PCI-DSS compliance for business with only swipe terminals I support the IT infrastructure for a small retail business which is now required to undergo a PCI-DSS assessment. The payment service and terminal provider (Streamline) has asked that we use Trustwave to do the PCI-DSS certification.

The problem I face is that if I answer all questions and follow Trustwave's requirements to the letter, we will have to invest significantly in networking equipment to segment LANs and /or do internal vulnerability scanning, while at the same time Streamline assures me that the terminals we have (Verifone VX670-B and MagIC3 X-8) are secure, don't store any credit card information and are PCI-DSS compliant so by implication we don't need to take any action to ensure their network security.

I'm looking for any suggestions as to how we can most easily meet the networking requirements for PCI-DSS.

Some background on our current network setup:

single wired LAN, also with WiFi turned on (though if this creates any PCI-DSS complexities we can turn it off).
single Netgear ADSL router. This is the only firewall we have in place, and the firewall is out the box configuration (i.e. no DMZ, SNMP etc). Passwords have been changed though :-)
a few windows PCs and 2 windows based tills, none of which ever see any credit card information at all.
two swipe terminals. Until a few months ago (before we were told we had to be PCI-DSS certified) these terminals did auth/capture over the phone. Streamline suggested we moved to their IP Broadband service, which instead uses an SSL encrypted channel over the internet to do auth/capture, so we now use that service.

We don't do any ecommerce or receive payments over the internet. All transactions are either cardholder present, or MOTO with details given over phone and typed direct into terminal. We're based in the UK.

As I currently understand it we have three options in order to get PCI-DSS certification.

segment our network so the POS terminals are isolated from all PCs, and set up internal vulnerability scanning on that network.
don't segment the network, and have to do more internal scanning and have more onerous management of PCs than I think we need (for example, though the tills are Windows based, they are fully managed so I have no control over software update policies, anti virus etc). All PCs have anti virus (MSE) and windows updates automatically applied, but we don't have any centralised
go back to auth/capture over phone lines.

I can't imagine we are the first merchant to be in this situation. I'm looking for any recommendations a simple, cost effective way to be PCI-DSS compliant - either by doing 1 or 2 above with (hopefully) simple and inexpensive equipment/software, or any other ways if there's a better way to do this. Or... should we just go back to the digital stone age and do auth/capture over the phone, which means we don't need to do anything on our network to be PCI-DSS certified?

I am not an auditor, and no one but an auditor can give you valid answers.  That said, the PCI Data Security Standard is reasonably direct on these matters:

  The cardholder data environment is comprised of people, processes and technology that store, process or transmit cardholder data or sensitive authentication data.

Therefore, storage of card data is not required to put you in scope; transmission is sufficient.  Your terminals will be transmitting cardholder data, and so are "in scope" for PCI requirements.

  Network segmentation of, or isolating (segmenting), the cardholder
  data environment from the remainder of an entity’s network is not a
  PCI DSS  requirement. However, it is strongly recommended as a method
  that may reduce:

  The scope of the PCI DSS assessment
  The cost of the PCI DSS assessment
  The cost and difficulty of implementing and maintaining PCI DSS controls
  The risk to an organization (reduced by consolidating cardholder data into fewer, more controlled locations)

In other words, any system connected to the network with processing terminals on it is "in scope", and will have to be scanned and audited as well.  You only have to segment it if you don't want to attest that it's up to PCI security snuff every year!  (That being said, it's probably cheaper and easier for you to segment it than to subject everything on your network to PCI requirements).

The PCI DSS Self-Assessment Questionnaire outlines the different types of businesses and what their broad requirements are.  Based on your description, you're SAQ "C", outlined on page 11.  I've quoted part of it below and highlighted the bullet stating that, yes, they want you to segment your network:

  SAQ C merchants validate compliance by completing SAQ C and the
  associated Attestation of  Compliance, confirming that:

  Your company has a payment application system and an Internet connection on the same device and/or same local area network (LAN);
  The payment application system/Internet device is not connected to any other systems within your environment (this can be achieved via network segmentation to isolate payment application system/Internet device from all other systems);
  Your company store is not connected to other store locations, and any LAN is for a single store only;
  Your company retains only paper reports or paper copies of receipts;
  Your company does not store cardholder data in electronic format; and
  Your company’s payment application software vendor uses secure techniques to provide remote support to your payment application
  system.

The good news is:

At the low-volume merchant level, you're pretty much only required to fill out a form and sign it saying that you're compliant, so you don't have the expensive audit to deal with.
There are many PCI rules which seem silly.  This is not one of them.  Network segmentation, or lack thereof, has been repeatedly shown to be a significant factor in card data breaches.
If the shop is that small, then this is not expensive to fix.  Buy a SOHO firewall with a integrated 4-port switch, make sure it has wireless turned off, connect your two terminals to it and then connect the WAN interface to your LAN.  You're done for less than $100.


When connecting laptop to internet through VPN via phone's hotspot, should VPN be active on phone, laptop, or both? The objective is to connect a laptop to the internet through a VPN via a mobile phone's hotspot or USB cable.

Should the VPN be activated on the laptop, on the phone, or both?

Secondarily, is using a USB cable substantially safer than a password-protected hotspot?

OSX and Android.

Depends on the device you want it to cover. If you activate it on the phone, it will route your phone and your computer’s traffic through it. If you set it up on your computer it will only route your computer’s traffic. If you activate the VPN on both devices, it may cause interference.

Using a USB cable to share internet is substantially safer than setting up a WiFi hotspot, but the latter can also be safe if you set a strong password, and use strong encryption, such as WPA2.


Pass the hash to identify as domain user instead of being stuck as NT Authority\System Recently I discovered that passing the creds of local admin and domain admin to a remote windows 7 machine yields the same result: I gain access to that machine as NT Authority\System. The only way I found to get the domain admin rights back on remote machine is through token impersonation. Surely there is an easier way to identify as domain admin after passing the creds?
I used metasploit's psexec module and connected through Admin$ share. I also provided domain name and domain admin creds, yet after running "getuid" in meterpreter I was still identified as local nt authority\system.

The reason this is happening to you is because of the way psexec works. Psexec uses your credentials to create a service on the remote machine using dcerpc's service control manager. Services by default will use the system principal as their process token.
Now to the matter at hand - how do I get back my administrator rights, assuming you don't have a hash, tgt or password - you can't.
Why?

Credentials are by design not passed on the wire, only a challenge response hash (ntlm) of a tgs is passed between hosts, meaning that even if the host accepts your credentials you won't be able to use them from that host to other hosts.
If you only require local access with the admin user you can use wmi as your remote execution method.(but even that is a network logon which doesn't allow forwarding credentials to other hosts)


How are mobile telephony networks like LTE and HSPA encrypted? How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is it similar to TLS?

I suspect that @Jay Looney is correct; for authoritative answers, contact the service provider.  (who will report you to DHS and DMCA).

Blackhat description of attacks on HSPA includes a brief overview and architecture, that may address the portion of the question re: what parts are encrypted.  This resource also includes the following sentence,

  The reality is that most UMTS/HSPA devices are also GSM/GPRS/EDGE capable, and are
  configured to try and connect to a GSM/GPRS/EDGE network whenever a suitable UMTS/HSPA network is not available.

I found one source that asserts that the answer is Feistel encryption, but it doesn't address the key management issue. I continue to believe that is something that only the vendor can answer, and I'm willing to bet they won't.

Agilent provides some internal details, but I think that is more specific than you want. It may be useful as context/example.

You could always take a course in the subject for a mere $1500.


Secure Connection between two mobile (Android and/or iOS) devices I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC).

All the devices will be handled a Token upon authentication which somehow needs to be transferred over to the Device A over network securely and confidentially.

What is the best possible way to achieve it.? I guess something like SSL handshaking will be secure, but a simpler solution will be preferred.

Basically Device A needs to act as a server.

Research done so far has led me to the following flow:

Device A manages to send a public key to client.
The client uses the key to encrypt the Token and send it to Device A.
Only Device A can read the Token and authenticate the client.

Problems with this approach (and their solutions, as per my limited knowledge while dealing with security systems):

The token is same and the public key might repeat as well, giving a weak point in the system.

The token will be transferred over the network with a nonce.

MIM attack: Any Device X can mimic Device A and send a public key to client and initiate transaction. Now Device X knows the Token and mimic the client.

The Device A should possess some kind of digital certificate to prove its authenticity. The digital certificate will be assigned by a server written in Python/Django. And the all the clients should be able to verify the certificate without interacting with server.

Concerns:

Since I need this for mobile devices, I need the public private key pair to be as short as possible but yet secure.

Questions:

How can I implement the last part algorithm? Is there any open source python library available for generating, issuing and verifying certificates?
Is the algorithm secure ? I'm a newbie in security and would like any valuable feedback.

Thanks in Advance!!

Sounds like a very cool project.  It seems that you have rediscovered the very problem that Kerberos was designed to solve.

Looking at your example, why would you not just use PKI both ways? Or can you not control the certificates at both ends?  You could look at SSL session initialization to see how you could transfer a confidential message under the gaze of a warden.

If you are rolling your own solution, you will find that secure key storage is a very difficult problem to overcome.

EDIT:
To address your well thought out concern, Elliptic Curve Cryptography is often used on mobile devices because of computational limitations.


nmap says "variable 'keys' is not declared" when trying to run ssl-ccs-injection.nse I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I haven't ever tried to run this script before, and I'm wondering what I've missed.

Here's a sanitized copy of the session along with the errors, I've replaced the hostname with example.com and used 10.10.10.10 for its IP.

nmap -p 443 -d --script ssl-ccs-injection.nse --script-args vulns.showall example.com

Starting Nmap 6.47 ( http://nmap.org ) at 2015-02-24 10:17 Eastern Standard Time
Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
NSE: Using Lua 5.2.
NSE: Script Arguments seen from CLI: vulns.showall
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating Ping Scan at 10:17
Scanning example.com (10.10.10.10) [4 ports]
Packet capture filter (device eth2): dst host 10.10.10.11 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.10.10.10)))
We got a TCP ping packet back from 10.10.10.10 port 443 (trynum = 0)
Completed Ping Scan at 10:17, 0.42s elapsed (1 total hosts)
Overall sending rates: 9.43 packets / s, 358.49 bytes / s.
mass_rdns: Using DNS server 209.244.0.3
mass_rdns: Using DNS server 4.2.2.1
mass_rdns: Using DNS server 156.154.70.1
mass_rdns: Using DNS server 209.244.0.3
mass_rdns: Using DNS server 4.2.2.1
mass_rdns: Using DNS server 156.154.70.1
Initiating Parallel DNS resolution of 1 host. at 10:17
mass_rdns: 1.93s 0/1 [#: 6, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 10:17, 0.02s elapsed
DNS resolution of 1 IPs took 1.93s. Mode: Async [#: 6, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 10:17
Scanning example.com (10.10.10.10) [1 port]
Packet capture filter (device eth2): dst host 10.10.10.11 and (icmp or icmp6 or ((tcp or udp or sctp) and (src host 10.10.10.10)))
Discovered open port 443/tcp on 10.10.10.10
Completed SYN Stealth Scan at 10:17, 0.36s elapsed (1 total ports)
Overall sending rates: 2.77 packets / s, 121.88 bytes / s.
NSE: Script scanning 10.10.10.10.
NSE: Starting runlevel 1 (of 1) scan.
NSE: Starting ssl-ccs-injection against example.com (10.10.10.10:443).
Initiating NSE at 10:17
NSE: ssl-ccs-injection against example.com (10.10.10.10:443) threw an error!
C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: variable 'keys' is not declared
stack traceback:
    [C]: in function 'error'
    C:\Program Files (x86)\Nmap/nselib/strict.lua:80: in function '__index'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: in function 'test_ccs_injection'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:269: in function <C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:245>
    (...tail calls...)
Completed NSE at 10:17, 0.00s elapsed
Nmap scan report for example.com (10.10.10.10)
Host is up, received syn-ack (0.28s latency).
Scanned at 2015-02-24 10:17:12 Eastern Standard Time for 3s
PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
Final times for host: srtt: 284875 rttvar: 227250  to: 1193875
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Read from C:\Program Files (x86)\Nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.92 seconds
           Raw packets sent: 5 (196B) | Rcvd: 2 (88B)

What's going on?

The script is written for the current development version of Nmap, not the released version. In r33651, I moved several different implementations of the same function into the stdnse library. You should be able to copy that library into your nselib/ directory just like you did to copy the ssl-ccs-injection script into the scripts/ directory. This will also solve the further problems of the same sort you may run into involving the debug function.

EDIT: The ssl-ccs-injection script was released with Nmap 6.49BETA1, and is available in stable releases after that (such as Nmap 7.01).


web application security testing definition Possible Duplicate:
  What is the difference between a penetration test and a vulnerability assessment?

When people talk about webapp security testing, do they usually mean vulnerability scanning or Penetration testing? or both?

My understanding is pen-test should include vulnerability scanning with the additional step exploitation, and it is a complete webapp security testing.

The vulnerability scanning usually done by the scanner, and do not include the exploitation step. After the vulnerability scanning is completed, then we can go further on the penetration testing, which can use different specific pen-test tools, or via manual process.

Please comment. Thanks!!

In a penetration test, the limits and bounds of the test has to be defined beforehand. The company and the pen-tester has to agree on a set of test which can be carried out, with legal documents drawn up to protect both parties before the test is carried out.

For a detailed test, it should include the exploitation step to fully test the system. The penetration test should be carried out based on a specific methodology step by step to ensure that nothing is missed.


Does a reverse proxy pass keep the backend server anonymous? If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2:

upstream 123 {
    server 2.2.2.2;
}

server {
    listen 80 default_server;
    location / {
        proxy_pass http://123;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

For an outsider who only knows the address 1.1.1.1. Is it possible for them to find out that the IP address 2.2.2.2 is the one that it is redirected to?

If properly configured, then yes, the IP address of the backend server would be hidden. This is the operating principle behind DDoS protection services like Cloudflare: Hide the real server behind a proxy server that can tolerate a large volume of traffic while filtering out bad requests.

That said, if it's imperative that your backend server IP remains hidden then you need to make sure it is not being leaked, either by your web application or by any DNS records that you have. If the backend server is publicly reachable, you should configure its firewall to only accept requests from the proxy server. This will prevent it from being discovered through a scan of all public IP addresses looking for a server that serves the same webpage as your proxy.


Want to build a password manager using OpenPGP.js I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust.

As I haven't found one, I thought it could be an interesting project for me to work on. I'm going to use AngularJS just b/c it's a technology that I want to start using and this project seems like a good fit.

My idea would be to have a dumb backend that took care of the login / registration and CRUD operations of the passwords (with tags to make the search easier)... but all the encryption / decryption should be performed by the browser.

The only thing that I'm not quite sure is how safe the private key is on the browser... Can different plugins / addons access to it when I load it into OpenPGP? is the private key stored as is on memory when OpenPGP is using it?

I've seen there are quite some other plugins using this, but I'm not exactly sure how good this would be.

I guess I could just have a different profile, or a browser I don't use with this... how good of an idea is it?

[Disclosure: I, too, work for a password manager company]

Long ago, I tried to develop my own password management solution using PGP/GnuPG. As I thought more about it, I found it unsatisfactory and eventually switched to the one that I have now come to work for.

Here are some things you should consider before trying to roll your own password management system:

What is your source of randomness for key and password generation?

Do
you know how to use a cryptographically secure random number
generator and why it works the way it does
What is your key derivation function?

Does it use something like
PBKDF2 to resist password cracking attempts against your master password?

Do you know how all of the choices in your KDF interact and stand up against
current and foreseeable attacks?
How much sensitive data remains decrypted at any one time?

If you
decrypt an entire file, then all of that decrypted data will need to
reside in memory or virtual memory on your computer, leaving it
potentially exposed after a crash, in memory, in automatic backup
files, or in system swap files
What measures does the system have to prevent data loss?

Does the
(automatic) back up system perform any integrity checks on the data
prior to making a backup?
How is memory of sensitive data cleared when it is no longer needed?

Are there obfuscation techniques for sensitive data (such as
decryption keys) that may need to reside in the app’s memory for a
while?
Will your system automatically lock or does it require you to take
action to lock/close your data?
Can you eliminate or minimize the use of Copy and Paste of sensitive
data?
If you build in web browser support are you aware of the kinds of threats against password management tools "in the browser"?
And most importantly, can you keep up with all of the research and
development on all of these (and other) issues that may require a
change in design or implementation?

You do not have to have a satisfactory answer to all of these to try to roll your own. But if you wish to "ignore" some of these questions you should do so deliberately.

I wish you the best with whatever you decide to do.


Why is Google Chrome blocking raw SWF playback? If you attempt to visit the URL of a raw SWF file, Chrome 57 refuses to display and instead asks if you want to download, with the warning "This type of file can harm your computer". However, if you wrap the same SWF in a simple web page with an object tag, it loads normally. The files are served with the correct "application/x-shockwave-flash" content type.

Is there any security reason why the former case should be treated differently from the latter?

FWIW, I have Flash playback set to "Ask first (recommended)" in chrome://settings/content

Example: http://www.sjgames.com/dice/cthulhudice/demo.html vs http://www.sjgames.com/dice/cthulhudice/img/CDdemo.swf

This behavior is apparently related to how Flash Player is a click-to-enable feature in Chrome now (Chrome Help forum discussion on this behavior). If you visit a SWF directly, it will not ask you to click-to-run, it will simply download it instead.

If you were to go to chrome://plugins/ and check "Always allow to run" it would play the SWF as previously normal in the browser directly, without the HTML wrapper. The fact it will not prompt you to enable it does not seem to be a security decision.

  Is there any security reason why the former case should be treated differently from the latter?

All that being said, yes, I think there would be.

Imagine there was a website, say an old forum, which allows you to upload an avatar. It is expected you will upload an image file, but the file type checking is poor, and an attacker uploads a malicious SWF file instead, to perform an XSS attack on the site admins. Now, the HTML being generated for this avatar, might look something like this:

<img src="http://example.com/user/123/avatar.swf" />

That won't run as a SWF, so no HTML for the attacker. So instead the attacker tricks the admins into clicking a link to http://example.com/user/123/avatar.swf where the SWF does load, and that SWF performs the XSS attack as the privileged users, and PWNs the site.

Of course, such a risk is not unique to Flash Player. A similar attack could be performed with JavaScript inside an SVG instead of a SWF.


Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation? Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected?  In other words, is there a way for a zone to provide a signed statement indicating that it is DNSSEC protected, and to suggest that DNSSEC clients can use strict signature checking for DNS records in that zone?

This would be analogous to a HSTS record (where a site opts into only HTTPS, and suggests that browsers should reject any attempts to connect through insecure HTTP), or a SPF policy that opts into strict checking (stating that emails that don't comply with the SPF policy should be rejected).

Background (as I understand it).  In principle, DNSSEC provides protection against man-in-the-middle attacks: the client can check whether the DNS response has a valid signature, and ignore all unsigned responses and responses with invalid signatures.  Unfortunately, in practice, this has an unacceptable compatibility cost.  If you treat all unsigned responses as invalid, then you "break the Internet": some sites stop working, either because the domain isn't consistently signing all records, or (I'm told) because signatures occasionally get stripped by middleboxes.

As a result, for practical deployment reasons, many DNSSEC-capable clients are actually non-validating: they look at the signature, but if the signature is missing, they still accept the DNSSEC response.  (Even Google's public DNS resolver will do this in some cases.)

This opens up a nasty man-in-the-middle attack: the man-in-the-middle simply strips all of the DNSSEC signatures, and then modifies the records however he likes.  If the client accepts unsigned DNS responses, this man-in-the-middle attack negates the value of DNSSEC.  Of course the other side of this unhappy situation is that if the client rejects all unsigned DNS responses, then it might be secure against man-in-the-middle attacks, but many legacy sites will stop working, causing an unacceptable compatibility cost.  At least, this is my understanding.

You could imagine a better solution might be possible if DNSSEC-aware clients had a way to tell which zones should use strict signature validation.  In particular, if google.com or good.com had a way to declare "I guarantee all of my DNS records will be signed, and I want you to treat any unsigned records as invalid", then a cooperating client could apply strict validation to DNS records for *.good.com, while being non-validating for other zones.  This might allow good compatibility with legacy domains while allowing strict checking for zones that want to opt into it, in other words, providing partial protection against man-in-the-middle attacks without "breaking the Internet".

Does such a mechanism exist?

There are three flags in a DNSSec packet that are responsible for communicating the validation requirements of a domain.

The DO bit

The DO bit is set by the resolver to indicate that it requires authentication Resource Records to be included in the response.

If a resolver is security aware, it MUST set the DO bit. If a Name Server gets a message without the DO bit, it MUST strip out any authentication Resource Records. Unless there is a specific request for an authentication record.

The CD bit

This bit allows the intermediate name servers to disable signature validation. This basically says 'don't bother validating things, I'll do it myself, just send me the raw records'

The AD bit

This is the part that actually answers your question.

  The name server side SHOULD set the AD bit if and only if
     the resolver side considers all RRsets in the Answer section and any
     relevant negative response RRs in the Authority section to be
     authentic.

The AD bit says, these records are authentic they are signed.

Performing Secure Queries

If www.example.com has the correct keys and resource records configured. It must still respond to clients that don't understand DNSSec. DNSSec is designed to be backwardly compatible, it must respond to requests that don't understand DNSSec. This does create the vulnerability that you highlight.

However the process exists, using the above flags to ensure that only authentic records are received, but this requires that the resolver is configured to do so. Bind does provide this mechanism in the DNSSec-validation flag (which is enabled by default)

  Enable DNSSec validation in named. Note DNSSec-enable also needs to be set to yes to be effective. The default is yes.

So if you create your own DNS Resolver, and configure it to only accept validated responses, you will not be able to resolve domains that don't have a complete chain of trust associated with them. Though domains that have no DNSSec records will work as before.

The reason that Google's name servers behave as they do, is that they have configured them to ignore the AD Bit if the domain is popular. So if stackexchange had a problem with their certificate, Google would still resolve with their name servers. This seems like a decision to prevent stackexchange dropping off the internet for a large proportion of people using Google DNS.

edited to answer the actual question!

If you have configured your secure resolver, and somebody upstream can hijack its queries they could strip out the DO bit, which would force the upstream servers to strip out all authentication records. When your secure resolver receives that record it would simply presume that the domain you were looking for didn't have any authentication configured.

To perform this attack you don't even explicitly need to be completely inserted in the middle, the ability to adjust the outgoing DNS packet would be enough.

This was considered as part of DNSSec's original design. According to RFC3833 - Threat Analysis of the Domain Name System

  While it certainly would be possible to sign DNS messages using a
     channel security mechanism such as TSIG or IPsec, or even to encrypt
     them using IPsec, this would not be a very good solution for
     interception attacks
  [...]
  For heavily used name servers (such
     as the servers for the root zone), this cost would almost certainly
     be prohibitively high.  Even more important, however, is that the
     underlying trust model in such a design would be wrong, since at best
     it would only provide a hop-by-hop integrity check on DNS messages
     and would not provide any sort of end-to-end integrity check

DNSSec is designed to protect against a number of specific attacks, such as cache poisoning, Man in the middle attacks were simply discounted for the above reason.


How secure are DECT and 5.8Ghz Digital Cordless home Phones? Is it safe to assume someone with $1,000-$3,000 U.S. to throw around can purchase the expertise or equipment to tap someone's modern cordless phone via a vulnerability, or otherwise? I mean someone with targeted intent, not someone looking to eavesdrop on random people.

We hear a lot about WiFi encryption but not too much about Cordless home phones and headsets. How much more secure is DECT vs 5.8 Digital, and is either of them secure "enough" for a motivated person barring "very" specialized hackers?

To answer your question directly: It might work. But the success relies on the hardware of the victim.

The security of DECT Phones relies on the implementation. There are DECT Phones that don't do encryption so the calls can be captured. To test this you need some (old) hardware that is compatible with a tool called dedected. You can find further information here and here.

I tried it back in the days but I think today the hardest task is finding a laptop that still has a PCMCIA slot. The card is still available on amazon.


AD User vs SQL User for SQL Server Authentication My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me.

Many of these customers are deploying the web application to point to the deployed database using the same Active Directory credentials as a server administrator. If the application was to be compromised for any reason, the attacker has also earnt themselves rights to the server and potentially network.

What is the correct purpose of using Active Directory for SQL Server. The only healthy reason I could think of using it, is if you had web farms with multiple SQL Servers in which you would have isolated accounts/groups for accessing all of those servers with correct permissions and even then I would have concerns in particular environments. Is my assumption correct that these users and groups should remain isolated in permissions from other permissions such as machine/server Admin accounts aka an account should never be able to log into a server and log into a database?

Or is it just lazy security in which you should never use AD for SQL Server?

Thanks,

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform.

SQL Authentication is a legacy authentication mechanism  that in a properly configured environment should not be enabled at all.  Microsoft doesn't recommend it and the disassociation between the identity of the user or application from the authentication context is only bad, from a security point of view.

That settled, you are certainly correct that an application should not be accessing a database in the context of  a server or domain administrator account.  The web application should be run under an account that has the necessary permissions to execute the functions of the web application (including the appropriate access to the database(s) it requires to function) and no more.

Ultimately, this is not a question of AD auth vs SQL auth, but about the use (or lack thereof) of limited use accounts, or the violation of the principle of least privilege.  The fact that they're not using SQL auth is not a problem, and is in fact the correct design.  The fact that the AD accounts have  excessive privileges on the other hand, is as you've noticed, a serious problem and one that should be addressed.


What is the intended attack vector of this email? I received this email in my inbox:

It seems innocuous enough and the source of the message tends to confirm this:

Return-Path: <info@retinaljessicandis.info>
X-Original-To: admin@quickmediasolutions.com
Delivered-To: admin@quickmediasolutions.com
Received: by quickmediasolutions.com (Postfix, from userid 117)
    id 1DBEB3F466; Fri, 17 Mar 2017 01:32:56 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
    mail.quickmediasolutions.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.7 required=5.0 tests=BAYES_60,RCVD_IN_BRBL_LASTEXT,
    RDNS_NONE,SPF_HELO_PASS,SPF_PASS autolearn=no autolearn_force=no version=3.4.1
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=201.197.252.218; helo=retinaljessicandis.info; envelope-from=info@retinaljessicandis.info; receiver=admin@quickmediasolutions.com
Received: from retinaljessicandis.info (unknown [201.197.252.218])
    by quickmediasolutions.com (Postfix) with ESMTP id 44D3B3F303
    for <admin@quickmediasolutions.com>; Fri, 17 Mar 2017 01:32:53 +0000 (UTC)
Message-ID: <00848281.1BB7F609@retinaljessicandis.info>
Date: Fri, 17 Mar 2017 02:32:58 +0100
From: "Nina" <info@retinaljessicandis.info>
X-Accept-Language: en-us
MIME-Version: 1.0
To: <admin@quickmediasolutions.com>
Subject: Hi
Content-Type: text/plain;
    charset="us-ascii"
Content-Transfer-Encoding: 7bit

Good luck :)

Based on the information shown above, I have come to the following conclusions:

The SPF test passed, confirming that the IP address my mailserver received the message from is authorized to send emails for that domain.
The message does not appear to contain any malware — no JavaScript (it isn't even a multipart message) and no attachments of any sort.
The message doesn't contain any links or URLs.

Am I missing an attack vector here? Is this an attempt at phishing? If so, what is it that I am supposed to be tricked into doing?

Such question merely asks for opinions as only the sender really knows his own intent, other people can only guess.

I suppose that in your question you kept the real email address: admin@quickmediasolutions.com. It is an interesting one which can be divided in two parts:

admin: this is a common word appearing on the top of most usernames lists and frequently used for email addresses. Not only this username is common, but it is sometimes linked to a mailing list targeting several humans at once (as many chances for a malicious payload to be opened), this is just bonus, and humans with administrative privileges on whatever they are using, this is the cherry on the cake.
quickmediasolutions.com: this is just a working domain name, they are plenty of ways to get large lists of working domain names.

To me, but this is my personal guess, the attacker is sending the same innocuous email to admin@<domain> (at least, I expect other names such as webmaster to be also targeted) to the widest range of domain names possible. Using such an harmless email is the safest way to avoid spam filters to alter the results in any way.

From there all the domains tried will in one of these categories:

Those who rejected the email with an SMTP 550 Invalid Recipient message, they will most likely be left out as not being low hanging fruits.
Those who accepted the email, they will earn their ticket to the next step in the attacker's agenda.

What does this next step contains? Here again, only the attacker (or the people hiring him) may know. Maybe the goal is just to constitute a list and sell it, maybe the goal is to directly use this list and try to send some malicious payloads, maybe both...

Anyway, the idea is that such emails is most likely not meant to carry any malicious payload by itself, but is just a low-cost probe to sort targets on a wide scale.


How to include third parties in PCI DSS SAQ When filling in the SAQ for PCI compliance, how do you include requirements covered by a third party provider? Say you're using a PCI compliant VPS provider for example.

Do you select 'yes' then include a reference to the third party's AoC? Or is it considered a compensating measure? Or just not applicable and fill out the worksheet?

There must be information in one of the PCI council documents but I couldn't find it.

You could select In Place but there's nowhere to justify that it's In Place and you've outsourced the responsibility. In the case of an SAQ, it's clearer to select Not Applicable, and then to justify the Not Applicable selections with a statement such as:

'Not applicable as responsibility for meeting this control has been outsourced to X service provider. Their AOC, dated dd mmm yyyy, has been reviewed and shows that this requirement is In Place'.


Can AES-256 encrypted data be changed? I have a file that supposedly contains AES-256 encrypted data. The file was created using a proprietary program that claims to use AES-256.

I have tested decrypting the file with an open source program (openssl) and it works, I get my exact original file back.

Given this, is it possible that the proprietary program created a back door into the encrypted file?

In other words, could the program's developer be able to access my original file given the encrypted data (assuming he doesn't know the password I supplied).  Does my ability to open it with OpenSSL prove that there isn't some intentional weakness in the way that the proprietary software encrypted it?

There is no reason to assume that because another program can decrypt an AES encrypted file that it's backdoored. AES is a standardized form of encryption, so if your proprietary protocol implements this standard, then it's quite normal that you can decrypt this data with openSSL as well (which also follows this standard).


How can I list all self-signed certificates in my stores on a Windows client? I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be exported to a nice human-readable file.

Try “cert:” PsDrive

This here will be human readable. And (thanks to the semicolon as the delimiter) it will also open nicely in Excel:

dir cert: -Recurse |
where {$_.subject -ne $null} |
where {$_.subject -eq $_.issuer} |
Export-Csv -NoTypeInformation -Encoding UTF8 -delimiter ';' -path selfsignedcerts.csv

Further reading

Great blog on this: https://blogs.technet.microsoft.com/scotts-it-blog/2014/12/30/working-with-certificates-in-powershell/


Does Windows 10 provide sufficient virus and threat protection? I am configuring a new laptop with Windows 10 Home and trying to determine if it is necessary to buy one of the big antivirus packages such as Norton, McAfee, etc. Is the security software that comes preinstalled in Windows 10 Home sufficient to protect against basic threats the average user is likely to encounter or would it be wise to use non-Windows virus and threat protection software?

Windows defender is more than adequate for home use. I find its actually becoming a tad annoying as I will PoC malware techniques to understand them and defender keeps dropping my files in quarantine.

Really for the price and what it does you cannot go wrong with Windows defender.


API Security - Mutual TLS vs TLS with shared secret . When setting up the security for business to business API integration.  We are discussion 2 option

Mutual TLS with IP Filtering
TLS with a Shared secret and IP Filtering.

Which is the more secure approach and what makes the potential difference?

My understanding is, either way, the initial connection secures the data then the shared secret or the second certificate confirms the identity (to an extent).

Are there any potential benefits either way? It seems Mutual TLS can be more challenging to implement. The only benefit I can think of with the Mutual TLS is the potential for the certificate to expire and be revoked.

I'm trying to understand the difference in the potential attacks.

Both can be secure, so potential attacks are not the main thing here.

The differences are in identity- and key management.

With PSK (pre-shared key) you just get a key ID for the client, not a certificate with X.500 attributes such as common name. So to identify the identity you need to link already known information to the key ID.

With PSK you share a secret key between client and server. But if there are multiple clients or multiple servers then you need to share keys between a lot of entities. With certificates - or rather, the public key infrastructure (PKI or PKIX) created using certificates - you just need to have one secret (or rather private) key per entity. The public key can be trusted if it is part of a certificate in a certificate chain, so the public keys don't need to be distributed either.

As you've already indicated there are a lot of other key management options for certificates.

One disadvantage of using certs is that the server cert is usually required to include the server name, and the connection may not be established on differently named hosts.

For business to business I'd certainly go for the client / server authentication using certificates. This is the most common and most flexible option. Be sure to trust only those certificates that you require (and not all certificates that are trusted by a default trust store).


What can I do with private 128 bit AES Keys? For my studies, I am required to do an investigation on a fictional criminal VMWare image. The image is suspected of participating in DDoS attacks and other illegal activities. On this PC TrueCrypt is installed. Along with TrueCrypt, The image has Mozilla Thunderbird installed with a OpenPGP security module.

I made a raw memory.dmp of the RAM memory in the image to perform analysis.
Using aeskeyfind I got several results.

  michael@cf15:~/Documents/Volatility$ aeskeyfind memory.dmp
  b4ce75c857163e668818d0d76c46bad2
  ccf865429e42144a9dce839b036c3f7c
  51c35f7f0b79e7d1e6d5345d2a291ac8
  Keyfind progress: 100%

This command shows me that there are 3 AES keys present in the RAM. Using -v (verbose mode) I can see that they're all 128bits.

What exactly can someone undertake when they found these private keys unencrypted on the disk? As the OpenPGP asks for a 2048 RSA-key, I think the keys are connected to hidden TrueCrypt volumes.

Can a attacker use these keys to gain access to volumes without having the appropriate passphrase?

You can try to decrypt things using these keys :)

First of all I would try to decrypt the hard disk (TrueCrypt) using the keys.

Regarding OpenPGP you should know that the 2048-bit RSA key is only used to decrypt a symmetric key, which can be used to decrypt the message. It's a matter of performance. You you can try decrypting the message with one of the above keys.


What affect does modulus have on CSPRNG outputs? I work in security and I've seen modulus (modulo) used in many encoding and crypto algorithms. However, today, a friend of mine mentioned that using modulo like this:

unsigned long int result = some_CSPRNG_output % 556600;

"Limits the security effectiveness of the CSPRNG."

If you are not familiar with C, the pseudo-code there is essentially stating that the output of some cryptographically secure random number generator, such as /dev/urandom on a linux system, modulo 556600, squeezed into a positive integer, is assigned to the variable "result."

The idea behind his argument is that modulus limits the number of possible outputs, therefore weakening the strength of the entropy. He stated for example, that if we have a CSPRNG output and we compute it with modulo 2, there are fewer possibilities of outcome, thus the entropy is weaker.

Is this true? Please explain why or why not.

The modulo operation is useful to obtain a number within a certain range. In your example, the output will always be in [0, 556600).

This can cause some changes in the distribution of the random numbers generated:

The main one: a smaller pool of possible values:

If the original number of bytes read out of /dev/urandom is more than ~2.5, then it had a bigger range and higher entropy than the resulting number due simply to the fact that the range is smaller.

The extreme example is modulo 2. You can go from a massive range of possible values to just 0 or 1.

This in itself is not a problem. If you need to randomly pick between two choices, this is the right thing to do. If anything, this will smooth out some imbalances in the PRNG.

The nasty one: a non-uniform distribution:

One nasty side effect of modulus is when the size of the range is not a multiple of the modulus.

eg: % 2 on the range [0, 2]. Two of the original possible values map to 0 while only one maps to 1. If the original distribution is uniform, the final distribution is massively skewed towards 0.

The bigger the range is compared to the modulus, the less of a bias this causes.

In your original example, if we initially read 4 bytes from /dev/urandom, the range is 7716.43 times the modulus (2^32 / 556600) which is not a multiple, but is large enough to be less impactful. Whether the bias is useful will depend on the application.

This part can be problematic: if you need to pick between two choices and you pick the first one 66% of the time, you have a problem.

Summary:

Your friend was partially correct in saying that the entropy changes through a modulo operation, but for the wrong reason. Limiting the number of possible values does not necessarily change the entropy. But biasing the final distribution might.


What does LUKS header contain? What is contained inside the LUKS header? I know, the header has size of 2MB. Also, cryptsetup supports "detached header", where the header can be stored in a separate file.

Thus, for example, I can format luks device and specify detached header in a separate file:

dd if=/dev/zero of=LUKS-HEADER bs=1M count=2
cryptsetup luksFormat /dev/sdb1 --header LUKS-HEADER --align-payload=0

IIUC, this format operation only writes to the header. The disk partition is not modified (I checked with md5sum). So why does cryptsetyp  luksFormat require specifying the device (/dev/sdb1) ?

Can I share one header for multiple luks devices?

UPDATE

After further investigation, it seems to me that the first 4096 B of the header contain the header information, which is being printed with cryptsetup luksDump.

What is stored in the remaining part of the 2MB file is a mystery to me. It seems to be overwritten with random data (I filled it the with zeros initially, so I can see the difference). Also, the 2MB file is absolutely un-compressible.  Further indication of random/encrypted data.

Can somebody please authoritatively explain what is contained in the 2 MB LUKS header?

I believe that the header results being 2MB large because of the Anti-Forensic splitter: the encrypted master key is splitted in several blocks to enhance the diffusion and make sure that it can be easily erased from the disk.
In particular erasing one single stripe makes the entire encrypted mk irrecoverable.

https://web.archive.org/web/20160517044339/http://tomb.dyne.org/Luks_on_disk_format.pdf

here's LUKS2 specification: https://gitlab.com/cryptsetup/LUKS2-docs/blob/master/luks2_doc_wip.pdf

I wonder how one can extract the encrypted master key...


My Control Panel and online IP addess tools report different results for my IP address Control Panel says it's 192.168.1.1; Google, whatismyipaddress.com etc. says it's 75.92.141.32

When I put the IP address reported online in my address bar I get a Nokia login page, but my ISP is Clear. I think someone may be trying to hack my computer or something.

The first IP address 192.168.1.1 is a local (private) IP address for your computer on your local network.  IP addresses that start with 192.168.x.x, 172.16.x.x - 172.31.x.x, and 10.x.x.x are private addresses to be used for private networks.  This is so large private networks (that aren't hosting services to be accessed by the outside world directly) do not need to be assigned unique IP addresses (as there are only about 4 billion IPv4 addresses).  It would be problematic if two machines doing different functions were assigned the same IP address on the actual internet, but its no problem if you and I both have devices on our local home networks with the address of 192.168.1.1.

The other IP address (starting with 75.92.x.x) is your real IP for the router you are connecting through that was assigned to you by your ISP.  Your home router performs Network Address Translation (NAT) to route packets going to from your computer with a local address to the internet.

For example, let's say you request to see a website at 1.2.3.4 on port 80.  Your computer makes that request from a randomly assigned port that it is not using (say 34567) from 192.168.1.1.  Your computer knows to send network requests to your home's router (there's probably an entry in the routing table saying forward everything that's not 127.0.0.1 to the local router).  The router sees the destination isn't on the home network, so changes the source IP address of the request in the IP layer to its own assigned IP address before forwarding the packet out on the actual internet (NAT may also change the source port, but for this example I'll assume it doesn't).   Then when the response comes back from 1.2.3.4 port 80 to the router to your router's IP address (at the port 34567), your router changes the destination of the IP packet to 192.168.1.1 port 34567 (as your router remembered 192.168.1.1 made the request) and continues to route it to your device on the local network.  So to the outside world you are the address that doesn't start with 192.168.1.1, but on your local network you are 192.168.1.1.

Also, the addresses 192.168.1.1/192.168.0.1 by convention tend to be the address of your actual router in home network scenarios.  Typically, the IP address assigned to each computer on your local network is something like 192.168.1.101.


Is HMAC-SHA256 and HMAC-SHA512 able to act as drop in replacement for HMAC-SHA1 in HOTP/TOTP? In RFC 4226, the algorithm for HOTP is described as follows:

  HOTP(K,C) = Truncate(HMAC-SHA-1(K,C))

TOTP is essentially the same algorithm as HOTP except for the fact that the counter "C" is replaced by an integer derived from the current time (in Unix Time). In the words of RFC 6238,

  Basically, we define TOTP as TOTP = HOTP(K, T), where T is an integer
     and represents the number of time steps between the initial counter
     time T0 and the current Unix time.

However, the reference code described in RFC 6238 as well as the test values listed in Appendix B has reference to HMAC-SHA256 and HMAC-SHA512. The two algorithms are not mentioned anywhere else in either RFC 4226 or RFC 6238 though.

My question - Are HMAC-SHA256 and HMAC-SHA512 officially supported as variants of the HOTP and TOTP algorithms?

It's not only the code sample and the test values, it's even there explicitly in the RFC 6238:

  TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions,
  based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the
  HMAC-SHA-1 function that has been specified for the HOTP computation
  in [RFC4226].

So, yes.

My inexperienced but slightly educated guess would be that there's nothing wrong with using them even with HOTP (even though the RFC doesn't explicitly say it). After all, HOTP and TOPT are virtually the same.


Remote Buffer Overflow w/out Memory Leak I'm working on an exploit development challenge right now in which I've been presented with a compiled binary and I have to exploit it on a remote server. No stack protections have been enabled and ASLR is disabled. I've written the exploit successfully and tested on my device and it works. However when I run it on the remote server it fails.

There aren't any memory leaks so I can't do a ret2libc style attack and I'm not very good at ROP. The buffer overflows by quite a bit and there is an executable stack. What are the other options rather than ROP that I could use to get EIP pointing to my buffer without knowing it's exact location? Is it possible to use just a couple gadgets to point EIP to some location relative to the current stack? If so, could one potentially help explain the ASM required to do that?

Thank you in advance.

In the end, it turns out that I was making an elementary mistake. Prefixing my shellcode with a NOP sled ended up successfully exploiting the remote instance of the vulnerable application.


Microservice security: How to perform authorization + services also need auth checks individually? I have the following architecture for accessing a REST service that requires authentication:

Oidc token flow managed at the client
Access token verified at the server in the auth service (proxied by the api gateway), exchanged for a jwt that contains authorisation information about the user.
The resource is accessed

In the current model, every request needs to verify the access token (which is normal), but also needs to retrieve the authorization information on every request, which I don't feel is ok.
The jwt used in this model is only for internal use at the server cluster, as there really is no need to send it back tot the client. Also generating a jwt on every request doesn't feel quite right.

Storing the jwt in a server store (cache / database) is something I don't feel is right with this model, because this makes the system stateful again (in case of multiple api gateways, there is need again for sticky sessions, synchronisation etc). Hence this doesn't offer a solution.

One possible solution would be that authorization is not checked upfront along with the authentication (i.e. verification) process, but only depending on the requested route / action. I don't particularly like this, as this requires back and forth messaging when a protected resource is accessed. It doesn't smell like clean architecture.

What is the advised way to go about this?
Related, I wondered if it is enough to perform authentication in the api gateway. These microservices work independently, and I feel a bit uncomfortable that the api gateway grants all access while keeping the underlying services 'dumb'. Is this a misplaced sense of paranoia?

I do not see the problem in authentication it's more authorization.

Legit solution is to enforce networking rules with iptables so any traffic besides api gateway is not allowed only from api gateway.

One of security rules is to take care of attack vectors which in your case is api gateway.
For more security you should check business logic on api gateway if privilege escalation is possible and if so implement authorization inside.

Why is it fine to have auth only on api gateway:

If attacker privilege escalates api gateway and grabs some subset of JWT-s there impact is near to same as api gateway having full access to services.
If attacker obtains JWT for some resource over api gateway there isn't any mechanism to stop him using the sam JWT on internal services if he gains access you adds a bottleneck to app

If your paranoia is big enough make sure to SSL encrypt traffic between api gateway and other services and iptables should be enough:
 - On same host: localhost port -> services endpoints
 - Different hosts: public static ip -> services public static ip/ips.

More info on subject look for threat modelling: https://www.owasp.org/index.php/Application_Threat_Modeling


what does "no value specified" default to in keychain on osx? In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me and was wondering what the certificate trust would default to when "no value specified" is what trusting ssl certificates is set to? I am also wondering what type of certificates this intermediate certificate could issue/sign?

The images below are of the intermediate root ca, as a side note this ca has already been used to sign certificates for x.509 basic policy and extensible authentication protocol(EAP) which makes sense since this is used to connect to wifi.

Listed below are some of the questions I had about how my school's wifi is set up and how I can protect myself

Can the intermediate root ca which my school forces me to trust man in the middle my system by signing/issuing ssl certificates?
can changing the certificate the intermediate CA certificate has issued trust to "Never trust" to everything but EAP and X.509 would help?
Will revoking the intermediate CA's trust after the school wifi has given me an EAP certificate to connect to the wifi. allow me to both use school wifi and not have the school man in the middle my connection? and if so how I could go about doing this on IOS?
Finally I was wondering what someone else would do in my position with mobile data prices in Toronto being so high?
what the school was asking of me was a reasonable compromise between security and functionality? –

To be fair, I didn't use OS X much lately, but my suspicion is: Yes.

Not setting specific values for those usage types that supersede the system default is irrelevant, as the certificate is a CA.

With those options, you can disallow a specific usage for a specific certificate.

You can check if you are MITM'd by checking the CA of the certificate. Please also note that with PK-Pinning and HSTS, it's harder for SSL-Proxies to work without you easily noticing it, as long as the website is up for it.

There are browser plugins that check what other people get for a certificate for a given domain, further warning you of a MITM.

So the MITM when browsing can be mitigated, leaving other TLS-based services. There is DANE for that, but it must be supported by the client and the server and is not as wide spread as one would hope.

As far as "the school is forcing me to trust this CA" goes, you might also just import all leaf certificates that CA signed by hand and explicitly trust them to have access but not trust the CA. Thus, you know when something is wrong, but have to sometimes grant trust to new leaf certificates.

This would work for any other OS with a centralized and user-manageable trust store as well.

The weighing of that trade-off is ones personal opinion, while when aware you might just reduce the usage to non-critical applications or those secured by DANE.


Secure algorithm for transferring data between users via QR Code I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use.
The scenario should be something similar to this.

User A wants to transfer X points to User B.
User A generates a QR code on his mobile application, embeds the points number(X) and userA.id in the QR code.
User B reads the QR code, sends {points numver:X, from=userA.id, to=userB.id} to the server.
User A can generate the QRCode while offline, where user B must be online to read the QRCode.
The server receives the request and transfers X points from user A to user B.

The technical scenario we have for making this:

The server has a global value named salt. salt is random and auto generated every day.
In the server, every user has the following fields:

id: Auto Incriminate number.
userKey: md5( id + salt ) => changes every day.
generatedQRCodesNumberForToday: a number represents how many times the user generated a QRCode today, max value is 10, the value resets every day.
N: Array of already uses numbers in the current day while transferring points, the array resets everyday.

Every day, the user claims a new userKey.
Every user have a counter in his mobile application represents generatedQRCodesNumberForToday, this number is synced with the server whenever the user is online, and this number increases whenever the user creates an new QRCode.
If user A wants to transfer X points to user B:

User A creates a QRCode that has {from:userA.id, numberOfTrile:md5(userA.userKey + userA.generatedQRCodesNumberForToday), points:encode(userA.pointsToTransfer, userA.userKey)}.
User B reads the qr data, adds to:userB.id to them, and sends them to the server.

On server side:

The server receives the from field and knows who is the sender.
The server receives the to field and knows who is the receiver.
The server receives the points field and decodes is using the sender userKey to know the amount of points.
The server receives numberOfTrile field. The use of numberOfTrile field is to make sure that no user will generate the same QRCode more than once. The server tries to match numberOfTrile with {md5(from.userKey + '1'),...,md5(from.userKey + N),...,md5(from.userKey + '10')} where N was not used before, if there's a match then the transform process is approved and the number that matched the concatenation N is marked as not valid for future use.

I want to know if my process is secure or it has any possible security vulnerabilities.

You are overcomplicating this. A counter of QR codes per day, daily salts, values that need to be synchronized...

I would simply design the application having an ECC keypair. When A wants to give N points, it makes a 'coin' with the information (timestamp, sourceUser, points, expiry), signed with its private key.

Then user B scans the coin and presents that to the server, «I am user B and want these points, here is the check signed by A». The server just needs to verify that

it has a valid signature from A
the last transaction by A was earlier than this coin timestamp (just a counter would do, too) - in order to avoid double spends (I am assuming that a valid transaction invalidates all previous ones that might be pending and somehow the server didn't see yet)
A actually has enough points to give out

Since A and B will be at the same place, the expiry an be as short as a few minutes, which is nicer than the daily salts (what if A is offline and meeting B after midnight?). You need to allow a bit of leeway for unsynchronized clocks between devices, but since the points would be redeemed almost instantaneously, at the point it starts being rejected it would be easy to understand by the end user, too when you tell them "This offer was only valid until XX:YY, it's now XX:ZZ, please check the clock time is set right."


Can the conversion of a malicious PDF to image be exploitable? Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do:

Convert the PDF to image using a library and store it in my file server as an image? Can the process of converting a potentially malicious PDF file be exploitable?
Or convert the PDF to PDF/A format and store it in PDF/A format? Does this will remove all the active and harmful actions from the document?
Is the presence of a network anti-malware product going to help?

Also, please note that after the upload, these files will not be available for my customers to view.

Thank you

As always, it depends. Potentially every piece of code operating on user-controlled data is exploitable if it contains bugs in implementation (it does). However common pdf attacks are targeted at popular viewer applications, not automated converters, so your potential adversary is a targeted and capable hacker. They are less common, much more dangerous and are attracted to financial organizations ;)

  Can the process of converting a potentially malicious PDF file be exploitable?

Yes. Here your security depends on the security of your chosen library. For example, image processing library Imagemagic and video processing library ffmpeg have 535 and 314 CVEs respectively. Some of those allow the attacker to execute arbitrary code on your machine.

The most popular (AFAIK) pdf processing library (Apache PDFBox) is written in Java, so it's relatively hard to perform memory corruption attacks, however, it's not immune from all attacks and has 4 CVEs to show that. It's unfair to compare the numbers here since PDFBox is much less popular than the other two libraries.

The fact that PDF is one of the craziest formats ever invented (here, play some breakout.pdf) doesn't help with security.

The main takeaway is that just like a malicious image can exploit imagemagic and malicious video can exploit ffmpeg, malicious pdf can exploit your chosen library.

  Or convert the PDF to PDF/A

I would imagine that converting to PDF/A allows you to save more useful information for later processing than converting to plain image, so that's a plus. As for security, this reduces the attack surface for the readers that would subsequently open the converted PDF/A and changes codepath inside pdf converter, but it's impossible to say whether this codepath is safer or not.

Either way, you need to care about the security of your converter. The principle of least privilege is very useful here. Extract your pdf converter into a separate process/container and allow it to take pdfs from one dir, convert them, and store them in another dir. No process spawning, no network access, execution timeouts, etc.

  Is the presence of a network anti-malware product going to help?

I'm skeptical. Despite how much AV vendors push "behavioral analysis" technologies, the bulk of AV job is just comparing files with signatures of common viruses. Attack on specific pdf parser will probably be quite uncommon, perhaps even 0-day, so you shouldn't rely on AV catching it.

Some kind of network activity analysis could make the attack harder to pull off unnoticed or even prevent it, but nothing can guarantee security here.


Full Disk Encryption and Network security I very recently had a job interview in which the interviewer asked me how full disk encryption helped improve network security? Initially I believe they are seperate and not linked, FDE is local to the device and network security handles more the network traffic but I wanted to give an answer. As such I stated that it would be helpful for employees who work remotely using company laptops. If the laptop was lost/stollen then if the had the VPN settings and password was saved on it (i.e. in a text file by the user) then the FDE would prevent the attacker from getting it and accessing the network.

Apart from that, how else is full disk encryption related to network security.

In case a laptop got stolen, FDE will make sure that:

Private keys cannot be stolen (e.g. from a web server, or indeed from a VPN)
Stored WiFi password cannot be stolen
Other passwords cannot be stolen (from router, switch, etc.)
When device registration is mandatory, an attacker could use the already registered device to access the network.


A Wordpress plugin stores a SMTP password in plaintext, why? A Wordpress plugin I am using for using a SMTP server instead of the server's built in mail function is stating:

  The password [SMTP password] is stored in plain text. We highly recommend you setup your password in your WordPress configuration file for improved security...

So while I understand this is different from a login situation where you can check against a password hash and don't have to store the plaintext, is there no better way for the plugin to have access to the SMTP password and not store it in plaintext?

Does their suggestion of shifting the plaintext password's location from the database to a config file make any real difference - in general and in regard to Wordpress?

So while I understand this is different from a login situation where you can check against a password hash and don't have to store the plaintext, is there no better way for the plugin to have access to the SMTP password and not store it in plaintext?

The plugin needs to have access to the plain password in order to do SMTP authentication. While one might encrypt the password this only moves the problem since one now would need to store the encryption key somewhere accessible to the plugin.

  Does their suggestion of shifting the plaintext password's location from the database to a config file make any real difference - in general and in regard to Wordpress?

In case there is a successful SQL injection the password might be read from the database. For reading a config file instead the server either has to be configured insecurely by making this file accessible from outside or there need to be another way the attacker can access data on the server, for example using some remote code execution vulnerability. But in this case the attacker will also have access to the database too since the database credentials are also stored in some config file.

Thus, neither solution provides absolute security. But the risk of using a properly protected config file might be the smaller one.


Block web content authoring from internet In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet?

Configuring httpd.conf to restrict the content authoring URLs to
only internal LAN.
Configuring firewall rules.

By using second method, one would need to configure the content authoring to run on a port other than port 80, which I do not have an issue.
By using the first method, if there is a mis-configuration in httpd.conf then it will open up a loop hole.

Which method is more sound in terms of security?

thanks

Depends on the capabilities of your firewall, really, but first: stop doing anything that involves being logged in on port 80! If your CMS asks for username and password, and you're running over HTTP (as would be standard for port 80), your username and password would be sent in clear text between your local machine and your server.

Once you're running over HTTPS, there is very little difference in the two approaches:

Any misconfiguration in httpd.conf could open up loopholes, so you should be looking to minimise the chances of these. This could be through a limited set of configuration options being used, making it easier to monitor, or through keeping restrictions relating to specific sites in dedicated configuration files, again, ensuring that they can easily be checked for issues.
If your firewall can only monitor traffic on a port level, it may introduce unintended paths to access content authoring functions if the CMS has not been built with this in mind. For example, it might still be possible to access content authoring tools over the main site port, but for the content authoring port to be unable to access the main site - this would depend on the specific CMS in use.

If you have a more powerful firewall, which can do traffic inspection, you may be able to restrict access to specific URLs to given IP addresses. You may also be able to put these restrictions in place with some WAF systems. There is still a chance of misconfiguration, just as with httpd.conf though.

For most small sites, modifying httpd.conf or related files is probably sufficient. For larger sites, there is nothing to stop you from doing both - defence in depth is a good principle. For really high profile sites, you probably want to separate the content authoring and actual site serving, and implement some kind of push mechanism to send updates made on an authoring server to hosting servers which don't allow for modifications by other methods.


What is a Truecrypt alternative with deniable encryption for linux? Preferably an alternative that is Free Liberating Open-Source Software/ FLOSS. I would have used Truecrypt, but it has been discontinued.

TrueCrypt 7.1a has been forked into other projects, such as VeraCrypt, which just like TrueCrypt offers hidden volumes.

I can't comment on whether to trust TrueCrypt/VeraCrypt or not (since TrueCrypt's sudden discontinuation), but both are open-source so you can figure it out yourself, and there has been an audit on TrueCrypt recently (as of writing).


How do PGP keyservers synchronize the keys? I want to know technical details about how public PGP keyservers synchronize the keys.

If I send my key to one keyserver, how exactly does it "travel" to all the other ones? Who sends it to who and how? What would I need to know it I wanted to write my own public key server software from scratch?

I am trying to look for either some protocol description or even the actual code that takes care of this, but I cannot find it.

One of the examples I had in mind were keyservers like http://pgp.mit.edu and http://pgp.zdv.uni-mainz.de. As far as I know, if I upload a key to the first one, it gets somehow "magically" transfered to the other one, and then dozens of other keyservers publicly found on the internet.

I am asking for concrete standards how those keyservers exchange the submitted keys, and if there is not one concrete strategy, then what strategies are usually used.

Key server synchronize using different protocols, forming a network of more than hundred servers all around the world involved.

E-Mail Synchronization

The "old" way of key server synchronization is based on the key servers sending e-mails to each other. Whenever a key server receives new information he doesn't know yet (either uploaded by a user or received from another key server), he forwards these information to all other key servers in his synchronization list.

SKS Protocol

Because the old e-mail based protocol doesn't scale very well (especially with the number of servers in the synchronization list), a new protocol was defined for the Synchronizing Key Server (SKS), which is based on set reconciliation.

These key servers "gossip" with each other in a given time interval. From a very basic point of view, set reconciliation orders the keys in a so-called partition tree, which allows to find the differences easily without transmitting a lot of information. Only the modified keys are then exchanged.

MIT and University of Mainz Key Servers

For SKS keyservers (and also Hockeypuck, which is another implementation of the SKS protocol), the gossip partners can be retrieved by fetching their statistics page, available as http://[keyserver]:11371/pks/lookup?op=stats. Looking at the statistic pages of both the MIT key server and the one of the University of Mainz, one will realize they even have a direct, mutual synchronization agreement (look at the "Gossip Peers" column).

The key server of the CCC Hanau on the other does not directly gossip with the one of the MIT. If you upload a key to any of these servers, the other will not get aware of it directly, but through the intermediate server of the University of Mainz (or on any other synchronization path).

Visualizing the Whole Key Server Network

The SKS keyserver pool crawls the key server network periodically, and provides a dot file of the key server network (of all servers in the SKS pool, not including synchronization links based on the old e-mail synchronization algorithm).


Mod_security rules-updater.pl fails to pull new release Mod_security has a rules updater distributed with their release packages on sourceforge:

http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/

Usually, you can run the script and modsec will update the rules for you. However, recently, this feature has stopped working. I get the following 404 error when I attempt to update the ruleset to 2.2.4:

$ ./rules-updater.pl -rhttp://www.modsecurity.org/autoupdate/repository -prepository/ -Smodsecurity-crs
Could not load GnuPG module - cannot verify ruleset signatures
Fetching: modsecurity-crs/modsecurity-crs_2.2.3.zip ...
Failed to retrieve ruleset modsecurity-crs/modsecurity-crs_2.2.3.zip: 404 Not Found

We have a cron job which downloads and applies the rules frequently. It's been great up till now. Has anybody found a solution to this? Is anybody aware of other free/open repositories with self-update scripts? I've searched the forums, but no luck so far. Any help is greatly appreciate.

It's looking for 2.2.3, which isn't there, so no surprise it fails. Sounds like you should report a bug  to them.


Understanding how clients handle incomplete certificate chains How do clients (browser for example) handle a missing intermediate certificate?

In the following answer it is explained that they download certificates or use cached certificates: https://security.stackexchange.com/a/163660

I don't understand how this works. Where do they download them from? If they can download and cache intermediate certificates, why have an intermediate certificate store at all? Why not make it a part of the protocol, since this is considered a secure behavior?

Some certificates use the AIA (Authority Information Access) field to specify a URL from which the next certificate up in the chain can be downloaded.

For example, if you view the certificate for security.stackexchange.com, you'll see that the certificate for *.stackexchange.com is issued by Let's Encrypt, so the next certificate in the chain above the certificate for *.stackexchange.com is the certificate for Let's Encrypt Authority X3.  Sure enough, if you look in the AIA field of the certificate for *.stackexchange.com, you'll see a URL (http://cert.int-x3.letsencrypt.org/) from where the certificate for Let's Encrypt Authority X3 can be downloaded.

However, I'm not sure all browsers will read the AIA information and fetch any missing intermediate certificates from the URLs specified in the AIA.  So, for greatest reliability, it's probably best to bundle all of the certificates in the chain (including all of the intermediate certificates along with the terminating certificate for your site) in one .crt file.

For more information on AIA, see https://discussions.qualys.com/thread/12098.


How to confirm VPN is working properly? I've just started using a VPN service because I'm doing work from a hotel room for an extended period of time with an iMac connected to the hotel's open wifi. Hotel has a web log-in with password, but no encryption.
I installed a personal VPN service and it appears to be working properly, but when I turn off the VPN the internet connection continues to function without any indication.
UPDATE: My VPN service settings are set to "Start on Boot up", and I have enabled "Kill switch" option that disables internet traffic if the VPN goes down. It also includes by default DNS leak protection and IPv6 leak protection by routing all IPv6 traffic through its servers, and stopping it there. Also, my VPN IP address is different every time I reconnect to the VPN. And I've confirmed that my public IP address is different than my IP address when VPN is enabled.
However, my question is whether there is a straight-forward way for me to confirm that all of my internet traffic is going through the VPN, when the VPN is enabled?  This may seem like a silly question, but if I can't tell the difference between VPN or NO VPN, then what's to say that some data isn't bypassing VPN encryption and going straight onto the unencrypted open wifi?

Open your browser and navigate to the link below and check the IP returned before and after enabling your VPN software. You should see your VPN provider's IP when VPN is enabled to route your stuff via VPN provider's server. Otherwise, you'd see your hotel wifi provider's IP.
https://ifconfig.me/ip
Update:
As you know, the above check verifies if your browser is going through the VPN tunnel or not. So if all you care about is your browser traffic, this check is good enough. However, if you want to absolutely make sure all your traffic is routed through your VPN server, you can check your kernel routing table to make sure it is setup correctly by your VPN software which I am pretty sure is done correctly.
The following list is part of my kernel routing table. As you can see, my VPN inserted routes to override the 'default' route which is on my physical interface (i.e. en1) to VPN tunnel interface (i.e. utun2). As long as you see similar things on your machine you can be sure all your stuff is going through your VPN tunnel. I do not know what OS you are on but the following check can be done on MacOS or Linux and I assume Windows has similar tools. Open a command shell and do the following.
arul@lion$ ip route list
0.0.0.0/1 via 10.8.0.1 dev utun2
default via 192.168.1.1 dev en1
128.0.0.0/1 via 10.8.0.1 dev utun2
...

You can also do the following additional check that tells you how your connection will be routed. In this example, it tells me it would use my utun2 device to get to a public IP i.e. 8.8.8.8
arul@lion$ ip route get 8.8.8.8
8.8.8.8 via 10.8.0.1 dev utun2  src 10.8.0.75

Finally, you want to absolutely make sure you are only using VPN tunnel, you can delete the default route which I am pretty sure is how your VPN software implemented their 'Kill switch'.


NIST 800-53 rev 4 - CM-7(2) implementation on Linux NIST 800-53 rev 4 CM-7(2) states:

(2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION
The information system employs automated mechanisms to prevent program execution in accordance with [Selection (one or more): authorized software programs; unauthorized software programs; rules authorizing the terms and conditions of software program usage].

What automated mechanisms exist in Linux to prevent specific program(s) execution? I understand Linux DAC permissions can be used at a high level to restrict execution of all programs, but that is not whitelist/blacklist implementation. I'm also aware that a strict policy implementation of SELinux could be used to satisfy a white list by requiring policies to be definied for every application that is approved. Are there any other options that are less onerous than SELinux strict policy (which is a considerable effort to implement in a strict policy configuration)?

There are a few ways to prevent execution on Linux. It is important to remember, though, that these only apply to binary executables (like ELFs). Scripts or any other interpreted files cannot be blocked in the same way. For example, a bash script isn't actually executed, it is merely read by /bin/bash, which parses it. The same goes with something like python, where /usr/bin/python reads and interprets a python file. Blocking execution of the scripts will prevent one from doing ./file.sh, but you will still be able to do /bin/bash file.sh, unless the bash executable itself is blocked. As such, any programs which act as interpreters can bypass these protections.

A few ways to block execution:

Setting the noexec mount flag prevents execution on an entire partition.
DAC can be used on a blacklist basis, by removing the executable flag on a file.
AppArmor, and many other MACs, can be used to whitelist individual files for execution.

Note that AppArmor by default only applies to programs you create a policy for. There are ways to use a global profile so whitelists for each program are required, but it is not officially supported.

It looks like what you want is a MAC, just one simpler than SELinux.


Was Goggle.com actually crazy malware in 2006? This video shows how somebody accidentally opens Goggle.com instead of Google.com. He gets flooded with pop-ups, SpySheriff or SpywareSTOP get installed automatically, and the computer user has no chance of closing the seemingly hundreds of pop-up windows:

McAfee version: “Spyware
Rubbernecking”
WebRoot version: “The effects of
typosquatting”

The Wayback Machine, unfortunately, excludes Goggle.com, Goggle.net and Goggle.org for unknown reasons.

Did this crazy pop-up flooding malware actually exist in 2006?

Let me summarise what you are seeing:

someone navigates to a typo-squat site (goggle.com)
the browser is then flooded with numerous pop-ups, warning windows, etc.
eventually, the anti-virus starts to detect malware
the machine crashes

It is difficult to think that there are young technology professionals now for whom that sequence is new and strange. For those of us browsing the Internet in 2006, this was a reality. I experienced this, myself, more times than I could count.

To answer your question, this was neither crazy nor limited to this one site.

The malicious (or hacked) website was coded to flood the user with ads and legitimate-looking Windows warning windows. When the user tried to close the windows, dozens more sprouted until the machine crashed. For many people, events like this are what got them familiar with the Windows Task Manager, which was the only way to prevent a total machine meltdown.

The warning windows were, in fact, browser windows, and when you interacted with them, it translated the user's click into an "OK" for installing something. That's how the viruses got installed.

So, these little gems crashed your machine (causing a reboot) and installed all manner of viruses. It was sometimes impossible to remove them without "nuking from orbit".

Many layers of security now exist in browsers to prevent that type of problem (although the attackers continue to evolve). Pop-up blockers, now standard, was the first thing to be used on the browser side. UAC was one of Windows first attempts to block this sort of application behavior from the OS.


What is the quick fix for CSRF attack? The application is constructed in Java language and JSF framework. I have reported a CSRF attack and the development team have to fix it soon since the application is in production.

I recommended to use CSRF tokens but the development team says it may take some time for the implementation.

Can any of you suggest a better and faster way to remediate CSRF? If it is a temporary solution for now, that is also fine. Later, they will implement the proper CSRF tokens in the code in a reasonable time.

A quick fix against CSRF is to check the Referer and/or Origin HTTP header. At least one of these should be set and the domain it contains should be your domain (i.e. same origin).

Note that this will break cases where your site is accessed from a bookmark, link inside a mail or similar since in thus cases no Referer will be sent. But in no case you should simply accept an empty Referer (unless you have a non-empty Origin header) since this is easy to create for an attacker.

You should also make sure that your checks for the domain are correct. This is, if your site is www.example.com you must not accept Referer like http://www.example.com.attacker.com or http://www.attacker.com/www.example.com or http://www-example.com.

You should also make sure that the attacker can not use other functionality (or bugs) in your application as a trampoline to create a custom request with malicious payload but the expected same-origin Referer. As Arminius nicely pointed out in a comment, open redirects might be such a trampoline. Thus you should either make sure that all requests to the domain have a same-origin Referer or that any parts which might need to accept a cross-origin Referer can not be abused as trampoline.

For more information about this method of protecting against CSRF and about its potential problems see Verifying Same Origin with Standard Headers in the Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet from OWASP.


Is there a reason to disable root login, if SSH connections are restricted to a single IPv4 address? I have a linux server running centos, and while hardending the SSH server, I asked myself: Is there a reason to disable root login, when only I (assuming my IP address is static, and i have direct access to internet i.e no routers etc) can access the server (ssh daemon running on port different than 22, tcp connections to that port are accepted only from my IP, the default policy is DROP, using iptables firewall) ?


Length of a stretched gnupg passphrase that is comparable in strength to an unstretched string of 256 random bits Assume that we want to encrypt a file with gnupg using AES-256 as the encryption algorithm.  (Hence, symmetric encryption.)

In this mode, gnupg requires a passphrase from the user.  I understand that gnupg then derives from this passphrase a 256-bit key, which it uses for encryption.

This question is about choosing a passphrase that is at least as difficult to crack as the rest of the encryption scheme.

Now, passphrases are typically strings of printable characters, but if we used a random 256-bit string as the "passphrase", then such a "passphrase" would be at least as secure as the rest of this encryption scheme.

In contrast, a passphrase consisting of a single ASCII character (8 bits) would probably not be deemed secure, since it would be too easy to guess through a brute-force search.

The comparison between the strentgth of the passphrase and the strength of a random 256-bit key is not straightforward, however, for at least two reasons.

First, in order to derive the key from the passphrase, gnupg uses "passphrase stretching", which increases the computational cost of performing a brute-force search for the passphrase.

Second, passphrases are made of printable ASCII characters, so a 32-character (== 256-bit) passphrase, even if it were a random string of printable ASCII characters, would still have less entropy than a random 256-bit key, despite having the same number of bits.

So my question is, if we take into account both gnupg's passphrase stretching as well as the fact that passphrases consist of printable ASCII characters, what would be the length of the shortest random passphrase that would be equally hard to guess as a random 256-bit string without passphrase stretching?

Find a space of 2256 distinct possibilities, and choose your password uniformly at random from that space.  For example:

Pick 40 characters independently uniformly at random from the graphic US-ASCII set, like with tr -cd '[:graph:]' < /dev/urandom | head -c 40.  There are 94 such characters, and so 9440 > 2256 possible passwords this way.  (You can include space too if you want to allow space; then you only need 39 to exceed 2256 possibilities.)
Pick 20 words independently uniformly at random from a 7776-word list, like with diceware.  There are 777620 > 2256 possible passwords this way.  You can choose a word list you like to make things more memorable; there are many options available.

Once you do this, the stretching isn't important any more!  The stretching is only a crutch to lean on if you insist on human-chosen passwords, which are a bad idea anyway.

If you use the password only for GnuPG, and you always use it with salted s2k (which, obviously!), then you can safely turn this down to 2128, e.g. a mere 20 characters or a mere 10 words.  But if there's any danger you might reuse it in an unsalted context you should stay at 2256.


Is storing answers to security questions in plain text bad form? If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?

I'll assume the model you're trying to defend against is where an attacker has access to the database. If that's the case, yes, it's a bad idea if an attacker can compromise an account by only knowing those details.

My advice would be to convert the answer to uppercase, then salt + hash it. Optionally also trim it or collapse all whitespace. This provides a reasonable security measure without reducing usability.