Any Known countermeasures against clock skew fingerprinting? I know lots of websites that do clock skew fingerprinting using tcp timestamps. I know how to disable timestamps but i want to know techniques that can be used to counter clock skew fingerprinting. I read somewhere that one can spoof this clock skew based identification process by altering the system timestamp
values, it is a complex procedure and requires a detailed knowledge of how the kernel interprets system time and how this system time is reflected in the default OS generated fields in packet headers.

Anyone knows how to spoof/ alter tcp timestamps?

As of Linux kernel commit 95a22caee396cef0bb2ca8fafdd82966a49367bb, all TCP timestamps are randomized. This allows you to mitigate clock skew fingerprinting without worrying about the issues that can arise on high-throughput connections when timestamps are disabled. Note that this commit was partially reverted due to breakages, but TCP timestamps are still randomized on a per-host basis.

See a copy of the relevant commit message, from 2016:

tcp: randomize tcp timestamp offsets for each connection

jiffies based timestamps allow for easy inference of number of devices
behind NAT translators and also makes tracking of hosts simpler.

commit ceaa1fe ("tcp: adding a per-socket timestamp offset")
added the main infrastructure that is needed for per-connection ts
randomization, in particular writing/reading the on-wire tcp header
format takes the offset into account so rest of stack can use normal
tcp_time_stamp (jiffies).

So only two items are left:
 - add a tsoffset for request sockets
 - extend the tcp isn generator to also return another 32bit number
   in addition to the ISN.

Re-use of ISN generator also means timestamps are still monotonically
increasing for same connection quadruple, i.e. PAWS will still work.

Includes fixes from Eric Dumazet.

Signed-off-by: Florian Westphal
Acked-by: Eric Dumazet
Acked-by: Yuchung Cheng
Signed-off-by: David S. Miller

Prior to this change, it would have been necessary to manually patch your kernel.


External command execution in Excel formulas It's known that MS Excel functionality of external references will allow executing arbitrary commands from its formulas with appropriate security warnings and confirmation required from the user.

E.g. having a cell in excel sheet (or csv file opened by excel) that contains the formula =cmd|' /C calc'!A1 will run calc.exe in a manner that can be extended to run arbitrary code.

However, this rises two questions:

Are the details of this functionality documented anywhere? MS Office documentation of external references doesn't do so.
Is there an equivalent construction in Excel for Mac? The particular example doesn't work, but it could as well be because of cmd (and calc) being windows-specific command names; if the external execution is intentional (as those old vulnerabilities haven't been removed but just had the warnings added) it should likely be implemented in Excel for Mac as well.

The functionality to run arbitrary code was an intentional feature that Microsoft added. Back when office was released the whole threat molded was different, we did not share files like we do today. And since Microsoft hate to remove features and break backwards comparability we still have to deal whit this.

  Are the details of this functionality documented anywhere? MS Office
  documentation of external references doesn't do so.

=cmd Appears to be badly documented it can't be found in the list Excel functions (alphabetical), however the VB documentation has example code on how to start the calculator Here

  Is there an equivalent construction in Excel for Mac? The particular example doesn't work, but it could as well be because of cmd (and calc) being windows-specific command names; if the external execution is intentional (as those old vulnerabilities haven't been removed but just had the warnings added) it should likely be implemented in Excel for Mac as well.

Yes, Office 2011 can run arbitrary code POC, In office 2016 Microsoft added a sandbox but it has had issues: ref


When gpg encrypt is called from the command line, how is a key chosen to do the encryption? I am using GnuPG. When gpg encrypt is called from the command line, how is a key chosen to do the encryption? It appears to me that -r, or --recipient, supplies a user id and that is the simple answer. I believe all of the examples I have looked at they show an email address for recipient, which is required input when creating your key. However, I was able to create 2 keys with the exact same user name, comment, and email address. How does gpg pick a key if there are two keys that have identical email addresses and that email address is used for the recipient? It seems to me like using key id would be the best way to do this, but I do not see that option.

Often, whenever you provide a filter to a parameter which matches multiple keys, it uses  all of them (e.g. --list-keys or --export). I was expecting it to do the same here. However, a basic check shows that it is not encrypting to all of them, but only to a single key, which is the one imported earliest to the keyring (the selection changes if imported in the other order). The command --delete-keys acts in the same way as -r, choosing just the first one present in the keyring.

You may see to which keys it was encrypted (other than by attempting a decrypt) by parsing the actual packets:

echo Hello world | gpg -e -r jdoe  | gpg --list-packets

And, as noted by CBHacking, you can use key ids everywhere. Using the textual user ids are actually simplifications for better usability.


Secure Web Password Fields + http to https redirect I'm a software developer but I'm marking my niche in secure development.  It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of web passwords:  The login page is http, but the submit button links to an https link.

Using WebScarab I captured the password in plaintext form... meaning to my eyes, that my message will be sent as plaintext, unless WebScarab is looking at this input BEFORE it encapsulates it via https.

In any case, this makes me VERY uneasy staring at plaintext in the http request...

Are my worries founded here?  What should be my next step?  (I've already reported this to the vendor.)

Yes, this is a security issue because an attacker may be able to change the HTML code. He can change the action attribute of the form to point to his own server. Or less obvious and better: Add some javascript code that mirrors the password to his own server without breaking the login to the real site.

Unfortunately both Facebook and Twitter set a bad example here. Google Plus, however, redirects to https immediately, so there is some hope.

What should you do? Educate users that they need to check the address bar for https and the correct domain before they enter any private information into web forms.


Why is Facebook planning to drop support for SHA-1 encrypted sites, when they themselves use a SHA-1 certificate? I noticed this problem when I implemented the Facebook Like Button plugin on my website, and got this error in my browser console:

Hmm, I'm assuming that Firefox is talking about the last request, which is to Facebook's API.  But just to be sure...

Alright, I guess they just haven't gotten around to updating yet.  But wait a minute, Facebook themselves are planning to block apps that use SHA-1 in about a month!

Hmm, maybe my browser is caching some old cert (is that even possible???)  Well, let's see:

What the heck is going on here?

From the first paragraph of the link you've provided:

  As a result, apps that don't support SHA-2 certificate signatures will no longer be able to connect to Facebook starting on October 1, 2015.

I would read this differently to your interpretation. This is not a requirement to the apps to have certificates signed with SHA-2 but it is a requirement to support SHA-2 signatures. This is probably because facebook is moving to SHA-2. And if the certificate for facebook is signed by SHA-2 apps which don't support this algorithm will not be able to validate the certificate and will thus (hopefully) fail.

If you look at the certificate of facebook you will see that it expires at 15/10/15. This means that they will have a new certificate after that date and I guess this will be signed with SHA-2 which is the reason they require apps to update now.


Computer monitoring while working at home I have a computer from the company and, while working at home, I would like to know if the company could be capable of monitoring or spying on my computer.
I am not connected to any company's server and I am using a personal no-log VPN for security reasons.

I am not sure if me being logged in to the company´s mail (gmail), they could be capable of monitoring my network traffic or the data in my internal storage, or even access my computer and monitor and find out what I am really doing real-time...

I know they can check my activity related to that google account. Nonetheless, using another browser with my personal account, would they be capable of monitoring that traffic or activity?

It depends on the very nature & purpose of your laptop. Since you mentioned that it is a work laptop, I would not rule out the possibility that the company installed software to log down user activities.

I know for a fact that logging into the company's gmail does not allow them to "monitor your network traffic and internal storage." So rest assured on that.

It all comes down to the software that is installed on the laptop, and the forms that you would need to sign to notify you of the 'monitoring' aspect of the device (most companies must adhere to their own respective legislation)


What are the risks of using FTP? Are the risks of using FTP essentially the same as the risks of using HTTP? That is my current understanding, and reading an answer (Risks of using HTTP when I trust the local network) on the topic seems to offer little help.

Let's say I am moving backend code via FTP. Is there really a risk of someone getting the code if there is no one tapped between my computer and my modem? Is the main concern someone at the internet provider company reading it?

As you correctly noticed, the risk of using plain FTP is essentially the same as using plain HTTP: it provides neither encryption nor tamper resistance. This means passwords are transmitted in clear and an attacker can sniff the passwords. And the attacker can also modify the traffic like injecting malware into downloads.
This means that plain FTP should not be used for anything were these attacks can be a problem, i.e. for most things were FTP is actually still used today.

  Is there really a risk of someone getting the code if there is no one tapped between my computer and my modem?

If you are inside a local network where you control all the software running and all the systems connected and were nobody can tap into the network (i.e. strong WiFi password or no WiFi at all, fully secured router...) then the risk of somebody attacking you insecure FTP connection inside the network is probably low. It still might be your ISP or it might be somebody at or in front of your FTP server. But even the local network might be less secure than you consider it because we live at a time of insecure routers and where even light bulbs might be a way in your network.


What are some existing or ideas where the use of a password can be replaced to login to a service? The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. Plus there are loads of other problems with people using the password like reuse, too simple or brute forcing etc.

So my question is what are some ideas where we can replace the process of using a password to logon to a service or application? I know we have 2FA but I'm interested in either existing or future ideas to completely replace the password for the user.

A good example of what I'm on about which is sort of an alternative is typing DNA: https://www.typingdna.com/ But it still uses the idea of a password for the user.

I think the idea is to make it as simple and convenient as the password but more secure and easy for the user to still use as a login method.

One option would be biometric authentication (e.g. fingerprint). This is a bad idea in a lot of cases. Primarily not because you finger might be damaged or someone uses it in some unsafe way but because if your secret (fingerprint) gets oublicly known: You will have the heck of a hard time changing it.

Another option would be temporary passwords. For example you enter your username and the service sends you a sms that you will be required to enter. Its like 2nd factor but as a first factor. It can also be a lot more elegant e.g. you will be requested by an app on you mobile device to tap a button and this simply authorizes your session in a web client on another machine.

A different option would be authentication via email. In this case a service generates an unique email adress (mail-auth-172adj289hf09ue2h9j8@yourdomain.com) that the user has to send a mail to using a special adress or containing a special string.

Basicly every 2nd factor could be used as a first factor. Like a hardware token that is plugged in or generates offline keys for you.


ISP and ssh tunneling I have a question about ssh tunneling.
Is it possible for the ISP to realize the destination server which I want to connect it via ssh tunneling? I mean the destination website which I want to visit it.

Yes there is, but not the reason you may think off directly. The problem is that your traffic is secure so your ISP can't see what you are sending, and if you are using just IPs, he won't even see whereto you are connecting (he will only see traffic flowing between you and your SSH server). The problem is that you need to take care of your DNS requests. If you connect to a site you will probably use UDP for performing a DNS request. UDP can't pass a SSH tunnel as it's connection oriented.

So this means that your DNS request is sent unencrypted and your ISP will be able to see it, therefor disclosing to which website you are connecting when using a domain name.


A secure way to encrypt a connection between 2 clients securing against both passive and active adversaries Recently I got interested in encryption and the methods behind them. So for a fun / school project I am building a program in python to encrypt data between two clients (chat and files).

I'm just really not sure how to truly make it secure against both passive and active attacks. Right now my idea is to use a server to establish a handshake between the clients in the following manner:

Once a client starts, it connects to server to let it know its alive.
Client bob lets the server know it wants to connect to client Alice
Server sends message to client Alice that bob wants to set up a secure connection
Alice tells the server she accepts the connection
The server generates a random number and encrypts it using the client public key
The client has private RSA key hard coded (doesn't change per connection / client)
Server sends the random number to both Alice and Bob
Alice and bob decrypt the random number and hash it, both send it back to the server
Server checks if both hashes are the same (none are tempered with)
Server sends an OK or error to both parties
Alice and bob hash the number a number of times equal to the random number (so if the server sends 1234 they hash it 1234 times.
Alice and Bob setup a common key for this connection using Diffie-Hellman key exchange and encrypt the exchange with AES.
Once a common key is decided, use this key or a hash of this key for AES encryption (this key does change per connection and all the data is sent over this channel)

The only problem I see with this protocol if adversaries can reverse engineer my code to get the private key, and can use active attacks at both Alice and Bob's connection OR if the server is ever compromised.

I will use py2exe to compile the code, that way it should be hard to get the key but I'm not sure just how hard it would be.

Sorry for the long question but it just feels like a really horrible idea to hard code the key into the client but I'm not sure where to go from here.

Thoughts on this idea / improvements / How can I do it better?

Sorry for any typos, English isn't my first language.

You can't have a private key hard coded in software that is distributed.

The two options I see are:

Have each client generate a unique key-pair that they use for communicating with the server. Bob would send his public key to the server when he initially connects. The server will then encrypt messages to Bob with his public key. The first communication between the server and Alice will be the server asking Alice for her public key so that it can be used for future communications. The server can then pass a symmetric key encrypted with their public keys to each of Bob and Alice to use for future communications.
Give the server a key-pair. When Bob first connects with the server, Bob creates a symmetric key that he encrypts with the server's public key. The server and Bob use this for encrypting further communications. When the server first contacts Alice it passes her its public key. Alice responds by creating a symmetric key and sending it to the server, encrypted with the server's public key. The server can then communicate with Alice using this key.

Option 1 above uses what I'll call the SSH model where clients generate unique key-pairs for each server. Option 2 uses what I'll call the SSL model where servers have the key-pair (though SSL communicates the public key in a signed cert).

If you do the above you'll have very good security. That said, it won't be perfect. The problem is that you'll still be vulnerable to MiTM attacks.

In order to work safely, SSH requires you to validate the fingerprint of the server's public key the first time you connect with it. The protocol doesn't explain how you validate this. Most users just say say OK without validating, but there's a chance for a MITM there.

SSL automatically validates the public key from the server by validating the cert chain. This only works because there's a keystore with trusted root certs pre-installed with your OS, browser, or other client. Without that validation, the public key in the server's cert can be forged without detection.

I don't think that you're going to be able to do much better unless you use an existing security infrastructure. For example, you can have your server run SSL and have the client's validate the certificate passed in the SSL handshake.

I don't see this as a problem as you're going to be as secure as SSH is when the client doesn't properly validate the server's public key. IMO, that's pretty good.

This is a very cool problem. Enjoy!

PS: No need to apologize about your English. It's as good as a native speaker's.


Authenticating REST API using Access Token If you have a REST API, which when you log in from the client side, generates an access token for the client, which is then stored in local storage and used for all authentication from this point on.

Is it secure to keep using the same access token, say you generate the access token, store it in the database, and keep using this access token till the client actively presses log out?

If no, what would be the requirements to make this secure?

Yes and no.

What you are talking is like an authentication cookie.

Yes because unless the computer is compromised, physic access or virus, the cookie is safe and only the source computer can use it. Many site do that, for example this one. Even if I close my browser or computer, I'm still logged in because the cookie stay in my browser which reside on my personal computer.

But, only do that for non-critical service.

No because the longer an authentication cookie stay alive the more chance it has to be stolen. For example, would you like to stay logged in to your bank account? A "friend" come at your house, you leave your computer open. He access your bank account because you are still logged in and steal some money. Friend do that all the time with opened facebook account. Also the longer is stays active the more chance it has to be stolen, no matter how it is stolen.

The shorter the live of your cookie the more secure it is. But for non critical applications, it's ok to have cookies that live a long time and persist after we close the browser.


Track my girlfriend's stolen computer My girlfriend just told me that her computer was stolen, the computer was hibernated and the second the thief turn the computer on a lots a things will open automatically. I'm hoping I can get the computer location, or at least an IP address when the computer turns on

It is a Windows 7, below the services that will pop up (most promising first):

Skype
Chrome with at least:

GMail ( google hangouts runs service )
Facebook
Duolingo
Google Translate
Pandora (through Hola Unblocker extension)

Lots of useless PDFs and Word files

Is it possible to track any (or most) of those services and get some information when the computer turns on?

PS: I'm working on the assumption that the computer have not being turn on because her skype account is offline since before the thief

PS2: I'm going to try to contact someone from those companies, but I don't think they will give a damn

PS2: She changed her Google and Facebook passwords for privacy concernes. Skype stuff was really helpfull, I will post their info has an answer

Down at the bottom-right corner of the Gmail inbox is a "last account activity" line with a "details" link.  You can click on that link to get a list of IP addresses that the account has been accessed from.


Are SAQ A-EP network questions office network or a web server network? I am not a security expert, and unfortunately we are too small company to have one. Since I am in charge of completing PCI DSS self-assessment questionnaires, I was shocked with the amount of questions specified.

First couple of questions are about firewall, network topology, routers etc, etc. Since we are an e-commerce and we host our web server on a remote location, I would really like to know are those questions regarding our web server or our office location.

Since we do not store or process any credit card information at our office location, we have chosen SAQ A -EP. but I am still not sure which network this questionnaire addresses?

If they are meant for our web server, how can I know all these network settings from a third party hosting. I contacted them (large hosting company) and they explained  they did not have similar request.

Now I am confused did I got this process all wrong?

The 'scope' that you define is the key to this. You have to justify (according to PCI-DSS rules) that a network (like your office) is not in scope. Then you don't have to worry about that (as long as nothing changes that affects the scope).

As for 3rd party hosting, you need the details from them. They should not be new to PCI-DSS questions. It is possible that they are simply not PCI-DSS compliant, and you will have to review whether they are an appropriate hosting provider for your company.

You are required to use a PCI-compliant 3rd party as outlined in the "Before You Begin" section of the standard (page iii).


CSP is not enforced inside Web Worker A CSP response header is set on the web worker JS file, but it is not enforced by the browser. The CSP is enforced in the Web worker only if the parent document's response header contains the CSP header. Is this expected?

index.html

<html>
  <head>
    <title>Helle</title>
  </head>
  <body>
    <script>
    var worker = new Worker('/worker.js');

worker.addEventListener('message', function(e) {
  console.log('Worker said: ', e.data);
}, false);

worker.postMessage('getResponse');
    </script>
  </body>
</html>

worker.js

self.addEventListener('message', function(e) {
var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {

          self.postMessage("done by worker");
       // Typical action to be performed when the document is ready:
            console.log(xhttp.responseText);
    } else if (this.readyState == 4 && this.status != 200) {
        console.log(xhttp.statusText);
        self.postMessage("done by worker error");
    }
};
xhttp.open("GET", "https://jsonplaceholder.typicode.com/todos/1", true);
xhttp.send();
}, false);

Response Header Content-Security-Policy: connect-src 'self'; is set on the worker.js file, but the CSP is still not enforced and the API call is successful in the network tab.

1). Yes, this behavior is expected. If a (parent)frame does not include a CSP header, the CSP on the children will not be enforced.

2). Furthermore, if you have an XSS vulnerability, the attacker can insert frames that do not contain CSP and still run the JS [according to the above statement, the JS is inside the frame which does not contain CSP].


Encode metasploit payload with ContextEncoding? Using metasploit I generated an exploit exploit/windows/fileformat/ms14_017_rtf for windows 7 with windows/shell_reverse_tcp payload. In show advanced, I use option EnableContextEncoding true and it's working well. Then I create a stand alone module, that generate malicious rtf document. Now I want add encode function in my module. What the module uses the option EnableContextEncoding true? Is this x86/shikata_ga_nai.rb or other? I need standalone code, which encode my buffer (shellcode)? I can't find it.

You probably don't really want Context Encoding.  Context Encoding is a technique for generating self-decrypting shellcode that will only work on the intended machine. It is off by default because it requires knowing specific information about the victim that you usually do not have unless you have already compromised that machine.

msfvenom can take shellcode on stdin and output encoded shellcode on stdout like so:

cat payload.bin | msfvenom -p - -a x86 --platform windows -e x86/shikata_ga_nai -f raw > encoded.bin


Google Chrome says "Your connection to example.com is encrypted using an obsolete cipher suite." I get following info when I click on lock icon on address bar:

I have couple of questions:

Q1. What are the security concerns here?

Q2. Even after 'obsolete cipher suit' message, Chrome is able to establish private connection and I see a GREEN lock, how it's doing that?

I see another question here on Sec.SE which talks about 'Obsolete Cryptography', but I have different set of issues.

Note: example.com is just an example not a real host.

Alright, here we go:
Question 1

TLS 1.0 is not quite perfect. See the answers to this question for details.
3DES is somewhat odd these days, but still okay, nonetheless depricated by AES.
using RSA as a key exchange mechanism fails to provide forward secrecy.
using SHA1 is okayish right now but expecected to be broken any time, hence there is the SHA2 family available for quite some time already.

Question 2
Well, the developers of Chrome chose to accept this and show a green lock instead of a yellow one (connection established with warnings) for now, as otherwise a lot of sites (banks for example) would fail to show the green lock.
While using that exact combination is not ideal, it's still able to establish a connection, verify the remote machine and the exchanged data is reasonably safe (for now, at least, see forward secrecy link above).
As to how this is established: there is a handshake taking place between the browser and the server, agreeing on a specific cipher suite. Your browser and that server agreed on this one (because either might not support anything newer), even if it's not the best option. See the How does TLS work for good coverage on that.


Visibility of network traffic in Teamviewer I intend to use public wifi to access my home computer from the local library.

I was wondering if I remote login to my home computer using Teamviewer on a compromised wifi, will a hacker be able to see the contents of the Teamviewer traffic to my home desktop or just traffic.

The following answer is made under the assumption that TeamViewer uses a secure connection with remote host/peer validation.

Source: https://community.teamviewer.com/t5/Knowledge-Base/How-secure-is-TeamViewer/ta-p/4619

If the TeamViewer client correctly verifies the remote host and no invalid remote host error or warning is given, we can conclude the connection is secure and is not subject to a mitm attack.

However, it seems that TeamViewer is using self-developed key-exchange and remote host validation mechanisms and is not using open and popular algorithms like TLS 1.2 or TLS 1.3.

Because the implementation is an important factor we cannot be completely sure a mitm attack is impossible.


Security Modules - Hardware vs. Software In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS CloudHSM solves?

Something like a Gazzang zTrustee could be used to meet the PCI key management requirements. The trick would be to make sure that they help you follow all the requirements for PCI compliance. A good way to do this is to see if they are FIPS 140-2 certified, or at least follow the FIPS 140-2 standard published by NIST. A short review of the their site I don't think they are certified by they do mention that they follow FIPS requirements. It would take some more digging and asking questions to see what they actually mean by that.

As a more general answer to your question, PCI doesn't dictate that you have to use a hardware device for key management. You can use a either or a combination, anything that helps you meet the outlined requirements in section 3 of the PCI DSS.


Dangers of passing Oauth 2.0 client id and client secret in the request uri I was reading here that when passing a client_id and client_secret to an authorization server,

  The parameters can only
     be transmitted in the request-body and MUST NOT be included in the
     request URI.

What are the possible dangers of posting these parameters in the
request uri?
Should the server not provide an access token to the client if these
parameters are in the request uri instead of the body?

Should the server not provide an access token to the client if these parameters are in the request uri instead of the body?

This probably makes sense in order to educate programmers (if they don't get an access token, then they'll learn to do it the right way), but it wouldn't make the system more secure if it was under attack. If the client id and client secret were stolen, then the attacker could impersonate the client and get a valid access token by sending a correct request (with the id and secret in the message body).

  What are the possible dangers of posting these parameters in the request uri?

If you use https to communicate with your endpoint and you trust your access token provider, the danger would probably be small.

The client id and secret can show up in your browser history if you're sending them directly from the browser and could probably be stolen from it via malicious javascript, which I'd think would be the greatest risk. (But note that if you entrust browser javascript with your client id and secret, then they are already unsecure...)

The id and secret could also be stolen at the other end of the connection, since they show up in the web server logs of the server you send it to, but because you're sending your client credentials to a provider who already has them, and who hopefully knows how to keep his systems secure, I'd think this wasn't a likely point of compromise.

If you use unencrypted http, then the client id and secret might end up in logs of caches and proxies. Whether somone who sniffs your traffic can see the URL is only midly relevant; since in order to do that he has to look at the request, and therefore could also see the id and secret if they were sent in the request body.


Are Meltdown and Spectre only exploitable with compiled code? Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode?

Does it depend on the language? Compiler?

Or, do attacks depend on the attacker loading very specific, compiled instructions onto the machine?

As it's been pointed out, the JavaScript on a web page can theoretically perform an attack.

Is this because V8 and company generate specific machine instructions that can be carefully tailored? Are the vulnerabilities in the JITing? The VM's? Or can any Turing-complete language mount an attack? ... Where's the line?

No, interpreted or JIT'd code is also vulnerable

According to multiple sources, the attack can be exploited via JavaScript in browsers. An excerpt from the Windows Blogs on Microsoft:

  Today, Google Project Zero published details of a class of vulnerabilities which can be exploited by speculative execution side-channel attacks. These techniques can be used via JavaScript code running in the browser, which may allow attackers to gain access to memory in the attacker’s process.

From Chromium Security:

  This research has implications for products and services that execute externally supplied code, including Chrome and other browsers with support for JavaScript and WebAssembly.

And from the Mozilla Security Blog:

  Our internal experiments confirm that it is possible to use similar techniques from Web content to read private information between different origins.  The full extent of this class of attack is still under investigation and we are working with security researchers and other browser vendors to fully understand the threat and fixes.

These days, JavaScript is quite advanced with the advent of things like Node.js and WebAssembly, and can arguably be considered lower level than it was in previous years.

The three aforementioned browser vendors have taken precautions against the vulnerability:

Edge and IE 11: https://blogs.windows.com/msedgedev/2018/01/03/speculative-execution-mitigations-microsoft-edge-internet-explorer/
Chromium/Chrome: https://www.chromium.org/Home/chromium-security/ssca
Firefox: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/


Will ios8 encryption fail on forced shutdown? I understand that IOS 8 data can be encrypted when the phone is locked, and decrypted for use when the phone is unlocked.

But let's say the phone was unlocked (and thus the data is decrypted), and then immediately shut down (by, for instance, forcing a shutdown if the phone freezes). There will be no chance for the data to be encrypted, will there?

Is this security loophole?

This was just a comment...

tl;dresearch: as far as I know the only threat in your scenario would *potentially* come from a cold boot attack if the attacker could freeze your phone and do nasty things to it.

Full disk encryption stores the decrypted file to be accessed in volatile memory. Thus, if the power is disrupted by any means, disk is left encrypted and the decrypted files are gone. However, you may be able to do what is called a cold boot attack where you literally freeze the memory before power fails but I havent done the research to see if this is possible with a phone (I dont see why not) moreover, this requires the forensic examiner (malicious or otherwise) to freeze the memory before or very very soon after power is lost.

References:

cold boot attack vector 1
cold boot attack vector 2
how full disk encryption works 1
how full disk encryption works 2 (pdf)

More: (these are more apple specific, but still great)

https://www.ethicalhacker.net/features/root/using-cold-boot-attacks-forensic-techniques-penetration-tests
http://resources.infosecinstitute.com/cold-boot-attack/
http://www.eweek.com/c/a/Security/MacBook-Air-Resistant-to-ColdBoot-Encryption-Attack/
here and here I found information about an iphone cold boot attack.


Is there any risk in posting "local info" to the Internet? Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc:

Is there actually a need to do so?

A quick Google search shows that many people in fact broadly publicize these info.

How can leaking these harmless miscellaneous info allow an attacker to penetrate or hack my computers?

When performing pen-tests, it's amazing how much information can be gathered by finding the StackExchange accounts of employees. Server naming patterns for example can be quite helpful, makes finding targets easier.

Test environments rarely are secured properly - or at least to the same level as production systems. If you can get into a test system, it's disturbingly common to be able to use that to then make it into production systems.

Any information leaked can help an attacker - even minor things can help an attacker gain a better understanding of the target environment.


The NIST randomness tests for a generated key Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?

There are no randomness tests for keys, and in fact there will probably never be. The reason is that randomness tests require a huge amount of input to function, often on the order of gigabytes, so a single key can never be tested. What randomness tests are for is to ensure that hardware noise sources and PRNG algorithms are generating pseudorandom and uniformly-distributed output.


Why limit request variable name and value lengths I have a server with suhosin installed (a protection system for PHP installations). I noticed software I am running is causing the following logs on suhosin.

ALERT - configured GET variable value length limit exceeded - dropped variable
ALERT - configured request variable name length limit exceeded - dropped variable

Could allowing long request variable names or values present a security issue?

In a word, yes.

To elaborate, by limiting the size of variables, you reduce the chances that an attack will be successful.  This is because the limit reduces the chance that the information passed can trigger an overflow, the chance that the variable will be able to hold an effective payload, and the chance that the system can be overwhelmed when processing overlong variables.

If it's a legitimately long variable, you should be possible to increase the limit, but keep in mind the larger the limit, the greater the amount of space potential attackers will have to play with.


Can teleworking let my boss to sniff my network traffic? What else could he do? My boss proposed me to code from home on the their machines via internet, in two possible ways:

I would connect to their computer and work on their machine, as if I was in front of the computer(from what he said the method used in this case would not be a VNC but something different)
Via SVN

My concern is all about the privacy for the first way. It is easier, I'm not a security expert and I would be not so happy if he could sniff network coming out of my router. In this case he could see the traffic of all my family, and this is very annoying.

Could someone give me some tips to understand if this way of working could be dangerous for my privacy or not? What should I pay attention to?

Fairly Safe for most purposes.

For a remote desktop tool like VNC, Citrix or Remote Desktop

These tools are more or less constrained to the graphical window on your box, they might be able to access your copy/paste buffer.

For a VPN Tool

These have the ability to, but probably wouldn't route your local PC traffic to the employers system before sending it to the internet. Their configuration may disable all other network routes. It would be a problem only while it was 'connected'. The tool wouldn't forward the rest of your family network unless you are using the PC as the network router.

BUT

This assumes that the company/boss doesn't ask you to download monitoring/spyware/software management programs onto your computer as part of the remote access deal.


How should I escalate a vulnerability that is dismissed by the vendor? I've come across a vulnerability that secure@microsoft does not think is worth pursuing.

I would estimate that there are many, many customers affected by this issue.

I do not want to start a grassroots campaign to fix this, as that would publish the vulnerability in the process.

What should I do?

You could:

try to persuade why this vulnerability is so severe and what consequences customers may have;
try to sell to companies like ZDI;
go full disclosure - provide detailed description and solution, e.g. patch;

I suppose there are no other ways how you could put your vulnerability fixed. Also, in your recent topic Was the ASP.NET Padding Oracle exploit exposed in an ethical manner?  What could have been done differently? you were already pointed to How to disclose a security vulnerability in an ethical fashion?.


Is there a way to make linux pass ls require decryption? So pass, the standard unix password manager is great and I've started to use it to encrypt my passwords. But there is one thing that bugs me. When you run pass ls it shows you all your identities. I know it's not the passwords. But this still doesn't allow true anonymity, because if someone were to get hold of your computer, they could trace various accounts to you, even though they would not be able to get the password without your passphrase.

Now I can encrypt the ~/.password-store/ folder myself using gpg-zip and delete the original. Then when I need to use pass I could decrypt/unzip the folder and delete it again when I'm done but that is very tedious to do.

Update 1:

I'm using a Mac.

First sentence of the pass website:

  Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password

In other words, no, encrypting these within pass is not technologically possible. pass depends on the file name to be the account name.

Personally: You could have a 100MB filesystem image that you encrypt with AES, through cryptsetup / LUKS. It will only be readable for as long as you mount that filesystem – as soon as you unmount it, the files contained in that filesystem cease to "exist" at their known position.


Finding Targets in Foreign Network Say you popped into a network after exploiting something, and you are looking to further infiltrate the network.  When theorizing in my head I realized the local ip's can change themselves.  So doing a ping sweep of the subnet of your ip could potentially miss targets if they were using different ip's?

After this realization, how do you discover these hosts? All I can think of is sniffing to find hosts, besides that what else can you do?

This is a huge question but I'll put out a few things in the way I would approach finding other targets to pivot to.

1.) look at layer 2 arp -a sends no packets to the wire and helps you spot other hosts the system you have access to is talking too.

2.) look at layer 3/4 lsof -i (or it's equivalent) will show you established connections that allow you to see the IP's and some protocols that this computer is communicating with others on. Again this sends no packets on the network.

3.) Check for mounted storage, local scripts, backup configurations, DLP software, or passwords which may be configured to give you information, or possibly access too, other servers. Again this sends no packets onto the network and the storage devices may have shared networks to other hosts (possibly beyond the scope of your question).

4.) At this point verify you are not on a HoneyPot before proceeding.

5.) Optionally at this point you could look at packet capture, this can be detected but 99.9% of organizations aren't looking for this so it's generally safe to do. This will help you find other hosts on the network that are broadcasting their information and depending on the type network may give you access to lots of other traffic nearby.

6.) Determine internal DNS and if possible scan the internal DNS for other hosts. DNS traffic is considered pretty normal. Do it slowly if you are in a high-security environment.

7.) At this point I would suggest exploiting the connected systems using the connecting protocols. You want to go out on protocols the system you are on normally talks out on (DLP, NMS, Backup are most common but frequently databases are also available). These are outbound connections which might not look weird to from the standpoint of netflow communications. If you can pivot in-band it is much stealthier than scanning.

8.) Next step connecting to hosts which connect to the one you are on. This is similar to the step above but from a netflow perspective some systems always initiate connections to the end points in this case you are likely an endpoint connecting back which may or may not get caught.

9.) If that hasn't worked you start scanning. Slow your scans below the most common IDS timing threshold for scans or do this manually at first. Aim for protocols you can exploit and prioritize most common protocols that a given client would have. Go slow stay under the radar. The scanning tool nmap from nmap.org has a --top-ports option if you don't know where to start. I'd say start with the top 10-20 ports at first unless you are in a rush.

10.) If you are still having no luck now you start deeper scans and map the entire environment out.

11.) Still having issues try jumping VLANS's

https://github.com/nccgroup/vlan-hopping

Good video of it in use on a Cisco switch.

https://www.youtube.com/watch?v=2Y7CQDkY8nE

http://www.yersinia.net/attacks.htm

https://github.com/rapid7/metasploit-framework

12.) Check for wireless, if the device you have has wireless access (try turning it on at some point if it's not on) scan the wireless network for other targets. Don't forget Bluetooth or any other protocol likely to be on the type host you have access too.

13.) Still no luck. Check to see if you are on a Virtual Machine, identify which one and look for ways to jailbreak the VM into the Hypervisor and attack from there.

NOTE: Always check for IPv6 connections and explore for storage connections in depth. There is also more work to be done on the local host like grabbing keys and passwords if you can but your question was more focused on finding targets so I'm leaving that out of scope.

This is a BIG subject with lots of additional things you could do but what is a listed above is a very effective strategy for mapping out nearby hosts in the situation you asked about.


Is it safe to include full filesystem paths in files published on Github? Some of the configuration files I mean to publish as part of a Github project include full filesystem paths (including username login) in my localhost. Does this pose as a possible security vulnerability?

For example in a configuration file I may have

<script>window.MathJax || document.write('<script type="text/javascript" src="/home/myspecialusername/projects/MathJax/MathJax.js?config=TeX-AMS_HTML-full"><\/script>')</script>

(In this example the browser is instructed to use a local copy of MathJax if offline.)

Full filesystem paths by themselves do not present an issue, but it's not best practice, for either security or general software development.  As schroeder mentioned, you should use use relative paths.  Exposing the full file path could make it easier to exploit other vulnerabilities, such as path traversal, direct object reference, or local file inclusion.  As far as general software design principles, using absolute file paths like that makes your solution extremely brittle and potentially difficult to deploy to multiple servers/environments.

On the flip-side, I would ask yourself if there is any reason why using absolute file paths is preferable to the relative ones.  The only time where that might be the case is when you're referencing a CDN hosted file.


CTR: Why not XOR before AES I just learned AES-CTR.

I am wondering about the security of the CTR mode. It is basically an AES of the nonce with an XOR-Encryption at the end.

Are this 2 assumptions correct?

The nonce doesn't have to be random, can also be 0 for example, but it has to be unique in combination with the key
XOR-Encryption needs a key with good entropy

Since AES is an encryption and not a random number generator I wonder if the output is truely random and therefore suitable as a key. (Ok, I see right now that OFB for example uses this princible, too)

But I am wondering, why the XOR-encryption is not done with the nonce before applying AES. Wouldn't that make the mode more robust if AES is found not generating enough entropy. Is this mode known/used? Would it have other known weaknesses?

The nonce doesn't have to be random, can also be 0 for example, but it has to be unique in combination with the key

There is no requirement for the nonce to be random or secret for CTR mode. One nonce value is as good as any other potential value. The only requirement is that a nonce is not repeated for a given key.

This is the norm for almost all common algorithms, but check an algorithm's specification to know for sure.

Outside of cryptography, the word might be used differently. WordPress calls its anti-CSRF token a "nonce", despite the fact that they're reused. (And may need to be secret. Double submit cookie tokens need to be unpredictable.)

  XOR-Encryption needs a key with good entropy

I think by "XOR-Encryption" you mean the process by which each bit of plaintext is XORed with a corresponding keystream bit. (And not a "repeating key XOR cipher", which are especially far from being secure.)

No. These type of ciphers need to have an unpredictable keystream, but that doesn't require much entropy in a key. An attacker can only be 50% certain about the value of each unknown keystream bit. Even if they learn other keystream bit values, have a large number of ciphertext bits, or (if relevant) have multiple messages encrypted with the same key.

The reason keystream bits might become known is that a person can guess portions of the plaintext, then XOR it with the ciphertext to get raw keystream bits.

Though for serious stream ciphers, like AES-CTR, learning any number of those keystream bits doesn't aid you in finding the remaining unknown bits. Not unless an attacker can brute force the 128-bit to 256-bit key; an impossible task for securely generated keys.

Do not equate stream ciphers (XOR encryption) with OTPs. The OTP algorithm is one kind of stream cipher algorithms. Stream cipher algorithms in general are not wannabe OTPs.

OTP is just the most trivial version of a stream cipher. You assert that a key is only used once (barring using multiple messages to break the key). And you assert that each keystream bit is statistically independent of one another and that each bit has exactly 1-bit entropy. (Trivially making it so knowing one keystream bit can't help you learn the value of the rest.)

But this comes at the cost of needing exactly as many bits entropy as the length of the message you're trying to encrypt, making OTPs very impractical.

Other stream ciphers are less trivial, but allow you to use smaller keys. You get 128-bit security out of something like AES-CTR, assuming your key has 128-bit entropy. As long as key secrecy is maintained and nonce reuse is avoided, the only thing you have to worry about in practice is the internal counter rolling over. (Simply putting a hard limit on the maximum message length you can encrypt.) ... And, well, software glitches.

It's usually recommended, however, for CTR mode with 128-bit blocks, that you restrict the message length to Gigabytes or Terrabytes. It's also usually recommended that you re-key after encrypting a large number of messages. All versions of AES use 128-bit blocks, even if the key size is larger.


Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server? Ubuntu 20.04
iptables 1.8.4-1

I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router:

-A INPUT -s <remote_ip_addresses_range> -j DROP

Despite the above rule, I was able to witness the following snapshot using pktstat -tF -i <wired_ethernet_interface>:

udp <remote_fqdn>:29937 <-> <server_fqdn>:domain
udp <remote_fqdn>:21862 <-> <server_fqdn>:domain
udp <remote_fqdn>:37097 <-> <server_fqdn>:domain
udp <remote_fqdn>:1886 <-> <server_fqdn>:domain
udp <remote_fqdn>:16824 <-> <server_fqdn>:domain
udp <remote_fqdn>:43989 <-> <server_fqdn>:domain
udp <remote_fqdn>:49939 <-> <server_fqdn>:domain
udp <remote_fqdn>:25297 <-> <server_fqdn>:domain
udp <remote_fqdn>:13319 <-> <server_fqdn>:domain
udp <remote_fqdn>:62586 <-> <server_fqdn>:domain
udp <remote_fqdn>:24825 <-> <server_fqdn>:domain
udp <remote_fqdn>:52733 <-> <server_fqdn>:domain
udp <remote_fqdn>:44866 <-> <server_fqdn>:domain
udp <remote_fqdn>:19691 <-> <server_fqdn>:domain
udp <remote_fqdn>:31634 <-> <server_fqdn>:domain
udp <remote_fqdn>:36689 <-> <server_fqdn>:domain
udp <remote_fqdn>:20213 <-> <server_fqdn>:domain
udp <remote_fqdn>:38816 <-> <server_fqdn>:domain
udp <remote_fqdn>:62049 <-> <server_fqdn>:domain
udp <remote_fqdn>:51384 <-> <server_fqdn>:domain
udp <remote_fqdn>:55557 <-> <server_fqdn>:domain
udp <remote_fqdn>:39710 <-> <server_fqdn>:domain
udp <remote_fqdn>:56031 <-> <server_fqdn>:domain
udp <remote_fqdn>:50839 <-> <server_fqdn>:domain
udp <remote_fqdn>:53202 <-> <server_fqdn>:domain
udp <remote_fqdn>:39416 <-> <server_fqdn>:domain
udp <remote_fqdn>:25693 <-> <server_fqdn>:domain
udp <remote_fqdn>:55591 <-> <server_fqdn>:domain
udp <remote_fqdn>:30182 <-> <server_fqdn>:domain

I am positive that <remote_fqdn> is within <remote_ip_addresses_range>.

I see only 2 possible explanations for that situation:

pktstat sniffs on packets before iptables filtering takes place, which I doubt is possible
there is a security flaw in iptables

The tcpdump trace shows that all rogue DNS queries are similar; the attacker tried to hijack the server with recursive DNS searches of a strange DNS domain: packet.cf (not the domain served by <server_fqdn>).

Anyone with a clue?

pktstat sniffs on packets before iptables filtering takes place, which I doubt is possible

This is what happens. pktstat, tcpdump etc get the unfiltered data on the interface. See also Does tcpdump bypass iptables?.


SafeZone: keyloggers/malware/spyware protection As part of Avast free updates you have a chance to use SafeZone browser. Among features of SafeZone browser I found that SafeZone protects you from keyloggers/malware/spyware.

I'm interesting especially at keyloggers protection and how SafeZone manage to achieve it?

Also what did they ment by malware/spyware protection? Cannot I achieve the same with anonymous mode in Chrome?

Anonymous Mode does not protect you from malware.  It simply deletes cookies/browsing history/etc. after you close the window.

Unlike Anonymous Mode, SafeZone works like a virtual machine whose only function is browsing the web.  If you were to encounter any malware while browsing, it would be contained within the SafeZone "VM."

As for how it protects against keyloggers: It detects them by looking for signatures and hashes that match known keyloggers.  Additionally, SafeZone "prevents keyloggers and network-based eavesdropping from capturing any of your data," meaning that if you have any keyloggers on your machine(or other info-gathering malware), they should not be able to tell what you are doing in SafeZone.  A hardware-based or low-level keylogger could log your keystrokes before SafeZone can secure them.


What are OIDs in the context of this keytool command? I'm in the process of setting up a 3rd party plugin to Elasticsearch called Search Guard which requires also Search Guard SSL.

While setting up Search Guard SSL, you're required to set up several keystores and SSL certificates. Several scripts are provided by Search Guard SSL, in this directory: example-pki-scripts.

In one of the provided scripts the following command is run:

$ keytool -genkey \
        -alias     $NODE_NAME \
        -keystore  $NODE_NAME-keystore.jks \
        -keyalg    RSA \
        -keysize   2048 \
        -validity  712 \
        -sigalg SHA256withRSA \
        -keypass $KS_PASS \
        -storepass $KS_PASS \
        -dname "CN=$NODE_NAME.example.com, OU=SSL, O=Test, L=Test, C=DE" \
        -ext san=dns:$NODE_NAME.example.com,dns:localhost,ip:127.0.0.1,oid:1.2.3.4.5.5

#oid:1.2.3.4.5.5 denote this a server node certificate for search guard

I've not encountered the use of oid:XXXX before in the -ext switch to keytool.

My questions

Is the use of a oid: here the recommended way to go here?
Is it secure to use an oid:XXX here, it seems like security through obscurity?
Where does the number sequence for oid: come from, is it just arbitrary?

OID stands for an object identifier and in this context it is used to identify an X.509 certificate extension, i.e. additional data fields stored in the certificate, which are not predefined by the standard.

OID is not a secret number, hence it cannot be called a "security through obscurity" mechanism. It is more of an administrative feature.

In this case Search Guard expects (looks for) the value of a san field (subject alternative name). The san is defined in an extension identified by the specified OID of 1.2.3.4.5.5 and it (Search Guard) will (presumably) ignore all data specified in san fields in extensions with any other OIDs.

The value of OID is defined usually by an application and is not standardised, i.e. the developer can choose one arbitrarily as long as it doesn't conflict with other OIDs. Some applications/organisations apply a hierarchical structure to OID.

Refer for example to Red Hat's Standard X.509 v3 Certificate Extension Reference for examples of how specific certificate extensions.


Can you login to Facebook through a VPN or a proxy? I've heard that there's a new type of security in Facebook. When logging in they automatically check if the IP Address is similar to that of the original IP during registration. That's in order to prevent hacking into someone's account via the three methods i.e  keylogging, phishing or social engineering.

So, since VPNs and proxies change your IP, Facebook might just think that you're intruding in someone's account. I haven't tried it (I will) but I hope it doesn't work  :P. Is it possible?

As far as I'm aware, Facebook don't actually block the new attempts from different IPs. Instead, they send an email to the registered email address with a notification that you logged into a new device, with a button to mark this as legitimate or malicious.

The tracking appears to work not only via your IP, but also a long-term identification cookie and other browser fingerprint data (e.g. user agent header) so that switching browsers or computers within the same network will still trigger it.


Is it safe to authenticate user by email confirmation link? When a user registers on a website, he has to confirm e-mail to activate account.
When clicking confirmation link, the user is identified by one-time hash to activate account.
Is it safe to authenticate user right away or should he sign-in by login/password after activating?
Proposed Registration flow:

Fill-in registration form with login/email/password
Confirm e-mail by one-time link with hash
If e-mail confirmed (and account was not activated), authenticate user and grant access to his account

My Current Registration Flow:

Fill-in registration form with login/email/password
Confirm e-mail by one-time link with hash
If properly confirmed, user needs to enter email or login and password

Side notes:

While having access to e-mail, it is possible to reset password
Registration form contains only login/email/password

It depends on why you want to confirm an e-mail. If that e-mail will later be used for password reset, the proposed workflow has a major security problem. Consider the following scenario:

Alice creates a new account and inadvertantly write Bob's mail (say she copy-paste the mail and uses wrong line)
evil Bob sees the mail, confirms the account, writes down Alice's login name if it is different from the e-mail and logs out
Alice tries to connect later and sees everything works fine - she assumes validation was automatic and she normally uses her account for a while
some times later, Bob tries to connect using Alice's account, asks for a password reset => as he own the registered mail, he is successful in changing the password
Bob now owns Alice's account and can do anything on behalf of her!

Ok, Alice was not very cautious when creating her account, but the proposed workflow did not really protect her :-(

That's the reason why my prefered workflow is:

let a user create a new account with login, password an e-mail (may be login or not, better not) -> the account is created unactivated and will be destroyed if not activated within a limited period of time (say 2 days)
send a unique confimation link to the given mail
the link opens a login form - the user name should be pre-filled and read-only. If the user successfully logs in, the account is validated, the link is invalidated and the user is put his session. If the password is incorrect after three attempts the connection is broken.
if a user tries to connect using a non validated account, he/she sees a message saying that a validation mail was send to that address, that he/she still has n days/hours to validate the account, and proposing him/her to re-create the account with a new mail address. In that case, the old validation link is immediately invalidated.

If the previous scenario happens, Bob will not be able to validate Alice's account nor to steal her account later.


What criteria do you use for evaluating Client-Side / Endpoint security products? What features are important to you in client-side AV and Firewall products?

Who benefits from these features? Managment, the end user, helpdesk.

Are there features that are being 'sold' by the vendor, or managment, that provide no real value in your perspective?

1) Footprint.  We already run a number of things on the client so we want them to be as lean as possible.  Where possible we stick with the same vendor since they are more likely to combine agents and lower the overall footprint.

2) Dependencies.  The more we install on the client the more we have to juggle when things upgrade or delay upgrades.  A common thing is to see if this requires a specific version of Java or .Net.

3) Management of the software.  Can it tie into anything we already own for management?  Does it integrate with other systems for layered security?  Or is it just another silo?

We are big proponents of having as few vendors as possible and helping them refine their products over time to meet our needs.  In the end I think these things help everyone.  The end users get something that works well and is unobtrusive; the help desk gets something that doesn't break as often, the IT analyst gets something that integrates with what they already know and Management gets a generally less expensive product since we usually get bulk license discounts (for owning a lot of software from that same vendor).

Sometimes we get software that doesn't do everything we want, but we are okay with that if the vendor is honest and willing to implement the other features.  It's not uncommon for our IT shop to be told something can't be done by the vendor that built a product, then prove them wrong.  Because of that we don't expect most off the shelf software to do everything we can think up or plan to do with it; but if the vendor is willing to work with us we'll gladly be their pilot site.


Dropbox vulnerability details Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?

There was been at least five issues reported over the past few months

Problem with authentication, ie  if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data
Data stored in dropbox is accessible by dropbox employees
A recent code update meant that any dropbox account could be accessed with just the users email address for a short period of time.
The Terms of service were recently updated to give Dropbox much wider privileges to your data
You can detect if another user has uploaded a file to dropbox by monitoring the amount of time it takes to upload the file


Are public/private keys needed when using Diffie-Hellman with TLS When using RSA for key exchange in TLS, the role of the public key embedded in the certificate is clear: for asymmetric encryption when sending the master key, which the server can decode using its private key.

However when doing diffie-hellman to generate a shared master, these public/private keys are no longer needed. So are they included in the certificate merely for legacy reasons (to support clients still using RSA for key exchange)?

Before the key exchange is done the client has to ensure that it is talking to the correct server and not to some active man in the middle which could split the TLS connection into one between client and attacker and another between attacker and server. To authenticate the server the client is using the content of the certificate provided by the server, i.e. the subject  and subject alternative names to validate the server name, the start and end time to check the life time and the signature to verify the trust chain to the builtin root CA.

The signature of the issuer of the certificate must be verified when building the trust chain which is done by using the known public key of the issuers CA certificate. Additionally it must be verified that the server is actually the owner of the certificate, i.e. knows the private key which only the owner should know. This is essentially done by the client providing input to a challenge which then gets signed by the server with the private key. This signature then can be validated by the client using the public key contained in the certificate and thus ownership of the certificate is verified. If client authentication is done using certificates a similar process is done for validating the client certificate.


Generating token for email validation and registration security My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses.

I am using MVC 5 and ASP.NET identity 2.

As I am reading CSV file, I am creating the user, and generating a token for them as below:

var userManager = new ApplicationUserManager(new UserStore<ApplicationUser>(_db));

var dataProtectionProvider = new DpapiDataProtectionProvider("Sample");
userManager.UserTokenProvider = new DataProtectorTokenProvider<ApplicationUser>(dataProtectionProvider.Create("ASP.NET Identity"));

string code = userManager.GenerateEmailConfirmationToken(appUser.Id);
var callbackUrl = "http://localhost:2595/Account/Verify?t="+appUser.Id+"&c="+HttpUtility.UrlEncode(code);
SendMail(callbackUrl, appUser.Email);

Once I create a callback URL, I send an email to the user. When the User clicks on the link I sent, user goes to a password registration page, creates password and then logs in with the password he/she created.

Does this approach has any security flaws?

public async Task<ActionResult> Verify(string t, string c)
        {
            if (User.Identity.IsAuthenticated)
            {
                AuthenticationManager.SignOut();
                return RedirectToAction("Index","Home");
            }

            if (t == null || c == null)
            {
                return View("Error");
            }

            var user = UserManager.FindById(t);

            if (user == null)
            {
                return View("Error");
            }

            if (user.EmailConfirmed)
            {
                return View("AlreadyConfirmed");
            }

            var result = await UserManager.ConfirmEmailAsync(t, c);
            if (result.Succeeded)
            {
                user.EmailConfirmed = true;
                UserManager.Update(user);

                ViewBag.Id = t;
                return View("ConfirmEmail");
            }

            AddErrors(result);

            return View();
        }

It looks secure enough considering the details you commented about, but I think the best course of action would be to cut the user ID out of the callback and have the user login normally to proceed with authentication if they are not logged in already. The exposure is not too bad as is, so if it is a pain to redirect back to auth page after login then I would say it's fine.


Creating tunnel with most ports closed? How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since routers interface is on port 80?

Would TOR be a better solution for something like this?

I often use Tor for this kind of tunneling. If Tor works in your network environment, set up a hidden service. The directory /var/lib/tor (GNU/Linux) has a subdirectory for your hidden service. Inside is a file called hostname. You add a section in you .ssh/config:

Host *.onion
  ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050

plus maybe other options. Now you can connect to your machine using ssh hidden-service-hostname.onion and no firewall will stop you.


Mystery link containing fragment identifier in malicious email The following link was received in a suspected phishing attack email. Unfortunately, the recipient clicked on the link in their outlook client:

    This summary of your queued emails for the last 7 days. Please use the
    retrieve queued emails to release emails your email account info@email.address inbox.

The user reported that it opened a new window in their web browser (firefox), which is expected based on the target. I'm trying to determine the possible scope of the breach. Ordinarily I would assume http://#%23email%23%23 is a broken link, since there's no actual resource identifier before the fragment identifier. However, given the phishing and the client-side nature of fragment identifier interpretation, I'm left wondering:

What was the attacker trying to do with this link? How can fragment identifiers be abused? Are there other areas of this email that I should look to for clues?

I have an idea. It boils down to "they goofed". Let me lay out my reasoning first, though:

%23 is percent-encoding. It's how you encode special characters in a URL. The format is a percent sign, followed by the hex value of the byte being encoded. You'll also see it frequently with parens (%28/%29), spaces (%20), and equals signs (%3D).
So %23 = whatever codepoint 0x23 is, aka #.
So their URL is equivalent to ##email##, once URL decoded.
##email## isn't very likely to appear in random text, so it'd make a good template string.
A lot of things -- email clients, browsers, Markdown parsers, whatever -- will try to automatically correct broken URLs. For example, adding https:// in front, and url-encoding characters to avoid ambiguity.

So based on that reasoning, here's what I think happened:

They had some mass-market phishing email template, ready to be blasted out to millions of potential suckers.
As part of that, they had a placeholder for the phishing URL, to be replaced when the email is sent out.
Either:

They use something like Markdown, which is rendered to HTML, and then do their template replacement. The rendering engine they use autocorrects URLs, so ##email## got changed, and therefore didn't get replaced by a naive search-and-replace.
They just plumb forgot to do the replacement, and something between them sending and you receiving (maybe even your email server) replaced the extra #s with %23. If you're looking at the source in the Inspect pane of a browser, it's likely that your browser is 'correcting' the URL, to show where it's been interpreted as pointing to.

In short: They're probably not trying some complex exploit. They did their spam wrong. Barring something extremely weird in your browser, you should be fine.

Still definitely get that employee retrained, though. This time, they got lucky. Next time, they might not.


How can I prevent users from using bad passwords in my web application? There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but evidently, weak passwords jeopardize the entire organization and other user's data as well.

What are the ways of ensuring the user will pick a strong password and/or pick a password that is not one of the first tested passwords in a brute-force attack?

There are a few ways I can think of.

Require certain character combinations

This is a commonly used technique. Require users to input a certain combination of characters like a mix of capitalized words, non-capitalized words, numbers and symbols. Enforce a minimum password length. Do not be overly restrictive though, as it might force users to mix combinations in an insecure manner.

Password1234 is no more secure than password.

This technique could also restrict strong passphrases. See: XKCD #936: Short complex password, or long dictionary passphrase?

Deny common passwords using a blacklist

Maintain a blacklist of commonly cracked passwords and do not allow the users to register using them. This could prove to be a sizable amount of work to maintain.


How can I improve security in a production environment? I'm setting up a system where devices are going to be tested right after production. Each device has an individually given AES-key, which must be known in order to communicate. Those individual keys are delivered by the device manufacturer in a shipment-file (one per ~1000 devices), which is itself RSA encrypted. Only the test authority has the private key to decrypt such shipment files.

The current plan was first to export the device keys from the shipment files into a central database. This will be done once for a delivery of ~1000 devices. The test application will then access this database to get out the individual device keys.

Putting all device keys directly into the database does work but isn't a very attractive solution: everybody gaining access to the database automatically gains access to the device keys.

Keeping in mind that this is very vulnerable, how can I improve security? I could AES encrypt the device keys before writing into the database, but then the test application has to know this private AES key. The problem just shifts to "how to keep this internal key secret". So it is a little better, but still unsatisfactory.

What else would be an acceptable solution? Maybe using a smart card?

The best option is to use a hardware security model (HSM) to encrypt/decrypt data in your database. But HSMs are expensive and can be awkward to use.

Without hardware support, you're going to have the chicken and the egg problem of where do you store the initial key. That said, adding one more layer of encryption, encryption before being stored in the database,  and storing the AES master password in a configuration file for the client does add security. An attacker who gets access to your DB, say due to a SQL injection vulnerability or DB misconfiguration, will still need to get access to the AES system master. So they'll need to compromise your configuration file or get access to your client's memory.

Be sure to rotate the AES master password frequently (maybe for each batch). This will reduce the harm caused by a DB compromise and key theft. I would also not store the AES master password in clear text. You can encrypt it with a 2nd static AES password that is hardwired into the code. This adds minimal security, but it prevents employees from accidentally printing the configuration file and exposing the password.


Network Access Control for Wireless Network I am looking for suggestions to implement a group policy that gives the control to administrator of domain to allow or disallow a user whenever he/she connects to the wifi network. Is there any way i can do this?

For example, a person in my organization wants to connect to an unsecure/secure wifi. When he/she connects, a prompt or a message will be given to admin to either allow or disallow the access.

There is no such feature included in the operating system for sure. Your idea is also not really practicable for a variety of reasons. First of all you would need a secured data channel which is available all the time to give you the possibility to communicate with these laptops (which you don't have) and you would also need to be approachable 24/7 which you will likely not be.

You can whitelist and blacklist specific WLANs by group policy as described in this article. The problem there is that it relies on the SSID (The Name) of the given wireless network which is by no means unique or reliable.


Attackers of Google DNS hijacking As we know Google DNS server (8.8.8.8) in 14th and 15th March was hijacked in Sao Paulo. And subsequent to this event, BGPmon.org announced an alert.

Now, In a course assignment, we are asked to find AS number of the attacker. I for this question have downloaded related dump files from routeviews.org and found this related messages:

TIME: 03/15/14 17:23:56
TYPE: BGP4MP/MESSAGE/Update
FROM: 187.16.216.20 AS28571
TO: 187.16.216.223 AS6447
ORIGIN: IGP
ASPATH: 28571 1251 20080 7908
NEXT_HOP: 187.16.216.20
ANNOUNCE
   8.8.8.8/32

TIME: 03/15/14 17:23:56
TYPE: BGP4MP/MESSAGE/Update
FROM: 187.16.218.21 AS52888
TO: 187.16.216.223 AS6447
ORIGIN: IGP
ASPATH: 52888 1251 20080 7908
NEXT_HOP: 187.16.218.21
ANNOUNCE
   8.8.8.8/32

Our TA would say the attacker's AS was 7908 (BT LATAM Venezuela, S.A). But in my opinion it wasn't, because in my view there is no advantages to be exploited by the attacker if he does redirect traffics to his own AS. Despite of this, I couldn't find any update messages originated by this AS in dump files. In other hand, in the picture above, time of attack has been announced 17:23 and from this time onwards, I couldn't find any interesting messages in dump files.

My question is, can anyone please tell me what's the real AS number of attacker?

Thanks in advance

The real AS to feed a false route is any AS along the AS path:

7908 --> 20080 --> 1251 --> |28571|
                            |52888| --> 6447

you see in the 2 wrong announces of route to:

8.8.8.8/32

Hence all traffic toward 8.8.8.8/32 shoud be routed since this attack through
ASes:

|28571|
|52888| --> 1251 --> 20080 --> 7908

If the target of this attack is to redirect all the flow toward Google
to a booby trapped web server mimicking perfectly Google,
then this booby trapped server must be inside of the under control AS
which is at the end of this faked route. It is:

7908

which belongs to:

BT LATAM Venezuela, S.A.

And clearly the university of Oregon doesn't have to route its Google traffic through a cache located in Venezuela.

This isn't sufficient to diagnose this is a real attack or rather a human error (leak of an internal route on the allowed ones to broadcast to BGP neighbours). If this is an human error then the origin is most
probably within:

AS 7908

But if this is an attack, then this is most probably conducted remotely and
you can't locate its first hop of access without the connections logs on BGP router inside AS 7908.


Is there any security risk with having incomplete data between information systems I was wondering if there would be any security vulnerabilities with having insufficient data for different employees in a cluster of systems. If an economic system would have incomplete or null fields, for employees in one system, but would be complete in an HR-system for example.

Could that provide a security vulnerability or other issues within the organization?

Sure. This happens all the time at the macro level. I suspect you're imagining something more low-level and technical. But at the macro level there are "identity providers" who know people's userids, passwords, etc. There are various authorisation systems, like the payroll system that knows who can approve changes to payments, etc. or the company file server that stores secret company files, or the employee performance review system where managers record employee performance.

In a company that had all these systems, you routinely have gaps. One expects a manager to have authority to enter feedback about her own employees but not about others. Or she can see the project files in her teams workspaces, but not in other teams. Or she knows the salaries of her own employees but not those on other teams. So the HR system records reporting lines Bob reports to Andrea who reports to Jill. That reporting line concept is completely missing on the fileserver, which has its own group system with its own ideas about what teams Bob and Andrea and Jill are. And the payroll system has its own idea about groups of users.

So it is quite easy, and it happens all the time in real companies, that Andrea moves off of Jill's team and onto Tom's team. HR is updated so that reporting lines are correct. Payroll is updated so that now Tom has access to Andrea's salary, but Jill no longer does. But then the IT team doesn't get notified, so Andrea still has access to files on her old team's workspace that she shouldn't have access to. Depending on your definition of "vulnerabilities", this is going to allow data to be exposed that shouldn't be.

If you're thinking more of a data consistency problem (e.g., we have a 3-node database and 1 of the 3 nodes has out-of-date data), that's not so much an information security problem as a data integrity problem. It won't just cause 'vulnerabilities', it will cause the system to fail in its primary purpose. Some queries will get bad data, and that's a problem generally—not just in some information security sense.


What is the risk of using http on an internal webserver? We have a web server exposed to the internet, it uses SSL/https.
Requests to this server are redirected through a firewall to a back end web server which only uses http. That server has access to the file storage server (the DMZ'd one with SSL doesn't) and it receives the requests, finds the document, copies the document to a cache folder in the DMZ, and the SSL'd server serves the copy.

What are the risks of not using https on the internal server as well, if any?

By not using TLS you are giving up the integrity  and confidentiality. Your connection can be monitored or altered and there is nothing there to guarentee the endpoint is who they say they are.

An internal attacker can man-in-the-middle your http connection reading and altering data.
An employee could be targeted via phishing and a DNS rebind attack could be used against them to access this resource to get documents. As they are already within your network the request would circumvent your firewall. This however requires the attacker to have knowledge of your network.

Unfortunately we live in a time where you must assume you are breached so plan your security controls around this.


How to distribute bash scripts to multiple IOT devices securely Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source.
Our customers however will have to buy separate IOT devices and flash our software (i.e. bash scripts) into them. The IOTs will have a Linux running (alpine or the like).
What we want to do is to flash our scripts into these IOT devices without having to compromise our source codes and close the IOT device for any further modification.
As soon as we "flash" these devices we close SSH ports and close any network connection. The user will have to rip off the nands in order to read the code.
Of course the end user can hit erase and reinstall their devices. That's fine as long as they don't access our scripts.
How do we do this securely?

The simple answer is that you don't.
You want your script to run at a computer not owned and controlled by you.

Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore

10 immutable laws of security
In addition, you use a shell scripting language, which by default can be read as clear text.
Microsoft has been trying to stop piracy for a few decades - throwing huge resources at the problem. Have they solved it? Nope.
I would opt for contractual protection. Tell your customers that they cannot distribute your software. If someone wants to copy it, they will likely be able to copy it, no matter what you do.
In addition I'd question the value of what you have. It may take time to make, but is it ultimately that valuable? If yes: is it possible to write a agent that ships whatever data you act upon to a backend server (controlled by you), and do the actual work on the backend? That way you'll be able to control the security (and access) of the proprietary software. All you need on the IoT-device is a agent for sending and receiving data.


Challenge/response authentication for garage door opener I'm building an Arduino based radio garage door opener, and in order to protect it from replay attacks I've came up with this algorithm:

sender initiates communication
receiver sends a random 32 bit number XORed with a secret key
sender reverses the XOR operation using the same secret key, resolves the challenge (ex: challenge ^ 2 - 5), XORes and sends the result to the receiver together with the command (gate up or gate down)
receiver compares the response with it's own calculation of the challenge and executes the command if they match.

I'm curious, do the steps described above ensure that the response is impossible to guess for an attacker?

No.

Let's write it up:

C is the challenge message
R is the response message
K is the secret key
C = q ⊕ K where q is a random number.
R = ((C ⊕ K)2 - 5) ⊕ K, or if we skip the decryption step: R = (q2 - 5) ⊕ K.

The attacker can see both C and R. If the attacker then xors the two values:

C ⊕ R = (q2 - 5) ⊕ K ⊕ q ⊕ K

Since we're xoring with K twice, we can just drop those operations out. This gives the attacker the following:

C ⊕ R = (q2 - 5) ⊕ q

There are only a few values for q for any given value of C ⊕ R in the 32-bit space. In fact, it's an easy enough operation to just brute force: just try all q values until you find all the values that match.

This gives you some possible value of q, the random number. Since C = q ⊕ K, just compute C ⊕ q for each candidate q to get a small number of possible K values. Repeat this process for a second time and see which candidate K value came up in both runs: this gives you K.

I even wrote a PoC!

// our key!
int k = 0xBAD1DEA;

void Main()
{
    // output the key just so we can see it in the output
    Console.WriteLine("Key is: 0x{0:X8}", k);

    int challenge = GenerateChallenge();
    int response = GenerateResponse(challenge);

    Console.WriteLine();
    Console.WriteLine("Cracking the challenge and response...");

    // this is the attacker: they know only the challenge and respoonse!
    Crack(challenge, response);
}

int GenerateChallenge()
{
    Random rng = new Random();

    // I'm keeping the random number small-ish to avoid the c^2 operation from overflowing
    // this is just a limitation of the fact that .NET has sane integer types that don't wrap on multiplication overflows
    int q = rng.Next(0, 10000000);
    Console.WriteLine("I picked q={0}", q);

    int challenge = k ^ q;
    return challenge;
}

int GenerateResponse(int c)
{
    c ^= k;
    return ((c * c) - 5) ^ k;
}

void Crack(int c, int r)
{
    int c_r = c ^ r;

    // try all possible 'q' values.
    for (int q = 1; q < int.MaxValue; q++)
    {
        if ((((q * q) - 5) ^ q) == c_r)
        {
            // got a match, output it
            Console.WriteLine("q candidate: {0}", q);
            Console.WriteLine("k candidate: 0x{0:X8}", q ^ c);
        }
    }
}

Sample output:

Key is: 0x0BAD1DEA
I picked q=2847555

Cracking the challenge and response...
q candidate: 2847555
k candidate: 0x0BAD1DEA

The "cracking" process took less than a second on my system.

EDIT: Since this apparently wasn't clear: you're not bruteforcing anything against the real system. This approach doesn't involve you sending any data to the receiver at all. You simply sit there with a software defined radio (SDR) and capture the signals produced when the owner opens their garage door. You then extract the challenge and response values from those signals - these are C and R. Given C and R you can use the above process to compute a few possible q values for that particular challenge/response pair. In some cases you'll get only one, in some cases you might get 2 or 3. Compute q ⊕ C for each candidate q to get a list of candidate K values. If you get more than one, wait for them to open their garage again and capture another C and R pair, re-run the process, and see which candidate K values match the first time around - this will give you the real K value. Once you've got that, you've got everything you need to impersonate the real opener device. You can reply correctly every time since you know the value of K.


Is it possible to lock down the http / https proxy settings on an Android phone? Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?

Mobile Device Management (MDM) solutions exist that allow you to control and lock down settings on the device, as well as manage devices from a central location.


Should Windows 2008 R2 be used as an externally facing DNS name server? When compared to more traditional DNS name servers, what are the benefits / drawbacks of using a Windows 2008 R2 as a public  ns record for a company.

What limitations, or security issues would I encounter?

Does the answer change if the in-house skillset is limited only to Windows based products?

I think you summed up the benefit pretty well.  You have to play in the ball-field that you are comfortable with.  Windows 2008 R2 can support DNSSEC and it is a relatively good server platform.

I'm not sure if I would go that direction, but I cannot say personally that it would be a bad direction to go.  The bigger question is does your in-house staff have the expertise to deploy this solution and keep it secure and available.  I would think you are going to stage this before you go production, why not put this side by side against some of the other options you are weighing?  What other platforms are you thinking about serving DNS?

DNSSEC Deployment Guide

EDIT : Added URL for Windows DNSSEC Deployments


Authenticating Users from Android with PHP Webservice I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice.

But I'm a little confused over the authentication scheme. I intent to host a script at www.mycoolsite.com/magic.php and POST data to it from Android.

What is the best way to authenticate a user with the server, should I send the username and password with every HTTP POST (encrypted)? Also, if there are large number of users using the same script at a time, will there be some concurrency and efficiency issues?

I understand that I can use REST to generate tokens, but I don't know
how this works to generate the token. Do I need to send the username and
password to the server once?
So if an intruder gets hold of this token, can't the intruder send
bogus requests. Is this token encrypted?

You want to use an encrypted channel (SSL for example) for the login and give some type of a session identifier back to the application.  That session identifier should then either be used to sign later requests or can simply be included with the requests as long as it is provided over a secured connection (such as SSL).

The easiest way is just to do everything over SSL so that only the client and server can take part in the communication and the client can verify itself while only having to login once.


BurpSuite: Anonymity Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?

BurpSuite is only used to send HTTP requests in an automated way. There is no way to tell if a request is coming from BurpSuite or not. (Just have a look at your request header or body).

You might be able to detect such a robot though. Tools such as BurpSuite use a scanner, and you can trap them by making them follow an invisible link on your website. Tools would automatically follow the link whereas users wouldn't even notice it. If someone visits the website.com/trap link, you can tell it's a scanner.

BurpSuite is just a tool, attacks can also be performed manually, just think about BurpSuite as a web browser with automated actions to help finding vulnerabilities. (Yeah, I know it's more than that, but all it does is send HTTP requests).


What real life scenarios require separate end user certificates for Signing and Identity? Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates.

Conventional logic & wisdom says there is no need to separate an Identity and Signing certificate, but I'm looking for any rational reason to the contrary (devil's advocate).

Here are a few imaginary examples that might have a basis in IT operations, risk management, or separation of concerns.  I hope that someone will validate any of these reasons (or will come up with their own) that justify separate keys:

Possible examples:

Is there any need to have different lifetimes/expiration of authentication and signing certs?
Is there ever a need to have different assurance levels of each certificate? (different CAs?)
Is it plausible that I need to revoke one, and not the other? Why?
Are there different software workflows, based on key usage (EKU) that would discourage automated operation? (preventing viruses from authenticating or signing as you)
Should I defend from Non-technically savvy legislation that may require such separation in the future?  (Security theatre)
Do they have different storage requirements (smart card, trusted device, DPAPI, etc) for multiple devices? (Do I need the same or different cert on a Phone, PC, iPad)
If multiple valid signing and identity certs are "active" at a time, does that help isolate and partition risk of misuse (all offending usages can be contained)?
...?

These are a few ideas that I can think of that might justify the need to maintain different signing keys, but I'm unsure of how realistic they are (including stuff I haven't thought of).

From a technical perspective I can imagine needing separate keys for these (and possibly other reasons)

Limitations on algorithm RSA vs ECC
key length
Internal compatibility (SHA1/SHA2/SHA3)

The EBICS financial protocol (European alternative to SwiftNet) can be a pertinent real life example. It uses three certificates respectively for authentication, signature and encryption.

Most (if not all) banks use three different certificates. However the official protocol specifications allows the use of the same certificate for authentication and encryption, but requires the use of a separate certificate dedicated exclusively to signature:

  EBICS allows the use of three different key pairs per subscriber. In
  doing this, EBICS  promotes the use of at least two different key
  pairs for each subscriber:

  One key pair is used exclusively for the bank-technical electronic signature.
  The use of one single key pair is allowed for identification and authentication of the  subscriber by the bank system AND decryption of transaction keys.

This decorrelates the authentication and signature certificates, and allows to achieve the following goals:

The authentication identifies the entity acting as the unique sender of the request. This entity might be a physical person as well as an abstract entity (a company or a business entity for example), it doesn't matter.
In the case of a request sent toward the bank, the request must be signed by one or several physical persons (depending on several criterion) to be taken into account by the bank. It is possible that none of these persons act as the sender.
The authentication certificate may be stored on a disk, along with software configuration files or its database. This allows automatic processing like fetching accounts balance, last transactions status, etc. (these requests still require authentication, thus authentication certificate usage)
The signature certificate however, identifying the physical person, must be stored in a physical token (cryptographic USB key or smartcard) remaining in possession of this person and requiring a PIN code to be used.