If you have to write an information security guide for non technical users, what would you cover? Inspired by a question I saw on Twitter:

As the title says, what items would you include? And to what depth?

Are there obvious topics everyone should be thinking of, or is it important to advise on areas they may not have considered but can take action on?

I would recommend that people read Consumer Report's Guide to Online Security.  It is excellent and covers a lot of what people need to know.

Beyond that, here are a few more suggestions:

User behavior. I would have some recommendations for how they behave online:

Practice good password hygiene.  I recommend that people pick two very strong passwords: one for your email account, and another for your banking and financial stuff.  Don't re-use those passwords anywhere else.  To select a random password, a good approach is to pick a phrase -- a sequence of four or more words -- that no one else is likely to guess or choose.  Anyone who breaks into your email account may be able to gain access to all your other accounts, so it is important to protect that one carefully.  And the need for a strong password for banking is obvious.

As long as you trust the folks you live with, it is fine to write these passwords down.  Writing the passwords down will make you feel comfortable choosing long and strong passwords, so it is generally a good thing (contrary to what you might hear from others).

For other sites, I suggest you pick other throwaway passwords.  They usually don't need to be especially strong.  It is fine to write them down, and I encourage it.
Use your browser password manager.  Take advantage of your browser's password manager, so you don't have to memorize your passwords.  When it asks whether it should remember your password, say yes.  Once you know that you can count on your browser to remember your password for you, it will free you up to choose hard-to-guess passwords.
Be careful where you enter your password. Bookmark security-sensitive sites, like your bank and your webmail provider.  When you want to log onto them, click on the bookmark then enter the password.

You want to avoid a situation where you are on some other site, click on a link, and then enter your banking or email password into the resulting page.  That's unsafe, so get out of the habit of doing that.  Similarly, avoid clicking on a link in your email and then entering your password into the resulting site.  If you get an email from your bank and want to log onto your bank account, click on the bookmark to your bank and then enter your password.

This is the equivalent of how to protect yourself offline.  There's a common scam where someone calls you up, pretends to be your bank, and asks for your bank details.  To avoid falling for that scam, all you need to remember is "don't call me, I'll call you": don't provide your banking details unless you called the bank yourself.  If your bank calls you and wants personal information, hang up, then call the bank's phone number on your bank card.  That's a good idea offline -- and it's a good idea when on the Internet, too.  When using your browser, follow the same practice.
When browsing, look up. When you are browsing the web, if you ever have any questions about what web site you are currently interacting with, look up at your browser's address bar.  You can identify the domain name of the site (the part that says, for instance, www.google.com) near the left side of the address bar.  In many browsers, it will be highlighted.  If you are considering entering in personal information and have any questions about who will be receiving the personal information, the address bar will tell you the answer.
Never download software from unfamiliar sites. Avoid downloading software from anywhere except the most trusted sites (otherwise you can get hit by malicious software).  If you're browsing the web and some random web page says you need additional software to view the cool videos or something, don't do it.

System administration. I would start with some recommendations for setting up their system:

Enable automatic updates. This is the best way to ensure you are always running the best, patched version of all software.
Enable automatic backups. Set up a backup system to automatically and routinely backup your system, without your involvement.  This is one of the best ways to ensure you can recover from a compromise.  Security is more than just prevention; it is also about enabling rapid and reliable recovery from compromise.
Choose a secure browser. I would recommend Chrome.  Firefox can also be good.  If you use Firefox, install HTTPS Everywhere, to ensure you use HTTPS (SSL/TLS) on every site that supports it, and I recommend AdBlock Plus to many people.
If using Windows, install free antivirus. The number-one user error I see on Windows is that people think they have antivirus software running because it came with their system.  What they might not realize is that the pre-loaded software is a trial version whose license expires after a while (a year or less); once it expires, they're not protected any longer.  Therefore, I recommend that people install antivirus.  To save some money, I usually recommend a free antivirus checker: Avast seems decent, and some recommend Avira.

Alternatively, you could just buy a Mac.  It's more expensive, and it isn't a silver bullet, but it tends to mean you don't have to worry about anti-virus software.  (All of the other comments about user behavior still apply regardless of platform, though.)


Does client Authentication needs the server to have intermediate certificate? I have a scenario where in the client send send a client certificate issued from trusted root.
The path of the client cert is like :
Trusted Root
   |-----Intermediate Issuer
             |---- Client certificate

The server authenticates the client based on WCF client authentication "ChainTrust",
serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.ChainTrust;

We have the Trusted Root cert in the server, do the server also need to have the Intermediate Issuer Certificate for client authentication?

Any help and suggestion will be helpful?

To validate the certificate of the client the server must be able to build the trust chain. That means that either the server needs to know all intermediate certificates already or the client has to include these together with its own certificate. This is no different from checking the server certificate at the client.


How can I store downloaded video securely to device's sd card? I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.

So for this what can I do? I think about storing encrypted videos to sd-card. Can you suggest which encryption/decryption is better or any other method which I can use for my problem.

You have the right instincts.  Everything on the SD card is readable by every application, so the best solution is to encrypt the file before storing it on the SD card.

I am assuming you are asking from the perspective of an application developer, and you want to know how to implement this protection in your app.  If so, one simple approach is to encrypt using AES-CBC mode (with a random IV), and then take the resulting ciphertext and append to it a message authentication code using AES-CMAC.  You will need two separate (and cryptographically random) AES keys.  You can generate the keys with java.util.SecureRandom.  You could then store the keys in app-private storage (not on the SD card).  Hopefully this should be pretty straightforward to code up.

If you are asking from the perspective of a user, then you'll need to provide more information about what you are trying to achieve.  If you just want to store the video on your cellphone, but not view it on your cellphone, then one possibility is to encrypt it using GPG (or PGP) on your desktop, then download the encrypted file onto your cellphone; when you later want to access it, copy it off your cellphone and decrypt with GPG (or PGP).  On the other hand, if you want to be able to view it on your cellphone, you'll probably need to explain what you mean by "no other application or user can use it, outside the application or on any other devices" (e.g., what application?).


Is this admin area secure enough? EDIT: Please view the revised question instead

The admin area has special access to the database (modifying orders, etc).

To help explain, I drew a diagram, so here is my process:

Notes:

I left out having a timed session from the diagram for sake of simplicity of the diagram, but I will actually set a last_login date in the database so that inactive sessions can be logged out automatically.
Passwords are stored with AES encryption
The secret key or "salt" is hard-coded out of the web root folder
All database queries are parameterized.

But what are your thoughts about this process? Am I missing anything out?

Don't implement your own session handler.   Use $_SESSION,  it was written and audited by people who very good understanding security.   I don't even know the intricacies of how your session handler works,  but based on the little information you have given us its insecure.

SQL Injection is useful to obtain data from the database.  We HASH passwords because in the event of an attacker obtaining this data,  they will be forced to crack the hash before its useful.  However,  in your case,  it doesn't matter that you are vulnerable to CWE-257,  the attacker can just pull the session id out of the database, and use that to authenticate.

I could also gain admin access because you have made no mention of OWASP a9 - Insufficient Transport Layer Protection. You are also vulnerable to Clickjacking,  every web app is by default.  CSRF or "session riding" was already mentioned.

Enable the security flags "httponly", "secure".  You can do this for $_SESSION by configuring PHP.

A defense in depth strategy is to plan on failure and limit the access your administrator has.  Don't allow file upload or code execution.  This is the number 1 reason why Wordpress instances get hacked,  once you have admin on a Wordpress site,  you have remote code execution on the server. Wordpress also implemented their own session handler at one point,  and you guessed it,  it was very insecure.


Using CentOS, is it OK to encrypt copies of root directories and mount the encrypted copies in place of the original root directories? I am using a CentOS running on a Cloud Hosted Virtual Machine. The cloud hosting service is Digital Ocean. The cloud hosted VM dose not allow you to use full hard disk encryption as it dose not provide the ability to enter a password on booting the device.

To encrypt the device I was going to create a copy of a number of root directories (/lost+found, /run, /srv, /tmp and /var) and swap the encrypted directories in place of the original directories by mounting the encrypted copies in place of the original root directories. I was going to mount the encrypted directory's each time the device was booted.

I was going to use DM-Crypt and LUKS to encrypt and access the directories.

Is this an OK idea?

I'd suggest configuring your initramfs to run sshd/dropbear so that you can ssh into your initramfs/initrd to enter the decryption passphrase. Look into the various solutions suggested in SSH to decrypt encrypted LVM during headless server boot?.


PCI-DSS requirements regarding long exposure to critical vulnerability (RCE) Suppose we have an e-commerce website where payment is done via redirection to a payment provider, with no processing / storage of cardholder data at our site (I'll update if needed with exact PCI merchant category, but I understand that it's the lowest one, all cardholder data is handled by the payment provider).

Suppose that we discovered 2 months ago that several critical vulnerabilities affect this website (CVSS score > 8, including RCE and SQLi).

Suppose that nothing has been done since then (patching, mitigation), and that  we have no internal capabilities for forensics investigation, log review or any other detection activity.

My questions are:

Is there a requirement for conducting investigation to identify whether
these vulnerabilities have been exploited?
Is there a mandatory disclosure to anyone?
An obligation in terms of delay for remediation?

Note : Not a QSA, but some PCI experience.

The section relevant here is section 6, especially 6.1 "Is there a process to identify security vulnerabilities" and especially 6.2.b "Are critical security patches installed within one month of release?" (though the whole section is relevant to the discussion)

To comply with PCI DSS, you must have a formal process for identifying security vulnerabilities, both in third party software and in software you write, through checking the National Vulnerability Database or other sources, through secure code reviews, through vulnerability testing.  You must also have a process for ranking those vulnerabilities - most places use the Common Vulnerability Scoring System but it isn't a requirement.  And once those are scored, you must have a process that determines when each must be fixed by - and that process must include fixing critical vulnerabilities within a month.

And once you have all these processes, you must actually follow them.

I am not aware of any requirements for disclosure within the PCI DSS standard, though industry best practice is to have policies defined for when to disclose to who and there may be local laws (California has some, for instance) that require disclosure in certain circumstances. I am a personal believer in defaulting to disclose when exploits happen.


How does LM hash deal with passwords that are between 8 and 13 chars If its 14 then it splits it to 7&7, but how about 13 characters? 7&6?

How does it work?

The password is padded with null bytes: extra bytes of value 0x00 are appended so that the total length is exactly 14 bytes. See this, item 4.

Of course, LM hash is a very poor password hashing algorithm. Don't use it (if you have the choice).


OAuth token vs. application-specific password: any meaningful benefit? I feel like this should be a duplicate, but I don't see it anywhere.

The question is pretty simple. When giving a mail client (say, Thunderbird) access to your e.g. Gmail account, you have the option of either using an application-specific password, or an OAuth token.

For the life of me, I don't understand the benefit of the OAuth token:

Both are used only for that specific application
Both are cryptographically secure against cracking
Both allow full access to the user's emails
Both can be later revoked by the user

On the other hand, the downside is that it's less universally supported and requires jumping through more hoops to set up.

So why in the world would I use a longer OAuth token over a shorter application-specific password? What benefits does it have—i.e. under what attack scenarios will I be glad to have used OAuth?

Using an app-specific password requires going into the target service, generating a new app-specific password, going to the destination app (Thunderbird, in this case) and entering the credentials.

Using OAuth only requires opening Thunderbird, adding your account using your normal username/password, and then clicking a button to approve that you want OAuth to set the permissions up for you.  You never see the password/token, you have nothing to copy/paste, etc.  So, it's easier to set up (usually), is safer, in the sense that you never see the password/token and nobody could look over your shoulder to jot it down to use as a backdoor access (masquerading as whatever app you generated it for, even though it really isn't - there's nothing stopping you from using an app-specific password on multiple devices simultaneously), whereas the OAuth token is literally on an app-by-app basis (unless I'm misinformed).


Why don't more websites implement Perfect Forward Secrecy? From what I understand, all it takes to enable PFS on a webserver is adding ephemeral cipher suites (ones that use DHE and ECDHE for the key exchange) to the list of cipher suites used in SSL/TLS handshake. I'm aware that some older web services and crypto libraries do not support these cipher suites. But besides that, all modern browsers support PFS. Enabling PFS does not prevent older, incompatible browsers from working in case some users can't or refuse to upgrade.

So, what's the issue here? Why don't more websites implement Perfect Forward Secrecy?

Actually most Web sites do implement forward secrecy, i.e. at least one of the "DHE" (or "ECDHE") cipher suites. Most SSL implementations support them out of the box, and most SSL server certificates are adequate (with a DHE cipher suite, the server's key is used for a signature; but almost everybody uses RSA and almost all RSA certificates allow the key usage for signatures).

However, most SSL implementations are also courteous, in that the server follows the client preferences. This means that, in the list of cipher suites announced as supported by the client (in the ClientHello message), the server will usually select the first one which is also supported on the server side. Since most clients tend to put the non-DHE cipher suites first, DHE suites remain unused.

The extra cost incurred by DHE cipher suites is slight, and almost always negligible:

The computational cost for the handshake is about doubled. This means that a basic server may do "only" 1000 full handshakes per second instead of 3000, based on its available CPU. Since servers don't usually boast 1000 new clients per second, on a single PC, this limitation is never a true limitation in practice.
The extra bandwidth is small: less than 1 kilobyte of overhead induced by the use of a DHE cipher suite. There again, this overhead is only for a full handshake, i.e. the very first connection between a client and a server; subsequent connections will use the "abbreviated handshake", which is more efficient, and completely unimpacted by the actual cipher suite.

So, to sum up, forward secrecy is already there and it is underused only because of the traditional behaviour of clients and servers (preference order) which remains as it is for no good technical reason, only inertia. In some cases, developers or sysadmins deactivate DHE support based on some unsubstantiated rumour about how DHE is "very expensive" and "might heavily impact performance", but these myths are easily dispelled with some actual benchmarks, and are still rare. Browsers and servers choose non-DHE cipher suites mostly because that is the default behaviour and nobody feels motivated enough to do anything about it.

To be complete, there is an extra effect: when the BEAST attack was published, people semi-panicked, and the common mantra was: "use RC4, it is immune". SSL has no DHE cipher suite with RC4 (there is no incompatibility between DH and RC4, but it just happens that no such standard cipher suite has been defined). So this resulted in clients and servers preferring RC4 cipher suites, which indirectly implies not using the DHE cipher suites.


GnuPG/OpenPGP in the corporate world Is GnuPG/OpenPGP a good solution to protect internal company email communication?

With PRISM and previous major company hacking news stories, I'm looking for a solid way to protect company confidential information while communicating by email?

Another concern is that most people are often need to access their email while on the move. It seems that Android does not yet have any solid support for GPG/PGP encryption through official apps.

Is GnuPG/OpenPGP more of a hassle than a benefit in a corporate environment?

The "hassle" is a trade off depending on what you are trying to protect. But it is benefficial to use GPG/PGP if you want to protect your emails. Make sure to train your employees.

On a side note:

If they really would want to get access to your files I don't think the NSA would be discouraged because you are using PGP, if the file is encrypted they will get the key...somehow.

image via xkcd.com


Best practices for working with a new computer What steps can I take to detect if a brand new computer has been compromised?

Would it take an actor with significant resources to compromise a system and still have it appear to start the standard Windows set up wizard? Partly I ask this because I wonder if reinstalling the operating system would help or if anyone who could compromise the system in this way could also compromise it (through the BIOS) such that a reinstall would still not help.

I ask because I just received a brand new laptop in the mail that arrived in a box with the only seal compromised (i.e. I could open the box and remove the laptop without cutting any tape or breaking any seal). I tried to ask a question in the least subjective way I could but please comment if you can suggest a less subjective form of the question or can recommend a better forum asking about this than Stack Exchange.

I would suggest that you re-install the OS to reduce the probability of a compromised system. It is relatively trivial to modify the windows image to include malware and then install it on your machine. Software such as NTLite is frequently used by OEMs to install antivirus trial versions that come with the machine. The same software can be used to pre-load malware onto the machine.

Although very rare, there are instances of malware affecting the BIOS. You could download the latest BIOS firmware image from the manufacturer's website and flash it.


Does a sudden ERR_CERT_COMMON_NAME_INVALID maybe suggest a man-in-the-middle attack? For months I regularly visited Russia Today (www.rt.com) with no problem. Then:

4 days ago, without even closing my Chrome browser on MacOS, www.rt.com just stopped loading.
on the command line, www.rt.com resolves to 207.244.80.166.
typing 207.244.80.166 into Chrome loads this error message:

  Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"

a traceroute makes it to 207.244.80.166 in 11 hops.
typing www.rt.com into a Chrome browser on Windows XP loads with no problems.
Chrome browser on iPhone using the local WiFi does not load.
Chrome browser on iPhone using a cellular network loads ok.

There is a public effort to restrict access to Russia Today from inside USA on youtube as well as www.rt.com. Am I being affected by this? What is that error?

typing 207.244.80.166 into Chrome loads this error message:
  Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"

This is the expected  behavior. If you specify the IP address instead of the hostname in the URL it will expect that the site returns a certificate which matches this IP address. But, the certificate returned for this site is not for a specific IP address but only for a hostname, i.e. it covers rt.com and *.rt.com.

"Subject Alternative Name Missing" is slightly misleading since the certificate actually has subject alternative names (SAN). Only, it has no SAN for an IP address but this is expected since you've entered an IP address in the URL.

  Gosh, could this mysterious error message that just came out of nowhere be explained by a man-in-the-middle attack?

There does not need to be any man-in-the-middle attack involved to get this kind of error. You get the same problems with other sites when just using the IP address in the URL instead of the hostname. Try for example https://104.102.5.46/ which uses the IP address for www.whitehouse.gov and you'll see that the problem is the same.


Delivery Failure Notification spam protection? My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com.  I have been getting flooded by delivery failure notices which I believe show that my mail system has not been exploited -- it's all hosted by Google Apps and all of the accounts seem to be unaffected.  Furthermore, the headers seem to indicate all email is being originated in middle eastern and south asian countries).  However, my domain is clearly being abused in a way that I cannot seem to protect against.

I fear that my domain may be placed onto blacklists or other problems.

Is there anything I can do except wait for it to subside?  How long does that usually take?

What you're getting is called backscatter, and it's annoying. Because email need not be authenticated, spammers will send email using a forged return address. When the spam delivery fails, the recipient will sometimes send a falure report back to the forged return address. The (real) recipient of that failure notification message can get understandably very angry about this, since he was never actually involved in this mess to begin with until the hapless spam recipient sent the failure notice to an innocent bystander.

The solution is for everybody to quit sending these failure notifications unless you can conclusively prove that it's going to someone who actually sent you the message you're notifying about.

If you're part or the problem then for the sake of everyone's sanity, quit it.


How to protect network equipment in public spaces? I'm curious whether there are standards or recommended best practices to protect network equipment that has to be left unattended and outside (of a secure data-center environment) for example for scientific research?

The assumption here is that even a primitive station would have network equipment (at least a switch/router) that connects to the device taking measurement but also communicates the data back via mobile networks / VPN.

As the equipment obviously has value it is of course at risk of being stolen or even being vandalized. If there is a sophisticated attacker the person might also try to intrude the researchers networks.

Is there best practices or frameworks to follow for this scenario to assess the risk and potential counter measures?

I haven't found an International (or National) Standard that goes into detail on protecting remote physical assets; the closest I have found is in ISO 27001 - Annex A.11: Physical & Environmental Security. According to Wikipedia, ISO 27001 itself is a much wider-ranging standard on the whole subject of "information security":

  ISO/IEC 27001 specifies a management system that is intended to bring information security under management control and gives specific requirements. Organizations that meet the requirements may be certified by an accredited certification body following successful completion of an audit.

However, from the first link, Annex A.11 of the standard is more specific, and comes in two parts:

  Annex A.11.1 is about ensuring secure physical and environmental areas. The objective in this Annex A control is to prevent unauthorised physical access, damage and interference to the organisation’s information and information processing facilities.

  Annex A.11.2 is about Equipment. The objective in this Annex A control is to prevent loss, damage, theft or compromise of assets and interruption to the organisation’s operations.

A lot of the annex is to do with "on site" assets, but Annex A.11.2 does include:

  A.11.2.6 Security of Equipment & Assets Off-Premises

  Security controls need to be applied to off-site assets, taking into account the different risks involved with working outside the organisation’s premises. This is a common area of vulnerability and it is therefore important that the appropriate level of controls is implemented and tie into other mobile controls and policies for homeworkers etc. Considerations should be made and risk assessments carried out for assets that are taken off site, either routinely or by exception. Controls will likely include a mixture of; Technical controls such as access control policies, password management, encryption; Physical controls such as Kensington Locks might also be considered too; alongside policy and process controls such as instruction to never leave assets unattended in public view (e.g. locking in the boot of the car). It is particularly important to review security incident trends relating to off-site assets. The auditor will expect to see evidence of this risk assessment taking place and the proportionate controls selected according to the evaluated risk levels. They will also expect to see evidence of policy compliance.

Some other resources that may help:

Physical security on Wikipedia includes in it's overview three "layers":

  deter potential intruders (e.g. warning signs and perimeter markings);
  detect intrusions and monitor/record intruders (e.g. intruder alarms and CCTV systems); and
  trigger appropriate incident responses (e.g. by security guards and police).

The UK's Centre for the Protection of National Infrastructure has pages on Physical Security and Protecting my Asset that both cover the multi-layered approach, including from the second link:

  Deter: stop or displace the attack
  Detect: verify an attack, initiate the response
  Delay: prevent the attack from reaching the asset (including measures to minimise the consequences of an attack)
  Mitigate: minimise the consequences of an attack against your site
  Response: actions to prevent the goal of the attack being completed

The US Government's Physical Security Systems Assessment Guide (PDF), while appearing to be mainly aimed at larger (and often manned) facilities, covers similar ground and many aspects will apply to the protection of remote equipment.


Are web browser able to use camera without permission? Is it possible to be recorded via our camera/micro via web browser without asking our permission ?

The privacy model of modern browsers ask for permissions and sometimes elevated privileges when they require access to the camera. So normally, they are not able to access the camera without your permission.

But there have been multiple vulnerabilities in Flash, Chrome and even Facebook that tricked the user or the browser to turn on the camera.


How to detect if a site is using a JavaScript exploit? Is there a way for me (non-expert in JavaScript) to detect JavaScript attacks from a website. I have done a lot of searching around and have not come up with a definitive answer. NoScript is a pain in the ass to use as more and more sites REQUIRE Java and scripting to be enabled (e.g. signing into this site). Every time I click on "allow site" I wonder what I'm "allowing." Also the advice, "Only allow sites you trust" is not really helpful as many sites have been hacked and don't even know it.

Also, I suspect a site running something to pick up my router IP as they seem to be able to identify me although I'm on TOR. I am not referring to a hidden site or one dealing in illegal content. I am talking about normal, known sites.

Code is neutral. There is no intrinsic difference between code which fulfils some functionality, and an active exploit, except that in the latter case you would prefer it not to happen. The difference is in your head, not in the code; computers cannot detect it automatically.

This is a fundamental property of IT security: there is no reliable test to know whether a given piece of code is benign or malicious. At best, we can:

Enforce benignity with heavy constraints, e.g. with NoScript: if the code cannot run, then it cannot harm.
Try to prune out malicious code by inspecting its source: allowing code to run only if it comes from a trustworthy source, and we have some reasonable assurance that what we got is indeed what that source sent (i.e., in a Web context: Javascript from a specific HTTPS Web site that we decided to trust).

I agree that this is unsatisfying. Unfortunately, the World has a tendency to be such.


Does it make senss for a company to have a VPN, if all its infrastructure is in the cloud? If all the applications, virtual machines and services we use at our company are hosted in different clouds and assuming all these services are accessed through encrypted layers (https/TLS/ssl ...).
Does getting a VPN so every employees trafic goes through our companies internet connexion (even if he's not physically in our HQ location) makes sens or is it totaly a waste of both money and bandwidth ?
I see only one usage for the VPN, and it's to have the same static IP for everyone so we can whitelist this IP only for admin access and direct access to our virtual machines and databases, instead of maintaining multiple whitelisted IPs or letting any IP trying to log on our servers and applications.
We have MFA and strong passwords, most of our files and datas are on services like Onedrive, Office 365 etc and most of our customers websites needs to be able to be accessed by any IP. So the one unique IP whitelisted rule would only be usefull for a handfull of virtual machines or databases.
Have I missed any usage ? Do I miss something, because a VPN do not look like very interesting in our case ?
I have read this question Does routing internet traffic via VPN through a company proxy gain any more security? and their answers but It is more about the utility of a proxy, which we do not plan on implementing for now.

Does it make sense to have a VPN for every employee, regardless of what they do?

Well, that depends on your scenario. In a modern cloud infrastructure, where everything runs on publicly accessible web applications that are protected by HTTPS the additional security benefit is rather small and may not justify the operational costs.
Things change however, if you have to rely on insecure protocols like HTTP or if you do not want to expose your servers or services to the public internet. For example, you would not want to expose your administrative interfaces (Web, RDP, SSH, ...) on the internet, as these are highly valuable targets.
Here a VPN allows you to limit the group of people that have access to these services and add an additional encryption layer around an otherwise insecure communication.


Is ASP.NET Event Validation completely secure? I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.

Is there some way to bypass it? How much assurance is there that it cannot be bypassed?

ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.

There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here).

From that last link there's an interesting quote from Microsoft here "The ASP.NET request validation feature performs basic input validation. Do not rely on it. Use it as an extra precautionary measure in addition to your own input validation. Only you can define what represents good input for your application."


Is it practically possible to spoof a WLAN access point? I want to try something out, but I wanted to see other opinions from you guys.

What I have:

WLAN Access point, with WPA2, ESSID: testing. Home router, I can change the configuration and everything on it.
windows computer (victim);
backtrack computer (attacker);

The backtrack computer has 2 wireless card, one built-in, and a USB wireless adapter.

The windows computer is connected to the AP, from it's own wireless card. The backtrack computer is connected to the AP, on wlan0 (wlan1, is the usb adapter).

Is it possible, if I change my wlan1 MAC, to the AP MAC, and make a fake access point, with the AP MAC, and also same ESSID. Before creating my fake AP, I can change the ESSID of the router from "testing" to something else, and use the original ESSID on my fake AP, and also set a WPA2 passphrase, the same one that the original AP had.

What will windows do ?

Will it connect to my fake AP, since I have the MAC, ESSID, and same WPA2 password?

What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple.

The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each individual packet on an individual basis, the attacker can force the client to connect to their rogue AP.

When combined with a deauthentication attack, this is an incredibly effective tool for performing MITM attacks.


What protects cookies? What protects cookies from being stolen? After all, they are just text files. A misbehaving browser can give up a lot more information that web masters would like. How do I know that a browser won't serve up cookies from another domain to my website if it asks for them?

In short, guarantee that cookies from site A won't be read by site B is provided by so called Same Origin Policy (SOP). This is browser security implementation. Sure, if there is a place for code injection (like XSS), attacker can steal your cookies, but that's another scope - in that case client "allows" (but user is unaware) to retrieve cookies by third-party.

Additionally, I highly recommend to read Michal Zalewski's browser security book, or, at least chapter of it: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies.
Also, nice post about cookies is again from himself: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.html.

Some good, related to this question links from here: How can I check that my cookies are only sent over encrypted https and not http?  and Are browser still vulnerable to Cross-Site Cooking?.


SAML assertion encryption and using same key for encryption as signing I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the user must already exist in the system).

If we are signing the response, what would be my justification for wanting to encrypt this non confidential data?

Customer's argument is its just good to do, and that all of their other providers facilitate for this by just using the same key to encrypt and for signing (and that all of their other service providers allow this). This sets off massive red flags for me for everything I have ever been taught on the basics of cryptography.

Firstly, the whole point of supplying a public key for signing is that anyone can own the key to check it, wouldn't this mean an identity provider would use the same private key for every service provider for signing? Therefore using the same key for encryption would void the trust boundary between every service provider using that identity provider? Am I misunderstanding this?

Secondly, if the Identity provider supplies the metadata with the encryption key, wouldn't it be a public key they are supplying to the service provider. Shouldn't the party on the receiving end of the encrypted message (aka the service provider) have the private key, not the public key? What am I missing?

Thanks,

Encrypting the SAML assertion is optional. Whether or not it's encrypted, you still have privacy through the transport layer security.

Scenarios where encrypting the SAML assertion should be considered include: the SAML assertion contains particularly sensitive user information; SAML SSO is occurring in a sensitive environment.

Your understanding regarding public vs private keys is correct. The service provider supplies their encryption public key to the identity provider.

The identity provider encrypts the SAML assertion with the service provider's public key.

Only the custodian of the corresponding private key (ie the service provider) can decrypt the SAML assertion.

Regardless of whether or not the SAML assertion is encrypted, the identity provider should sign either the SAML assertion or the SAML response that envelopes the SAML assertion.

The identity provider signs the SAML assertion or response using its own private key.

The service provider verifies the signature using the corresponding public key of the identity provider.

The only other consideration is with SP-initiated SSO the SAML authn request often is signed.

In this case the service provider signs the authn request with its private key and the identity provider verifies the signature using the corresponding public key.

The service provider has the option of using the same or different keys for signature generation and SAML assertion decryption.

One advantage of using the same key for signature generation and decryption is that there's one less certificate to distribute and manage.

The golden rule in all of this is that no party should ever divulge their private key to another party.


Should I worry about a breach where my password was not revealed? After browsing another question on this site, I discovered haveibeenpwned.com and thought I'd check my email. It came up with one breach which has, apparently, not been widely shared and does not include a password or much in the way of personal information:

I have a 12+ characters random alphanumeric password for this site which is unlikely to be broken. I have not used the site for personal messaging, and have received but not made payments through it. So this doesn't sound like much to be concerned about, aside from a possible increase in spam.

I appreciate that there are several questions which ask what action should be taken if your details are leaked online. However, I don't want to go to the effort if remedial action is unnecessary, so I'm asking to ascertain whether or not I need to bother?

The Patreon data included passwords hashed using the industry best practice BCrypt algorithm (this data is available online through a search for "patreon data dump", although possession of it may be a criminal offence in some jurisdictions, so I'm not linking to it). This does not mean that they are impossible to break, but they are relatively slow to break. Therefore, you should still consider the password as potentially compromised.

Specifically, the table data available through sources such as this reveals that a table called "tblUsers" contained a field called "Password", and that another table called "tblUnverifiedUsers" did too. Given the scale of the dump, it would be irresponsible to assume that this data was not accessed. The CEO of Patreon also provided a later statement to Motherboard stating "We encrypt all tax form information with a 2048-bit RSA key. The key used to decrypt this information lives on a separate server and was not compromised. All user passwords are hashed using bcrypt with 8 or 12 passes, depending on when the user signed up."

The idea of hashing passwords is to provide that buffer for changing details in the event of a breach - any password can be broken, given sufficient time, no matter what algorithm is used. After all, there has to be a way to compare the input from the user to the data stored in the database - the worst case scenario for the attacker is that they try every possible input string through the same algorithm, with the same salt, until they get the same output. The best case for them is that they don't need to bother doing that.

Assuming you are practising good password usage, you are probably fine - you've presumably already changed your Patreon login, and it'll be different to every other site you have. There isn't anything you can do about any of the other data though.


Would DNSSEC and certificates for IP addresses be enough? Using DNSSEC you can be sure that you have the right IP for a domain and using a certificate for the IP signed by someone you trust you know you have the right IP.

Shouldn't this be enough to know the connection is correct? Why would the domain name be needed in the certificate used by the server?

Domain names are a different addressing scheme than IP addresses: There might be  multiple IP addresses for the same domain name and there can also be multiple domains on the same IP address. And these domains can serve different contents too, even if they have the same IP address (at least with HTTPS).

Only if there is a 1:1 relation between IP and domain name you could replace one with the other, i.e. connect to some domain by lookup up the IP address and then check if the IP address is contained in the certificate instead of looking for the domain name. But neither plain DNS nor DNSSec provide you with the information if this is a 1:1 mapping. Even if you get only a single IP address when looking up a domain it might still be possible that you get the same IP address when looking up other domains.

Because of that you have to check the subject/SAN of the certificate against your original expectation (domain name) and not against some derived expectation (IP address).


How should I store TOTP recovery codes on the server end? In TOTP implementations, it's always suggested that you give your users recovery codes. Should I treat these like tokens? Display them once and hash them?

If so, I'd love to know why. If not, I'm curious too.

What it appears you have in this particular TOTP library is the requirement to create and implement a 2FA bypass function outside of TOTP.

  These are a set of one time use codes that can be used instead of the
  TOTP. These can simply be randomly generated strings that you store in
  your backend.

Those recovery keys are "golden keys" that unlock the account. These become like a second password, and as such, should be protected and implemented in the same manner.


PHP crypt() trims the salt as it would be too long I am using Blowfish with PHP crypt() for password hashing but I noticed something weird. Quoting PHP documentation:

  CRYPT_BLOWFISH - Blowfish hashing with a salt as follows: "$2a$",
  "$2x$" or "$2y$", a two digit cost parameter, "$", and 22 digits from
  the alphabet "./0-9A-Za-z".

I noticed that the salt that gets included in the final hash is 1 character short (the last one is cut off) as if the salt was too long, but that is not the case.

Example of my script output:

  Salt: 97504ebb48c4619f820f83 with length 22

  Blowfish: $2a$13$97504ebb48c4619f820f8u4QTtlV5MoqHt9l7hmK4jEohUXrI.0PK

  Hash match.

As you can see, the random salt is exactly 22 digits but the '3' is missing in the final hash. If I make the salt 21 chars only I get a corrupted hash and it does not work. So why does it trim the last char?

Examples on PHP manual also add a final $ to the random salt. Is that $ there for a reason or they just randomly added it to Blowfish, SHA-256 and SHA-512 to confuse everyone?

And finally, this is my code:

if (CRYPT_BLOWFISH == 1) {
    $salt = md5(uniqid(rand(), TRUE));
    $salt = substr($salt, 0, 22);

    echo "Salt: " . $salt . " with length " . strlen($salt) . "
";
    $pass = "rasmuslerdorf";

    $bsalt = "$2a$13$".$salt;
    $blowfish=crypt($pass, $bsalt);
    echo 'Blowfish:     ' . $blowfish . "
";

    if (crypt($pass, $blowfish) == $blowfish) {
        echo "Hash match.
";
    }
    else echo "no
";
}
else {
    exit("You need php 5.3 or newer");
}

Actually the '3' is there, but it is called 'u'.

Explanations: bcrypt needs a 128-bit salt. The salt you provide should be in "modified base64", i.e. consisting in letters, digits, '/' or '.' signs (this is "modified" because in true Base64, the '+' sign is used instead of '.', and the order is different). Since this is a 64-element alphabet, each character is worth 6 bits, and your 22 characters encode 132 bits.

Bcrypt only uses the first 128 bits of your 132 bits, so the last four bits are totally ignored. The last four bits are the last four bits of the last salt character. In the modified base64, 'u' has value 48, 110000 in binary, while '3' has value 57, 111001 in binary. As you can see, the two values differ only in their last (rightmost) four bits, which are ignored.

What happens is that the bcrypt implementation you use first converts your salt (22 characters) into a 128-bit buffer (16 bytes), and that's where the drop occurs. Then the code will convert it back to modified base64, but this time it will use zeros for the "missing four bits", thus turning your '3' into a 'u'. If you use '97504ebb48c4619f820f8u' instead of '97504ebb48c4619f820f83' as salt, you will find that you obtain the exact same bcrypt output, because these two salts differ only in the last four bits, which are ignored.


An intranet web app for decrypting values : a bad idea, and if so, why? We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But then every user of the application needs to have the key installed on their PC.
If an intranet IIS server has SSL and Microsoft Windows Authentication was in place, would an ASP.NET web-app that accepted an encrypted value and returned a plain text be a viable alternative to installing the keys on every user's machine?
With the web app, no user would be able to export the key from their local container, and so the web app approach seems the more secure of the two.

Well, which is it? A user or an attacker? A user doesn't care about the key, an attacker does.
An attacker doesn't really even care about the key, but rather the password. Moreover, an attacker doesn't really even care about the password, but in fact the data in the database.
If an attacker could reasonably get the key out of the user profile (which is what you're suggesting is the attack) they could easily just observe the connection to the service or even the database itself.
The correct solution is to move the connection to the database out of the context of the user. Since that's probably not feasible, you should consider switching to a non-credential-based mechanism like Windows Integrated Auth. You seem happy to do it for the service, so why not the database?
Note however that this doesn't actually solve the problem, it just limits the ways an attacker can connect to the database.


"Microsoft Warning Alert" on Ubuntu computer I get the "Microsoft Warning Alert" popup from firefox on a Linux computer.

That scam is described in https://www.bleepingcomputer.com/virus-removal/remove-malicious-pornographic-spyware-riskware-detected-popup

How to clean it?

I cleared history and checked that there seems to be no add-on from the scam.

Is that enough?

Yes, but you should also purge all the browser's caches, clearing just a history is not enough. If you haven't used it from root user - this is OK, if you did - then chesk the new programs on your PC, some malware tries to drop a scripts on target PCs. If you're concerning about this kind of threats much - I'd like to advise you to use a simple but powerful open-source PC monitoring program called Osiris - it will help you to detect any changes happened after the popup appeared.


How will security need to be changed if P=NP? If we suppose that it is found that P=NP, how will security measures need to be changed?

I'd like to know the major security measures that are affected, and how they would need to be changed.  We can suppose that passwords can be hacked in time O(n^4), for the sake of argument.

As an example of what I'm partly looking for, we might have an answer like RSA passwords of 1,024 bits would need to be extended to 5 million bits, or SSH would be rendered insecure.  I guess I'm attempting to get a scientific measure of changes that should take place without getting into the realm of speculation.  So we would probably have to first determine what level of security is adequate, and then compare the necessary changes.  So to have this level as part of the question, we can simply use common security practices in effect today.

I'm somewhat of a novice in the realm of IT security, so I'm hoping that someone can help point out what's important to know in this scenario.

The answer is: it depends.

Suppose we found a O(n^4)-time algorithm for a NP-complete problem like SAT, where the constant hidden by the big-O notation isn't too large.  That would kill pretty much all of modern cryptography, including symmetric-key cryptography and public-key cryptography.  The only things left standing would be information-theoretically secure cryptosystems, like the one-time pad and Carter-Wegman-style message authentication.
In that case, one might be able to respond by designing cryptosystems with a 10 million-bit key or so, but oh boy, life would suck.  It would be pretty tough to transfer around keys that large.  And it would be awfully hard to trust the resulting cryptosystem for any kind of enduring security.  If today someone comes up with an O(n^4) algorithm for SAT, you have to assume that maybe next year someone is going to figure out how to improve that to O(n^3 log n) or something like that.  So, in practice, if someone finds a practical O(n^4) time algorithm for SAT, a lot of cryptography rests on a foundation of sand, and we'd have to re-think everything.

Alternatively, suppose someone found an O(n^100)-time algorithm for a NP-complete problem like SAT.  In terms of immediate impact, such an algorithm would be totally useless for cracking cryptography.  However, in many ways we'd be in the situation of the last paragraph: everyone would wonder if next year some genius will improve this to O(n^10), and then the year after that O(n^4), and so on.  This could easily be a blow to folks' confidence in the security of modern cryptography.  So this too would be a pretty ground-shattering discovery, even if it has no direct immediate impact.

Or, suppose someone finds a non-constructive proof that there exists a polynomial-time algorithm for some NP-complete problem, but with no indication of how to turn this into a real algorithm and no evidence that the resulting algorithm will be efficient in practice.  Then we'd just be in a state of confusion.  No one would know whether maybe we are in the world of bullet 1 above, or the world of bullet 2, or something else entirely.

All that said, I don't think any of these scenarios are very likely in the foreseeable future.  In fact, I would go so far as to guess that they are very unlikely.  We could just as well talk about what the effect on cryptography would be if a massive asteroid struck the earth next year.  Well, the impact would be pretty devastating -- but the likelihood is pretty tiny.  I think there are much more relevant, likely things to worry about.
So, if you are wondering whether you should take some steps to protect yourself against the possibility that someone proves P=NP: don't bother.  That's a waste of time.  Spend your energy on more realistic threats.


Is it possible to trick a keylogger, when entering a password? If I have to enter sensitive data like a password on a device/system I don't fully trust, because of a possible keylogger. Are there any (common) ways to trick the keylogger to don't get your sensitive data?
For example an application which maps your input to your real password and enters it into a the programm/website/etc.?

Are there any exisiting application or solutions for this?
Or is this technically not possible?

I am not interested in answers like: 'Then don't enter the data' ;)

Its impossible to tell without knowing which exact keylogger.

Depending on how the keylogger gets the keys, it can be tricked. For example, if the keylogger works on such a low level that it gets the keys before the operating system, then  you can likely hide from it by using a virtual on-screen keyboard or other methods that don't have you touch the actual keyboard.

OTOH, if the keylogger uses a high-level OS API to get the keys, then chances are you won't be able to trick it, since whatever the OS treats as a keystroke will be seen as a keystroke by the keylogger as well.

Some programs let you specify passwords using standard input. So what might work is storing the password in a file (off-system, of course), and then piping the password into the program you want to use via shell pipes. This will almost certainly  bypass keyloggers. The downside is that its limited to programs which accept input on the standard input stream, so most GUI programs are out.

Another method that should work everywhere with a clipboard is to store the sensitive info / password in a file, open it in a text editor, copy its contents into the clipboard and paste it where you need it. The keylogger will just see the copy and paste commands (if it doesn't know how to read the clipboard contents, that is). But note tha keeping sensitive info in a system clipboard is hardly secure.


Penetration testing approach - Is there a better method? Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts)

I wondering if there is a modern approach that should be looked at, a company that's doing things a bit differently? So for example who would netflix use for pen testing?

I know discussions can be viewed in a negative light but it would be great to get some feedback

Large tech companies, like Netflix, can afford to have an in-house security team influencing the design and deployment of their software. They don't need to bring in outside help.

Any company without an in-house security team has a few options for pen-testing:

White-box - Bring in outside experts to look through everything and secure it, either from the initial design or once the system is finished. This is the most intensive (and expensive) option.
Grey-box - Give outside experts some knowledge of the system and let them work from there on their own.
Black-box - Give the experts no prior knowledge and let them test the finished system. While this can save time and money if they can't penetrate it, the problems they find might not be easily solvable once the system is finished.


Re-sign Certificate Using Different Hashing Algorithm Consider a certificate used by a Certification Authority. This is currently hashed using SHA-1. I'd like to keep the same public/private key for this, but hash it using SHA-256. By hash it I mean hash the tbsCertificate section - as described in RFC5280 - using SHA-256, followed by signing the digest with the private key of the original CA that actually issued the certificate.

This comes in the context of this article, where it's stated that

  If you want to convert a CA certificate on an ADCS version prior to Windows Server 2012, you must export the CA cert off of the CA, import onto ADCS 2012 or later using certutil.exe with the -KSP option, then export the newly signed certificate as a PFX file, and re-import on the original server.

Besides the typing error (there's no -KSP, only a -CSP switch).

However, if you use a different CA to sign a certificate this results in the use of a different private key, providing that the Authority Key Identifier stays the same, and the public key of the referenced CA won't verify this new signature. Does this generate a certificate that would fail validation?

When you install ADCS, you get the option of generating a new key pair, or reusing an existing key pair. The sentence you quote seems to indicate the latter:

You export the certificate and private key from an existing CA, as a PFX file.
You import the PFX into a Windows Server 2012 machine.
You install ADCS on that machine, directing it to reuse the private key you just imported. ADCS then proceeds to generate and sign its certificate, using the private key you indicated.
You re-export the certificate and key from that new ADCS, again as a PFX file, and import that back into the original machine.

The first PFX file contains a certificate and a private key because that's what PFX files are for, but the certificate is completely ignored here; only the private key matters. It just happens that Microsoft tools are unable to process a private key travelling "alone"; they always access keys through certificates, so there must be a certificate.

During the import in the 2012 machine, you need to add a -csp "Microsoft Software Key Storage Provider" option so that the private key is handled in the new crypto system (CNG) because the old one (CryptoAPI) does not know SHA-256.

Of course that's a bit weird to go through an additional Windows 2012 machine, since Windows 2008 or Windows 7 perfectly know how to do crypto with SHA-256. In any case, with a bit of programming, it is not ultimately hard to decode tbsCertificate from the existing certificate, rehash it with SHA-256, compute the signature, and wrap the whole set into a new certificate. Of course you'd have to understand how the whole ASN.1/DER encoding works, but if you want to manage a CA properly you almost need to know that anyway, so you'd better get it done now.

By suggesting an extra system, one may even suspect that Microsoft is making money out of selling Windows licenses !


Fraud Email from Family Member I got an email from what I thought is my family member, when I viewed the email it said it was from "heiner@heiner-starp.de" (no idea who this is). However the label that this email is under is my mother's name.

Does this mean my email account may have been hacked? Or my mother's email?

An attacker can easily spoof the name appearing in the from field. This could have either been guessed, found from other information about yourself online (e.g. Social Media profile where your family is listed), or indeed someone has gotten into your Mother's email account and exported the contacts.

I would personally not think it was the latter however, as you'd think an attacker would just use the compromised Mother's email account to send the email rather than using a completely different one.

Probably best to get your Mother to change her email password anyway just in case, and set up a rule that sends all messages from the heiner email address straight to your trash.


How to gain a shell? I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.

My question is this: I can create application that is guaranteed to be run by the other user.  How can I use this to get shell access under their privileges/account?

It's less useful for me to just be able to run commands as them and more useful for me to actually be able to drop into a shell as them, because there's an application that verifies if I've succeeded in compromising the account properly, so I'd like to run that interactively.

The first thing that occurred to me was to spawn a netcat daemon and run my commands through that, but the -e option doesn't seem to exist on this compromised VM.

Thoughts/ideas?  I've been racking my brains here for a while - and I know this is simple!

EDIT: I'm not looking for an answer/spoiler to the exercise I'm stuck on, but I feel there's a gap in the fundamental understanding I have of system security.  I figure if I can't figure out how to exploit this hole, I'm missing some piece of information.  I want that fundamental piece of information, not an answer to the actual problem I'm facing.

If you can create a process that will run as the victim user, you already have shell access under their privileges.  Anything the victim can do, your program can do.  So you've already won, you just haven't realized it yet!

(One simple example: Why do you need a shell?  If there's something you want to do with the victim's privilegs, why don't you hard-code into your program what actions you want to do?)

If you really want to set up an interactive shell, that's doable too.  I could tell you several ways to do it, but you said you don't want spoilers, so let me just try to give you some hints without answering it flat-out.

You mentioned that running netcat would be one way to achieve your goals, however the version of netcat installed on their system is out of date.  If Alice wanted to install a program for her own use, could she?  If you have access to Alice's account and can do anything Alice can do, does that give you any ideas?
How is netcat implemented, internally?  How does it work?  Could you do something like that yourself?
Let's say you've compromised Alice's account.  What are some ways that Alice could log into her account?  Sure, she could log in with her login password, but what else?
Is there anything Alice could do to give one of her friends the ability to log into her account, if she wanted?  What are some ways she could do that?  If you have the ability to do anything Alice can do, does that give you any ideas for something you could do to get access to her account?
If you run ls -a from some user's home directory, what do you see?  What do those crazy files do?  Does that give you any ideas?

Hopefully that's enough to get you thinking!


Client-Side Hashing to decrease value of password guessing heuristics Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here.

I'd like to do something to mitigate the affect on the community as a whole when my password hash database is stolen. (See: LinkedIn, Match.com, Yahoo, etc...)

In those cases, statistical analysis of the leaked passwords have been used to improve the heuristics for targeting cracking of a user's password. I'd like to help stop that from happening.

Here is the idea: Take the user's cleartext password, slow-hash it client-side as many rounds as can be stomached. Then, use the hash as the password passed to the server. Treat the password-client-hash just like a normal password and slow-hash again on the server side.

This should make my password database immune to heuristic attacks. (Well, not actually immune, just extra expensive to use the heuristics.)

My concern, though, is that the reduced entropy in the client-side hashing output might eliminate the gains I found in eliminating the value of heuristics.

How can this trade-off be quantified? Any thoughts on the approach?

Edit

To be clear, I'm trying to make heuristic attacks less valuable. i.e I want to make 'Password1' as good a password as 'tqwe657fdh'. Meaning, an attacker will have to search the same space to crack either one.

Another Edit

The discussion has helped me clarify my thoughts:

With the recent leaks of so many large password databases, and the resulting analysis of common passwords and patterns, I believe that heuristics used in password cracking systems must have been improved.

Recent advances with GPU assisted hash execution (http://openwall.info/wiki/john/GPU) are further shifting the CPU imbalance benefit back towards the attacker. (Anyway, it was already pretty imbalanced. Its a tall order to handle slow-hashing passwords on centralized server hardware once a system approaches internet-scale.)

I want to do two things:

Eliminate the benefit my attacker receives from the heuristics, thus forcing a true brute-force attack.

Decrease the benefit my password database will have to the cracker community once it is stolen from me.

I suspect my idea might help, but I need a way to quantify the tradeoffs.

On the basis of standard password theory, this shouldn't work as we have to assume the password generation method is known.

I believe what you're asking is this, correct me if I'm wrong.

Your understanding of the standard method.

User 1 - (sent) password1 -> (stored) e38ad214943daad1d64c102faec29de4afe9da3d

User 2 - (sent) Di#aKHn!@ -> (stored) 9187b4dc0f7c7231334546a86984060233304c5e

Dictionary attack on the stored hashes recovers the passwords sent right?

What you want to do is this.

User 1 - (client side) password1 -> (sent) e38ad214943daad1d64c102faec29de4afe9da3d -> (stored) f8fde4f28c22e1a5a6201b6cce363477940cde50

User 2 - (client side) Di#aKHn!@ -> (sent) 9187b4dc0f7c7231334546a86984060233304c5e -> (stored) a893a40df9fc73ab3a9711a34e943f13271170c1

So the password for user 1 is seemingly as strong as the password from user 2, because they are both sending 40 character alpha numeric strings as passwords, and attacks on the final stored hash won't work* because the hash wasn't generated by a dictionary word, but a long hash.

The reason this won't work is again the process is all part of the program logic rather than entropy on the human side. The password cracking simply becomes SHA1(SHA1($pass)) instead of SHA1($pass) or whatever other control you have in place (salting etc). Given the need for repeatability it can't be hashed a random number of times on the client side, it must always be defined.

If I've misunderstood what you're suggesting just let me know.

Edit: To further expand on what I think you're saying re:comments below.

You want to make it so hashing takes X time, where X is the point where it's impractical to run dictionary attacks. You're saying that given the resources of the server, using a slow hash like bcrypt can only achieve a slowdown of time 'Y', which is not enough to get you over the 'X' threshold. You're idea is to use the client CPU as well 'Z', so now you have Y + Z to the point where you are hopefully achieving this 'X' threshold of rendering dictionary attacks useless.

My response would be I doubt there is enough CPU power between the client and server to make this impractical for someone to try a dictionary attack, while still maintaining a usable service. This is because the difference between GPU calculations and CPU calculations are so large.


x.509 certificate-chain signatures verification Once a client application downloads a leaf certificate file from some entity, issued by a CA, how does the verification of the cert's signatures work?

Specifically, I'm not clear on whether a leaf certificates signature is only crypto validated by that leaf certs public-key (the one that's embedded in the cert), or if in some way the cert of the parent CA is involved in that signature decrypt/verify process.

After the leaf cert is verified, and the app moves up the issuing chain and onto the intermediate CA cert, in the verification of that intermediate CA's signature is the root certs public key involved in some way? or does the app only need the public key of the intermediate CA to verify intermediate's signature?

The wikipedia page Chain of Trust has a good image explaining this:

In words:

A Certificate Authority's act of "issuing" a certificate is to use its private key to sign the new certificate. This is a statement that "I, the CA, promise that the information in this certificate is accurate and valid". If you trust the CA's public key, then you can trust anything that it has signed.
The Root CA signs the Intermediate CA, which signs the end-entity certificates.
This makes a "chain" because if you trust the Root CA's public key, then you can verify the signature on the Intermediate CA. Now you trust the Intermediate CA. Then you can check the signature on the end-entity. Now you trust the end-entity.

Root certificates are a weird exception to the above because they are signed by the same key that is in the certificate (aka "self-signed"). That means there is no pure-software way to verify whether you should trust it or not; you need some human - usually the vendor of your application or OS - to decide which root certificates should be trusted. This list of "trusted roots" is usually shipped inside your application or OS.

In practice, cert validation goes the other direction:

I have an end-entity certificate. Who signed it? Do I already trust them?
Oh, it's signed by a CA. Is this CA in my "trusted roots" list?
If yes, we're done (cert validation success)
If no, then who signed this CA certificate? Do I already trust them?
and so on until either you hit a trusted root (cert validation success), or you hit a self-signed cert that is not in your "trusted roots" list (cert validation fail).


USGCB on a non-networked computer We will be getting some data that needs to be kept in accordance with USGCB regulations. Our intent was to keep it secure by storing and using it on a non-networked computer, but the regulations seem to require a network connection, as they specify keeping the OS and virus scanner up to date. Surely there is a clause somewhere that exempts non-networked computers from these and similar parts of the regulations, but I can't find it.

Also, it requires a smart card reader on the computer, but I have no idea where to buy a couple of cards — the reader isn't hard to find but the vendors of cards seem to have a minimum order of 1,000.

How can a non-networked computer be made compliant with USGCB?

For updating non-connected computers, you can use offline updating tools that download the updates using another computer (which you can then transfer to the non-networked computer via USB drive for installation). For example, you can use the WSUS Offline Updater for Windows. For your AV vendor though, you would have to check with them on how to get offline updates.


How to secure (encrypt, password protect) external hard drive used with Windows 7 and 10? How can I secure (encrypt, password protect) a portable external hard drive (500GB, NTFS) I use on a couple of different computers (not simultaneously): one computer is my work Windows 7 laptop, the other is my home Windows 10 laptop.

Requirements/considerations are:

1) I can't find Bit Locker on my work laptop, but I do have Symantec Encryption Desktop. I don't have Symantec Encryption Desktop on my home computer though.

2) I want to secure the entire drive, not just a portion of it.

3) I use SyncToy to create backups of my external drive, to another external drive. As SyncToy works on the basis of pairing folders, I guess it is not necessary for the backup drive to be encrypted (or is it?) The backup drive is always in a secure location, so I don't really need it to be encrypted (but don't mind if it is).

4) I'm not necessarily after a "free" solution and happy to pay/subscribe for the right product.

Many thanks in advance!

Your best option with windows is BitLocker and it should be working already with windows 7 but in case you do not have it you can easily download it for free from:

https://www.microsoft.com/en-us/download/details.aspx?id=4794

You only need to enable it once and it will work.

From windows 10:

Sign in to Windows with an administrator account.
Go to Start, enter encryption, and select Change device encryption
settings from the list of results.
Select Manage BitLocker, select Turn on BitLocker, and then follow the instructions.

There is also available option when you right click the drive click "Turn On BitLocker"

More details form technet:
https://technet.microsoft.com/en-us/library/ee424323%28v=ws.10%29.aspx

Edit:
Your windows will detect if the hard drive is encrypted with BitLocker and will inform to provide a key. SyncToy will work normally after unlocking the drive.

Edit: based on @WhiteWinterWolf comment
Windows 7 - depend on the edition - may not have BitLocker available already or for install. When the external hard drive used with this kind of windows it will install BitLocker to go reader which all the read of data but no adding or editing. In this case the best option if you choose bitlocker is to you windows upgrade anytime feature of windows 7 to get the version that support (paid option).


Is it possible to get data from database server if you are on the application server? For example, You are attacking an application that employs two different servers: an application server and a database server. You have discovered a vulnerability that allows you to execute arbitrary operating system commands on the application server. How can you exploit this vulnerability to retrieve sensitive application data held within the database?

My opinion is, if I can execute arbitrary OS commands then I will try to find the database credentials from the config file and then I will log in. (Indirectly answer is NO).

In short : Possibly

On the one hand yes, this is a very real risk. With many ordinary application installations and database deployments, this vulnerability will indeed let you access the data.

On the other hand, no, an attacker can be blocked even at this stage. There are a number of techniques to mitigate this risk. For example:

Limited Privilege on OS. The arbitrary commands the attacker is executing on the application server must be executed with a particular user's credentials; if the user account has been configured in accordance with the Principle of Least Privilege, the user account may not have the authority to execute those arbitrary commands. Ideally, the user account will have permission to run the application but do absolutely nothing else.
Note: SELinux is a powerful technique for further limiting access to OS resources.
Limited Access to DB. Even if an attacker discovers the database credentials, they may not be much use. The database may be configured so these credentials are only valid for that application; so they cannot be used to connect to the database via any other tool. Or, the database may be configured so these credentials are only valid from this one client address; so all the attacker's db connections have to be tunneled through the database server, instead of from the attacker's own system.
There are no stored DB credentials. An application may be designed so that the user enters their credentials at login, for example, and these are used to access the DB. In this situation an attacker on the application server could not connect to the DB, no matter how much OS-level control they have.
DB credentials are stored elsewhere. An application may be configured so that it fetches the DB credentials from a separate service at runtime; this separate service may not allow connections except from the application itself.

Further note : these techniques are not exclusive, so combining them may be a powerful way of limiting an attacker's access. However, each one of these techniques require sophisticated non-default configuration, and a naive deployment is likely to miss out every single one.


Determining the accuracy of a biometric system How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?

Well, I am not sure if this what you are looking for. In general, the performance of any biometric system (e.g fingerprint, voice, facial recognition, etc) is described using several metrics.

FAR or False Acceptance rate is the probability that the system incorrectly authorizes a non-authorized person, due to incorrectly matching the biometric input with a template. The FAR is normally expressed as a percentage, following the FAR definition this is the percentage of invalid inputs which are incorrectly accepted.

FRR or False Rejection Rate is the probability that the system incorrectly rejects access to an authorized person, due to failing to match the biometric input with a template. The FRR is normally expressed as a percentage, following the FRR definition this is the percentage of valid inputs which are incorrectly rejected.

CER or Crossover Error Rate is the rate where both accept and reject error rates are equal.

FER The Failure to Enroll Rate (FER) is the percentage of the population which fails to complete enrollment.

EXAMPLE:

let us assume we have a fingerprint biometric system. We also, have 100 users. During the enrollment stage 5 users where not able to enroll (e.g we can not establish a fingerprint signature/template for them). This means the system has a Failure to Enroll Rate (FER) = 5%. This means only 95 users can use the system.

Then, during the testing out of the 95 users, 10 users were rejected when the system match their fingerprint against their enrollment fingerprint template. This means the FRR =10.52%.

Also, 3 users out of the 95 users were accepted by the system when the system match their fingerprint against other users fingerprint template. This means the FAR = 3.15%

The lower FAR and FRR , the better the system


How to get better IAM understanding I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong.

I began with Wikipedia and followed discussions here and there (twitter, slack channels, etc.).

My main problems are :

Terminology : sometimes, explanations need explanation about the words used
Different schools of thought : often, there are different ways of interpreting the problems and then even more ways of addressing them. I don't understand what methods are best for what situtation, and I want to know why this or that is not as good as another. I see divergent opinions and rarely people set for a best solution or method.
Technologies : I've read somewhere that a good access control works in synergy with the filesystem, that should be suited for that purpose. Is that true ? What are these systems ?
References : I fantasise to find a one, "best" reference that would clear all that up, while being objective and addressing things I have forgotten or didn't know.

For example, I started to think that ABAC would give the best fine-grained control and that XACML, SAML and OAUTH2 used together to form a perfect (yet maybe heavy and complex) system. But then I saw people ranting about it ("yet another OASIS definition") and opposing it to NGAC (Next Generation Access Control).

So now my questions:

How should I operate to gain the right expertise on that subject? In other words: where to start, what to look up next, what to ultimately achieve doing?
Am I asking the right questions?

Your question is a pretty good one and as an IAM practitioner I can only apologize for the confusion. IAM is indeed a large field. I think it may be worthwhile taking a step back and going through the basic elements.

Intro

IAM or Identity & Access Management is a field of IT Security (just like network security, crypto, etc...). It can be broken down into four key areas as displayed in the picture below:

There are several subfields within IAM. Here is a non-exhaustive list

authentication techniques

traditional authentication methods
strong authentication (e.g. one-time password, two-factor auth, ...). Vendors in that space include Yubico.

Identity Federation.

Vendors in that space include CA SSO, Ping Identity...

Identity as as Service (IdaaS)

Vendors in that space include Okta.

User management and directories

user directories e.g. LDAP
virtual directories. Vendors in that space include Radiant Logic.

privileged account management (PAM)

Vendors in that space include CyberArk

identity and access governance (IAG)

Vendors in that space include Savyint and Sailpoint

externalized (dynamic) authorization management (EAM or DAM)

Other areas with relations to IAM

There are side fields that do not belong to IAM per se but definitely help a lot such as SIEM (security information event management). And there are fields that use / leverage IAM such as API security. As a matter of fact, some of the standards you mention (OAuth 2.0, OpenID Connect) are standards that focus on API authentication.

Large vendor suites

You'll find that the larger vendors (Oracle, Microsoft, IBM) all have identity management suites that include some or all of the subfields aforementioned.

Externalized (or Dynamic) Authorization Management

The area I focus on is EAM. In the training courses I give, I typically start with this slide which I hope will help you too:

The de facto model for dynamic authorization management is called Attribute-Based Access Control (ABAC). It's a model that has been around for a long time. It was formalized in 2013 by NIST (National Institute of Standards and Technology).

The de facto standard that implements ABAC is XACML, the eXtensible Access Control Markup Language. It started in 2001 and its current version was released in 2013.

You mention NGAC: that's just an R&D initiative rather than a standard.

Literature in the space

I would refer to Kuppingercole and Gartner as the two main analyst firms that have extensive literature on IAM. They will have good definitions and videos.

Your questions

My main problems are :

  Terminology : sometimes, explanations need explanation about the words used

Read through my post, check out Wikipedia, and read the reports by Gartner and the likes.

  Different schools of thought : often, there are different ways of interpreting the problems and then even more ways of addressing them. I don't understand what methods are best for what situation, and I want to know why this or that is not as good as another. I see divergent opinions and rarely people set for a best solution or method.

No, in IAM, there aren't different schools of thought. The field is relatively uniform. There are competing vendors and open source solutions but the principles are well set in stone.

  Technologies : I've read somewhere that a good access control works in synergy with the filesystem, that should be suited for that purpose. Is that true ? What are these systems ?

This statement is a little odd because IAM is not specific to any one given layer. You should be able to use IAM in any of your layers (apps, databases, filesystems...). Also, the different disciplines in IAM aim to build on interoperable standards so that you can integrate your authentication with your user management with your authorization solution.

  References : I fantasise to find a one, "best" reference that would clear all that up, while being objective and addressing things I have forgotten or didn't know.

That's what analyst firms are for. Also consider IDPro, an organization I am a founding member of. We strive to create a space for all IT professionals to take part in, share their knowledge of IAM, or learn more about the space.

  For example, I started to think that ABAC would give the best fine-grained control and that XACML, SAML and OAUTH2 used together to form a perfect (yet maybe heavy and complex) system. But then I saw people ranting about it ("yet another OASIS definition") and opposing it to NGAC (Next Generation Access Control).

I am sorry you had to read through this. Let me shed some light.

ABAC is an authorization model as previously stated. It is formalized by NIST and comes to extend what RBAC has done well since 1992. You can see a quick intro video on RBAC, ABAC, and more here.
XACML: eXtensible Access Control Markup Language. An OASIS standard to define a policy language, architecture and a request / response scheme to manage ABAC authorization policies.
SAML: Security Assertion Markup Language. An OASIS standard to address identity federation (amongst other things). It is wildly used for web single-sign-on and federation.
OAuth 2.0: open standard aiming to fix the "password anti-pattern" whereby a user would have to give service 1 (e.g. Facebook) their password to service 2 (e.g. Twitter) so that service 1 could act on behalf of the user on service 2. With OAuth, you can do that without sharing your password. OAuth 2.0 implements authorization delegation.
OpenID Connect: a set of standards on top of OAuth 2.0 to address authentication especially in the API world. OIDC has the potential to replace SAML.

  How should I operate to gain the right expertise on that subject? In other words: where to start, what to look up next, what to ultimately achieve doing?

This is what this site, Wikipedia, the analyst sites (Gartner and Kuppingercole), specialist systems integrators (e.g. Security Architect in the US), standards bodies (e.g. Kantara, OASIS, IDPro) are for.

I hope this helps.


Is it possible to export an expired GPG subkey's public key without signatures? Based on Is it possible to export a GPG subkey's public component? I got familiar with:
gpg --keyid-format long --with-fingerprint --list-key {e-mail}
gpg --export --armor --output public-key.asc 633DBBC0! # for ssb1

and
gpg --export-options export-minimal {key-id}

I also found the following which I added to my gpg.conf.
list-options show-unusable-subkeys

In the context of a Yubikey, I sometimes need to transfer public key components to a new key ring on a new system in order to decrypt an old file. For some reason gpg --card-status is not enough to get the ball rolling. Gpg will keep reporting that no key exist to decrypt the file. After importing the public key component, it works. I read somewhere on Stack that "the yubikey has not enough data on it to recontruct the public key component." (Might add source later).
However, I don't want to export all old subkeys (hence keyid!), only a select few and I don't want to export any signatures (hence export-minimal).
So this is what I tried, but did not result in a desired result:
gpg --armor --export --export-options export-minimal {subkeyid1}! {subkeyid2!}
or
gpg --armor --export --export-options export-minimal {subkeyid1}!
gpg --armor --export --export-options export-minimal {subkeyid2}!

If I pick one {subkeyx}!, the output is the same. The combination of export-minimal and pointing to a subkey is not working as far as I can tell. I don't know of any switch I can put in front of keyid, do you?
Then I tried the following and merged them later:
gpg --armor --export --output file1.asc {subkeyid1}!
gpg --armor --export --output file2.asc {subkeyid2}!

But these public key components contain unwanted signatures (and their primary key public part and uid which is acceptable).
I used gpg --armor --export {subkeyid2}! | gpg for reading the output. If I do this with unexpired subkeys, I get an expected result of keys, but if I do this with expired subkeys, the subkey is not listed.
The question: So, how do I export two expired subkeys's public key components without any signatures?

(Sidenote; meta question; alternative route):

One beauty of a yubikey is facilitating the portability of private key material.
I don't want to use a public keyserver for the public key material. If anyone has any ideas what can facilitate the public key portability, I am all ears.

gpg --card-status delivers:
[...]
General key info..: sub {rsaX/eccX}/{keyid} {date} {name} {address}
sec# {rsaX/eccX}/{keyid} {created date} {expires date}
[...]
ssb> {rsaX/eccX}/{subkeyid1} {created date} {expires date}
card-no: {nr}
ssb> {rsaX/eccX}/{subkeyid2} {created date} {expires date}
card-no: {nr}

And as we now from gpg -k and gpg -K. 'sub' means public subkey; 'ssb' means private subkey and the '>' indicator means material is on smartcard. So this all seems to confirm the public material is not on the card.

 Could I put public keys on a backup slot on the Yubikey? How do you get a copy out later?

While not explicitly stated, apparently --export-minimal drops expired subkeys, which make sense.
The option you need is probably self-sigs-only. However, that is a filter only for import. We would need to use an intermediate keyring for that
TEMPORARY_KEYRING=`mktemp -d --tmpdir`
gpg --armor --export keyid | GNUPGHOME="$TEMPORARY_KEYRING" gpg --import --import-options self-sigs-only

# We can check it imported what you wanted with
GNUPGHOME="$TEMPORARY_KEYRING" gpg --list-keys --list-options show-unusable-subkeys

# Then you simply export it
GNUPGHOME="$TEMPORARY_KEYRING" gpg --armor --export

Other options include:

Faking the current time:

faketime 'time-when-subkey-was-valid' gpg --armor --export --export-options export-minimal subkeyid

Manually fetching the required pieces

gpg --export keyid | gpgsplit

# Manually inspect the created files and remove all the .sig not from your own master key
# Generate the new key file with just the bits you want
cat 00* > mykey.gpg


Host Injection Vulnerability Successful HTTP codes? I am trying to exploit Host Injection Vulnerability of a website.

If I change the host or add another host, what all are the HTTP response codes that will tell me about a successful HTML Host Injection Vulnerability?

I read a PoC (https://hackerone.com/reports/94637) of a HOST injection vulnerability where there was a 301 Moved Temporarily response when he changed host using Burp Suite and he was awarded a bounty.

What are all the HTML codes for successful HOST injection?

200 OK
301 Moved Temporarily
and ???

HTTP error codes are anything in 4xx or 5xx category.  4xx means client error, 5xx means server error. https://en.wikipedia.org/wiki/List_of_HTTP_status_codes. As schroeder indicates, any code in 1xx, 2xx, or 3xx category that you receive potentially means success.


Visual fingerprint verification OpenSSH allows to show a visual representation of fingerprints with the VisualHostKey, see announcement at O'Reilly and here.  The output looks approximately like this:

# Host github.com found: line 53 type RSA
2048 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48 |1|LCbDN2wZEUdf/m4pYL7OUiOk2RM=|QZw5k6xHgVjYct4Ja7VUUK0ZObs= (RSA)
+--[ RSA 2048]----+
|        .        |
|       + .       |
|      . B .      |
|     o * +       |
|    X * S        |
|   + O o . .     |
|    .   E . o    |
|       . . o     |
|        . .      |
+-----------------+

I am wondering and could not find any literature on this, how "visually unique" are the resulting patterns?  I.e. how difficult is it to create a near collision not in fingerprint space but in the image space?  In the above example, most users would probably not notice if some o were replaced by . or O by 0.

Are there published results about the cryptographic strength of random art against pre-image attacks (pun intended)?

The visual fingerprint was introduced in OpenSSH version 5.1. The basic idea behind this feature is, firstly, humans are unreliable in comparing meaningless strings and secondly, it is easier to remember visual patterns.

Explanation of OpenSSH algorithm is given by Dirk Loss, Tobias Limmer, and Alexander von Gernler in "The drunken bishop: An analysis of the OpenSSH fingerprint visualization algorithm".

The approach is based on Hash Visualization: a new technique to improve real-world security.

If you are looking for a simpler explanation then this blog could be helpful.


How to get an "A" on Qualys SSL Labs with Apache 2.2? I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers.

On their blog, they suggest a configuration for Apache 2.4 that should get an "A" grade in their ssltest, but the configuration [predictably] doesn't earn an "A" in Apache 2.2.

Does anybody know if it's possible to get an "A" with Apache 2.2 on this test? If so, how?

Apache 2.2.26 added support for ephemeral Elliptic curve Diffie–Hellman (ECDHE). This is likely what is preventing your ability to get an A on on the test. Some Internet Explorer browsers will prefer non-forward secrecy cipher suites when ECDHE is not available. This can also depends on if you prefer the server cipher order and other factors.


Virtual Machine Integrity Hash Check If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI file? This sounds overly simple, am I missing something?

Excluding a hash collision (possible but unlikely/difficult) and someone altering your "secure" copy of the hash, I think you got it. You should, of course, run the hashes when the VM is shut down.