What is the purpose of a Session Border Controller (a.k.a SBC) I'm working on the security part of some telephony projects, and in the architecture, there are some Session Border Controller.
In a security point of view, we don't know how to consider this equipment: are they some kind of telephony firewalls or more like some telephony proxy/reverse proxy?

Do we need to put them behind firewalls, or consider them as firewall and expose them directly to untrusted networks?

I've read some articles and studies on it, some say it's a reverse proxy, others say it's a firewall...

Great question.

The SBC is actually intended to be both a firewall and a reverse proxy.  In modern days however, it's essentially just a reverse proxy and a middleman server to allow different varieties of SIP applications/codecs/devices to all work together.

In the days of old, public IP addresses were assigned to most machines, and the SBC would get a public IP.  It would then essentially act as the firewall for the VoIP phone system in place, using whatever software was built into the OS or the SBC stack to act as a firewall and do basic packet inspection.

However, in modern architectures we usually see a firewall placed on the network perimeter.  This firewall is usually a lot better than the one on the SBC and receives a lot more attention, updates etc; so it'd be a best practice to use your main firewall.  In this case, the SBC should be behind this firewall and ports limited to those necessary to forward through.

The SBC may also carry additional layer-7 packet inspection; such as validating the VoIP traffic and getting rid of packets that might carry known exploits or other tricks such as spoofed caller ID.  Still, the layer 2/3 stateful firewall should be elsewhere and traffic forwarded to the SBC so it can do its layer-7 validation and inspection.

In the modern day and age I wouldn't recommend exposing an SBC to untrusted networks without a firewall in front of it; and if necessary I would do so within a DMZ or other isolated VLAN for the VoIP environment.


Prevent external hard disk drive from infection Will partition of my hard drive help me to protect my essential files?

I want to divide my 1 TB Hard disk drive into 4 partitions and store my files accordingly. For example I am keeping my movies in one partition and software setups in another. If my partition of movies gets infected will my other partitions get infected as well.

Is there any way to protect the partition with software setup?

Note :

I am dividing the same HDD into 4 partitions.
I have to keep using the same drive for backup of my software, my academic
     works and for data transfer as well.

Your external HDD can get infected in at least 3 ways:

Executable files stored on the ext. HDD can get infected, meaning that what they do when executed is changed.
Your ext. HDD can be made to boot a mini OS which then goes on to boot your normal OS. The infection for this can happen at any time though policies of your operating system can prevent unprivileged of doing the according changes. At least on Linux you should be fine as long as you don't give the malware root rights. Actually harming you, however, can only happen this way if your ext. HDD is connected while you boot your computer.
The firmware of your ext. HDD can be changed in such a way that it makes malware stored on it persistent. Then even overwriting your entire HDD doesn't get rid of the malware. This includes of course formatting existing partitions, deleting them, creating a new partition table, etc. Exploiting this requires vulnerability of your ext. HDD's firmware.

None of these ways of attack can be prevented by simply partitioning your ext. HDD into 4 partitions.

However, the first one can be partially prevented by partitioning your ext. HDD into 4 encrypted partitions and only decrypting the ones you're planning to use. If for example you only need access to the backups partition, only decrypt this one. Malware then can't infect your executable files stored on a different partition. If you want to transfer files from or to a computer which might have malware on it, only decrypt the file transfer partition. Make sure to never execute files from there.

Exploiting the second way of attack can as I already said be foiled by simply having your ext. HDD disconnected when you boot. If this is too inconvenient for you, maybe disabling booting from USB is a better option for you as this also renders this way of attack impractical. Make sure, though to not only change your boot order to put HDD first. Disable booting from USB all together in your BIOS settings. Otherwise malware which also uses the 3rd way of attack can trick your computer into booting from the ext. HDD anyways, however, it's very unlikely that this happens. I've never heard of a malware doing this.

The only ways the 3rd way of attack can be prevented is through OS policies or having an ext. HDD which makes in nearly infeasible to change its firmware. However, if you connect your HDD to a different computers, it might have different OS policies. And if that computer has a a malware with systems rights running, OS policies are useless.


Does PCI compliance require a DRP even if we don't store card data? Our company does not store any credit card details. We are storing it in a cloud platform which is already PCI compliant.

We just require to access the cloud portal from our company. I understand we need to be PCI compliant as well.

Are we required to have a DRP (Disaster Recovery Plan) in place for our AD servers/WSUS and Desktops, etc?

We just use our infrastructure to login to cloud solutions. We don't store any card data.

You are required to have a backup plan, you don't need a DRP plan. The only required DRP plan is in regard to an incident. So a DRP related to incident response (e.g. breach).

However if you are doing DRP, then your DRP plan should make sure your DRP site is PCI compliant.


Digital watermarking for detecting Copyright infringement - video file of customer A and B have same SHA Checksums? Sometimes I buy in a online shop video files (mp4). The online shop forces it's customers to buy with verified real name. In case of leaking his content the shop can identity who leaked it. I don't know how he does it technically, I guess some sort of Digital watermarking.

Now I compared the SHA Checksum of a video I bought and one leaked on a forum. The same checksum.

shasum customer_a.mp4 customer_b.mp4
195bb682e5cb4fzod75923321d0e9c82316b6952  customer_a.mp4
195bb682e5cb4fzod75923321d0e9c82316b6952  customer_b.mp4

file customer_a.mp4
customer_a.mp4: ISO Media, Apple iTunes Video (.M4V) Video

mediainfo customer_a.mp4
General
Complete name                            : customer_a.mp4
Format                                   : MPEG-4
Codec ID                                 : M4V  (M4V /mp42/isom)
File size                                : 907 MiB
Duration                                 : 21 min 14 s
Overall bit rate mode                    : Variable
Overall bit rate                         : 4 193 kb/s
Encoded date                             : UTC 2017-07-31 14:29:26
Tagged date                              : UTC 2017-07-31 14:29:26
©TIM                                     : 00:00:00:00
©TSC                                     : 25
©TSZ                                     : 1

Video
ID                                       : 1
Format                                   : AVC
Format/Info                              : Advanced Video Codec
Format profile                           : Main@L3.2
Format settings, CABAC                   : No
Format settings, RefFrames               : 2 frames
Format settings, GOP                     : M=1, N=33
Codec ID                                 : avc1
Codec ID/Info                            : Advanced Video Coding
Duration                                 : 21 min 14 s
Bit rate                                 : 3 995 kb/s
Width                                    : 1 280 pixels
Height                                   : 720 pixels
Display aspect ratio                     : 16:9
Frame rate mode                          : Constant
Frame rate                               : 25.000 FPS
Standard                                 : PAL
Color space                              : YUV
Chroma subsampling                       : 4:2:0
Bit depth                                : 8 bits
Scan type                                : Progressive
Bits/(Pixel*Frame)                       : 0.173
Stream size                              : 865 MiB (95%)
Language                                 : English
Encoded date                             : UTC 2017-07-31 14:49:20
Tagged date                              : UTC 2017-07-31 14:49:20
Color range                              : Limited

Audio
ID                                       : 2
Format                                   : AAC
Format/Info                              : Advanced Audio Codec
Format profile                           : LC
Codec ID                                 : 40
Duration                                 : 21 min 14 s
Source duration                          : 21 min 14 s
Bit rate mode                            : Variable
Bit rate                                 : 192 kb/s
Maximum bit rate                         : 245 kb/s
Channel(s)                               : 2 channels
Channel positions                        : Front: L R
Sampling rate                            : 48.0 kHz
Frame rate                               : 46.875 FPS (1024 SPF)
Compression mode                         : Lossy
Stream size                              : 41.0 MiB (5%)
Source stream size                       : 41.0 MiB (5%)
Language                                 : English
Encoded date                             : UTC 2017-07-31 14:49:20
Tagged date                              : UTC 2017-07-31 14:49:20

Does this mean if I share this video he can't trace me back? Are there other methods I am unaware?

Does this mean if I share this video he can't trace me back?

If the hashes are the same, then you can conclude that the files are identical.1

This implies that the file doesn't contain a watermark tied to your identity. However, there might be a watermark that associates it with the shop where you bought it.

1 Note that shasum defaults to SHA-1 which is broken. Hence, you should start using another algorithm, e.g. shasum -a 256 (or sha256sum, respectively). However, that doesn't mean that it's trivially feasible for the company to generate different videos that produce the same SHA-1 hash. You can safely assume this is not the case here.


Does encapsulation of encryption within a library provide some kind of additional security? Lets say there is an industrial device communicating with a central system. Secure communication is required from an end to end point of view. From time to time keys of the devices must be renewed by receiving encrypted keys based on NIST key-wrap protocol. So the device shall unwrap the keys and store it internally on a safe place. As a producer of an encryption library we encapsulate this functionality within API functions, running on a high-end micro-controller. This library makes use of certain cryptographic primitives implemented in hardware on the MCU and is provided to the partner manufacturer "P" of the device, who implements the main part of the firmware. Naturally, there is a point in my software, where the key is just being unpacked and available in memory - at least temporarily. It was decided, not to use a HSM because of cost issues - of course I know, that the approach is sub-optimal.

The question is quite simple now:

The functions of the library are clearly debug-able by P, at least on assembler level. So what we do internally is not at all invisible to the partner. Even when the API functions do not directly return keys, I would say, that we cannot assume unwrapped keys to be "hidden" against P.

Is there any difference in terms of "security" between passing keys directly to the user of the library and hiding them within our routines as described? In fact, this type of "hiding" is more than weak and so I would guess, that it is worth exactly nothing and in fact not existent.

However, my management has other opinion and wants to convince me, that the key material is somehow "secure", as long as the key material is not exposed directly as an output of the library. However, they say, for I would return a key as output of a function, this "security" would be broken. For me, this point of view is more than ridiculous...but I want to hear, what other people say. Maybe I'm wrong.

For those, tempted want to downgrade my question:

Regarding the architecture, it was not at all my decision, to implement it in that way...beside the possibility of a side channel attack the key material is secure within the device. Our management just wants to hide any key material from the manufacturer of the firmware, just to be sure to prevent them from doing any "bad" things. I think, that this goal is not in the least fulfilled by this approach.

There's a saying in security: If an adversary has physical access to your hardware, it's not your hardware anymore. HSMs try to circumvent that rule, but even they aren't perfect; nothing is. HSMs will only delay the attacker for longer and up the stakes, making them want to default to an easier target. Because of that, no, it's not secure against the firmware creator.

There is one important security consideration I think you're missing, though. You're writing a crypto library. That means someone will be using that crypto library. And that person probably isn't a cybersecurity engineer. They might not even be a good programmer. By not passing back the key, you're effectively protecting them from themselves. That will help security.


Confusion about trusting certificate chains Assume you have a client/server pair which wants to set up a secure connection using X509 v3 certificates and asymmetric cryptography.

The client sends a chain of certificates (let's say Root CA: C1, intermediate CA: C2 and client certificate: C3) and the server has to validate the chain (and then, of course, vice versa).

Up to this morning my understanding was that the server needs to know (at least) C1 and have it in a trust store, the idea being that the root CA is the entity all participating parties are willing to trust.

After encountering examples where this is handled differently I'm now confused and have some doubts.

In one example I found the server only had C3 (or only C2) in it's trust store and was happily accepting the connection request containing the rest of the chain (actually the whole chain) from the client.

So I'd like to know whether this an approach which

can be considered secure?
is in accord with relevant standards?

(Of course I do understand that it is, to some extend, up to the server admin to decide which parties are trustworthy. The question aims at a developer who is supposed to implement the validation).

From the RFC 5280:

  A user of a security service requiring knowledge of a public key generally needs to obtain and validate a certificate containing the required public key.  If the public key user does not already hold an assured copy of the public key of the CA that signed the certificate, the CA's name, and related information (such as the validity period or name constraints), then it might need an additional certificate to obtain that public key. In general, a chain of multiple certificates may be needed...

The server (from your question) validates the copy of "a certificate containing the required public key" first by checking its trust store. If C3 is in the trust store, there's no need to check anything else. If not it proceeds further.

Notice the potential form in the RFC: "it might need", "may be needed". It is not required to check the whole path if it already trusts a certificate.

Also take a look at this answer describing the difference between X.509 and TLS.


If I have a valid certificate for xxxxx.target.com, can't I read *.target.com's cookies? Follow up: If I have a valid certificate for xxxxx.github.com, can't I read *.github.com's cookies?

I was asked to ask this as a separate question. This isn't a duplicate question.

Okay, so I asked the above question coz I'm concerned of the following situation:

A domain sets auth cookies to *.target.com as multiple subdomains running different services need auth cookies. Also one such service is xxxx.target.com. Here, I am able to upload files under my sub-subdomain that is I can upload files as myname.xxxx.target.com/myownfilename.extn. Is this vulnerable?

For eg., Lets Encrypt asks to upload a file in /.well-known/acme-challenge/. For my case this isn't possible but I can upload a file like /somefile.extn.

My question is, is /.well-known/acme-challenge/ this path a standard for http file upload verification? Is the target.com vulnerable if I can upload file to /myfile.extn?

Is there any other ways to get the domain verification done in this case to get valid TLS cert?

In short, if a server, say target.com have auth cookies set to *.target.com and also allow users to upload files under target's subdomain but not exactly to /.well-known/acme-challenge/, is this situation vulnerable? Or, should the server be considered safe? I'm more concerned that other CA may have different http file upload verification methods that could put such servers at risk.

Here, I am able to upload files under my sub-subdomain that is I can upload files as myname.xxxx.target.com/myownfilename.extn. Is this vulnerable?

As long as an upload to your sub-subdomain does not get mapped to a URL in the main domain which can be used for domain validation I don't see any problem here. And if this is the case depends on the specific server setup which is unknown.

  ... is /.well-known/acme-challenge/ this path a standard for http file upload verification

This is the standard path defined in the ACME protocol which is used by Let's Encrypt and some others.

  ... Is there any other ways to get the domain verification done in this case to get valid TLS cert?

The scenario you describe is not that uncommon. It would be very bad if this could be used to get a valid TLS certificate. Given how common it is I don't think that you can get a valid certificate this way.

  In short, if a server, say target.com have auth cookies set to *.target.com and also allow users to upload files under target's subdomain but not exactly to /.well-known/acme-challenge/, is this situation vulnerable?

The scope of the auth cookies has nothing inherently to do where a file uploaded to some subdomain will occur in the main domain (if at all). Based on only these information there is no vulnerability.


In VMs, do shared folders reduce security effectiveness? VirtualBox offers the option of using shared folders, others probably offer the same thing. I am not sure whether the host is directly accessing the memory of the guest, or if there some process which basically syncs one folder on the host with another on the guest.

But regardless, when the host and guest's processes are kept so separate from each other, I can't help thinking that there is a danger to security through this process (such as malware which might be able to break out of the guests address space by finding its way to the shared folder).

Is this possible?

A virtual machine does not access directly the memory of the host in case of shared folders. In reality, the virtual machine uses a special file system driver in the Guest Addition to talk to the host. A shared folder is implemented like pseudo-network redirector.

The only way to be sure a virtual machine won't infect its host is to develop an architecture that isolates the virtual machine from its hosts as if it separates them physically. As long as this has not been possible (AFAIK)  it is not strange to read many cases on the Internet of hypervisors being escaped by malware (IBM X-Force ®  2010 Mid-Year Trend and Risk Report).

When sharing folders between the host and guest, you still have the option (at least with VirtualBox and VMWare Player that I use) to force the guest to access the shared folders in read only mode (you can copy data from the shared folder to your virtual machine but not in the opposite direction).

As for your question's title, no, shared folders do not add any security layer regarding the possibility of infection of your host. In opposite, it may be an additional attack vector especially in the case you create a shared folder with the default read AND write option.


Limit rights for user applications I have a website, where users are available to upload small applications which runs 24/7 on my server.

So if the user upload an application, some folders will be created:

/{USER_ID}/{APP_ID}/

(if the user folder already exists, the /{USER_ID}/ folder will not be created again)

Inside this directory, the application files will be stored.
For each application the user create, a bash file will be created inside the /{APP_ID}/ folder which contains the start command for the application.

For example if the user upload a .NET Core application, a bash file will be created which contains nohup dotnet app.dll ....

My question is, how I can secure my server the best way to limit the user's applications rights.

If the user created the application he can click a start button on the website which will run the start.sh bash file.

What is, if the application the user uploaded change the content of the bash file which can damage the server?

I want to prevent that by making the bash file non-editable/movable/deletable etc.

But I guess u can just do more bad stuff to damage the server.

So how I can prevent the user to only have rights to do stuff inside its folder own folder (/{USER_ID}/) [only userid because i dont care if the user damage his own applications].

My idea is that if the directory (/{USER_ID}/) will be created first, php will create a user on my server with only rights inside the /{USER_ID}/ folder.

Will this be secure enough ?

My os is Ubuntu 16.04.

Just isolating filesystem access is not enough by itself to protect the rest of the system, and it's also notoriously hard to do right (chroot can be pretty easily escaped, SELinux is a pain in the arse to set up, etc).  Among other potential means of attack you have:

IPC objects (semaphores, POSIX message queues, signals, etc).  There's no easy way to limit which process can manipulate which IPC objects, but globally blocking them will actually break many legitimate programs.
Network access.  This is easy to block, but obviously is not covered by just restricting filesystem access.
Certain types of resource limitations are actually pretty easy to side-step as a regular user (CPU affinity for example).
Without some effort on your part, your new users will have pretty easy access to certain types of hardware on the system.
Even aside from the above, there are a lot of system calls that should never be called by regular user code but can be (vm86 and iopl are probably two of the best examples).

Ideally, assuming you don't want to deal with complicated manual setup, look into a tool like firejail.  While it's not designed for this exact use case, it should be pretty trivial to adapt to it, and it's dead simple to configure compared to most sandbox software.  With a sane configuration, firejail can:

Securely restrict filesystem access in a way that's easy to configure.
Similarly protect IPC objects.
Restrict usage of capabilities.
Limit network access, possibly using a completely different network configuration from the host system.
Force specific CPU affinity.
Spoof a variety of common identifying information for the system (hostname, machine ID, data reported by uname, etc).
Disallow execution of memory that is or was writable (only on some architectures).
Disable access to a wide variety of hardware that may otherwise be accessible.
Explicitly prevent execution of code in certain directories.
Make certain directories ephemeral (they will lose state when the sandbox closes, great to ensure that temporary files get cleaned up).
Set and enforce various resource usage limits for the processes inside the sandbox.
Explicitly block specific system calls (the default profile with this enabled will block most of the ones that aren't needed by most applications and are a potential security risk).


What is the difference between Federated Login and Single Sign On? What is the difference between Federated Login and Single Sign On authentication methods?

Single Sign-on (SSO) allows users to access multiple services with a single login.

The term is actually a little ambiguous. Sometimes it's used to mean that (1) the user only has to provide credentials a single time per session, and then gains access to multiple services without having to sign in again during that session. But sometimes it's used to mean (2) merely that the same credentials are used for multiple services; the user might have to login multiple times, but it's always the same credentials. So beware, all SSO's are not the same in that regard. Many people (me included) only consider the first case to be "true" SSO.

Federated Identity (FID) refers to where the user stores their credentials. Alternatively, FID can be viewed as a way to connect Identity Management systems together. In FID, a user's credentials are always stored with the "home" organization (the "identity provider"). When the user logs into a service, instead of providing credentials to the service provider, the service provider trusts the identity provider to validate the credentials. So the user never provides credentials directly to anybody but the identity provider.

FID and SSO are different, but are very often used together. Most FID systems provide some kind of SSO. And many SSO systems are implemented under-the-hood as FID. But they don't have to be done that way; FID and SSO can be completely separate too.


Can someone please help me understand how the protocol EAP-TTLS really works? Okay so it's Tunneled TLS

All I got was this:

  EAP-TTLS Authentication Protocol. EAP-TTLS (Tunneled Transport Layer
  Security) is designed to provide authentication that is as strong as
  EAP-TLS, but it does not require that each user be issued a
  certificate. Instead, only the authentication servers are issued
  certificates. The authentication server's certificate is used to
  establish a tunnel between the user and the server. After the tunnel
  is established, credentials can be exchanged safely between the server
  and the user because tunnels encrypt all data in a secure fashion.
  This stage is called inner authentication.

What I don't understand why if it's Tunneled does that mean that clients don't need certificates anymore? Isn't the certificate needed for the client to prove who he is?

In EAP-TTLS, the tunnel is established with no authentication. Once the tunnel is established and secure communication possible, any means of authentication, such as AD credentials, can be used.

The certificate is used to establish a secure connection over a public channel, where the certificate is used to confirm the server's identity.

Once this channel has been established, the client knows it has connected to an authentication server, but the server has no idea who it is talking to.

Therefore, a second round of authentication, called the "inner authentication" is used to establish the identity of the client. The inner authentication can be done with AD, RADIUS, or any other authentication method.


Can we know what hacker has come up to so far in his attempt? I have discovered 'accidentally' while searching in my command history, that some one has issued these :

passwd
w
cat /proc/cpuinfo
free -m
uptime
w
perl v.py
python v.py
chmod +x *
./a 94.10

and these :

./a 52.30
rm -rf scan.log sparte.txt
./a 208.43 22
./a 208.43
rm -rf md
chmod +x *
rm -rf scan.log sparte.txt
./a 31.79 22
rm -rf scan.log
./a 163.172 22
rm -rf scan.log
./a 212.1
./a 212.1 22
rm -rf scan.log
rm -rf scan.log sparte.txt
./a 212.219 22
w
chmod +x *
rm -rf scan.log sparte.txt
./a 185.61 22
w
chmod +x *
cat sparte.txt
rm -rf scan.log sparte.txt
./a 81.102 22
./a 212.1 22
cat /proc/cpuinfo
free -m
rm -rf scan.log sparte.txt
chmod +x *
./a 31.220 22
rm -rf scan.log sparte.txt
./a 78.47 22
rm -rf scan.log sparte.txt

The apparently a noob intruder(hacker) who didn't clear the logs has taken advantage of a weak password to ssh into my server as he has tried with root :

Apr  1 06:35:39 ns346721 sshd[6641]: Failed password for root from 42.7.26.49 port 19029 ssh2

But succeed here

Apr  3 21:36:54 ns346721 sshd[26814]: Accepted password for [USERNAME] from 176.223.29.2 port 52054 ssh2

In the targeted user's home folder, the intruder has uploaded/generated some files :

/home/[USERNAME]/f
├── /home/[USERNAME]/f/a
├── /home/[USERNAME]/f/brute
├── /home/[USERNAME]/f/hu
├── /home/[USERNAME]/f/mass
├── /home/[USERNAME]/f/passfile
├── /home/[USERNAME]/f/scan.log
└── /home/[USERNAME]/f/vuln

that I guess some of them was the output of a python file in /home/[USERNAME]/v.py which after my search has the content of this https://github.com/funtimes-ninja/malware/blob/master/1a5c4fdec1e867bb27c633751e6f1184a6597bef82dc94512fbb3dbe398ed177

and the 'a' file :

#!/bin/bash
./brute 800 -b $1 passfile $2 "uname -a"

Unfortunately nothing readable can be displayed on the file 'brute' as it has a binary content.

When discovered the issue, one process with [USERNAME] was still running; so I just finished it.

What I have done :

Changed the password for the targeted user [USERNAME]
Disabled ssh for all users except root (I know it shouldn't be either).
Killed all processes under the user [USERNAME]

Now my main concern is to know what this intruder has made so far on the server.

Is there a well established procedure to check and clean malicious files and processes ?
 -

At a high level, what you are looking for is called an Incident Response Plan. Ideally, your organization will have created an Information Security Policy, and this would be one of the recommended items in the policy.

NIST has a good plan you can look at and follow: the Incident Handling and Response Guide.

At the lower level, you are still in the midst of an attack. You can't be sure the attacker didn't create a back door for himself somewhere in your network. Consider engaging a professional security firm to help ensure your response is adequate for your organization.


Is it possible to install a hardware key logger in iPhone? I took my iPhone to a repair shop today to get the broken screen repaired. It was not an Apple shop but typical kiosks you see in shopping malls.

Post the screen install things work fine but I am a bit worried about something: is it possible to somehow put a hardware key logger in the phone?

In theory, it is possible. In practice, it would be very difficult and costly to do so. Also, I do not know of a key logger chip for iPhones that can be bought, but feel free to correct me in comments. Of course, an iPhone does not have a physical keyboard, so one would need to intercept the SPI bus and interpret the data.

Moreover, what would the repair shop gain from having key loggers installed in random phones? This gain would need to be more profitable than the cost of buying and installing a key logger chip.


Is there a good way to store credentials outside of a password manager? A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management after reading recommendations/feedback on them. Is there any other secure and user-friendly solution to store passwords?

Install a password manager. A good password manager is much, much better than anything you can do by yourself.

They are software created by security professionals, follow strict development rules, and are tested by a lot of people, and attacked by a lot of people. They have better chance of protecting your passwords than anything invented by the average, even the above average user.


What is LinkedIn's "email challenges" feature? A LinkedIn blog post about the recent password dump says:

  We take the safety and security of our members' accounts seriously. For several years, we have hashed and salted every password in our database, and we have offered protection tools such as email challenges and dual factor authentication. We encourage our members to visit our safety center to learn about enabling two-step verification, and to use strong passwords in order to keep their accounts as safe as possible.

What is the "email challenges" security tool that they mention? I couldn't find anything relevant by searching their website.

It's basically a variation on two factor authentication that checks whether the user has access to their registered email address by emailing them a link containing a token. It is under the assumption that an attacker that has gained access to a LinkedIn account might not have gained access to the user's email inbox.

See here. Extract below.

  LinkedIn prompts users to take additional steps when it determines
  that the logon attempt is unusual.  ... the service presents a
  security challenge when the user attempts to sign-in “from an
  unfamiliar location or device” or when the service detects “suspicious
  web activity.” In this case, the user might be emailed a verification
  link  ... The security challenge could come up when the user accesses
  LinkedIn from a new country. In this case, the person would see:

  “This sign-in attempt seems unusual for you. As a security precaution,
  please check your email to verify this sign-in attempt.”


How can a certificate be valid in the Hybrid Model but not in the Chain Model? All dates in European format!

I am learning about validity models, but the solution for this assignment confuses me.

Translation:

  The relevant data for the applicable certificates are shown below.
  Assume that all signatures are valid, that means: they were issued by
  the "Issuer" written in the certificate.

Translation:

  You want to verify the signatures of Alice and Bob [note: I did not
  copy the table for Bob] on 1.2.2010. Fill out the table with "gültig"
  or "ungültig" for valid and invalid results, respectively.

I don't understand how a certificate can be valid (gültig) in the Hybrid Model, but not in the Chain Model (Kettenmodell) [see first line of the solution table].

Alice is the end-entity, and the validity of her certificate should be independant of Bob. But according to the first line of the solution table, the signature is invalid on 1.2.2010 even if it was created on 1.5.2009, when Alice's certificate was still valid.

There is the time of signature, and there is the time of verification. Let's first simplify the situation: we assume that the current date is 2009-07-08. For that value of "right now", the RootCA and SubCA certificates are still valid, but Alice's certificate is not. You see a signature which is purported to have been produced by Alice on 2009-05-01.

If you try to validate Alice's certificate, you will find it to be "expired" and, per X.509, that's the end of the story (section 6.1.3, step a.2). Possibly, there could exist a proof that the signature already existed at a past date, e.g. 2009-05-02; time stamps can be such proofs. At that date, Alice's certificate was still valid, so you could virtually imagine yourself looking at the signature and the certificates on 2009-05-02, and running the validation algorithm at that time. If you were convinced of the signature validity at that time, you would still remember it now. This is the basis of past validation.

But can you really time-travel like that ? There's the trouble with revocation. In a generic way, how would you know if Alice's private key was stolen ? Imagine that, on 2009-04-15, an evil individual (let's call him Albert) purloined Alice's key. Surely, a signature computed with that key on 2009-05-01 cannot be undoubtedly attributed to Alice, since Albert could have computed the same. In X.509, information about stolen keys ("compromised keys" in X.509 parlance) is distributed through revocation. The CRL published by SubCA would include Alice's certificate with a "revocation date" of 2009-04-15 (the theft might have been discovered only a few days later, but the CRL format includes a field which state the cut-off date). Now is the tricky point: a CRL produced at date T includes information about certificates which are still valid (as per "validity dates") at date T. On 2009-07-08, the CRL currently published by SubCA does not include Alice's certificate because Alice's certificate is expired, and you cannot know if it was revoked at some point or not.

Therefore, for past validation, you need more than a time stamp on the signature; you also need a time stamp on some revocation objects (CRL, OCSP responses...) which were issued while Alice's certificate was not expired yet.

In the discussion above, you see the two essential tools:

Time stamps allow for some forms of time travel, in which you envisioned yourself at a past date, operating over some values (signatures, certificates,...) which are proven to exist since that date.
Revocation is the way you are made aware of key compromises.

If we now consider ourselves to be on 2010-02-01, we have two extra layers of complexity:

SubCA's certificate has also expired. So you need to mind the possibility of a theft of SubCA's key as well. This is the same problem, one level up: SubCA's certificate is considered as valid because it was signed by the root CA.
RootCA's certificate has also "expired". This is a root CA, so it is not really a "certificate" (by whom is it certified ?), but some a priori trusted information about a name and a public key. If RootCA has an expiry date, then this means that beyond that date, you consider that you would not necessarily be made aware if the root private key was compromised. Strictly speaking, beyond that date, you have no trust whatsoever, therefore you lost.

All the validation "models" are just elaborate ways to dance around these issues, by ignoring some possibilities of key compromise. For instance, one would consider that a theft of the root's private key would be known anyway, even beyond the formal root "expiry", and that the end-of-life date for the root is just an administrative matter. If you begin to ignore some possible security issues, depending on a so-called "model", then it is not surprising that some signatures will be considered valid, or not valid, depending on the model.

Yet, as presented, your problem is very incomplete since it says nothing about time stamps, CRL, and time stamps on CRL.


Who was in the first set of CAs I am currently digging into the history of SSL/TLS. I found that netscape introduced SSL around 1994/1995. They obviously decided to go with a X.509 PKI to mitigate MitM attacks. I, however, could not find any information who was in the first set of CAs?
Can anyone provide me with the list and in an optimal case with a source for the information?

This might not be exactly the same as what was in the first Netscape release with SSL, but you can find one early list by running an emulated Windows 95 system from a 1996 install disk at win95.ajf.me and look at the built-in site certificates (Control Panel - Internet Properties - Security tab):

AT&T Certificate Services
AT&T Directory Services
AT&T Prototype Research CA
internetMCI Mall
Keywitness Canada Inc.
Verisign Class 2 Public Primary CA
Verisign Class 3 Public Primary CA
Verisign Class 4 Public Primary CA
Verisign/RSA Commerical
Verisign/RSA Secure Server

A later source from January 1999 is this thread, where Dan Geer compiled a list of the certificates included with Netscape v4.5 and Explorer v4.0.

Another good resource on early CAs is a project to create a "top-level certification authority (CA) using paper and ink," The Global Trust Register, which has a list of global CAs that the authors could find and verify in 1998. There is a copy available online here.


Server is returning an unrecognized error message? I've received reports of a strange error message (over HTTPS) that is not a part of my web application. The only thing I can think of is that it's coming from a proxy server. Is that possible? Can a proxy server intercept a request that is being sent over HTTPS and return a strange error before the request reaches it's intended destination?

HTTPS intercepting proxies are commonplace in many companies. But also many desktop antivirus products ship with a proxy to intercept and scan HTTPS traffic. And sometimes malware does it too. These proxies can then scan, modify or replace any traffic. This is used for valid purposes to block malware or data leakage (which might result in the strange errors you see) and for invalid purposes for example to inject advertisement into the traffic.

See also Is it common practice for companies to MITM HTTPS traffic?.


Can't explain data from side channel attack attempt I found the comparison function below (slightly modified) from a crypto library I was using. I was curious about the potential vulnerability to side channel attacks. Specifically, the character comparison is only done if the character being compared is within the bounds of the two strings. I suspected this might allow an attacker to determine string length.

Perhaps this difference is simply too small to be subject to a timing attack, but I played with an attempt below. I basically create strings of increasing lengths and compare to a given initial string. I was expecting to perhaps see linear growth in comparison time both before and after the point where the second string becomes longer, but perhaps with a different slope since the operations performed are different.

Instead, I see the data below (note the string being compared is 27 characters in length). Any explanation as to why I have no clue what I'm talking about would be greatly appreciated :)

A small note, I did try with -O0 in case some strange optimization was at fault. The only thing I can think to do from here is start digging into the generated assembly.

#include <string.h>
#include <sys/time.h>
#include <stdio.h>

int CompareStrings(const char* s1, const char* s2) {
    int eq = 1;
    int s1_len = strlen(s1);
    int s2_len = strlen(s2);

    if (s1_len != s2_len) {
        eq = 0;
    }

    const int max_len = (s2_len < s1_len) ? s1_len : s2_len;

    // to prevent timing attacks, should check entire string
    // don't exit after found to be false
    int i;
    for (i = 0; i < max_len; ++i) {
      if (s1_len >= i && s2_len >= i && s1[i] != s2[i]) {
        eq = 1;
      }
    }

    return eq;
}

double time_diff(struct timeval x , struct timeval y) {
    double x_ms , y_ms , diff;

    x_ms = (double)x.tv_sec*1000000 + (double)x.tv_usec;
    y_ms = (double)y.tv_sec*1000000 + (double)y.tv_usec;

    diff = (double)y_ms - (double)x_ms;

    return diff;
}

void test_with_length(char* str1, int n) {
    char str2[n + 1];
    struct timeval tp1;
    struct timeval tp2;
    int i;

    for (i = 0; i < n; i++) {
        str2[i] = 'a';
    }
    str2[n] = '\0';

    gettimeofday(&tp1, NULL);
    for (i = 0; i < 20000000; i++) {
        CompareStrings(str1, str2);
    }
    gettimeofday(&tp2, NULL);
    printf("%d %.01f\n", n, time_diff(tp1, tp2));
}

int main() {
    char *str1 = "XXXXXXXXXXXXXXXXXXXXXXXXXXX";

    int i = 0;
    for (i = 1; i <= 100; i++) {
        test_with_length(str1, i);
    }
}

First, some comments on the code:

Your calls to strlen are a black box - you cannot possibly know how they react to timing attacks.
Your compare loop exits after you exhaust the shortest string, leaking the shorter length.
You did not remove bias generated by the loop in test_with_length.
Array accesses are not O(1) time complexity, especially if each element is smaller than the word width of your CPU.

A better way to compensate for such attacks:

bool CompareStr(char* strA, char* strB)
{
    bool result = true;
    int lenA, lenB = 0;

    while(strA[n] != 0)
        lenA++;
    while(strB[n] != 0)
        lenB++;

    int maxLen = (lenA > lenB) ? lenA : lenB;

    // compensate for array access to some extent
    int diff = (lenA > lenB) ? lenA - lenB : lenB - lenA;
    char dummy = '\0';
    for(int i = 0; i < diff; i++) { dummy = strA[0]; }

    // better way to avoid timing attacks
    for(int i = 0; i < maxLen; i++)
    {
        if ( ((i >= lenA) ? strA[0] : strA[i]) != ((i >= lenB) ? strB[0] : strB[i]) )
            result = false;
    }

    return false;
}

// compute loop overhead
time_pre_loop = getTime();
for(int i = 0; i < LOOP_COUNT; i++) { }
time_post_loop = getTime();
double diff = time_diff(time_post_loop, time_pre_loop);

time_pre_test = getTime();
for(int i = 0; i < LOOP_COUNT; i++)
    CompareStr(strA, strB);
time_post_test = getTime();

double result = time_diff(time_post_test, time_pre_test) - diff;

Anyway, here's where the fun part starts. Consider the following assembly code that could be used to compute whether two strings are equal, with early-out optimisation removed as a basic timing attack defense:

 xor ecx, ecx                         ; clear counter to 0
 mov dword ptr ds:[0040AAAA], 1       ; set result to true
loopStart:
 mov ah, byte ptr ds:[ecx+00401234]   ; read char from string A
 mov bh, byte ptr ds:[ecx+00402468]   ; read char from string B
 cmp ah, bh                           ; compare the chars
 jz match                             ; are they equal?
 mov dword ptr ds:[0040AAAA], 0       ; strings don't match! set result to true
match:
 cmp ah, 0                            ; are we at the end of string A?
 jz done
 cmp bh, 0                            ; are we at the end of string B?
 jz done
 inc ecx                              ; increment counter and continue loop
 jmp loopStart
done:
 ret

There are actually a few timing attacks here. The first two instructions are O(1). However, the two single-byte reads that follow are not.

Whilst memory reads are usually O(1), in practice they will not be. In fact, they don't fit into the big-O model at all. On a 32-bit system, every 4th byte read will be faster than the others. On a 64-bit system, every 4th byte will be faster, and every 8th byte will be faster still. This is due to non-aligned memory reads. The CPU is great at fetching blocks of data that are aligned to its bus size, but not so great at fetching random individual bytes. The CPU will attempt to optimise this by pipelining instructions and loading the block into its L2 cache, which makes this issue more subtle, but it's still there.

The next trick is for strings that are larger than the CPU's cache. If you have a string that exceeds this size (usually 128KB or higher for the L2 cache) you'll see slight delays in memory fetches every time a read exceeds that boundary. This is usually only a small delay, since the L3 cache will be used to store the next block, but we can see an even bigger difference for larger strings (8MB+) as the memory fetches have to be done from system memory.

If we consider a block memory copy as O(n), where n is the memory length, this makes some sense, but does not properly depict the small variances in timing caused by implementation idiosyncrasies.

Finally, we can see that the mov dword ptr ds:[0040AAAA], 0 instruction is executed whenever one string does not match another. This leaks information in two ways:

Allows us to estimate the relative length of the shorter string by identifying the extra time used when repeatedly setting the result.
If we can measure accurately, allows us to identify which characters are different.

As we can see, it's quite difficult to prevent these issues. Here's my attempt at a better system, assuming fixed-length strings padded to alignment with null bytes:

int r, d = 0;
int* bufferA = (int*)stringA;
int* bufferB = (int*)stringB;
for(int i = 0; i < BUFFER_SIZE; i += 4)
{
    d = bufferA[i] ^ bufferB[i]; // if equal, d = 0
    r |= d; // if all cases are 0, r will be 0
}
return r; // result is 0 if equal, non-zero if not equal

This is almost perfectly O(n) for the following reasons:

Bitwise xor of aligned ints is O(1)
Bitwise or of aligned ints is O(1)
Memory reads are aligned.
Neither length is leaked, due to BUFFER_LENGTH padding.
No branches, excluding the loop.


Attack Signatures books I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on some programs, and then I must be able to recognise these same attacks.
      Currently I am in the research phase, more specifically how to generate signatures of the attacks. Does anybody have any idea where I could find some good books/documents/articles for signature generation (methods, approaches....)?
      I've already googled and looked in the first 40-50 pages of results and didn't find a lot of great resources. Are there any books dedicated to attack signatures?
      Any help would be greatly appreciated!
Thanks!

Edit: I will give you an example of steps. Let's say my IDS looks at the log file in generated by an application( just as example).
1) In training(learning) phase, My IDS looks in the log file to generate signatures from the attacks
2) In detection phase, my IDS will look at the log files when the application is attacked, and try to match the content from the log file with the database that holds the signatures generated in the previous step.
      My question is : how to generate the signatures What should I look at? For example, for the detection, I use FSA (Finite State Automaton) to express the steps of an attack (eg. ssh->open a file->read the file->upload file contents in the case of a hacker that makes a remote connection that reads a secret file and then uploads its contents)

I would look at Snort signatures, learn how they are written and use them as a template if you need to create your own.  For some examples, this page has collected several signatures it has found most effective against malware found by its Honeypot.

This is a good article about testing Snort with Metasploit.

Since you asked about a book, it has been almost 10 years since this book came out but that page has all the problems and answers from the signature section of the book.

Finally, the snort-sigs mailing list has in-depth discussion about exactly what you are looking for.  I would craft a much more specific question than "where do I look" if you approach that mailing list.

It is common to feed Wireshark captures into Snort manually and I think this is what you would do for this exercise


Is there a meaningful difference between Cyber Defense and Cyber Security? I've been describing some entrepreneurial aspirations to people and one of them in the IT area interrupted when I said I was interested in starting a "Cyber Defense" firm, and he said "Cyber Security" is the proper term.

Is there a difference between using the Cyber Security terminology or the Cyber Defense term?

I mean, can I safely interchange both terms?  I believe not, since the former seems more encompassing, whilst the later seems to be just the passive side of security.

Sometimes the term "cyber defense" is used to refer to the military/government side of cybersecurity.

Example.

  NATO and its Allies rely on strong and resilient cyber defences to fulfil the Alliance’s core tasks of collective defence, crisis management and cooperative security. [...] NATO signed a Technical Arrangement on cyber defence cooperation with the European Union in February 2016.

Source

Clearly, they are not talking about standard, corporate "cybersecurity".

Since cyber defence is mostly dealt with by governments and probably huge contractor companies, your firm wouldn't deal with it, which may be why you were corrected.


Safely Experimenting With Sockets I'm learning about TCP/IP and (Berkeley/UNIX) socket programming. Let's say I have two scenarios:

1) I write two programs in C, a client and a server, and bind them each to a non-well-known port on the same (Linux) host, and experiment with exchanging data using my (novice) C skills.

2) I run the server on the Linux and run the client from a Windows that is on the same LAN (behind NAT). I think this means that the port on the Windows is "active open"? (Note that I don't yet know anything about WinSock or getting around NAT.)

In each of these cases, is it conceivable that some bot could scan for open ports while one or both of the programs are running behind NAT? If so, is there a way for an attacker to see the source of the custom programs I'm running and exploit misused pointers, do buffer overruns, etc.? This is a home network, and there's no reason that anyone would target it specifically.

I already had bots connect to my applications when experimenting with client/server applications (only on well-known ports, though). However, the abuse potential is small. Bots which connect to random hosts usually first try to fingerprint what application is running (which will fail because nobody knows your application exists) and then run known exploits against that application (they won't know any for an application they have never seen).

If you want to be more careful (or just get rid of the noise), you can configure your router to disable port forwarding for your server application. That way it can only be reached from the local LAN.

If you want to be really careful, use virtualization software to run client and server on virtual machines which communicate through a virtual network.

If you want to be totally crazy paranoid careful, disconnect both client and server from the internet and have them communicate on an airgapped wired LAN.

Regarding your question "is there a way for an attacker to see the source of the custom programs I'm running": Did you intentionally write a program which responds with its own code to certain network messages (i.e. a networked quine)? If not, an unintentional bug which causes this to happen is quite unlikely, especially when you consider that C programs usually don't have access to their own code anymore after they are compiled. A buffer overrun vulnerability which dumps parts of the compiled code of the application is conceivable, but the attacker would have to invest quite a lot of work to reverse-engineer it and find more exploits. And I doubt anyone would bother to invest that much work to pwn a test program by a learner who might never even run it again.


File directory deletion So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the OS can't find them. I might be coming up with the wrong name.... But about my specific question: how did he do this and how can I protect myself from it? I'm guessing he SSH'ed into the guy's system and just did it from the command line. I'm looking for more info on this potential security hazard. Thanks.

I don't know what OS it is he used, it sound more like windows as NTFS filesystem supports alternate data streams which could be used to make the file look empty even though it contains data.

Also a delete on most filesystems only deletes an index entry or marks it as deleted for overwrite in the future, could this be what he was incorrectly referring to?


How do I turn off automated testing in OWASP ZAP? I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on.

How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time being for testing purposes.

When ZAP start the scanner is off.I take a screenshot so i can tell you the basic of ZAP.

http://imgur.com/9xBebTK

select the profile for scan
Target to scan
Here is where the scanner put the results


Running a brief asm script inline for dynamic analysis Is there any good reason not to run a brief unknown (30 line) assembly script inline in a usermode c program for dynamic analysis directly on my laptop?

There's only one system call to time, and at this point I can tell that it's a function that takes a c string and it's length, and performs some sort of encryption on it in a loop, which only iterates through the string as long as the length argument tells it.

I know that the script is (supposed to be) from a piece of malicious code, but for the life of me I can't think of any way it could possibly pwn my computer barring some sort of hardware bug (which seems unlikely given that the loop is ~ 7 instructions long and the strangest instruction in the whole script is a shr).

I know it sounds bad running an unknown piece of assembly code directly on the metal, but given my analysis up to this point I can't think of any way it could bite me or escape.

Is there a reason you can't just study the code? 30 lines of ASM should be easy to understand. Just add comments explaining what each line does, and you'll understand it in no time. This will be even easier given how quickly you can look up exactly what an individual instruction does.
Although I would agree that it is unlikely to be capable of doing anything dangerous on its own with only a single syscall, you should never underestimate the ingenuity some developers can have. It is perfectly possible to design shellcode to trick a disassembler into showing you code which is not actually there, as DEF CON talk a few years ago pointed out. 30 lines of x86 assembly is plenty for a stage 1 payload.
Chances are it's completely harmless. I wouldn't bet my life on it, though.

You can use seccomp on Linux to isolate it. Seccomp is a Linux feature which filters system calls. There are two modes for seccomp, mode 1 and mode 2. Seccomp mode 1 is the most strict mode. When a program enables this mode, it is limited to using only four hardcoded syscalls: read(), write(), exit(), and rt_sigreturn(). Mode 2 is more complex, and uses a userspace-generated eBPF filter to specify a custom whitelist of syscalls and syscall arguments. For a very simple piece of shellcode, you would only need mode 1.
Activating mode 1 seccomp is simple. Taken from another answer I wrote on another StackExchange site, a sample program that securely executes a function that returns 42 in bytecode:
#include <unistd.h>
#include <stdint.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <linux/seccomp.h>

/* "mov al,42; ret" aka "return 42" */
static const unsigned char code[] = "\xb0\x2a\xc3";

void main(void)
{
    int fd[2], ret;

    /* spawn child process, connected by a pipe */
    pipe(fd);
    if (fork() == 0) {
        close(fd[0]);

        /* enter mode 1 seccomp and execute untrusted bytecode */
        prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT);
        ret = (*(uint8_t(*)())code)();

        /* send result over pipe, and exit */
        write(fd[1], &ret, sizeof(ret));
        syscall(SYS_exit, 0);
    } else {
        close(fd[1]);

        /* read the result from the pipe, and print it */
        read(fd[0], &ret, sizeof(ret));
        printf("untrusted bytecode returned %d\n", ret);
    }
}

You would want to replace code[] with the shellcode you want to test.
You mentioned that there is one syscall to time(). On most Linux systems, this is not a true syscall, but a vDSO. If it is actually a direct syscall, you would need to use mode 2 seccomp and explicitly whitelist it. For this, you would want to use libseccomp to abstract away the complexity.


Does a webserver need an antivirus software installed? In what cases does a webserver need an antivirus software installed?
When it is not required?

If it is required sometimes, what should be considered when choosing the right one to install?

(In my case it is a Windows Web Server, but maybe I should not narrow down the question.)

There are a few points to consider here.

First, AV is not a fail-safe, catch-all mechanism for any malware. Even ignoring the blurred line between AntiVirus and AntiMalware (these engines function differently, even if they are packaged in a single product), there is no AV/Antimalware product that will catch customized, targeted attack code. So, if that is the threat you are trying to protect against, you can just as well forget that.

Secondly, if you are accepting file uploads from users (especially essentially anonymous users), you should play it safe and go for defense in depth - even it's trivial to get around AV, you can at least block the low hanging fruit - and the "innocent" victims who continue to spread the payload unknowingly.

Third, if you want to play it super-safe and have AV even if you don't need it, like @Tate recommended, you should realize that while you will be safer from viruses (again, low probability, but still exists), this is not free, there are costs involved:

Using AV on the server can add risk to the server, since you're adding potentially vulnerable code - less code, less attack surface. (There have even been cases of attacks on the server via the AV interfaces).
Checking for viruses right there on your server isn't necessarily the safest option, since these can potentially "leak" and fool the AV. (Also see George Ou over on ZDnet about defusing a bomb in your living room).
Of course, never forget the performance costs of running AV on your servers, consider this an opportunity cost. Also you'd need to add X more servers to offer the same performance and throughput, if you have specific usage targets this can cost real money.
Most server-ready AV have a non-negligable cost - more opportunity lost, and if you're spending security money there are better things to spend it on.

All that said, if/when you do decide to go for AV, consider the following points, including the obvious:

Coverage
Cost
Updates
reputation (i.e. do they actively research? what are their triggers? do they catch what they should? etc)
Performance (or more accurately, performance hit - on memory AND CPU, and throughput)
additional engines, e.g. anti-malware, loggers, anti-rootkit, etc
Security of the product itself! You don't want to introduce vulnerabilities any more than you have to...
VERY preferable - if you can offload the AV scanning to another box, e.g. appliance or gateway, so this isnt even ON the server. Or, there are (were?) some products that let you scan in memory, via an API call, without even writing to disk (or DB).


Disk encryption clarifications This is more of an educational question and not so much an attempt to perform a specific task.

A) When encrypting a disk, does this generally mean that all data is encrypted, file metadata, data, everything, or does this happen in a smarter way?

B) Once you plug in a disk I can imagine that some autorun file fires up a program (found local to the disk probably) that requests a password which it will use for the decryption process upon demand. So when you are trying to access a file, the disk will decrypt it first with the password you provided earlier using the decryption software on the disk. How does the respective OS know when you've accessed a file on the disk and what program to use (in this case the one on the disk) to decrypt the file? In the same logic, how does it know when you wrote a file on the disk so it can encrypt it transparently?

C) Are there any encryption mechanisms that simply encrypt the filesystem tree hierarchy but not the data? I understand this might sound like a bad solution as the actual data of the files still reside on the disk and therefore it can still be accessed but it could maybe be a very fast way to encrypt drives with HUGE volumes of data and keep them safe from most of the non-tech savvy population? This would only be used for not so sensitive data of course.

A) If you (the application you are using) correctly implements a full disk encryption then yes everything on the disk is encrypted that would normally be accessible via the OS (such as file, metadata, filename, ACLs, etc ... and the whole OS itself). It encrypts at the block level on the hard drive.

B) If its full disk encryption you supply the encryption/decryption application the decryption key at first use (either on boot or when you connect it to the computer) at this point the key remains in volatile memory and the OS/application handles the encryption and decryption transparently as any when the files are accessed.

C) This would be application specific implementation. It may be someone can recommend one, but product recommendations tend to be out of scope on this forum. But looking at the example I am not sure I am aware of anything that does do what you ask as it doesn't actually encrypt the data.


Cloning a system for forensic analysis How can I clone a system without leaving any footprint? I want to acquire RAM and other physical hard drives so that after cloning all the work can be done in VM without disturbing the target machine. If I install any software for cloning on the target machine I will leave a footprint. If I do something over network such as netcat, it will also leave the connection in the RAM. Also I don't want to remove the hard drive from the system and use a write blocker as it assumed that once the drive is unplugged and plugged again, the data will be wiped out.

I want to basically take a machine get all its data so that I have something to run in a VM which is exactly the same as original machine.

I am doing a project on windows forensics and as far as I  have progressed I am unable to capture ram so that I can be run on a virtual machine.

I have seen some tools with which I can clone the hard disk to make a disk for virtual machine but for that I need to install that software on target machine and that would leave footprints

You would need to use JTAG, a debugging protocol (specifically IEEE 1149.1)  and its interface on most modern devices. When a JTAG probe is attached, you can halt the machine state and read all the memory and registers. JTAG puts the system into a low-level debug state called probe mode, which the operating system has no control over. JTAG probes, prior to DCI, can be fairly expensive. The only trace left over by JTAG is the fact that the system's RTC will seem to jump forward. After all, the system will be in a stasis which it is unaware of for some time, while the RTC keeps ticking.

It is also possible to use a DMA attack which will typically have very little effect on the target system. However, a DMA attack on a running system is subject to memory smear which may complicate analysis and corrupts the memory temporally, rather than spatially (i.e. address x and address y may have been captured at different times, leading to inconsistencies). Additionally, DMA attacks require that the target system not support DMAR, which filters DMA using its IOMMU.

If you actually want to take the memory and drop it directly into a VM so it runs where it left off, you are out of luck, sorry. There is plenty of state which is not captured in memory (registers, PCI device configuration space / MMIO, etc). It would be an incredible undertaking to take the memory of running hardware and put it into a virtual machine, especially because you would need to write device emulators for all the proprietary devices on the target system. You should be able to comprehensively analyze a memory dump without it needing to be dropped into a virtual machine.

See some other answers I've written on this subject:

A: How can a user defeat anti-live forensics software?
A: Best strategy to recover running Macbook “modern” Pro ram


Can encrypted data be safely dispose off by quick formatting? I have a Windows laptop machine with a traditional hard disk drive and I used it for a year and then I turn on the full disk encryption (Including system and non system partitions) using veracrypt fde. Password is secure and is only in my head. In near future I have to travel to a country where I believe I'll be asked to reveal the password by airport officials to decrypt the contents of drive (they can also copy data bit by bit from my drive).
To avoid that I don't want to carry any data on the hard drive and it's OK for me to destroy the information rather than handing over to government officials. I have also read the Electronic Frontier Foundation guide on this but that emphasize more on wiping the drive.

Question:

Using Ubuntu live USB, simply quick formatting the whole drive will make it impossible to read contents? I know quick format doesn't write any new data and old data is still there but as encryption keys are derived from the password and with out it the encrypted data still present in the drive will be useless to authorities? or do i have to rewrite whole drive with zeroes or random data? which is a bit time consuming.

Provided that your password is strong, and the laptop is set up to require your password on startup (ie it is not setup to auto-login) then your data will be protected.

It sounds though, like your concern is not about the encryption itself, but about rubber hose attacks, as per XKCD:

So what you're really after is plausible deniability that there is any data on the drive at all (ie you want to be able to say "What password? This drive is empty" and have them believe you).

To that end, a quick format will probably be enough to get through airport security because the laptop won't boot. But if the airport people become suspicious and seize your laptop then it will be quite clear to any forensic analyst that there is encrypted data on the drive, and they may mount a legal case in order to compel the password from you.

So it depends on the level of risk you're willing to take. Your options are, starting with the most secure:

Travel with no hard drive and install one / buy a USB stick and make a bootable OS once you arrive.
Fully wipe the drive according to the EFF recommendations.
Soft wipe (aka quick format) the drive.
Leave it as-is and hope they don't ask you for the password.


Finding owner of a Wi-Fi network name that may be a threat I moved into my new home three years ago. All pre-wiring had been installed during the build.

The day of move in there was a security company installing the security system which included outside cameras and inside panel systems. At that time I gave the installer general personal information (Wi-Fi password).

While he was going over the instructions I noticed in Wi-Fi settings a network name with a very strong signal which was unprotected. When I mentioned it I was told it probably was just a neighbor and at the time dismissed it.

However, since that time my cameras were hacked and I found two hidden cameras inside the house (bedrooms) as smoke detectors. They have been removed and I had the old touch panels removed and I'm with a new company.

Unfortunately, I still feel like I'm being watched and the Wi-Fi network I mentioned above is still going strong. I understand I sound like a paranoid woman but really I'm not.

I've gone into settings many times and pressed forget this network due to the unsecured status I'm unable to remove it. After boring you with all of this I just want to know how to find out who the network name belongs to and see if I recognize this person. I know nothing about this stuff and frankly never thought I would be a victim to a voyeur.

I'd recommend going to your fuseboard and turning off power to different rooms one by one, keep checking to see if the network is still going - if you can have all the power off and the network is still up, then its most likely not on your property. However, if one of the switches turns off the signal, then the access point is on your premises.

i'm not sure by what you meant when you said 'your cameras were hacked', but if you've found hidden cameras in your home then i'd notify the authorities asap.

You could also try connecting to this network and seeing if there is an admin panel that you can access at 127.0.0.1 or 192.168.0.1(most common addresses)


Hashcat password cracking Consider a laptop running Ubuntu 14.04 which has only Hashcat installed apart from the standard software.

Is it correct to say that the attempts of brute force per second will be twice faster if I have a quad core processor instead of a duo core?

Which role does the RAM play in increasing the attempts per second?

Is it correct to say that the attempts of brute force per second will
  be twice faster if I have a quad core processor instead of a duo core?

Hashcat is multi-threaded so it will be faster with a quad-core but I don't think it will be twice as fast exactly.

  Which role does the RAM play in increasing the attempts per second?

Hashcat stores dictionaries in memory, so the more RAM you have the less swap needs to happen.

Ok so I went ahead and ran a little experiment, here are the results (I did not let the full benchmark run, so only the first few algorithms are tested). Here is the table for MD5:

| CPUs |  RAM | Words per Second |
|:----:|:----:|:----------------:|
|   1  |  512 |      13.59M      |
|   1  | 1024 |      12.47M      |
|   2  |  512 |      25.01M      |
|   2  | 1024 |      26.54M      |
|   4  | 1024 |      36.22M      |

Hashcat benchmark with 1 cpu and 512 MB RAM

Hashcat benchmark with 1 cpu and 1024 MB RAM

Hashcat benchmark with 2 cpus and 512 MB RAM

Hashcat benchmark with 2 cpus and 1024 MB RAM

Hashcat benchmark with 4 cpus and 1024 MB RAM


White-box vs. Black-box What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons of each? Are there situations where one is preferable over the other?

I believe this question is best addressed in chapter 4 of The Art of Software Security Assessment, a book by Mark Dowd, Justin Schuh, and John McDonald.

Without it as a reference, I can safely tell you that the best method is using runtime data along with source-code while determining "hits" (or traces, aka coverage) using black-box testing -- but only after a threat-model and general architecture of the system is well-known.

The authors also appear to like secure static code analysis when combined with candidate-point strategies, although it's my opinion that these can vary wildly in value assuming the following are not true:

The language, and its base class libraries, must be supported by the secure static analysis tool
The entire system must usually be available. I.e. it must include buildable source code including all third-party/contrib components and external libraries -- possibly even to include the system compiler, VM, or other artifacts of the original system
All external components/libraries that are not a part of the base class libraries must have sources and sinks defined in the secure static analysis tool's source-sink-passthru database. The intricacies of some passthrus (i.e. filters) can vary by implementation or implementer, and thus almost always require custom configuration
Additional use of certain patterns or architectural code elements could cause other variations, which could require customization that isn't possible with most modern secure static analysis tools

For the reasons above, as well as the reasons put forth in the NIST SATE studies (done by NIST SAMATE), I find it difficult to recommend many secure static analysis tools for use in white box analysis. It is almost always simply better to use code comprehension strategies that most likely involve reading the source code from top to bottom, which is really very important if you are looking for managed code rootkits and the like.

Instead of testing and auditing/assessing applications, I would take a different approach that is largely very technology-agnostic. My suggestion would be to implement an application security risk management portal that includes an app inventory along with each app's currently implemented application security controls. After an initial baseline, the application security controls should be evaluated against industry standards such as MITRE CWE, SAFEcode, and OWASP ASVS. A gap analysis (note that this is a standard risk management term and works best when implemented in an information security management program based on ISO 27001 or similar) can then be used to determine the optimal application security controls, as well as a path to get from the currently implemented controls to the required ones.

You should implement this risk management portal before performing risk assessment activity such as white-box or black-box testing in order to get better results, and to measure the success of your program.


Alternatives to basic and digest authentication in HTTP when resources are constrained I'm currently implementing a small webserver on an embedded platform which is quite resource-constrained. I am planning to use unsecured communication because TLS might not be possible in my embedded environment, but nevertheless I do not want to have username / password pairs transmitted in cleartext.

I have looked at Basic Authentication which is not the best solution in terms of security as we do transmit all information, including username and password in cleartext.

Compared to Basic Authentication, Digest Authentication seems more secure but the big problem here is that the HA1 sum stored in the database must be treated as real passwords (because that's actually what they are). As soon as you get a peek at a user's HA1 sum you can get access to all areas the user can get access to as you'd be able to calculate a valid HA1 sum for every nonce the server sends.

Is there any other established authentication method that can be used in the context of HTTP while avoiding the vulnerabilities described above? Note that I only need secure authentication and not secure communication. If there isn't I might really need to reconsider using TLS in which case basic authentication would be enough.

A common use case for old systems with few resources was to use a login form that was the only page served as HTTPS. It is not as secure as a fully HTTPS service, but at least the password is only transmitted in encrypted format and only a hash is stored on server. And as only the login page is served in HTTPS the overload on the server is still low.

But this still forces to setup a SSL configuration on the server.


Fixing DNS leak - transparent proxy My ISP is using a transparent proxy to intercept my DNS lookup requests when using VPN. Is there a way to prevent that? I am using Lubuntu if that makes any differance.

With a properly setup VPN all DNS traffic will be done through the VPN and cannot be intercepted. So you might check the configuration of your unknown VPN solution you use. Apart from that - how did you determine that your ISP is doing what you claim?


Can the user of an app see what's in the https packets? If I exchange https packets between a server and an Android client, is it easy for the user of the client to get whatever is in the encrypted traffic? Should I consider all such traffic unsafe if the safety is dependent on the user not being able to somehow read what's in the https packets?

I don't quite understand what is your usage model where the security depends on the user of the app itself not able to know the HTTPS traffic.

But I believe if your app has no certificate pinning built in, and your client do not properly check the TLS connection (similar to how an end user click "Add Exception..." when the browser complains "This Connection is Untrusted"), the user can simply install a proxy (such as Burp) in the middle to intercept the traffic.


Why not sandbox websites instead of using Same-Origin-Policy? Why do Browsers implement a Same-Origin-Policy (SOP) to prevent open websites in the browser from executing scripts that may access / modify data of other open websites in the used browser?

Another more 'usual' approach would be to simply sandbox each open website, i.e. every website 'thinks' to be the only website on the browser. This approach is in my opinion more familiar to prevent an attack of e.g. evil.com accessing data from bank.com.

Is there any advantage in using SOP with respect to sandboxing?

The problem is that cookies are browser-wide. So if some script sends a request to a website the session cookies get sent.

If you want to sandbox the websites this would have to mean that cookies are now only for one sandbox and would require that the user explicitly selects a sandbox. Firefox actually has something similar now. It's called containers but people often use it for groups of websites.

If you don't have explicit selection you could also not store cookies but that is even more inconvenient and therefore not viable.


Browser Unable to Fully Authenticate HTTPS I'm attempting to fully verify the HTTPS encryption using Chrome & Firefox but both browsers currently display the connection as 'including resources which are not secure'.

I have tried using WireShark to package sniff the wire, but I am unable to determine what is causing this http request, because WireShark detects no traffic as HTTP on the main page.

Here is my .htaccess file for the root domain https://diginomics.com:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://diginomics.com/$1 [R,L]

Notice how some pages such as /about are verified, but the main page is not? Why is this? There must be something simple that needs adjustment.

Also, the HTTPS redirect completely overruled by subdomain which should be on forum.diginomics.com

Good people of Stack Information Security, how can I find where the insecure content is coming from when I am packet sniffing and nothing on the main page comes up as HTTP? What is causing the breach in security on the main page but not on the others?

The reason you're getting this is because you load certain resources over HTTP. When you look at the page source code, you'll see this:

<link rel='stylesheet' id='google-font-body-css'  href='http://fonts.googleapis.com/css?family=Open+Sans+Condensed&#038;ver=4.1.1' type='text/css' media='all' />
<link rel='stylesheet' id='google-font-heading-css'  href='http://fonts.googleapis.com/css?family=Abel%3A300%2C500%2C600&#038;ver=4.1.1' type='text/css' media='all' />
<link rel='stylesheet' id='google-font-third-css'  href='http://fonts.googleapis.com/css?family=Indie+Flower&#038;ver=4.1.1' type='text/css' media='all' />

Meaning that your fonts are loaded over HTTP (possibly there are more resources that are loaded over HTTP rather than HTTPS)

In order to solve this problem, you could use the following code:

 <link rel='stylesheet' id='google-font-third-css'  href="//fonts.googleapis.com/css....">

This means that the resources are loaded over HTTP(s) if the page is loaded over HTTP(s)

Hope this helps.


Are command injections examples of confused deputies? In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the reverse also hold?

More generally, are command injection and confused deputies two sides of the same coin or is their relation more complicated?

A confused deputy is a concern over what entity should be in control - which is an authorization and access control problem.  This is a problem of trustworthiness, and verifying intent.  Vulnerabilities like; server-side request forgery(SSRF), client-side request forgery(CSRF), and insecure direct object reference (IDOR) fall under this category.

Injection attacks are caused by the confusion between what is data and what is code. An injection is one type of vulnerability that can be used to undermine access control systems, in that a compromised server becomes a kind of confused deputy that is useful in pivoting and post-exploitation (attack chaining).  But this isn't the only case, you could have a code injection vulnerability in a sandboxed environment - which isn't a trusted entity, but could still be used for abuse - like mining bitcoin.

Injection attacks are more or less Independent from confused deputies, but an injection could be used to take control over a trusted entity.  There are many ways that an attacker can confuse a deputy.


Encrypting a fixed format message with commands and transmitting over the internet Linked to: Encrypting a fixed format message?

I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my Site B. At Site B, I need to validate that the request indeed came from Site A.

Site A has a secret key that can be used for encryption.

The information that needs to be passed:

// The SiteName must somehow be identified to Site B otherwise
// I dont know which secret key to use for decryption
$SiteName = "SiteA";
$Command = "commandA";
$UserId = "42";
$UserName = "John";
$UserTimeZone ="America/New_York";
$UserCountryCode ="US"
$BookId ="966";
$message = encryptionfunction($SiteName.'-'.time());

Right now, i'm sending all of the above, visible to the user.

Should i be encrypting $Command and other fields and sending only

$SiteName = "SiteA";
$message = encryptionfunction($SiteName.'-'.$Command.'-'.$UserId.'-'.$UserName
           .'-'.$UserTimeZone.'-'.$UserCountryCode.'-'.$BookId.'-'.time());

1.Edit

frm: https://stackoverflow.com/questions/5727607/generating-one-time-tokens-via-mcrypt-in-php

i will be providing api keys to my partner sites and they will be using code that i give them to to generate "tokens".

these tokens will be automatically present on forms which the partner sites' users will click on and reach my site. when they reach my site, i will need to validate that they indeed came from a partner site.

how do i validate this? the apikey will be secret, but what is presented in the form will NOT be, so it must not be possible for smart users to reverse engineer my algorithm.

As already mentioned by @Georgios, if all you want is to validate the integrity of your transmission and the fact that it was generated on site A, then you should look at signing.

Whether to use encryption or not is another case. And it's up to you to decide.

Are you OK with your user seeing the submitted data in plain text? I suppose so, as I assume it's mostly user-generated input that gets transmitted either way (correct me if I'm wrong).

You may want to encrypt this data to circumvent eavesdropping on the way to site B, but it's your call to decide if it's worth the added overhead.


Can request from different software on same machine to a server be identified to be from same origin by tracking TLS handshakes? If two different users visit an website from two different browsers via HTTPS, can they be identified by the server to be from same origin (same client machine) using information available from TLS handshake (except just IP)?
As far as I can understand- since TLS is below application layer, so the Session ID (from Server Hello during TLS handshake) can be same for both requests from different browsers. Thus the server can determine both requests to be from same machine- is that correct?
And, as per the following statement from this article-

The connection will stay open while both sides send and receive
encrypted data until either side sends out a “closure alert” message
and then closes the connection. If we reconnect shortly after
disconnecting, we can re-use the negotiated keys (if the server still
has them cached) without using public key operations, otherwise we do
a completely new full handshake.

The article quoted above implies that even after disconnection the same negotiated keys can be used to continue data exchange. Does it mean even after changing IP, the server can trace (just based on TLS) that the requests are coming from same machine?
Is there anything else commonly known that a server can use to confidently relate two different HTTPS requests to be originating from same machine (but different
browser)?
Apologies if this is not the right place to ask OS specific question.

If two different users visit an website from two different browsers via https, can they be identified by the server to be from same origin(client machine) using information available from TLS handshake?

In some cases, yes.

For example, your question states that the requests come from the same client machine. If this machine has a static IP address then all the IP packets will have the same source IP address in the IP header. IP header information is not protected by TLS. TLS handshake packets are TCP packets, which are then encapsulated in IP packets, which contain the source IP information. Here I am considering this header information to be "part of" the TLS handshake since the remote server will certainly know it.

Edit/Update (to more directly address the question and comment):

  As far as I can understand- since TLS is below application layer, so the Session ID (from Server Hello during TLS handshake) can be same for both requests from different browsers. Thus the server can determine both requests to be from same machine- is that correct?

TLS is below the application layer in a sense, but it is also above the transport layer, since it relies on the underlying TCP.

Since processes communicate via TCP, you would not see two different web browsers (each a different application/process) running over the same TLS connection. Each browser will establish its own TLS connection, each will send its own client_hello, and each will receive its own server_hello. For example, if I use Chrome to connect to www.website.com, and then I use Internet Explorer to connect to www.website.com, I will be able to see (e.g., with Wireshark) two different server_hello packets from www.website.com and those packets have different Session ID values.

So, this would not be a good method of determining that the different browser requests are from the same machine. Whereas, the IP address method mentioned above does have a chance of working.


Running sqlmap against a parameter inside a parameter I have a domain in the format: example.com?host=http://anotherexample.com?bar=1

I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I can't select the bar variable with the -p argument.

Any way around this?

In response to one answer, the resulting command is like so:

sqlmap -v -p user -u "example.com?host=?user=1" --prefix="http://anotherexample.com/debug"

This isn't valid, as the first param must be a ? for the url to be valid, and the remaining params but be &'s.

Use the sqlmap pre- and suffix options

Sqlmap offers the options "--prefix" and "suffix" that according to the manual

--prefix=PREFIX     Injection payload prefix string
--suffix=SUFFIX     Injection payload suffix string

can be used to prepend or append a string to the injection payload.

So if you run your query with:

python sqlmap.py -p host -u "example.com?host=" --prefix "http://anotherexample.com?bar=1" --suffix "&restoftheurl=whatever"

sqlmap should construct the parameter in the format you are looking for.

So for the example injection payload ' AND 7235=7235-- the options create a request to the url

example.com?host=http://anotherexample.com?bar=1' AND 7235=7235--&restoftheurl=whatever

(in the real request the special characters and spaces of the URL parameter will be URL encoded).

Note: You might need to URL encode the special characters in the pre- and suffix options.


Is it possible to crack any SHA1 hashed password I'm trying to understand how easy it is to crack a SHA1 hashed password. I have a training database giving hundreds of password hashed.

I have tried to use some online tools to crack them and I have realized that I can only crack relatively simple passwords with them.

For what I know, to crack a hask, you generally use rainbow tables. In that sense, for me, you can only crack simple passwords. But some people online seem to say that tools like John the Ripper or Hashcat can crack anything.

So I was wondering, is it always possible to crack a SHA1 password (even a really complex one) ?

Thank you in advance for your help

No, it is not possible to crack just any SHA-1 hash. Currently, there are two main issues with using the hash function for security purposes (not specifically password hashing):

It is a very fast hash, meaning a brute force attack will run much more quickly than it would if you were to correctly use a slow KDF. The fact that SHA-1 is fast does not allow you to crack any password, but it does mean you can attempt more guesses per second.
It is vulnerable to collision attacks, as Google showed. A collision attack allows someone to create two inputs with the same hash. However, it does not allow them to reverse a hash or to modify an input without affecting the resulting hash. That would be a different kind of attack called a preimage attack, and SHA-1 is not vulnerable to that attack.

So no, you are not able to crack just any password that has been hashed with SHA-1 unless the password is short or weak. That does not mean you should use it for password hashing however, since it is so fast and is efficiently implemented on a GPU.


Certificate validation Local DNS hosts file I've a question regarding a certificate validation error I'm getting. I'm performing an https request from one machine to another (windows machines). On the destination machine I've configured a self-signed ssl certificate for the webapp. On the the machine that is performing the request i've installed the root certificate (which was used to sign the self-signed one I installed in the other machine) in the trusted root certificate store.

The source app performs the request to that webapp hosted on the destination machine, by domain name, but its domain name is not registed with a dns server. It's simply configured locally in the hosts file of the OS. Basically it's a local dns.

But when I perform the web request, I get certificate validation errors (could not establish ssl trust). If I try to perform the request from the browser, I get the same error. But if I investigate the certificate and certificate chain, I can find all certificates are ok (both the SSL certificate used, and up the certificate chain, the root one). But I still get the validation error.

Could the fact that I'm using a local dns (via that local hosts file) be the reason for this? Thank you.

The process of establishing a full trust chain between two system using TLS is the following:

1/ Create or obtain the root CA X509 certificate.
2/ Obtain all intermediate signing authorities.
3/ generate a leaf X509 certificate and have it signed by the authority immediately higher in the trust chain (either an intermediate CA or the root CA if you're using a simple model).

On the server:

Install the root CA in the trusted root certificate store (under windows, it is recommended to do so for the local computer account unless you know exactly which security principal will be used by the server app).
Install all intermediate CA certificates in the appropriate store (note that, depending on the server software, you might need to create a "chained" certificate file instead containin all relevant certificates in the chain as well as the private key for the leaf) (on windows same remark as for 1/)
Install the leaf certificate on the appropriate user principal store (in windows, again, typically the local computer "personal" store)

On the client:

Install the root CA in the trusted root certificate store.

Note that all certificate will need to exhibit the appropriate properties to be considered valid. The hard part is that this depends a LOT on the application, the usage of the certificate and how it was generated. Typically, for TLS, the leaf certificate must have a a subject.CN field or an a entry under SubjectAltName that matches the DNS name you're using to attempt to reach it (even if you're using a HOST file). Additional requirement can be placed by the client as well (for instance, Chrome will not accept certificate with SHA-1 signatures if their validity extend beyond 01/01/2017).

All this is independent on the name resolution process: it doesn't matter if the client obtains the server's IP address through a regular DNS resolution query or from a HOST file.


What's the best way to authenticate an user using a websocket? I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). When I was planning the game, I realized that the easiest way to migrate it to other platforms is writing it in HTML5. So, I need to create a login system using JS and websockets. But I'm not sure of how secure is to send a message with a content like username and password to the websocket server(which runs in a Java virtual machine).

If you want security, transmitting authentication data through TLS is a big start.
But let's assume the websocket is already set up over TLS.
A solution I would recommend would be based on a challenge-response mechanism :

The server would set up a random set of bytes (the challenge), set a timeout at the end of which the challenge wouldn't be authorized.
The client would send in "plain text" the username and the challenge and an hash (with a SHA2 or SHA3 algorithm) of challenge || username || f(password),
f(password) being how the password is stored in the database (a SHA256 of password for instance).
The server verifies with the username's data and the challenge the response and if so, authenticates the user. It also invalidates the challenge to invalidate any future attempt using this challenge.

This method provides an anti-replay functionality : an attacker could not capture the data and replay it later to authenticate.

I however have one big problem with this method : f(password) has here the roughly same security as password : if the database leaks, any attacker could authenticate as anybody else. I say "roughly" because, if stored in clear text, since a lot of users are using the same password on multiple websites (which is bad), their accounts could be compromised elsewhere.

I can't think of a method protecting against a database leakage and an anti-replay mechanism, but an anti-database leakage mechanism (send user password in clear text over TLS, hash password with database salt and compare with database) over TLS should be sufficient enough against most risks you will face