is how you can establish a secure communication channel with clients. Once you do this you can transfer whatever you want securely over the wire client <-> server. This is the same thing your bank does.
Article you link to doesn't say anything about HTTPS, looks like they're intending to send that over just HTTP. You should use HTTPS not HTTP for anything you wouldn't want compromised (such as a logged in user). Why try to build your own encryption mechanism when you can use HTTPS? Using HTTP for any kind of authentication sounds like terrible advice to me.
I'm not sure that your clients really need their own public/private key pair. Typically it's a server that's securing your application communication and that has a certificate with private key. Clients will still have a user name and password right? That's the authentication for your client (not a certificate) and you can send the user/pass to the server once you have a secure HTTPS channel established. Server side your app will verify the client login credentials are valid and give the client a way to say "I'm already authenticated for 30 minutes" via a cookie or session mechanism. Obviously once a client is logged in, communication needs to continue to happen over HTTPS or your authentication token/session could get stolen.

Bottom line, if you're just trying to secure communication between clients and a server then use HTTPS and don't re-invent the wheel.


Can you recognize this virus? Yesterday i noticed a folder with a strange name, it looked like this from the inside:

I was cautions not open any of the files, but i opened the .sql in a text-editor, to realize it's not SQL but some hash, i renamed the folder to "virus" to remind myself to google the content later, but then i noticed another folder that didn't exist, it must have been created after i renamed the folder, and this time it has a different names:

Then it jumped/copied it self to all partitions on the hard desk.
Each folder is exactly 1.83 MB with the same file structure.
My computer is behaving normally but i might re-install the OS if i couldn't find a way to remove this virus.

so...
Can you recognize this virus? What category it might belong to?

It looks like you installed Cybereason RansomFree.

This writes two folders with 'random' file names to each of your partitions, and one to the desktop labeled This folder protects against ransomware. Modifying it will reduce protection* (which you will only see if you have configured Windows to show hidden/system files).

The program monitors these folders for ransomware activity, and regularly rewrites them. The file contents are gibberish, you can't open one of these .xls files in Excel, etc.

So, not a virus.
Here is a sample folder from my drive:

* Actual text changes with version. They have been updating the program several times over the past few weeks.


Is a rand from /dev/urandom secure for a login key? Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice?

Should I be generating the key based on something else? Is this prone to an exploit somehow?

The short answer is yes. The long answer is also yes. /dev/urandom yields data which is indistinguishable from true randomness, given existing technology. Getting "better" randomness than what /dev/urandom provides is meaningless, unless you are using one of the few "information theoretic" cryptographic algorithm, which is not your case (you would know it).

The man page for urandom is somewhat misleading, arguably downright wrong, when it suggests that /dev/urandom may "run out of entropy" and /dev/random should be preferred; the only instant where /dev/urandom might imply a security issue due to low entropy is during the first moments of a fresh, automated OS install; if the machine booted up to a point where it has begun having some network activity then it has gathered enough physical randomness to provide randomness of high enough quality for all practical usages (I am talking about Linux here; on FreeBSD, that momentary instant of slight weakness does not occur at all). On the other hand, /dev/random has a tendency of blocking at inopportune times, leading to very real and irksome usability issues. Or, to say it in less words: use /dev/urandom and be happy; use /dev/random and be sorry.

(Edit: this Web page explains the differences between /dev/random and /dev/urandom quite clearly.)

For the purpose of producing a "cookie": such a cookie should be such that no two users share the same cookie, and that it is computationally infeasible for anybody to "guess" the value of an existing cookie. A sequence of random bytes does that well, provided that it uses randomness of adequate quality (/dev/urandom is fine) and that it is long enough. As a rule of thumb, if you have less than 2n users (n = 33 if the whole Earth population could use your system), then a sequence of n+128 bits is wide enough; you do not even have to check for a collision with existing values: you will not see it in your lifetime. 161 bits fits in 21 bytes.

There are some tricks which are doable if you want shorter cookies and still wish to avoid looking up for collisions in your database. But this should hardly be necessary for a cookie (I assume a Web-based context). Also, remember to keep your cookies confidential (i.e. use HTTPS, and set the cookie "secure" and "HttpOnly" flags).


Is PCI-DSS compliance required for non-credit card payment source? We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit card number that you will be paying the bill for.

Is PCI-DSS compliance required for this system even if your payment sources do not include credit cards?

The requirement to comply with PCI-DSS is contractual, typically in the agreement between a merchant who wants to accept card payments and their acquiring bank, or between a merchant and a provider of payment services. If you haven't signed an agreement with anyone agreeing to maintain PCI compliance, you have no requirement to abide by it.


Browser rejects certificate, but openssl s_client works I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a web browser, I get certificate verification error.

To complicate matters, the new host is a service that uses SNI. Therefore, the error message I'm shown, that the domain name does not match the cert, is referring to the cert before SNI. I'm doubtful SNI is set up incorrectly since every other connection works.

To try to diagnose the problem, I used openssl s_client. To my dismay, openssl does not have problems connecting, and I see no errors when issuing an HTTP request:

openssl s_client -connect <ipaddress>:443 -servername <domainname> -showcerts -debug

Are there any other tools out there to diagnose why web browsers (I've tested with Chrome, Firefox, and IE) are rejecting a certificate despite the fact that openssl s_client does not?

Here's the abbreviated output from openssl in case you can spot the issue:

CONNECTED(00000003)
Certificate chain
 0 s:<subject details>
   i:<issuer details>
 <certificate>
 1 s:<subject details>
   i:<issuer details>
 <certificate>
 2 s:<subject>
   i:<issuer, same as subject>
 <certificate>
---
Server certificate
[certificate information]
---
No client certificate CA names sent
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 4392 bytes and written 408 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: <session id>
    Session-ID-ctx:
    Master-Key: <master key>
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    <hex output>
    Start Time: 1434382473
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
read:errno=0

Update:

Chrome reports "Server's certificate does not match the URL," but as I said, this is because of using SNI; it is complaining that the certificate used to initially connect doesn't match the URL. openssl does the SNI thing just fine, so I'm thinking the browser is rejecting the certificate that openssl accepts.

Firefox error:

   uses an invalid security certificate. The certificate is only valid for the following names:  (Error code: ssl_error_bad_cert_domain)

IE error:

  The security certificate presented by this website was issued for a different website's address.

RESOLUTION:

Thanks everyone for your help. Details are hard to provide in my case for a variety of issues. I found the issue though. The certificate was properly installed and accepted. What I did not notice is that the site performed a redirect to a domain for which the cert was not installed properly (www.thedomainname.com). I wish I had noticed earlier.

...despite the fact that openssl s_client does not?

OpenSSL never checks the hostname against the certificate, but browsers do.

  ...openssl s_client -connect :443 ...

I see that you are using s_client with the IP address and not the hostname. Since you claim to have the proper mapping between name an IP address in your hosts file using the hostname should work too. If it does not, then you might have found the cause of the problem already, i.e. the wrong mapping.
Of course you must also use the hostname inside the browser, because (I assume that) the certificate is for the hostname and not the IP address.

Please make also sure that you don't have configured a proxy with the browsers because then the hostname is resolved by the proxy, i.e. not using the hosts file on your local machine.

If it works with s_client and the hostname but not with the browser and the hostname please check exactly the common name and subject alternative names section of the certificate. It must match the hostname given in the URL either exactly or based on the rules for wildcard matching if you have a wildcard certificate. A wildcard matches only a single label, i.e. *.example.com does not match foo.bar.example.com. And example.com is different from www.example.com. Note also that if you have subject alternative names the common name might be ignored (depending on the browser).

If you still have problems then add more details, especially
- The exact URL you use. Note that there is a difference if you use www.example.com vs. example.com.
- The certificate you see in the browser, especially the common name and the subject alternative name part. And compare this with the certificate you get from s_client and which you consider as correct.


Is this reponse vulnerable to xss? My application is returning  category parameter in json body as the following response..

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
P3P: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
Server: nginx
X-frame-options: SAMEORIGIN
Content-Length: 139
Accept-Ranges: bytes
Date: Mon, 26 Jun 2017 15:47:55 GMT
Connection: keep-alive
Set-Cookie: bf-geo-country=EG; expires=Tue, 27 Jun 2017 15:47:55 GMT; path=/; do                                                                main=.myapp.com;
Content-Security-Policy: upgrade-insecure-requests
Strict-Transport-Security: max-age=120; preload
X-Served-By: cache-hhn1524-HHN
X-Cache: MISS
X-Cache-Hits: 0
Vary: Accept-Encoding

{
   "response" : "an error occurred",
   "campaign_monitor_errors" : [
      "no config for Newsz<htMl onload=prompt(22)/></html>"
   ]
}

Can this lead to Reflected XSS by MIME sniffing in IE or Chrome ?

Short answer is that the parameter should be encoded regardless. As paj28 mentions in above comment, it depends what client side page does with the data.

The book, "The Tangled Web" by Michal Zalewski has a chapter about content detection.  He says, "In the history of the web, nothing has proven to be as misguided as content sniffing."

He gives advice at the end of the chapter. Primary tip from this book and from other sources is to use the X-Content-Options: nosniff header to prevent the browser from sniffing the content and coming up with its own answers and ignoring your content-type header.

Your browser's reaction to the actual JavaScript in your example will depend on the browser version.
Note:

text/javascript content type is deprecated. The official MIME type for JavaScript is application/javascript  (as of 2006)  http://www.rfc-editor.org/rfc/rfc4329.txt


Is it a good practice to proxy web-applications from Docker containers? The current setup is the following:

A production server (host) has only a few open ports, namely HTTP, HTTPS and secure ports for e-mailing.
On the host there is a non-privileged user running a Docker engine and containers.
Several web applications are running on Docker containers, each runs on a virtual bridged network provided by the Docker runtime. They have open ports HTTP and HTTPS. Applications are running on arbitrary web-server technology, like Apache 2.? or AKKA-HTTP.
Only one "http-proxy" container exposes its ports (80, 443) to the host. On this container, a non-privileged user is running a mod-secured Apache 2 server which only forwards requests based on the domain requested and forwards to one of the application containers.
Mail server is running on a Docker container with non-privileged user that exposes its ports to the host.

Questions are:

Are there any drawbacks to this model?
How would it be more secure?
How exposed are the application-containers to attacks?
Are there any security considerations regarding Docker?

Thanks!

Are there any drawbacks to this model?

I don't see any immediate drawbacks, except for the overheads and the use of disk space if you deploy your applications on a rolling basis without keeping volumes in check. Keep in mind that "A Docker data volume persists after a container is deleted. " see the Docker documentation.

However, there might be a few longer-term drawbacks. For example: since you run this in production, how often do you apply security updates to your containers? Given that docker images are a step removed from upstream, security patches might not be deployed fast enough. How often do you check for updates to your containers, and redeploy them?

Also, if one of your containers gets 0wned, do you filter outbound connections? What if a trivial exploit in your app makes it part of a botnet?

  How would it be more secure?

It depends. Do you mount the host's /proc or /sys in any container? If so, beware of this kind of attacks (and search for 'docker escape' for an entertaining read)

  How exposed are the application-containers to attacks?

For attacks coming from outside your network perimeter, they are as exposed as if the applications were running as regular UNIX processes on a system.

Oddily, for attacks coming from other containers you are actually increasing your attack surfaces: assuming some containers can see others (e.g. web server can see the db server, or a log server, and so on) you have to make sure each container does not run extra services and most importantly keep them up to date.

  Are there any security considerations regarding Docker?

Yes but the question is too broad. There are docker escapes due to poor container management (e.g. mounting /proc). There are potential docker exploits. There is the occasional misconfiguration that allows local users to attack it. If you're looking for a silver bullet to deploy and forget, you'll be disappointed...


What to do for my Web API authentication scheme? I've been reading a lot lately about Web API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based authentication but I'm not sure if it is the right choice.

Basically my Web API will manage all the operations needed and it will store the users of my website as well the API users.

I want to support the following

User can register on my website and apps using their G+ or Facebook account or an already created username from my service, as well they will be to login using their social account.
If the user is not logged in they won't be able to post Items but they will be able to see the Items, think something like Craiglist.
Let's say the user is a developer and they want to post the items through some software they created instead of going through the website and posting one item at a time, how do I allow this?

Now, my questions are:

When a user registers on my website, do I have to create a (public key/ secret key) for it subsequent access token , so I can use my API from the website as the user checking if they have access to certain endpoints?
Do I have to assign a (public key / secret key) for my website so I can consume the API when the user is not logged in?
The same as above for mobile apps
How do I allow users to (sign up / sign in) using G+ or Facebook?, if they log in using any social network how am I going to secure my api?

You need to separate authentication and authorization.

Authentication ensures that your web site knows that the incoming user is actually the one you have on file. In other words, once someone has registered as bob in your application, everyone claming that he is bob is checkd via authentication.

As you mention, you have several choices for authentication. You can offload the process on some well-known identity providers (Google, Facebook, LinkedIn, ...). They will make sure that someone coming in as Barack Obama has been authenticated as such on their side.

It is important to understand that you do not know whether Barack Obama logging to your site is indeed the US president. The only thing you know that someone registered as such on, say, Google and the same person will be consistently authenticated as such via Google.

You need to look up the identity management on the various sites you want to use (Google for instance). The keywords are OAuth and OpenID.

Now that you know that Barack Obama is coming in, you need to give him or her access to some things and not to others. This is the authorization part. It is completely dependent on your application.

What you will be basically coding is that a specific ID (which is ultimately the user logging in) can see some content. OWASP will help you to make it secure.

An advice: if you can completely offload authentication to someone you trust and your users will trust (typically the big players above), do it. Do not be Adobe.


How to report a vulnerability in a site that wants to call the FBI? I was browsing a site recently that looked like it had been designed in 2000. However, this site has a good Alexa rank and a fairly active online community. For the protection of the site, I will not give specific details about the site.

I found a trivial reflected XSS on one page when I followed a broken link and saw that a URL parameter was reflected in the HTML. I dug some more and found a few other reflected & stored XSS holes. I looked for contact information on the site, and found the email of the admin and a page about the site's security.

On this page, the owner bragged about the security of the site, making some claims irrelevant to XSS. The owner also said that if you even attempt to hack the site the owner will tell the FBI and I don't want to get in legal trouble for submitting a security hole. The owner also claims that the site is valueless to anyone who breaks in because no important data is stored. However, the site has a login with usernames and passwords, and XKCD #792 tells us that stealing passwords is a very big deal.

The security page also claims that text is well sanitized and unsafe text is stripped. However, the only adjustment I had to do to get reflected & stored XSS was to make the HTML tags uppercase (lowercase tags were stripped, possibly in an unsafe way.)

I am unsure about how to report a security hole to this website without getting arrested. What should I do?

If you're really just trying to help out for the greater good, you can send a message anonymously using something like Guerrilla Mail over Tor. Believe there's also a Tor hidden service for/like this, but I'm at work right now and can't check to see if it still works.


spam with my own domain At my work we have a very tricky issue with spam. We use postfix, and recently began to receive several spam mails from our own domain.

This is obviously very prejudicial for us, because many customers could think that those mails were sent by our company.

Does anyone know some guide or solution for this particular problem? The thing is that mail server configuration isn't my expertise, so I'm a bit lost in this.

There's no fix for this. Anyone can forge the From: address in an email, and only a technically sophisticated user can detect the forgery.

You could use DKIM and/or SPF to increase the chance that ISPs will detect the forgeries and block the emails, but this will only work sometimes.


security of swoopnow integration on website We are planning to use swoopnow site apis (no-password) integration for our website.
(swoopnow provide apis which give user to login on site without any password)
However we are not sure about its api security level.
(https://swoopnow.com/wp-content/uploads/2018/05/@Pay-Authentication-101-3.pdf)

Could any one let us know it really secure to use ?
Are there similar apis which provide these type of features?

As I said in a comment - we don't do review of arbitrary third-party API's here. But given that the site claims to provide an API for easy integration of password-less logins I find it worth to take a closer look.

The problem is that there are no real technical information on this site on how this works. I've tried there small demo and found that it works be either the client send them a mail with a specific recipient and they log you once they receive this mail - or that the client provided them with an email and they send a link and after clicking on the link the user is logged in. This means probably that all what is needed is for someone to have access to your mail account - and maybe even the possibility to fake sending mails from your account (which is easy) is sufficient.  For more on this topic read
 Passwordless login over email - security considerations.

On top of that they now have your mail address and it is unclear what they will do with it. At least I did not find any kind of privacy policy on their site which maybe means that they feel free to use all the mail addresses they've received for advertisements or even resell the mail addresses. This is likely not the kind of services you want to offer to your customers.

But there are even more warning signs. If you look at the prominently featured documentation how simple an integration is you will notice that

It recommends to include a script from a third party site which you don't control. This script has essentially full control over the site in the browser, i.e. can extract information from it, change information, submit information with the origin of your site etc. See Should I be worried of tracking domains on a banking website? for more information.
It recommends to include the script as insecure http:// and not secure https://. This means that the transport of the script is not protected against man in the middle attacks which can manipulate the contents of the script and thus essentially have full control over your site display in the browser. Fortunately, if your site itself uses https:// (recommended) such insecurely included third party scripts will not work at all. But this also means that if you just follow the documentation the integration of the service will either be insecure or it will fail completely. And it gives some idea of the (missing) security mindset of the developers of this service.
But third party scripts can actually be included in a secure way. subresource integrity lets you specify the hash for the expected script. And it is actually supported by most major browsers. Of course, with subresource integrity the third party cannot just make changes to the script - but this is probably exact the thing you are trying to avoid.

Another red flags are there security claims. To cite from the FAQ part of their site:

  Is Swoop secure?
  Swoop uses state-of-the-art 2,048-bit encryption to
  authenticate your user. But what does that even mean? Well, if a
  hacker got started 13.7 billion years ago (at the start of the Big
  Bang), then he would still only be .00000213% of the way done. That’s
  how secure it is.

And this is just bullshit and playing with big numbers. The only state-of-the-art 2048 bit encryption they could mean is RSA - the others use far fewer bits (like 256) since these are sufficient.  And you only need 2048 bits with RSA since RSA is not as good as the other algorithms.

Apart from that it is not clear what gets encrypted here in the first place. It cannot be the mails which are sent for authentication because swoopnow has no control over how the mail gets delivered. See How (in)secure is POP/IMAP/SMTP and How secure is e-mail landscape right now?.

In summary:

they can collect and misuse the mail addresses of your customers
the documentation for integration they provide results either in an insecure integration or one which does not work
the make silly security claims instead of providing any real design information


"Authorized" Man in the middle I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root certificates.

Is it possible for a tool to log the connection as a man in the middle, but authorized? For the server this tool would appear to be a client; for the client it would be seen as the server.

Is this possible? Which certificates does this tool need?

You just need to add the tool certificate in the trust store of the client, so that the client trust your "tool as a server". Then in order not to have any errors, every time the client tries to open a TLS connection, you have to clone the actual cert with your custom CA:

Client tries to initiate connection with the server, it goes through your proxy
The proxy initiates actual connection with the server, gets the server certificate back
The proxy creates a new certificate with the same CN but with its custom CA
The proxy responds to the client with that new certificate, it's trusted by the client because you added your custom CA in the client trust store

Also be wary of propagating possible certs errors to the clients (not like Lenovo for instance..)


Does Kismac work on MacOSX 10.9+? Hi I am trying to get Kismac working.

I downloaded the r407 version from here (http://trac.kismac-ng.org/wiki/Downloads) but when I scan for networks I get a never ending sceen saying "Loading Apple Extreme card, passive mode".

When I try to use the other versions, I can scan the network but I get not packets with the passive mode.

Does anyone knows how ot make Kismac work on MacOSX 10.9+?

Many thanks for your help

Best

Kismac is no longer developed. Besides, macs generally do not have the wireless chipset that is capable of injecting packets.

A more effective solution would be to create a linux VM (running under Fusion or your chosen VM software), investigate which chipsets are capable of injection, buy one, install the aircrack-ng suite and go from there.


Securing folder being accessed by batch file I will state up-front that I know fairly little about encryption and could be asking a silly question, or asking a good question in a silly way.  Thank you in advance for your patience.

I have a folder, within which are Python modules as well as pickled files containing support vector machines and numpy arrays.  Outside the folder I have a batch file that initiates the main module within the folder, and that main module utilizes the other modules and periodically loads the SVMs and arrays.  The entire process has a duration of perhaps two hours.

I want to encrypt or otherwise secure both the folder and the batch file, such that:

a user can run the batch file but cannot open or otherwise edit it;
the batch file can access the folder's contents (presumably using a password hidden to the user thanks to (1);
IMPORTANTLY, a user cannot access the folder's contents even when the batch file is accessing the folder; and
all of this must be accomplished without the user having to explicitly install and rely on third-party software on her own system, even if the folder and batch files are moved to her system.

Is this a trivial task, or a complicated one, or impossible?  Are there other approaches that would better meet (or at least come close to meeting) my four above-stated goals?

AFAIK, you cannot with a batch file on any Unix-like system, because when you launch a batch file, you execute the shell program (/bin/sh for example) that reads the file. AFAIK, it will be the same on Window: a batch without the read permission will not be executable by the user.

If it becomes an executable file on Unix, you can make use of the set user id mode. It a a disputable feature that allows a process to gain the authorizations of the owner of the program, instead of the ones of the user starting it, during the time of execution. That was heavily used for local games in the 70's: only the game program could read/set the scores. Here that means that the directory will be accessible to only one user (the owner of the program) and the other users will only be able to start the program.

Although very powerful, this mode has corner cases and several security implications and is now seldom used (if any) is serious application. Anyway, nothing like that exists under Windows.

The now recommended way is to have a daemon (Unix) or service (Windows) started at boot time and running under the user id of the owner of the folder, the folder being accessible only to that user. And you have front programs that communicate with the daemon/service through an interprocess communication tools such as named pipes, message queues, sockets etc.

That is slightly more complex as it involves two processes and one communication channel, but is far more secure since it cleanly separates the user interface from the processing program. But you also gain the possibility to have the user interface on remote machines and the folder with data on one single secured machine, by simply switching to a network communication channel...


Why don't people hash and salt usernames before storing them Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.

What I started to wonder today is why the don't they also store the user ID in a similar hashed & salted password?

To me this would seem logical because I can't see any drawbacks, and if the db was compromised, the attackers would need to "crack" the password and the username hash before they could compromise that account. It would also mean that if usernames were hashed and salted email addresses, they would be more protected from being sold on to SPAMmers.

You see that thing up there where it displays your username? They can't do that if the username is stored hashed now can they?

One word, usability.


Is deleting LUKS keys during operation a good way to protect my data? Let's say Alice owns a server that stores highly sensitive data. Let's further assume the data is worth a lot, but losing all data is way less of a problem than having it read by attacker Mallet.

To have the data safe in normal operation, all the harddisks have LVM and LUKS with full volume encryption enabled. There is one keyslot enabled. The server is protected against power loss via UPS.

Alice could see Mallet, physically trying to steal the harddisks, coming, ssh into the server and issue cryptsetup luksErase to permanently destroy the header and thus make the data unrecoverable.

If, however, Mallet sneaked into the server room, unplugged the server from the UPS without shutting it down, and then took out the drives, the LUKS headers with the keys would still be on there. Assuming Mallet had the computation power at his hands to break the password, he could unlock the volumes.

Now I came up with this: What if the server, once the volumes are unlocked, overwrote the headers? In a case of sudden power loss, all data would be gone forever. When Alice needs to reboot, she could copy the data off the unlocked volume to another disk, reboot, reinitialize the LUKS volume and restore the data, then destroy the external disk.

Would that be safer or is it sufficient to choose a long enough password for LUKS? (Not to mention the solution is surely paranoid, but just in theory)

Would your solution be more secure than choosing a really long password?

That depends on the size of the passphrase.

The luks header contains a certain-sized key and iv.II don't know the sizes in bits of those two without looking them up, but lets assume that together they are 512 bits long.

If you overwrite the luks header, in order to decrypt the partition, you need to correctly guess these 512 bits. This is currently impossible to do in a useful amount of time (think anytime before the sun explodes...)

If you assume luks doesn't do any key stretching (which it does), you need a random passphrase of 64 characters to match this. You can easily produce such a key:

$ dd if=/dev/random of=my-key bs=64 count=1

You can even pass in such a key directly while creating a luks partition. This is how encrypted swap works on linux. The swap partition gets reinitialized with a new random key every time the system boots, so the old swap contents are securely destroyed.

For your system, you could make it easier to handle by storing the luks key in memory (or /dev/shm). When the system unexpectedly shuts down, the partition is lost. when you want to reboot, you store the key to disk (or export it over the network) and open the luks container using the stored key after reboot. Then you replace the key with a new key, which you again only keep in memory.

This way, you won't lose the data on scheduled shutdowns.


Concern about potential of VPN access being restricted in Italy Background: I work a remote employee in the US for a US based company. I log into our company's intranet via VPN to work every day. I also connect to multiple client networks via VPN (as well as using TeamViewer, LogMeIn, RPD, etc).

Plan: I want to work from northern Italy (Bergamo area) for 2-3 months while visiting family. This is a well established commercially developed area with fast, reliable internet access.

Concern: My company has expressed concern about me being able connect to networks, use my VOIP phone, access client servers, or even our own VPN from that location.

Question:
Is this a valid concern? Is it possible that certain services or VPN's would block incoming traffic from Italy? I'm almost 100% sure that Italy would not block outgoing traffic (other countries). Is there any way to test this? I'm not even sure where to start.

I don't know about the VPN service blocking the traffic, but some IT Security Defense measures entails only allowing IP's from certain geographic locations. Its possible that either the ISP the company is using or the company itself is using a GEO IP service to determine location and blocking traffic based on it. For Instance a Company based in the US that doesn't employ oversea workers would have no need for any foreign IP connection. Thus filtering traffic based on GEO IP and reducing risk.


A security warning when accessing a site through IP When I go to https://www.schneier.com/, everything works normal.
As soon as I access the same site using its IP address (66.33.204.254), I get a security warning (even if I write something like https://66.33.204.254:443/).

The same is not true for google.com (I'm using this IP address: 216.58.211.14)

Why is that? How are these two sites different?

UPD: Here's the GIF of what I see when entering Google's IP, no warning there: http://www.giphy.com/gifs/26gYMNRlBYy9yAYnu

It's because you generally create a TLS Certificate for an hostname, not an IP. Changing IP addresses is trivial, changing domains are not that common.

If you open the site in Firefox using IP, you will see this message:

66.33.204.254 uses an invalid security certificate.

The certificate is only valid for the following names:
 schneier.com, www.schneier.com

Opening 216.58.211.14 (Google) will give the same message.


Is there a good 160 bit alternative for SHA-1? SHA-1 has long been considered insecure, and now the attacks have been demonstrated in practice also. The proposed alternative for SSL certificates is the SHA-2 suite of hash functions, of which SHA-512 is most commonly used.
However, the hash generated by SHA-512 is nearly 4 times longer than SHA-1. This is not a problem is the hash is used only by machines, but for e.g. verifying file integrity manually it is inconveniently long.
Question
Is there any hash function that:

has the same (at most) 160 bit long hash as SHA-1,
has been widely analyzed,
but has no known vulnerabilities?

First, SHA-256 is significantly faster (usually) than SHA-512, and is strong enough for the vast majority of uses.

Second, you can truncate hash output, as long as you're aware of the "birthday paradox" -- e.g. 160 bits of output gives you ~80 bits of security. You probably want to avoid truncating if possible, but if you need to, SHA-256 truncated to 160 bits is better than SHA-1 at this point.

Note that all the recent SHA-1 attacks are collision-based -- there are no preimage or 2nd preimage attacks, even against MD5, so "reversing" these aren't feasible (currently).


Is adding a supplementary credit transaction something that could improve online payment security? An online company from which I regularly buy goods apparently recently upgraded their security policy.

Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout process and will actually process the payment only upon shipment a few days later.

The shipment confirmation email contained a strange notice I could translate as follow:

  Amount ordered: 73,31 €

  Within the framework of the reassurance of the online payments we
  proceeded to the following operations:

  Amount charged on your credit-card: 73,41 €
  Amount credited on your credit-card: 0,10 €

The amount additionally charged appears to be random and varies from a few cents to a few euros.

I'm wondering what threat are they protecting against?

They received the payment, so they got the money.
They used 3D-Secure for a relatively low amount, so the transaction is largely covered by the bank in case of fraud.
It seems they are checking that the card used for the payment can also process credit, maybe a way to detect prepaid or onetime payment cards, but again: what's the point since they got the money? By the way they also had to create a new page for the users of such cards a few weeks after deploying this system, "Due to technical restrictions" as they stated it.

I just do not understand the threat they are trying to avoid, or maybe is it just some security theater made to impress customers with some crappy but unique security measure?

Answering my own question to be able to flag it as answered and prevent it from popping up from time to time: this measure appears as a plain example of security theater.

Here are the elements leading me to this conclusion:

I asked their support teams then reason behind this change: while they were usually quick to answer more usual questions I never received any answer to this one.
The change was apparently clunky and not well thought: they had to add a special functionality to allow onetime and prepaid cards to bypass this measure a few weeks after enabling this system as, obviously, a section of their customers weren't able to proceed with the payment step anymore.
This process is exclusive to this website: this a good thing to impress their customers but, from a technical point-of-view, this does also mean that no one else ever wanted or felt the need of such a system. It never takes long for new and genuinely efficient security-related ideas to spread, under one form or another.
This process is directly noticeable by the end user, which is required for an effective security theater measure.
I never saw any advantage to this measure, neither did any of the other Security.SE contributors for the two last years.

If anyone has some knowledge which could change this conclusion, feel free to add your own answer, but after two years I think I can safely put this one in the security theater bin, alongside with other ideas resulting from "pseudo-security as a marketing argument", "you hired a too zealous security intern/company" and "we need to justify our budget".


Remote Desktop Access to Local Networked Machine If an attacker had access to another system on my home network, how could I protect myself while still having access to the internet? What steps or things could I do to increase the security on my side to protect myself?

In this scenario I cannot interfere with the compromised machine (this is a theoretical situation, realistically I could disinfect the other machine, but I want to know what I could do on my end).

All machines on an untrusted or semi-trusted network should run their own firewalls. They should also be running anti-virus and have strong pass phrases for all logins and no default ID's. You should also make sure that remote support & remote access protocols are turned off unless needed. Periodic anti-rootkit and anti-malware checks may also be helpful. In other words, all the usual stuff you would do. Laptops should also have fully encrypted drives and ideally disabled USB ports (though few people will want to live with the hassle of that).

You haven't said what OS but assuming Windows 10, it already has a reasonable, pre-configured firewall.


Downloading Text from Articles Is there any security measures that I should take when downloading article text from the web as far as file integrity? For example, I've written a bot that retrieves article text from a user's blog and saves them to disk. What measures would you recommend and/or enforce?

hmm is this confidential information? if is already public domain.. why even worry about how secure it is?
like if this was confidential and authorized level of access then I will do the copy over ssh.. scp just to mention a simple solution.


How can I generate custom brute-force dictionaries? I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc).

So if I gave it the phrase "stack exchange' it would ideally compute as many logical variations as possible including things like:

stack_exchange!

I've seen many dictionary generators but they all seem to do something along the lines of

aaaaaaa
aaaaaab
aaaaaac
aaaaaad

I'm wondering if there are any tools available that will allow me to generate a large number of permutations given a 'starting' word.

Try using crunch - wordlist generator.

Usage is:

./crunch <from-len> <to-len> [-f <path to charset.lst> charset-name] [-o wordlist.txt or START] [-t [FIXED]@@@@] [-s startblock]

-t option allows you to specify a pattern, eg: st%ck^%xch%ng%

Where only

the @'s will change with lowercase letters
the ,'s will change with uppercase letters
the %'s will change with numbers
the ^'s will change with symbols

Running as following:

./crunch 14 14 -t st%ck^%xch%ng% -o wordlist.txt

gives 330000 results:

st0ck!0xch0ng0
st0ck!0xch0ng1
st0ck!0xch0ng2
st0ck!0xch0ng3
st0ck!0xch0ng4
st0ck!0xch0ng5
st0ck!0xch0ng6
...

You can also modify the charset if you think it's insufficient.


Metasploit - Does the multi handler sends the payload, or just listens for connection Does the metasploit module: exploit/multi/handler

sends payloads to stagers?
Or does it just listens for an incoming connection like a netcat
listener?
Or does it do both, as needed?

It depends. The exploit/multi/handler is more of a stub for whatever payload handler you need to run. So whichever payload you select (with set payload ...) is responsible for doing whatever it needs, just like if you were running it from a regular exploit module.

So yes, from a multi-handler, any of the following could happen:

A simple socket listener/connection, like netcat (for plain shell payloads)
A handler for stager payloads that uploads Meterpreter (for meterpreter/* payloads)
A handler for single-stage (stageless?) Meterpreter (for meterpreter_* payloads)


Is jQuery 2.1.1 vulnerable to OS command injection? Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website.  In each instance, the vulnerable URL was the jQuery plugin itself (version 2.1.1).
Barracuda rates each Severity as Critical, and the Confidence as Certain.

An OS command injection attack occurs when an attacker attempts to
execute system level commands through a vulnerable application.
Applications are considered vulnerable to the OS command injection
attack if they utilize user input in a system level command.
CVSS
Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Remedation Background
Minimize use of OS commands in web applications, as they are always a
security risk. When it is necessary to use an OS command that includes
user input, comprehensively scrub all user input for malicious
characters prior to running the command.

The issue details are "The field v was submitted with the value /bin/cat /etc/passwd. The marker root:" followed by a huge chunk of minified jQuery (6 pages), and ends with "fa+";expires=Thu, 01 Jan
1970 00:00:00 was found in the response, suggesting that the injected command was executed, and therefore that OS command injection is
possible.".
There were also High Severity in the same jQuery plugin for Directory Traversal:

Directory Traversal, also known as Path Traversal, "dot-dot-slash" and
"backtracking", is when a misconfigured server or code error allows an
attacker access to files outside the web root folder. These files may
contain source code, configuration, and critical system files,
including password files.
CVSS Score: 6.8
Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
Remedation Background
Do not use user input
that is not properly sanitized as any part of a path component. It is
even more advisable to never use user input in a path component at
all.

Again, the details were "The v parameter was submitted with the value /etc/passwd, and the response contained the value root:" followed by 6 pages of minified jQuery.
I'm going through all of the forms to verify that the inputs are, in fact, properly sanitized, but the report seems to be identifying the vulnerabilities in jQuery 2.1.1 itself.
That strikes me as unlikely, but I'd like to be able to know for sure if these are, in fact, false positives.  I will be updating to a more recent version of jQuery, just to be safe. What steps should I take beyond investigating the form inputs and updating jQuery?

It's a false positive.

In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is:

root:function(a){return a===o}

This is obviously not from a passwd file. It is also very unlikely that any server-side vulnerability exists in a request for a jQuery file, generally they are static files that are served as-is.

That the scanner reports "certain" is a bit surprising, as "root:" is way too general of a keyword for such a high confidence rating.

When getting a report such as this, you need to verify the result. In these cases, you should:

search for the keyword the scanner gives you - "root:" in this case - and see if it actually is what the scanner thinks it is.
adapt the payload and see what happens. In the case of the command injection, you could try other commands and see if they are executed, in the case of the file inclusion you should try to include other files.


Should each service running on a domain have a separate certificate? I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g. web server for website and wiki run on different ports served by the same apache2 instance, others by separate software (e.g. issue tracker)). I only own the domain name without subdomains and distinguish the service by non-standard ports (e.g. 1234 to 1243). So far I used self-signed certificates in order to learn administration and get a minimum of security. That all works fine.

Now, I got a SSL certificate from letsencrypt.org and want to use it for as many service as possible.

Is it better practice to use as few certificates as possible/keep the chain as short as possible or is it considered better to have a separate certificate for each service/port? The former follows the KISS paradigma, but an issue with the certificate would affect all services (I don't know any, but there might be some), the latter would increase the maintainance at creation, setup and renewal.

There might be issues which arise after general availabilty of IPv6 which I'm not very firm with.

"Complexity is the enemy of security"

I would always look to use the least amount of certs possible for a number of reasons, mostly due to the ease of administration. It's my understanding that letsencrypt is not currently allowing wild card certificates (these certificates essentially allow you to secure all subdomains of a domain where the traditional certificates only allow a specific URL (ie secure.domain.com).

Now with that said wild card certs come at a premium and they can be quite expensive, especially if you're using them simply for personal use. In that case you may find that you'll need to key multiple certificates and expose them via non-standard ports as you've described, however in a professional setting I'd go with wild card certs simply because of the ease of administration. The easier the administration the less likely you are to miss something / screw up a configuration which reduces your attack vector imo.


How to protect my email and social media accounts? Someone been hacking my account. It seems the person is expert hacker. I have had changed my password multiple times. They seems to know personal details of my life and things on my gmail and facebook account that very personal. I used a computer that someone installed teamviewer and logmein. I have increased the number of characters used in my account. I have in pass used unsecure wifi. I was trying figure out more methods to prevent this in the future.

Two step authentication, make it send a text to your phone anytime you need to login. check your logs on your computer and check all programs. run ccleaner, and malwarebytes.


How to handle a malicious SSL/TLS shutdown The TLS protocol specifies that a close nofify message should be sent whenever one of the peers wants to close the connection. This prevents a truncation attack that would send a TCP FIN message as if the peer sent it himself.

Therefore, if the connection is closed without receiving the close notify message, it means a malicious third party is messing up with our connection (let's ignore the fact where a legitimate peer would not perform the shutdown properly)

My question is: what should we do in such a situation?
Does it mean that the last message received is corrupted and should be discarded? Does the whole session need to be rolled back?

Note that I am thinking about a situation where we are sure that the lack of close notify is malicious as opposed to bad peer implementation. I am also not assuming a specific application protocol.

In practice, many widely deployed HTTPS servers close connections abruptly, without any prior notice, and in particular without the close_notify. They do that because they want to kill connections that have been inactive for too long (say, more than 30 seconds), and they want to do it even if the connection was inactive because the client is gone (e.g. crashed, or moved out of range of the WiFi access point, or any other similar situation) and will not actually acknowledge the close_notify.

It would be technologically feasible for a server to send a close_notify even to a dead client, and still clean up resources properly, but many server designers find it easier to simply not send the close_notify (this allows keeping the SSL engine and the socket management separate). This is in contradiction with the TLS standard, but we know that real-world developers have an uncanny ability to "cut corners" when they see fit. Note that TLS 1.1 and 1.2 acknowledge the widespread practice of not sending a close_notify, by considering that such a failure does not invalidate the TLS session as a whole (the session may thus be resumed over other connections):

   close_notify
      This message notifies the recipient that the sender will not send
      any more messages on this connection.  Note that as of TLS 1.1,
      failure to properly close a connection no longer requires that a
      session not be resumed.  This is a change from TLS 1.0 to conform
      with widespread implementation practice.

Consequences are not necessarily bad. The close_notify is necessary for security when the application protocol is not self-terminated. For instance, with HTTP-0.9, the client knows that the end of the requested document is reached because the connection is closed; lack of a close_notify means that a truncation attack is possible (the attacker maliciously forces a TCP connection close "early"). However, with HTTP-1.0 and later versions, request and response bodies have an explicit Content-Length, or use "chunked" transfer encoding, both of which unambiguously identifying the end of the body. For a self-terminated protocol like HTTP-1.0, the close_notify is not needed for security.

A situation where close_notify is absolutely needed is for protocols that exchange data before and after the SSL/TLS session, over the same connection (the STARTTLS method). In that case, client and server cannot reliably send data to each other over the connection after the SSL closure if they did not mark the closure with close_notify messages.

To sum up, you may formally react to a lack of close_notify as an ongoing attack or a network failure, but if your communication protocol is self-terminated, then you may simply ignore the lack of close_notify.


Does factory resetting a phone erase spyware? I thought that there was spyware on my phone so I did a factory reset.
Would the spyware be gone or it will still exist even after a factory reset?

Chances of malware surviving a factory reset are very, very small, but not zero.
If you have rooted your phone, there is a small chance that malware can copy itself to the system partition, so it would survive a factory reset. Some anti-theft software will do the same for legit reasons: if a thief steals a phone and performs a factory reset, the owner can still track the phone.
If you are resetting the phone, you can do a firmware upgrade: download the latest firmware package from the phone manufacturer, and follow the instructions to upgrade the firmware. This will wipe out any trace of anything on the phone.


Verify senders of earlier emails in chain I know that an emails' sender can be verified e.g. through DKIM.

If I receive an email chain containing replies, forwards, etc. is there any way to verify the sender of other (earlier) emails in the chain?

If you get a mail with was forwarded as a message/rfc822 attachment with all headers instead of inline it is possible to validate the DKIM signature and check the result against a DMARC policy. For other kinds of forwarding (i.e. quoted, prefixed...) this is not possible. It is also not possible for replies since none of these contains both the necessary DKIM-Signature header and the unchanged mail headers and body which are covered by this signature.


Why is a scrypt hash different each time? I'm trying to wrap my mind around scrypt and how it's hashing works. I've got a basic function that will create a scrypt hash, however it seems that everytime I run it, the hash is different. Does scrypt always output a different hash, if so, why?

from passlib.hash import scrypt

def scrypt_hash(string, salt=None, front=False, back=False):
    print scrypt.hash(string)

#<= $scrypt$ln=16,r=8,p=1$3RvjfE9JCWEMobT2HoPQ+g$fv0toINPck6zSYD5+QqKUFi4GkptYT/deJ/C8R0JLSU
#<= $scrypt$ln=16,r=8,p=1$Xus9x/g/p1QK4bzX+p9zLg$G/JbYOw8Km1l57MUescXrPEjbVz8GIh8lPyIlOI9rMc
#<= $scrypt$ln=16,r=8,p=1$qzXGOIew1npvzZnzvpdSqg$17/frDtJOPnOODHSXOM4kw6N3oUNLltLOTf+odzZ8RA

If you don't specify a salt, one is randomly generated. The salt is different each time, so the hash will also be different.

  salt (str) – Optional salt string. If specified, the length must be between 0-1024 bytes. If not specified, one will be auto-generated (this is recommended).

source