Understanding Java Security Providers I'm hoping to use the below issue we came across recently to better understand Java's security providers, ciphers and encryption in general.

We got the following error during an SSL Handshake (using the InstallCert tool) from a Solaris 10 host, running Java 1.6.0_81 to one of two AD hosts:

]$ java InstallCert host1.example.com:636
Loading KeyStore /usr/jdk/instances/jdk1.6.0/jre/lib/security/cacerts...
Opening connection to host1.example.com:636...
Starting SSL handshake...

javax.net.ssl.SSLException: java.lang.RuntimeException: Could not parse key values
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1747)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1708)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1691)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1222)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1199)
        at InstallCert.main(InstallCert.java:98)
Caused by: java.lang.RuntimeException: Could not parse key values
        at sun.security.pkcs11.P11Key$P11ECPublicKey.fetchValues(P11Key.java:954)
        at sun.security.pkcs11.P11Key$P11ECPublicKey.getW(P11Key.java:975)
        at com.sun.net.ssl.internal.ssl.ECDHClientKeyExchange.<init>(ECDHClientKeyExchange.java:40)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:782)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:241)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:943)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1188)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1215)
        ... 2 more
Caused by: java.io.IOException: extra data given to DerValue constructor
        at sun.security.util.DerValue.init(DerValue.java:368)
        at sun.security.util.DerValue.<init>(DerValue.java:277)
        at sun.security.pkcs11.P11Key$P11ECPublicKey.fetchValues(P11Key.java:945)
        ... 11 more

The second host does not give any errors. The only difference I've been able to glean here is the cipher on host1.example.com -- it is AES256-SHA;  cipher on host2.example.com is AES128-SHA.

]$ echo -n | openssl s_client -connect host1.example.com:636 | grep 'Cipher is'
New, TLSv1/SSLv3, Cipher is AES256-SHA

]$ echo -n | openssl s_client -connect host2.example.com:636 | grep 'Cipher is'
New, TLSv1/SSLv3, Cipher is AES128-SHA

My questions are:

What is the purpose of Java security providers and what is their role in encryption?
What is it about the cipher of AES256-SHA on host1.example.com that yields this error?
We eventually commented out this security provider in java.security file to resolve the issue:

security.provider.1=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/sunpkcs11-solaris.cfg

So it appears that this combination of a buggy provider and Cipher was causing this issue? That link references "EC", and I'm not sure what that is.

Any pointers and insights much appreciated!

And more specifically ECDH is the Elliptic Curve variant of Diffie-Hellman, used here for key exchange. Almost certainly in the form of ECDHE, ephemeral ECDH, but we can't confirm that from the information here.

You can't say "the" cipher on the server; practically all SSL/TLS implementations support multiple ciphersuites (abbreviated, imprecisely, ciphers). Normally the client offers a big list of suites that the client supports, and the server chooses the "best" one among them that the server also supports, where exactly what is "best" is complicated and there are (many) other questions on that. Even if I ass-u-me AD means Windows Active Directory, I don't know what suites that supports and I believe it depends on your versions of Windows and possibly of AD neither of which you stated.

Your Java6 attempt to host1 clearly offered at least one suite using ECDH that the server chose, but which failed to work in the Sun PKCS11 provider. I'm not certain about Solaris but the Windows and Linux Java6 distros from Sun did not include a builtin ECC provider and thus would not offer (or agree) any ECDH suite unless PKCS11 gives access to something that (allegedly) supported it. Java7 and 8 do come with ECC builtin, but if you have PKCS11 at provider position 1 it will still get preference.

Your openssl s_client negotiated a plain-RSA suite on host1. (The OpenSSL name AES256-SHA actually means TLS_RSA_WITH_AES_256_CBC_SHA; for historical reasons the OpenSSL names omit the RSA for plain-RSA key-exchange.) OpenSSL versions 0.9.* do not support ECC by default and would produce this result. (Technically you can get 0.9.8 to do ECC if you beat it enough, but I assume you would have mentioned that.) OpenSSL (upstream) 1.0.0 or greater supports all standard ECDH suites and prefers them, which I would expect to cause the server to select one. I know RedHat packages of OpenSSL omitted ECC until recently over patent concerns; obviously RedHat wouldn't apply on Solaris, but conceivably the (a?) Solaris packager might have done the same thing. It's also possible somebody tweaked your build to support ECC but not prefer it, and the server followed that preference. You might try adding -cipher ECDH:!aNULL and see if that succeeds in getting some ECDH suite and if so which.

Trusting wildly with Java: In any case, with openssl you don't need InstallCert. Do

echo Q | openssl s_client -connect $host:$port -showcerts \
| nawk '/--BEG/,/--END/{print>"anchor"} /--END/{close("anchor")}'

i.e. add -showcerts and select the last block of certificate data into a file, then

 keytool -keystore $YOURJRE/lib/security/cacerts -importcert -file anchor -alias $NAME

where $NAME is a brief name of letters and digits only mnemonic of your local authority (domain or whatever), and enter the password changeit and confirm.


How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM? I am studying SIEM tools.

Firewall logs will be different from IDS logs and even from Antivirus logs.

How can log aggregation take place?

The logs do not need to be the same. They do not even need to log data about the same types of information (although it can help). Aggregation is simply to gather the information together.

In a SIEM, what you are most concerned with are identifiable entities: users, IPs, domains, services, etc. Firewall, IDS, and Antivirus logs will contain information about these things, and that's how a SIEM can stitch together information.

For example:

IDS log: Known malicious traffic pattern from Source IP 10.10.10.9 to Destination IP 10.10.10.10 at 12:00 pm
Antivirus log: User Sun-IT disabled Antivirus scanning on IP 10.10.10.10 11:50 am
Firewall log: Source IP 10.10.10.10 sent a high volume of data out of the network at 12:05 pm

The logic in the aggregator pulls out the data fields to provide a timeline and a logic flow:

User Sun-IT disabled anti-virus on 10.10.10.10, which was then sent malicious content from 10.10.10.9, and then 10.10.10.10 sent large amounts of data outside of the organisation.
10.10.10.9 and Sun-IT are the suspicious actors (a decision support step)
quarantine 10.10.10.9, 10.10.10.10, reset Sun-IT's credentials and forensically investigate 10.10.10.9 and Sun-IT (this is an automation/orchestration step)

The logs themselves do not need to record the same information or even be in the same format. The data fields just have to be recognisable enough for the log aggregator to identify and stitch the data points together.


How a database connection makes mysqli_real_escape_string more secure? I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and multibyte characters but I don't get it fully. So my question is how database connection helps in making mysqli_real_escape_string function more secure?

As a note, before I say anything about this issue: please consider moving towards MySQLi or PDO with parameterised queries. Not only are they an order or magnitude more secure, but they're easier to work with and fully supported. The old mysql_ functions are now considered end-of-life and will soon be deprecated. (sorry, missed the tiny i from your original post... damn procedural calls!)

MySQL operates on strings. Strings are two things: a sequence of bytes, and a sequence of characters. The way that these two sequences map to each other is called a character set, which is specified by an encoding.

For example, ASCII maps letters, numbers, symbols, and control characters onto the byte values 0 to 127. Extended ASCII then adds more characters for the values 128 to 255. Other encodings, such as the UTF family (e.g. UTF-8) use single or multiple bytes to encode different characters. For example, UTF-16 characters can be encoded as either one or two 2-byte codepoints (i.e. each character is encoded as either 2 or 4 bytes).

The interesting part happens when you assume one character set or encoding, but the underlying data is actually encoded differently. For example, the East-Asian CJK character for "water" is 水, which is defined in UTF-16 as U+6C34. This encodes to 34 6C in UTF-16LE. Now, if we accidentally assume that the data we were handed is ASCII, we'd decode this as "4l" rather than the proper Unicode character.

Now, what if your front-end application (in this case PHP) were configured to use Extended ASCII, but your database collation was set to UTF-8 (e.g. utf8_general_ci), and your user's machine was set up to use the Windows CP1251 Cyrillic codepage? In an ideal world, each system would recognise the requirements of the target application, and convert appropriately. Unfortunately this is not an ideal world. The underlying bytes representing Cyrillic characters would probably get garbled into ASCII characters on their way into the PHP webapp. Then any high characters (128-255) might re-map to different byte sequences when the ASCII characters are converted into UTF-8, or may even form entirely new characters if accidentally naively translated into UTF-8 codepoints. In some cases, there are special rules that cause certain sequential codepoints (e.g. diacritic marks) to get combined into special-form characters.

In short: character encoding is voodoo. This is serious "here be dragons" territory. If you can get a sane response from anyone who has written a real string library before (they usually just scrawl "cthulhu ebcdic fhtagn" on your face with a magic marker and walk away mysteriously) then they'll probably tell you some truly disgusting things about the abomination that is our human language.

Why does this matter for stuff like mysql_escape_string? Well, let's say your PHP app is UTF-8 mode, but your MySQL server is running in ASCII mode. Your user types a ∻ character (U+223B) and your escape function says "well shucks, that looks fine to me, I just care about quotes and stuff". Your MySQL server then looks at those underlying bytes... oh, it turns out that 22 3B is an encoding of "; in ASCII. Whoops!

This gets worse when you remember those combining tricks. You can do things like apply a diacritic mark to a piece of punctuation, or slap that punctuation in the middle of some Arabic text, and it could get combined into a "combined form" character with a totally different codepoint when it is re-encoded. This matters when you're using different modern encoding formats such as UTF-8 and UTF-16 together.

The mysql_real_escape_string function attempts to save us from this hell by properly checking the string once it has been re-encoded in the target MySQL server's selected encoding. It needs a reference to the connection in order to retrieve this metadata from the server.

The most merciful thing in the world, I think, is the inability of the human mind to comprehend character encodings. We live on a placid island of ignorance in the midst of black seas of codepoints, and it was not meant that we should voyage far. The languages, each straining in its own direction, have hitherto harmed us little; but some day the piecing together of dissociated Unicode planes will open up such terrifying eccentricities of language, and of our frightful position therein, that we shall either segfault from the revelation or flee from the light into the peace and safety of EBCDIC.


Forgot password best practice for mobile applications There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either make users choose easily guessable answers to questions like "whats your favorite color?" or in case the user forgets the actual password, most likely he won't remember the security question either.

So we see many websites delivering password links via email, the login can also be enhanced with second factor authentication via email or text messages.

Threat Model

In our threat model, suppose we have a mobile payment application, and we want to protect the user in case his mobile phone is stolen or accessed via malicious actors. We assume that the mobile is broken into (there's no password set on the device), now if an attacker gains access to the device, most likely he also has access to the email address which is setup on the device, so he can request a password reset on installed applications and break into them, unless security questions are used but I'm against this solution because of aforementioned issues.

My question is, first, is this threat model valid, because I haven't seen it being taken into account in many mobile payment applications, and second, how hard would it be to protect against such attack scenario and what are the possible solutions since most of side channels (OTP, Text Message, Email) are setup on mobile devices.

You could ask for details about the actions the user has performed in your app.

Example: Show users a list of 3 popular merchants in the region out of which only one is used regularly by the user. Ask the user to select the merchant he has regularly paid using your app.

Options for trusted contacts like Facebook. The user can assign trusted friends or family members who will each receive a part of a recovery code if the user forgets the password.


How can I identify my phone call is being tracked or tapped? When I read about mobile call tracing, the hackers/security experts track and record mobile phone calls somehow.

Is it possible for us to identify that our call is tracked by someone or heard by someone?

You could try another old-fashioned way and disclose something specific on the phone, and nowhere else, that would be of interest to those monitoring you.

If that information is later used you will know your phones are being monitored.


How is "reliability" achieved in TLS? I read that, on TLS, each TLS Record (after the handshake) is "reliable", meaning, it cannot be tampered with.
I understand the handshake, but I don't understand exactly how "tamper-proofness" is achieved per TLS Record or TCP packet.
I have a suspicion that each record includes the HMAC of the record itself plus the session/master-key, but I would like to confirm that.
How is each TLS record "signed"?

The property you're referring to is usually called integrity.  In general, TLS uses one of two approaches for this.
The first approach, which is new in TLS 1.2, is called an AEAD (authenticated encryption with associated data) cipher.  This type of cipher both encrypts the data and generates an authentication tag that the remote side can used to verify the integrity of the data.  In TLS, the most common ciphers that are used this way are AES-GCM and ChaCha20-Poly1305, with AES-CCM used less frequently.
The older approach is to use HMAC in conjunction with an independent cipher.  As part of the generation of session keys, an additional set of MAC keys is generated to be used with HMAC.  TLS authenticates the plaintext and then encrypts the plaintext and MAC, instead of encrypting the data and then authenticating the ciphertext.  The former approach means that a variety of timing attacks on padding and MAC verification can be exploited if the implementer is not exceptionally careful.  The latter approach, called Encrypt-then-MAC, is preferred in the cryptographic community because it avoids those problems, but is not commonly used in TLS for historical reasons.  TLS 1.3 no longer permits this mechanism because of the potential for timing attacks.
In all cases, the data authenticated is similar, and includes the sequence number (and in DTLS, the epoch), headers, and data.  Authenticating this additional data, including the sequence number, prevents an attacker from replaying packets and is a best practice for cryptographic protocols.


Is there a security benefit to testing HTTP header presence with Javascript? I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If any header is not present, the library throws an exception. Is there a security reason to ever perform existence checks on HTTP headers?

It depends on the header, and on what the library is designed to handle. Let me go through each header and explain if it would make sense or not:

Does specifying Content-Type make sense?

Yes and no. It's certainly nice for the server to tell us that the response is in JSON, but it is by no means a requirement. It would make sense to throw an exception if the Content-Type was something unexpected, such as application/xml. However, to throw an exception if the content type was not specified seems overly strict. It doesn't give any security benefit either, since the application has to ensure that the consumed JSON was parsed correctly.

Specifying the charset is a "nice to have", as well, but I would wager defaulting to UTF-8 if no charset was specified should be the norm. An exception because the charset was not explicitly defined is overkill.

Does specifying X-Content-Type-Options make sense?

The X-Content-Type-Options header is designed to tell browsers "Don't try to figure out what this is on your own. Just trust my Content-Type header. Your library is not a browser, it probably doesn't try to figure out what kind of content it receives based on whichever parser doesn't throw an error. The fact that the library throws an exception if this header is not present likely indicates that the behavior of "Just parse whatever you get as JSON" is hard-coded, so demanding a header that tells the library to behave how it already behaves is pointless.

Does specifying Content-Disposition make sense?

No. The idea of Content-Disposition: attachment is to kindly ask the browser to download and save a file, rather than to display it. This can be nice if you want the user to download a file (e.g. a video), rather than to display it.

In the context of a JSON response of an API, this makes no sense whatsoever. Forcing the API to instruct the browser to download a response instead of displaying it inline just makes debugging harder. It's pointless, it makes your life harder, and it has no security benefit whatsoever.

Does specifying X-Frame-Options make sense?

No. The idea of X-Frame-Options is to prevent clickjacking. An API response is not an interactive website, and it makes no sense for an API consumer to demand this header to be set.

So, what should I do?

Remove these checks, plain and simple. They don't add to security and reduce compatibility.

The only checks that might make sense is the Content-Type header, but even then I would only throw an exception if the content type is something other than application/json, meaning that the server bothered to check and is sending something that the library knows it can't parse.


Does accessing a personally owned Tor node (that only you ever visit) over the Tor network break anonymity? Does accessing a personally owned Tor node (that only you ever visit) over the Tor network break anonymity?

I read from a long guide by Whonix on how to properly use Tor that I shouldn't ever access small personal clearnet websites over the Tor network (e.g. personal blog). For obvious reasons this is bad because you would be a be a likely visitor of your own blog and that information could be used by the exit node to deanonymize your entire Tor connection.

So, what I want to know is if the same thing applies to Tor nodes you operate. I run my SSH over Tor and was curious. (I use Qubes-Whonix if that's at all relevant)

Thank you! :D

No!

This is exactly what Tor hidden services are designed to accomplish.

Nothing is absolutely safe and given enough worldwide oversight and resources, Tor is vulnerable in theory. In practice the vulnerability bar is very very very high.

If you are the only user of your hidden service, you may want to make it a "Stealth Hidden Service". This requires an additional key in your Tor client, so it doesn't scale well and may limit how you chose to use it, but it adds yet more anonymity by making it difficult to identify that it exists even in the master hidden service directories.

One seemingly counter intuitive aspect is: do NOT use HTTPS on your hidden server! The Tor connection is already multiple encrypted so you don't need it for security. Worse, it may result in your client calling outside Tor to check the certificate authenticity which only you use, that might compromise your anonymity.


Benefit of having multiple DH moduli of same length? What is the benefit of having multiple Diffie Hellman moduli of the same length in OpenSSH's moduli file?
In the distributed moduli file there are around 40 primes for each length to choose from randomly...

In contrast, when using OpenSSL it seems to be sufficient to be only use a single modulus.

Having only one moduli of some length makes Logjam attack feasible, because the attacker can make pre-computation of parameters for given moduli and them break the communication in fraction of the time needed without the knowledge what will be the prime used.

Having more primes (and of course long enough ones 1024 b and more) mitigates the attack, because even running pre-computation is really expensive operation and making it 40 times is usually blocker.


Disable Encrypted Protocols Through Firewall In my company, we have two internal domains with a firewall between them. When requesting firewall rules for an application with components on domain A and domain B, I was told that encrypted protocols were not allowed through the firewall. (e.g. HTTPS 443, SSH 22).

The rational was that hackers could potentially tunnel over an encrypted protocol and packet inspection would have limited functionality.

Is this a normal practice?

Is this a normal practice?

Well, it's more common (in my limited network security experience) to force the installation of a man-in-the-middle root cert on all clients on that network and then run a tool that uses the MitM certificate authority to decrypt and inspect TLS traffic. This doesn't work perfectly for some programs (which may use certificate pinning or have their own certificate stores) and is TLS-specific (there's an equivalent you could do for SSH, though I've never seen it done).

  (You didn't ask, but) Is it a good idea?

Honestly, if it's being done by port filtering, it's pretty trivial to bypass. There's no rule that says SSH must use port 22, or HTTPS (never mind any other TLS protocol) must use 443; those are merely the defaults. I could simply set up an external SSH server listening on another port, then SSH to it and use it as a proxy to bypass the monitoring. You can't even do this by simply whitelisting ports; so long as I don't have anything else (like a web server) running on port 80 on my machine, I could set up my SSH server to listen on that port.

It's much more effective to restrict connections - especially outbound ones - in general. Only allow them with the specific combinations of addresses, ports, and protocols that are required, and nothing more. If you have some specific reason that your machines need to make outbound connections to UDP port 9670 on the 233.14.98.128/25 subnet (all numbers sourced rectally), you can allow exactly those connections and no others.


Php Wso Shell and Simple Shell returns Blank Page - Why? I just uploaded a simple shell as well as a WSO shell on a web server for running shell command. But the php file seems to open a blank page. Any Ideas why's this happening?

In the PHP realms the blank page you are encountering is also known as the WSOD (White Screen Of Death, most probably in reference to Windows' Blue Screen Of Death).

This issue happens when the PHP engine encounters an low level irrecoverable error while no output has been produced yet. The most common cause of the issue it when the PHP file contains a syntax error making parsing fail.

This syntax error is usually caused either by the webshell using a syntax not supported by the PHP version running server-side, or by an incorrect invocation of your PHP code (this is mostly true for PHP injection techniques, but your question gives me the impression you are simply uploading a raw PHP file).

Note that while this are the most common causes, there can be other causes as well, mainly related to specific settings which may have been applied on the remote server.

The solution to get around this is to limit your features to the ones you really need and implement them in a way supported by the remote server. This can be manually attempted by trying to manually create PHP one-liners such as <?php eval($_GET['cmd']); ?> which will attempt to execute any command you provide as cmd GET parameter.

BTW, if you like you can also give a try to my own attempt to write a PHP web-shell targeted at just getting the job done and done right. I wrote it out-of-frustration of several issues I encountered with other more "featureful" web-shells. Feedbacks are welcome ;).


Email Spoofing Modified Headers I have be reading more and more about email spoofing and was curious how some things are done.

I know in PHP you can simply do mail() and then include "From: spoofsender@provider.com" for example, but how would you spoof the whole header?

Info such as sending IP address for example etc.

Thanks

Modifying headers can be done like this:

$headers = "From: <$email> \n";
$headers .= "X-Sender: <$from>\n";
$headers .= "X-Mailer: PHP\n";

But if you want very detailed information on headers, check this out...
http://kb.mediatemple.net/questions/892/Understanding+an+email+header

EDIT: Keep in mind that spoofing your headers will highly decrease the chances of your email arriving to the user inbox, if you are unlucky, it won't even show on the receiver's spam folder.


Why is shared less secure than open when it comes to WEP? According to this post, Jeffrey Tippet (Microsoft employee) writes:

  WEP can run in two modes: shared and open.  Despite the names, shared is actually less secure than open.  Because of this, our
  telemetry shows that that only 0.1% (and declining) of Windows 7 users
  connect to these highly-insecure shared WEP networks.

  In order to simplify Windows, make it easier for people to pick more
  secure defaults, and to enable us to focus on improving the wireless
  networking that the other 99.9% of our customers use, we removed
  shared WEP from Windows 8. Windows 8 continues to support open WEP. We
  recommend that you configure your AP to use open WEP, as it's more
  secure and more broadly-supported.

However, there isn't an explanation as to why shared is less secure than open. Why is this the case?

Shared would send a plaintext query to authenticate clients which would be encrypted and returned. This left the key vulnerable to a known-plaintext attack.

Open would allow anyone to authenticate, but wouldn't pass plaintext around, making the key harder to guess.

Here and here are links to more details.


How to protect my API endpoints I have an API written in nodejs and I have a frontendapp written in angularjs. I want my API to be called only through my frontendapp and not from any other source.

e.g. I have an endpoint called myhost.com/posts/id and when the method is delete it deletes the posts. I dont want an attacker to access this end point and deletes my posts. How can I prevent it?

I believe that this is not possible in a failsafe way, unfortunately. Let me explain why.

You want your frontend app to have a way to identify itself to the API. In other words, you want authentication.

But authentication requires the existence of some kind of unique, secret data that the frontend app can use to distinguish itself from other applications. This can be a shared secret (password, "API key"), a private asymmetric crypto key, or something else yet. But whatever it is, it has to remain a secret, since if another app can copy it, it can pass as your frontend app.

So the question is, where are you going to store that secret?

If it is stored inside of the application code itself, or directly accessible to it, then it is vulnerable to reverse engineering or exploits on your front-end app, no matter how many layers of cryptographic indirection you use to hide it. This is the fundamental security flaw that led to the failure of almost all DRM schemes devised to date.

If it is stored on some tamper-proof location of the client machine (e.g. TPM chip, trusted OS key management facility), then the question becomes, how does it get there initially? And how are you going to access it from Javascript code, which has limited low-level OS access capabilities?

If it is stored remotely, then you are only shifting the issue of app authentication elsewhere: how is your front-end app going to authenticate on the remote server? Or in other words, what is preventing another app from accessing that remote server in exactly the same way?

My conclusion is that there is no truly secure way to authenticate a piece of JS software. You'll have to design your API in a fashion that is secure from malicious client input and, if you do want a way to ban compromised clients anyway, provide clients with revocable "API keys" that you can easily ban on the server side, the way most web services (and newer DRMs) do it.


In Oauth what is the benefit of the access token being opaque Why was the decision taken that the Client doesn't need to be able to parse the access token?

It seems to me that if the token included, in addition to the current fields, a client_id and a user_id, it would make life much simpler, prevent spoofing, enable authentication, etc.

I've noted that as per section 1.4 of RFC 6749 it does not HAVE to be opaque, but it seems to me that much of OpenID Connect, if not all of it, is a way of making the Access Token into something meaningful.  Yes, it adds an ID token, but the fact that it is implemented as something accompanying in stead of embedded in the access token does not change this fact. It seems every video, tutorial and blog post talks about it as if that is to be assumed to be the case (that access tokens will be opaque, because "The client is not the intended audience") ... And yet it is the API or resource provider who cannot establish authentication based on the the bearer having the token.

Actually I need to add that I don't think the token being opaque to the client is the problem.  The problem is that the token is a bearer token that doesn't restrict WHO can use it.

In OAuth, or any other protocol where the token can be opaque or transparent, the benefits and risks swing based on what your desired result is:

If you want the client to be able to parse the access token, you need the token to be transparent.
If you don't want the client to be able to parse the access token, you need the token to be opaque.

Indeed, this is the definition of opaque and transparent tokens; the client can see into them, or not.

If your token is transparent, you must sign it, otherwise, anyone could simply edit your token contents, and claim anything they want.

So, the first obvious benefit of having an opaque token is that you can just throw away any signing mechanism; you don't need it, and conversely, if you have a proper transparent token, the client can read the token, but not edit it.

Another benefit of having an opaque token is it is more secure; No encryption method is truly random (i.e., there must be a way to decrypt it), meaning you can always tell which encryption protocol is used if you can read enough of the contents of the tokens (transparent tokens).  This itself reduces the time to identify your cipher (knowing the protocol).  Many people don't think this is very risky, and indeed, if you use more than 80 bits of entropy, they are right (10 truly random characters for your cipher, i.e. "secret key").

However, and this is much more of a risk; transparent tokens allow crackers to play with the contents (because they see them), and some protocols have serious weaknesses that allow you to create collisions or even decode the cipher in a much shorter period because the cracker will know the protocol as well as the contents of valid blocks (most encryption protocols use 16 byte-long blocks, so if your token contains 160 chars of data, you've given the cracker 10 valid combinations to your cipher. This decreases the time it will take for them to identify your cipher by an order of magnitude.  Giving them more transparent tokens will further reduce this time as well.  Some protocols have a reduced version of this risk, but by the nature of what encoding is, having the encoded block, and decoded block both in your hands, you're always going to make it easier to break.

This is why many choose opaque tokens.  Indeed you should always opt for opaque tokens if there is no need for any external entity to be able to parse your token.  An example of this is a service framework in which you only pass the token to the service as a blind claim; you have no idea what it says, but you know it works and identifies you.  It is only up to the service to confirm it's you via the secret key or cipher.

Opaque tokens also don't require signing, which I mentioned above, they also don't require divulging anything about chosen protocols.

For this reason, they are much more secure, not only mathematically and logically, but get rid of human implementation errors, which is, to be honest, 99% of the reason cracks are ever made in the first place.

Interesting note

Even true randomness means a 36.7% loss (1 divided by e) of combination space when randomly guessing. This means a 1000 possibility combination lock, if guessed randomly, actually has a 1 in 630 chance of getting it correct.

So 1 / e is the absolute best chance you have, and that is pure random.

Any "possibility" that is interesting to a human, "information", is not truly random by definition, and worse, any protocol that is used to decode it, gives up some possible space for the cipher by the way the protocol works.  So, in reality, your chances of randomly guessing an answer is significantly smaller than the entropy or combination space most people talk about or think they actually have; it's usually, when all accounts are measured by a good hacker, at least one order of magnitude easier than a layperson thinks.


Bettercap 2.x SSLStrip Is Not Breaking TLS (Without HSTS) I have the latest version of bettercap. I have the latest version of Kali linux using the latest version of VirtualBox on the latest version of Windows 10. My target machine is the lowest possible version of WindowsXP with the default IE and Chrome installed. I will first start by going over what I think I know and troubleshooting I have done. Bettercap appears to be functioning in the sense that it can grab passwords from normal HTTP websites but not HTTPS websites.

What I THINK I know.

-SSLStrip converts HTTPS to HTTP

-SSLStrip will not work on anything that has HSTS preloaded

-SSLStrip will only work on non-preloaded HSTS websites if and only if the user is visiting it for the "first" time.

-SSLStrip will work against TLS and SSL if HSTS is not used

-If HSTS is not implemented, A victim doesn't need to do anything specific or be tricked into installing any certs.

-SSLStrip will attempt to redirect ALL HTTPS websites the victim visits to their HTTP counterpart.

What I Want To Do
-Monitor the victim's computer's traffic

-Get the victim user to go to my personal LAMP server, click the login page I wrote myself and receive an HTTP version of my domain. (more accurately http://accounts.shopify.com)

-Get the victim user to go to a real non HSTS website like shopify.com, click the login page and receive an HTTP version of http://shopify.com (more accurately http://accounts.shopify.com)

What I have done

I used a typical install method

apt-get install bettercap

I have been following this website

https://www.peerlyst.com/posts/bettercap-2-x-mitm-framework-general-info-examples-cyberpunk-1

I have used these commands once I activate bettercap

» set http.proxy.sslstrip true
» set net.sniff.verbose false
» set arp.spoof.targets 192.168.1.6
» arp.spoof on
» http.proxy on
» net.sniff on

What is working

-Can successfully redirect victim traffic to the attacking device

-Can successfully grab headers

-Can successfully display the password when I enter it in non-HTTP websites

What is NOT

-The part where HTTPS is supposed to automatically be converted into HTTP

So guys, I feel like I'm missing something essential. This sounds too straightforward of a process to fail. So what is it? What am I missing?

after a lot of searching I just found out that Bettercap 2.x apparently just does not do the HSTS bypass thing.
The sslstrip from the http.proxy module works just fine, I've tested it on my network, all the HTTPS website where now HTTP, however Chrome, Firefox and so on block them cause you visited them once with HTTPS, some website are still visitable by clicking the "Proceed (unsafe)" button, for for https://google.com and/or https://facebook.com the button just won't show up.

With Bettercap 1.x HSTS bypass was basically working because it was changing the URL in order to make the browser think that this is the first time you visit that page, and so https://www.google.com become http://wwww.google.com

And well... that HSTS feature is just missing apparently, or it's well hidden cause I've not found any answer or article using it in Bettercap 2.x.

(Sorry, I would have commented instead of posting an answer, but I did not have enough reputation. Also, sorry for any stupid grammatical English error, it's not my main language.

Any help in the comment for that is really appreciated, Bettercap 2.x it's supposed to be better than 1.x, but if it does not have HSTS bypass it's pretty much useless...)

UPDATE:

After some testings, I managed to make Bettercap use the HSTS Bypass.
By running ARP spoof, DNS spoof and the sniffer module it works fine (enabling ssl strip in the modules).
This way, I got the URL modified into http://wwww.google.com
Unluckily though, the latest Firefox blocked all the web pages, still trying to get it right.


How do shared IP addresses work and do they give privacy? I assume "shared IP addresses" work by NAT, because obviously two devices with the same IP address need someway to distinguish them.

I've seen some privacy advocates boast they have "shared IP addresses" making it impossible
for someone to track their activity.

For example

  IPVanish takes an interesting approach to privacy and security. They
  use shared IP addresses, so when they say no one has any idea what
  you're doing when you're connected, they mean it.

Is all that is happening that connections on a specific port go to a certain computer and in that sense, while knowing the IP address isn't enough, knowing the port and IP would uniquely identify a computer? And IP packets contain the source/destination port so this really isn't saying much.

NAT stores connections into a tuple in its NAT tables, for lack of typing an RFC like answer, works like this: Assume you and I are on the same network

You (10.1.2.3 internal) --> router/firewall 10.1.2.3:80 internal 1.2.3.4:1000 external
Me (10.1.2.10 internal) --> router/firewall 10.1.2.3:3000 internal 1.2.3.4:2000 external

When you make a connection anywhere, the device performing NAT stores info as a port (tuple) both inside and outside. When you leave, and come back, it matches this tuple. This is how both you and I, and others on the same network, can all visit Google simultaneously with the router/firewall knowing to send: "Pokemon" searches to you, and say "Cupcake" searches to me.

There is minor privacy behind NAT. While the average person will see one address, anyone with access to the firewall/router can pinpoint who did what. Further, on the public side of the equation, there have been discussions concerning the reality of privacy and NAT. See: "A Location-Privacy Threat Stemming from the Use of Shared Public IP Addresses"

Also see: "Analysis of Solution Candidates to Reveal a Host Identifier (HOST_ID) in Shared Address Deployments"


not allowing pasting of bank account number One of my credit card's bill paying site has an incredibly annoying limitation... it does not allow the user to paste in the bank routing and account number.  Therefor, every month I am forced to manually type these numbers in (twice!).  I have other credit cards and bills and none of them have this limitation.  Is there any security advantage to the one bank not allowing pasting?

The problem isn't with pasting, it's with copying confidential data. The copy buffer isn't a protected resource and can be accessed fairly freely.

That said, account and routing numbers aren't really confidential as you give them out on every check so this idea sounds hair brained. Perhaps they do this to give the impression of security to less informed users? Perhaps they're just really confused.


How to evaluate anti-virus solutions Some people want to know what is the "best antivirus", I am a little disappointed and it's difficult for me to answer this question. I think Windows Defender is good but I can't give arguments. How can I answer this?

Normally when doing a product evaluation you look at multiple factors:

What do you seek as minimum features to achieve the desired outcome (e.g. centrally managed, easy deployment, offline/online updates, HIDS/HIPS support, file integrity monitoring, etc...)
For AV specifically you want to look at coverage, this can be seen in most comparison websites (e.g. after submitting x amount of samples, how many were detected)
How fast do they update their sources
What's the cost

This is what I would normally put as part of an evaluation for AV.


Trust level of whole disk encryption software For example, if we take this software into account:

Symantec Endpoint Encryption
Sophos Safeguard Encryption

How can we trust suppliers of whole disk encryption software in the lights of the recent NSA events?
Are those providers really "secure" or do we miss something that should be obvious?

These are the only players with mac os x support, which is my main operation system.

I guess it depends on what your threat model is, if the NSA are after you as a person of interest, full disk encryption is the least of your problems, you should probably just stick to a one time pad and abacus.

If you want to keep a potential thief from accessing your documents if your laptop should get stolen, any of the closed source full disk encryption packages will do.

If you're really worried about it, just double up, use full disk encryption from one of the vendors then encrypt the sensitive files with an open source tool as well, the more layers you add the harder it becomes to compromise.

Fyi, Mac has full disk encryption built in: system preferences > system & security > file vault. (Just don't backup the keys with apple)


Are there risks associated with using a free SSH server? So basically I was looking on the Internet for free SSH server as I wanted to exercise some Linux commands and I only have Windows installed on my laptop.

I saw so many Free SSH servers on the result pages that I started to wonder if there are any risks associated with using one?

OpenSSH is one of the implementations of SSH (like Dropbear for example).

SSH is a protocol to securely connect to servers.

Now, I just searched for "free ssh servers" and the results you are seeing are rather VPN services.

If you want to mess with SSH, just get a Linux distro and play with it (really nothing to do though)


Is upgrading key-stretching algorithms and/or repetitions a thing? Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc.

Well the web evolves, and over time more advanced security measures become expected and common place. Key stretching, more advanced hardware, cheaper hardware, etc.

Lets imagine that not all of your customers log in every year. You don't care how often they log in, if they created the account in the 90s and want to access it in 2014, thats perfectly fine. But you want to upgrade their security.

Imagine an evolution in security where you go from a simple SHA hash, to PBKDF, to Bcrypt, to Scrypt, and into the futureCrypt. Throughout this evolution, you increase repetitions and any other configurable values that may come into existence as hardware increases in power and affordability.

I guess

1) do people do this, is this a thing?

And

2) What are the current strategies or theoretical strategies for upgrading password security in such a way?

Upgrading passwords hashes is a thing. Indeed, as per password hashing theory, the iteration count in a good password hashing function (e.g. bcrypt) is a trade-off: you make the function as slow as you can tolerate in your current context. When you buy new, faster hardware, you can increase the iteration count, and thus you should. The iteration count allows to counter the effects of Moore's Law, but this works only as long as the count is indeed regularly increased.

The generic method is to wait for the user to come back, and re-hash the password with the new parameters (or even new function) at that point where your server indeed obtains the password and can work on it. People who do that often couple it with an expiry policy (accounts which have not been accessed in two years are closed or at least "frozen").

If we want to do more, i.e. upgrading password hashes in an offline fashion (without waiting for the user to show up), then we have to put our hands in the crypto. One can devise some nesting hashing mechanisms as described in this answer, but that's crypto design so one should be extra careful and basically refrain from it. Generically, you "hash the hash" to (temporarily) strengthen a hash value until the user comes back.

For the ongoing Password Hashing Competition, the call for candidates listed as desirable feature:

  Ability to transform an existing hash to a different cost setting without knowledge of the password.

Such a feature requires a specific internal structure. Some PHC candidates offer it, e.g. mine.


How to include HSTS policy in dns replies packet I want to protect the clients from sslstrip attack. HSTS should be used.
But HSTS does not protect the first visit of the client to the server.
So I want to include HSTS policy in dns replies and send to clients that are requesting.
Is it possible?
If possible, how to implement it?

Not with the current standards and norms, to the best of my knowledge.

The most obvious DNS Query is the A record and I don't see a direct way to incorporate HSTS there - unless it is included in the additional info section of the DNS Response.

The other alternative (and most used/abused bit of DNS) is the TXT record.

Since there is no standard, de-facto or otherwise, it does need widespread browser implementation before it can work. I don't know if there is enough motivation to do this, because of the available option of HSTS Pre-load (see here, here and here). It is fairly easy to ask to preload your domain on to the major browsers. It is also easy to break your apps if you miss renewing / getting certs for any of your infra - after you get into the list (yes, it seems to happen more frequently than we think).

We could argue that wiring it into DNS is better plumbing (giving the earliest opportunity) but given the difficulties DNS has had over the years in its attempts at security (DNSSEC in particular), it has its issues.

So for now, HSTS-PreLoad is the practical, available and widely implemented, if not perfect solution; not DNS.


WPA PSK to WPA EAP PSK roaming Would clients (iPhone, android, whatever) roam seamlessly from an AP using WPA-PSK to an AP using WPA-EAP-PSK (with PEAP passthrough setup) if the same PSK was used and valid on both APs (AP1 and AP2 radius)?

Further elaboration:

1) I would like to set up AP1 to use normal wpa2 psk. A user connects and types in their passphrase to log on.

2) I would then like to set up AP2 to use EAP. But I don't want the user to type in a username and password, I just want their passphrase to work.

Can AP2 / its radius be set up so that it authenticates the users passphrase without a need for username and password and to just let them on so they continue roaming seamlessly?

Basically, on our network, some APs have a 'hard coded' passphrase that we want to add to our database and be able to let them on other EAP APs.

Is this possible?

If certificate its the same, WPA-PSK without EAP uses key and not certificate. Shoud run without problems.. mechanism are both same but difference in certificate and user and password added for more security. WPA-PSK are Encryption method and EAP add just user and password to. In other words.. EAP its designed for a Corporative Networks that require much security.


Can a provider allowing 2FA with a Yubikey identify me if I use the same key for different accounts? I was wondering if someone providing a service can identify me (other than by IP, browser fingerprinting etc.) purely based on the code generated by the Yubikey when I touch it, if I use the same Yubikey on two different accounts.

I.e. will the provider know implicitly that the same Yubikey was used?

With Yubikey's alphanumeric one-time passwords, yes:

Each Yubikey had a unique public identifier. The authentication server must know this ID in order to select the correct AES key for the OTP. The proprietary Yubico OTP protocol should no longer be used.

With FIDO U2F, no:

The Yubikey creates a unique keypair for each combination of device+user+service. This is described in the Registration section. The FIDO protocol is newer and focuses on both secure authentication and user privacy.


How can I publish text and video without revealing my identity? Let's I want to publish online

a fiction book and
a series of videos for promoting it.

Let's further assume that the book challenges some widely held views and it is possible that people will hat me for that. However, no part of the book breaks any law (i. e. there are no threats in that book, nor appeals to violence; I can prove that it was me who wrote the book).

How can I make the book and the videos accessible to a wider audience such that

my identity cannot easily be revealed, nor
the identities of people who read the book and view the videos?

Note that the protection is meant against co-workers,  employers, and neighbors who may not like my views. It is not a protection against the authorities.

This is an extremely broad question and it depends on many factors. You'll need to adopt a pen name. This name must have no relationship to your name or your interests. If you like video games, you must not use a Mario reference, for example. Do not interact with your pen name either. That is, do not even mention that you (the real and public you) know that the book exists. This is called OPSEC.
You might want to manage the videos and publish the book while using the Tails live DVD.
Anonymously publishing a book
Avoiding attribution with the book requires you pend special attention to resist stylometric attacks. There are dozens of research papers on how to do this, as well as tools to assist with it. The general idea behind stylometry is that everyone has a unique writeprint, and with sufficient text, it's possible to uniquely identify individuals. It's a very powerful technique using multiple methods and can accurately identify if two texts are from the same individual in a set of nearly a million. Avoiding it requires adhering to strict writing rules. Stylometry is a bigger deal if your adversaries are sophisticated.
If your neighbors, co-workers, etc. have access to a large number of "sample" texts from you, they will be able to use simple and public tools to determine how likely it is that this book was written by you. I do not know how sophisticated they are or how dedicated they are into proving authorship.
Anonymously publishing a video
It's more difficult to hide your identity when creating a video. If you expect any level of sophistication behind those who want to identify you, you need to use a throwaway camera. The reason for this is that every camera lens and CCD sensors have unique artifacts that may not be visible to the naked eye. These artifacts can prove with absolute certainty that two videos come from the same camera. Other than that, it really depends on what the video will be of. You'll need to avoid having anything that can identify you in the background, for example. It's also vital to strip EXIF data, if present.
Protecting the identities of your readers
Unless someone is purposefully trying to remain anonymous, they are going to be identified. You can perform the most basic privacy measures like hosting the video on a site which does not keep or publish logs and using a distributor who does not require personal information. Even then, you must expect some of your readers will talk about your book with their real name on social media.
At the extreme end, you can publish the material through a Tor hidden service. This is a special domain which can only be accessed over the Tor anonymity network. Naturally this will alienate some readers, as not everyone will be willing to download a new browser just to read your book, but it will guarantee that, by default, everyone who views the material will leave no trace of doing so on their computer or in their ISP logs. Obviously, this doesn't prevent someone from disclosing that they read your book...


How Can I Prevent Hackers From Spoofing TCP messages onto my server? I have a Python client and server communicating over a TCP socket - they send and receive a certain set of standardized string commands to each other.
How can I prevent a hacker from creating their own client that sends the same kind of string commands (but with their own values) to the server?
Is it right that I can assume the hacker has access to the TCP messages being transmitted/received, but not the individual code that is being executed (if I only give them the executable)?
I'm new to network security and wanted to decide how best to design my network communication scheme.
Idea - I was imagining that I could possibly encrypt the messages before sending and decrypt on the server (assuming the hacker can't find any of the keys in the source code?). Is this a secure way of going about it and am I on the right track?

Never trust the client. If the client has a local copy of your application, they can do many things to manipulate and reverse engineer it. You can possibly slow down and discourage this by obfuscating and encrypting/packing the code, requiring certificate pinning, employing anti-debugging techniques etc., but a determined adversary will not be delayed for long.
Instead, focus on the server side. Make sure users are properly authenticated before they are able to interact any further, and check if they are properly authorized for every action. It is especially important to validate their input; since you can't trust the client, you should expect to receive invalid input. Any critical code (business logic, authn/authz, secrets, proprietary code) should be solely located on the server side. If the application is designed correctly, you shouldn't need to care about having rogue clients.


How should I use Facebook while giving as little information as possible? As a college student, Facebook and Messenger are virtually necessary to have in my life for communicating with clubs, classmates, finding housing, and more. As much as I want to get rid of them, it's not an option. Still, how can I reduce the amount of information they glean from me as much as possible?

I'm not worried about them seeing my activity while I'm using Facebook or Messenger as that's unavoidable, but I'd like to avoid information from third parties being sent to them or associated with my Facebook account somehow.

The main thing I'm worried about is browser-based tracking. I am only logged into Facebook on one browser (Mac Safari with adblocker) across both my computers and mobile devices. I also have the Facebook and Messenger apps installed on my iPhone with as greatly restricted permissions as possible. Assuming I want to be able to use Facebook from my phone and I can't delete the Messenger app, is it better to use the Facebook app or log in through Safari?

If I'm logged in on Safari, then they can track me on other websites I visit more easily. Is it ignorant of me to assume they can't do this if I've never logged in through the browser?
I don't trust Facebook not to do sketchy stuff through their apps, but I can't delete the Messenger app because I need notifications. Is it ignorant of me to assume that anything Facebook can do with two apps they can do with one app (Messenger)? If that's true, then keeping both apps and not logging in through a browser seems like the "safer" solution.

I have a pi-hole and use it for adblocking. I can't straight up block Facebook domains, but is there any way it could be useful (e.g. block Facebook requests from certain devices, apps, websites)?

I know 99% of the data Facebook collects on me is out of my control, but I'd still like to minimize the remaining 1% as much as I can. Thanks!

Update: Per Jeroen's suggestion, I have quarantined Facebook to Firefox. Going above and beyond, I have set Little Snitch to block ALL requests to Facebook from my entire computer, with the exception of Firefox. I also have it set to block all requests from Firefox to any site but Facebook and a few others (Mozilla, DDG, CDNs, etc.). I also changed my user agent on Firefox because why not. Hopefully this helps keep Facebook separate from the rest of my online presence. For now, I'm keeping the Facebook app though.

Here are some habits I've implemented in order to limit Facebook's reach on my personal info:

I have a browser dedicated to using Facebook and Instagram (which is owned by Facebook) and don't use it for anything else
I have one of those anti-track plugins on my main browser that basically removes any known embedded trackers (Google Analytics, Facebook share buttons etc.). Remember, Facebook builds a profile on you even when you're not logged in.
On my phone, I only use Messenger Lite and if I need to use Facebook, I log in through the browser, using a private tab.
If you have an Android phone, disable chat heads.
Disable as many permissions to the Messenger Lite app as you can afford. Especially location.


We saw URL-decoded PHP code. What does the code mean? We saw URL-decoded PHP code that will probably try to take down our web servers via overflow attack, but we do not know exactly what it does.

The decoded URL string is:

/<?php echo chr(78).chr(69).chr(84).chr(83).chr(80).chr(65).chr(82).chr(75).chr(45).chr(80).chr(72).chr(80).chr(45).chr(48).chr(45).(44353702950 (intval($_GET[997])*4567)).chr(45) ?>

I tried converting the string and ended up with:

NETSPARK-PHP-0-0-

It is  testing payload for code injection bug by the tool netsparker. Someone might have started the tool on your site to test for PHP code injection.

As can be simulated on writephponline.com :-

url: http://www.writephponline.com/?997=7876876

payload:-

echo chr(78).chr(69).chr(84).chr(83).chr(80).chr(65).chr(82).chr(75).chr(45).chr(80).chr(72).chr(80).chr(45).chr(48).chr(45).(44353702950*(intval($_GET[997])*4567)).chr(45);


Authy asks for the recovery password without a reason. Is this normal behavior? The last time i opened the Authy 2FA app it showed a message telling me to enter my recovery password. The title of the message window was in all-caps and said something along the lines of "Enter your recovery password as a help so you don't forget it". Is this normal behavior or is something sketchy going on?

This is normal behaviour, and a sensible idea. If you don't use the password for a year or two, and then suddenly need it, you're quite likely to have forgotten it.


Do home video surveillance cameras work as deterrents? After an alarming uptick in automotive and household burglaries, Our neighborhood is chatting about installing video cameras on their houses.

I'm looking for research that shows whether or not they work as a deterrent. Does crime leave the neighborhood, just move in-between the lenses, or do criminals ignore them? What is the saturation level that they need to reach in order to be effective - does everybody need to have them, or will every-third-house be enough?

There's a lot about public systems, but I'm looking for specific numbers, for deterrence, for home systems. "Common sense" would suggest that cameras are more effective at deterrence than public systems, but I would like to test that hypothesis.

Studies show that the deterrent effect of security cameras is minimal.

Moreover, the question is whether are you trying to deter crime in the whole neighborhood or just in your house. If it's the latter, it makes sense to put up a CCTV in your home if other people haven't -- this will likely shift the interest of the burglars from your home to your neighbors'.

If it's the former, hiring a security guard to roam the neighborhood would probably be better in terms of cost/benefits.  A neighborhood watch program might also be effective.

Yet, this largely depends on which country/city you live. The local police, knowing the territory, should be able to give you good advice.


Can using simultaneous intrusion detection systems (IDS) create conflicts? Can simultaneously using 2 or more intrusion detection systems (IDS) on the same computer or network create conflicts ?

Talking about tools (as examples) such as but not limited to: tripwire, bro, aide, psad, rkhunter.

Thanks !

Yes, according to my research you can use multiple IDS on the same computer simultaneously.

  If you are paranoid and have sufficient free time to read all the
  email, you will be happy to hear that multiple HIDS tools running in
  parallel do not get in each other's way. In other words, you can run a
  combination of Tripwire, AIDE, AFICK, Samhain, and OSSEC on a single
  computer and let the systems monitor one another. But some caution is
  advised: Updates that arrive at the same time can easily send the
  system into an infinite loop.
  http://www.linux-magazine.com/Issues/2016/183/Host-Based-IDS/(offset)/3#article_i4


How serious is the hardware threat? I am considering upgrading my computer and from what I understand the newer motherboards have soft flashable firmware. This raises the possibility that a hack could infect the firmware on the machine, which could include the UEFI, the memory controller, drive controllers and other hardware components. If this true, then if my machine gets hacked I can't just wipe the drives, I have to throw out the whole machine.

Is this a justifiable fear? Is there anything I do to mitigate it? Are there any modern motherboards that do not have soft flashable firmware components?

Signed Updates Not Reassuring

As far as "signing keys" are concerned they are worthless because it is easy for hackers to get them. For example: http://www.eweek.com/security/sony-left-passwords-code-signing-keys-virtually-unprotected.html. That is just a published example. On the dark net signing keys for many manufacturers are traded like candy.

The threat depends on who your adversary is and the way the firmware is protected.

Case A: Signed Firmware:

Some people have more resources for example if the threat is from government based malware (who may be able to coerce the manufacturer to hand over signing keys) then it's a more serious threat then if you are concerned about some random malware developer. The threat still exists but on a smaller scale.

Case B: Write Protect Screw:

Some motherboards have a "write-protect" screw that you must remove before the firmware can be adjusted. While this doesn't provide the same type of security it does ensure that you can't be attacked except during a timeframe you know about. That being said you'll have to know Thow to inspect your motherboard for a removed write-protect screw.

On the subject of mitigating an attack:

I would take the advice in the comments and require that all future updates are signed. For past attacks though your best case would be to manually flash a new safe copy of the firmware through another device. (It'd be a nice hands on activity however I'm not able to provide assistance nor instructions on this type of activity as I do not have the experience to do so).

Severity of the threat:

The threat is difficult to remove however it's a very targeted attack and since there are so many different types of computers the attacks have to be extreamly targeted and are out of reach for most malware developers. If a large group got together with a lot of funds they might be able to mass target multiple computer users but it'd be an extreamly expensive attack to pull off and it wouldn't make enough of a payout to justify the initial cost of doing so. It's easier and by far cheaper to mass target a specific vuln and keep attack new users.

Please leave a comment on my answer if you have any questions about my answer and/or need further clarification on anything :)


How to securely share key between two remote devices? Assuming I have a server/client topology, currently I'm facing the problem that I want to generate some key on the client side and somehow make the remote server get it securely.

I'm using AES on both parts, so basically what I need is to generate a random IV and a random secret key, but how to share it with the server so it can afterward decrypt the messages?

The server side is an Apache/PHP web server, so the requests will be sent through POST, and I'll be using a SSL certificate for sure, but I'm not sure if this is enough to securely send the data to the other side.

I'd appreciate any approach/idea for this.

---- EDIT ----

This is actually an Android OS app. Instead of using direct Sockets against the server, I use HTTP POST requests from the client side to the server, and Google Cloud Messages in the opposite way simulating a multicast behavior since the server will be sending new events to the subscribed users.

But these messages will be sent just to registered users, so prior to sending one I need to register the user and thus share the key between both server and client, that's the motivation of the question.

What you are looking for is a public/private key pair otherwise known as SSL in the computer world.

An SSL certificate as you mentioned is enough security since to find out what is being sent you need the private key of the certificate and you cant get that without breaking into the server.

If you don't want to use SSL another option would be to use a hardcoded public/private key pair into the client/server which would act just like SSL but without having a signed certificate.


Is this ransomware encryption or file corruption? I have backups of a user folder from an older drive that I am getting to organizing now and noticed files are either corrupted or encrypted.

File extensions and names are not changed, appears exe files are impacted, and with further analysis I have found some good files. The readable files are under about 655 bytes and I thought maybe it's a systematic if less than XXX then encrypt kind of logic. But I have also found a file of 651 is that unreadable and another of 655 is readable, it appears anything below 650 bytes is for sure readable and above 1kb for sure not readable.

Now there might be some readable bigger files but I have yet to find any suggestions for a Windows utility to do this?

Example of a unreadable readme.txt file of 766 byte:

RÐÜ`„ÜAŒŠz>‹ú ©<ìyF’”Îã¸b{¿>Q(9 <UÐˆÔIMút€*GŽ#'nÚÁ°…‹Œ#2ª0SŠ`2Aàè€aÕ›’jÚm5ñ®‰¡2æimºÈóÇæ{ž+Ý‡Ã»'åûÛs’Ø˜Òý};rÎÙœÈÐÓK;=œ¼œ¬û#W&Ì9»nI›˜´
²y…ë$c×wT<¼ò}Sð¨æfté¤:eÖ+;’®iƒŒ‘ØmÄ<XôÝçRg&y4é^~9®]¢ÓC _@jyäÇˆ¸«`dŽ<ŽK2T®f°>!@°Çødâ!YnmîÞÜ=ˆp°f|×V?œÍwöáÍèÃ[W£OòJl<‰Q‡,ùü*sõúÎt¹    @ë¯öyþ1G>zkJkŸX`Ï4Ë r @‰ŒJ¯³;ü¹ï«19QñW•[×ÞBG_fl›¤lP`ï•±Ø‘1âˆŒ#  àžˆû°9[xø•Ÿ}.y«A2ÖäkˆsÌ÷'op3|ËÕøëT
ª°^Òé÷ÄÉñ3@ˆÀC%Íõj„£”¾ŠãíïsVõ   J:ÂrËá}Æw¾Ã&Eß9´Þ=y%¹
ù6 C¾MœlIöy€@kzQûˆK”158êòü¿p¿õ3aò·ý‹p²PÁ€`”—s
.‚.ÉAô³ã´# ˜q
“ÂÂêËœ—4‡è'Š@È˜w à¬Lyqo.ùƒ3Qž—çoœ¬<øÄÚÃ9äÒ®Æ½†¦¬oVA h 9ÛVÝiÛ{%þ8›òNé’÷R7{8ñwŽ+Ç<GÏËr>Þul”,´YŸ<«îÈ™ø¬»z»~ö€ª`ÒŸ¯qoàÌHà–çDÌ¾™NTJÜ_Áå1ävwò~·3ilàB™û"]o'z7Xò]]Wr%8r§·ñps¡$Ëhq'¸sÏc1ÖY'W6t¿:

RansomNoteCleaner reports CryLocker however the files it tags are just HTML type and if opened are all corrupted.

When I then scan with CryptoSerach for CryLocker encrypted files it finds 0 results.

Now also, if I think really hard I seem to vaguely recall an episode from a few years back of a ransomware pop-up, but you would think I would notice my files corrupted then.

This is some really nostalgic stuff from over a decade ago, so part of me wishes it is ransomware as that brings some hope of getting them back.

And yes, this was a rude awakening that I am now working out a process to have backups off backups in the cloud.

UPDATE:

This appears to have been a ransomware attack, I still don't which one however to my surprise I had good copies of all impacted files: lesson here, have backups of backups!

Your Shannon entropy score of 7.9 is very high (the scale goes from 1-8).

While I can't say for sure that this is the result of ransomware encrypting the files, it seems likely when we take into account your previous positive finding that identifies this as CryLocker.

I looked through my go to list of decrypters but didn't find one that specifically mentioned CryLocker. It's possible the identification of CryLocker wasn't quite accurate, and one of those decrypters could still help.


untangle server at work place privacy When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example:

Skype chat messages
Personal emails (Gmail, Yahoo)

It depends. Untangle has the capability of intercepting HTTPS using a man in the middle proxy (https://www.untangle.com/store/https-inspector.html). If this is enabled, the HTTPS inspector can see all HTTPS traffic. This however requires that all desktop client install a root certificate issued by the Untangle device.


Limiting Concurrent Login For System Admins On Windows Domain Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our team does not use the admin accounts (there are no anonymous admin accounts, each administrator has a designated admin account) during normal operations. Only when needed to make a change, perform maintenance etc and for off-site support we have two-factor authentication. Small companies where you have to be multi-talented, overworked and underpaid is what I am getting at :)

We recently went through an audit where there was a request for us to limit/disable the concurrent logins for admin accounts. The general idea is: how do we make it hard for a rogue admin to be malicious, and also how do we know that the logged in admin accounts are not compromised (hacker logged in with admin).

From my research there is no way to limit the concurrent logins for an account on a Windows domain out of the box? Does it require third party software?

so I don't think this is going to be 100% possible.

What you can do is limit your servers to a single RDP session :
https://support.managed.com/kb/a1816/how-to-enable-disable-multiple-rdp-sessions-in-windows-2012.aspx

What you won't be able to prevent (I don't think) is someone using a console session at the same time (so MSTSC /admin) and the equivelent physical access console session.


Apple's OTA update process When reading the iOS security doc, on page 6, it discusses the OTA update process.

The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, Apples signs the version information and device ID. A nonce is also sent by device to tackle replay attacks.

Apple also states:

The boot-time chain-of-trust evaluation verifies that the signature comes from
Apple and that the measurement of the item loaded from disk, combined with the
device’s ECID, matches what was covered by the signature. These steps ensure that
the authorization is for a specific device and that an old iOS version from one
device can’t be copied to another. The nonce prevents an attacker from saving
the server’s response and using it to tamper with a device or otherwise alter
the system software.

My questions are:

1) Why is the signed device ID required to be part of OTA update ? If device contacts Apple, only Apple can sign a OTA response. Given a nonce is involved, the device could tell its for the request just sent. Then why is the signed device ID needed for personalizing the OTA update ?

2) They mention copying old iOS to different phone - do they imply via some USB interface or other ? How can this be accomplished ?

The iOS firmware installation process over USB requires "SHSH blobs" which contain the iOS version string and unique device ID and which are then signed by Apple. The iOS bootloader requires that signature before it will load and execute that code. I assume OTA updates are similar and as a result also require SHSH blobs.

Why is the signed device ID necessary? Ask Apple, not us. Most likely it's a defense mechanism against downgrading to vulnerable firmwares (for jailbreaking) since you need the matching SHSH blobs which Apple no longer signs if a new firmware release is available. This is actually mentioned in your quote, they want so that "an old iOS version from one device can’t be copied to another".


Keylogger on an SD Card? Can an SD card be used as a medium of implementing a keylogger? The location of an SD card slot on some laptops is such that it is impossible to see if it contains a card in it unless you deliberately check it, so it could be an easy spot to put a keylogger. But from what I understand an SD card slot unlike a USB one uses a purely read-write protocol (i.e. storage) that cannot execute any code so running a keylogger should not be possible - but is that so?

SD cards are simply micro-controllers with NAND flash storage, similar to USB flash drives. The firmware on these devices has been shown to be vulnerable to manipulation and SD cards have been shown to be capable of MITM attacks: here

Code execution being possible, and many software-based key loggers being available, it's not a stretch to say that an SD card could be used to install a software-based Keylogger on your system. Also like you point out, they are also not easy to spot.

Andrew Huang and Sean Cross even note regarding their exploit:

  While SD cards are admittedly I/O-limited, some clever hacking of the
  microcontroller in an SD card could make for a very economical and
  compact data logging solution for I2C- or SPI-based sensors


How to fight browser fingerprinting? https://panopticlick.eff.org/ , aka "How unique and trackable is your browser". For example it usually gives me a unique score. The biggest entropy values come from navigator.plugins and fonts via java and flash, but the linked pdf also points out that disabling these common plugins actually just adds to the uniqueness, as well as simply altering the User Agent. Font detection is also seems possible via css introspection.

What steps can one take, what technology options do exists to counter-measure fingerprinting of one's browser?

The fingerprinting technology used by the EFF is nothing but the "normal" Javascript functions used by web sites to, well, operate properly. It is possible to report untrue information to the outside, but then you'd risk either "falling behind":

the untrue information you would need send along changes and yours doesn't, making you unique -- and suspicious;
the detection techniques change, and you aren't aware of it, so become unique again;

or having a really awkward navigation.

Assuming that you can use Tor or a VPN or an openshell anywhere to tunnel away your IP address, the "safest" practice in my opinion would be to fire up a virtual machine, install a stock Windows Seven on it, and use that for any privacy-sensitive operation. Do not install anything unusual on the machine, and it will truthfully report to be a stock Windows Seven machine, one among a horde of similar machines.

You have also the advantage of the machine being insulated inside your true system, and you being able to snapshot/reinstall it in a flash. Which you can do every now and then - the "you" that did all the navigation before disappears and a fresh "you" appears, with a clean history.

This can be very useful, in that you could keep a "clean" snapshot and always restore it before sensitive operations such as home banking. Some VM's also allow 'sandboxing', i.e., nothing done in the VM will actually permanently change its contents -- all system changes, malware downloaded, virus installed, keyloggers injected, disappear as soon as the virtual machine is powered down.

Any other technique would be no less intrusive, and would entail a considerable work on the browser or on some kind of anonymizing proxy designed not only to sanitize your headers and your Javascript responses (as well as the fonts!), but to do it in a believable way.

In my opinion, not only would the total amount of work be the same (or even more), but it would be a much more complicated and less stable kind of work.

Install the most common OS, keep to the bundled browser and software, resist the temptation of pimping it, and what's to tell that machine apart from literally hundreds of thousands of similar just-installed, never-maintained, computers-are-not-my-thing machines on the Internet?

Update - browsing behaviour and side channels

Now I have installed a virtual Windows 7 machine, even upgraded it to Windows 10 as Joe Q. Average would do. I'm not using Tor or VPN; all that an external site can see is that I'm connecting from Florence, Italy. There are thirty thousand connections exactly like mine. Even knowing my provider, that still leaves around nine thousand candidates. Is this sufficiently anonymous?

It turns out not to be the case. There might still be correlations that could be investigated, having sufficient access. For example I'm playing an online game and my typing is sent straight away (character buffered, not line buffered). It becomes possible to fingerprint digram and trigram delays, and with a sufficiently large corpus, establish that online user A is the same person as online user B (within the same online game, of course). The same problem could happen elsewhere.

When I surf the Internet, I tend to always hit the same sites in the same order. And of course I hit my "personal pages" on several sites, e.g. Stack Overflow, regularly. A bespoke distribution of images is already in my browser and is not downloaded at all or is bypassed with a HTTP If-Modified-Since or If-None-Match request. This combination of habit and browser helpfulness also constitutes a signature.

Given the wealth of tagging methods available to websites, it's not safe to assume that only cookies and passive data may have been collected. A site might for example advertise the need to install a font called Tracking-ff0a7a.otf, and the browser would download it dutifully. This file would not necessarily be deleted upon cache clearing, and on subsequent visits it not being re-downloaded would be proof that I've already visited the site. The font could not be the same for all users, but contain a unique combination of glyphs (e.g. the character "1" could contain a "d", "2" could contain an "e", "4" could contain a "d" again - or this could be done with rarely used font code points), and HTML5 can be used to draw a glyph string "12345678" on an invisible canvas and uploading the result as an image. The image would then spell the hex sequence, unique to me, 'deadbeef'. And this is, to all intents and purposes, a cookie.

To fight this, I may need to:

completely re-snapshot the VM after each browsing session (and reset the modem when I do). Keeping always the same VM wouldn't be enough.
use several different virtual machines, or browsers, as well as well-known proxy services or Tor (it wouldn't do for me to use a proxy that's unique to me, or for which I'm the only Florence user, for anonymity purposes).
routinely empty and/or sanitize the browser cache and remember not to always open, say, XKCD immediately after Questionable Content.
adopt two or more different "personas" for those services I want anonymity in, and those I don't care about, and take care to keep them separated in separated VMs - it only takes one slip, and logging to one believing it's the other, for a permanent link to possibly be established by a savvy enough external agency.

Audio Fingerprint

This is a very ingenious method of "fingerprinting" a system, basically consisting in turning off the audio system, then virtually playing a sound through HTML5 and analysing it back. The result will depend from the underlying audio system, which is tied to the hardware and not even to the browser. Of course, there are ways of fighting this by injecting random noise with a plugin, but this very act might turn out to be damning, since you might well be the only one using such a plugin (and therefore having a noisy audio channel) among the pool matching your "average" configuration.

A better way that I found working, but you'll have to experiment and verify this for yourself, is to use two different VM engines or configurations. For example I have two different fingerprints on the same Dell Precision M6800 in two different VMs using 4 and 8 GB of RAM and two different ICH7 AC97 Audio settings (I suspect that the additional RAM available makes the driver employ different sampling strategies, which in turn yield slightly different fingerprints. I discovered this totally by accident by the way). I assume that I could set up a third VM using VMware and/or maybe a fourth with sound disabled.

What I do not know, though, is whether the fingerprints I did manage to get are revealing the fact it's a VM (do all Windows 7 VirtualBoxen have 50b1f43716da3103fd74137f205420a8c0a845ec as hash of full buffer? Do all M6800's?)

All the above going to show that I'll better have a good reason to want anonymity: because achieving it reliably is going to be a royal pain in the rear end.


Is copying & pasting to the clipboard vulnerable to keyloggers? (CTRL+C and CTRL+V) If I copy a username/password from an email and paste it into an FTP client or an online form in the browser, can keyloggers capture this private information?

And does it make any difference whether using:

CTRL+C and CTRL+V
vs
Right-click > Copy, Right-click > Paste

Or are both equally vulnerable to keyloggers?

From the MSDN page.

  The clipboard is a set of functions and messages that enable applications to transfer data. Because all applications have access to the clipboard, data can be easily transferred between applications or within an application.

Any applications can read data from the clipboard. A keylogger might not be logging such data, but it's definitely possible.


Is there an AES 256 LUKS encryption option in Fedora? I have certain information on my drive that I don't want anyone (not even me ;) ) to gain access to.  I read recently that Fedora only offers EAS 256 LUKS encryption.  This just isn't secure enough for me.  I want 256 or stronger for my entire drive.

Now I'm confused because on this site: http://docs.fedoraproject.org/en-US/Fedora/14/html/Security_Guide/sect-Security_Guide-LUKS_Disk_Encryption.html it says that Fedora only supports 128 - bit.  Though here: How secure is Ubuntu's default full-disk encryption? it says that LUKS uses 256 - bit, or is this for Ubuntu only.

Is there a way that I can use 256 or stronger AES full disk encryption on Fedora?

When you say that 128 bits are not enough for you, and you really want 256 bits, then you are basically saying one of the two following things:

Laws of physics do not apply to you.
You do not understand what key size is, and you just want the biggest number, the cryptographic equivalent of painting your car in red to make it go faster.

Your choice.

See this question on more information on the subject.

As for your specific question, see the documentation and try for yourself with a toy example. If you use "-s 256" as parameter to cryptsetup and it does not blow up in your face, then you can rejoice in your huge key.

See also the contents of the /proc/crypto file on your machine; this will tell you which algorithms are supported by your machine, and with which key sizes (warning: key sizes in /proc/crypto are expressed in bytes, not bits).


Enterprise IDS - Deployment & Uses I am investigating deploying the Snort IDS for an enterprise environment.  This environment consists of a NOC that manages several servers, mainly internal but some internet facing.  There are several paths to the internet from the NOC and the server's, as well as several paths to the DC from the NOC.  My question is:

Should the IDS be deployed to primarily monitor inter-LAN traffic (a NOC employee inadvertently brings a compromised computer onto the network) or to monitor internet facing traffic (exploits against the web server).

Most of the network is heavily segmented and firewalled.  The only things remotely reachable from the outside are VPN appliances and a web server cluster.  Everything else is internal.  Is an IDS necessary?  What types of attacks do they block?  For a web server wouldn't it make more sense to port block at the firewall and deploy a good application layer firewall such as ModSec to filter SQL injection\XSS.  I don't think an IDS is used for that

I'm going to answer both your questions in a kinda non-specific way, but bear with me.

Your first question is "I'm putting in an IDS, what should I tell it to do?"

Well, you're doing it backwards, but don't worry - this is a common security confusion.

An IDS, like any security system, is not a magic wand. You don't just install it and everything's hunky dory. It's a tool, that you use to treat a specific risk.

So you have to start with a risk analysis. Identify all the threats you face, and the vulnerabilities in your setup that those threats might use to harm your assets. Those are the risks. Identify the likelihood of those risks happening, and the harm they could cause. Those are the risk levels. Now you can tell which risks you are happy with, and which you need to treat.

For example, if you decide that "a NOC employee inadvertently brings a compromised computer onto the network" is a risk that is currently at an unacceptable level, then you sit and figure out a way to fix it. Part of that fix might be to have an IDS sitting inside the NOC looking at all the traffic going by. Not all of it though - you'll probably also be looking at improved scanning of machines before they get in, better processes for employees, etc. etc. You pick the control based on how well it reduces the risk.

Then you do the same process again for "exploits against the web server" and all the other risks your analysis found.

The key is: Identify and understand the risk first, and then put treatments in place to reduce it.

Your second question is "I have a strong perimeter, do I need an IDS behind it?"

There's an important security principle called "defence in depth". Basically, don't rely on one control to protect you. Layer controls, and think about what happens if one fails.

Sure, you have a strong perimeter, and little is going to get through, and thats good. But if something does, wouldn't it be nice to have an IDS there that sees it?

Of course, the question is if it is worth the expense. Snort's free, sure, but your time isn't. That's something for you to work out, based on the risk level - how likely is something to get through, how much harm could it do? Maybe it's worth it, maybe not. That's a pure business decision.


How should I share the key of the AES algorithm in each client? My doubt would be the following:

How should each client know the encryption key? Using the AES algorithm.
(or the best way):

Save it in a file encrypted by password?
Save it in a DB?
Send it over the network via SSL?

PS:

How often is it advisable to change the password?
Is it advisable that while the program is running it is saved in a private variable?

Thanks.

What you are trying to do is called key distribution. Key distribution requires you to use a secure channel. This can be:

Symmetric using a password (but then you need to distribute the password securely, so it is a bit of a chicken and egg problem).
A DB is not considered a secure way of sharing keys
SSL: assymetric encryption is one way of doing it, but in this case you could just implement SSL/TLS on your app in the first place. Similar to HTTPS is used (in fact it uses hybrid encryption to exchange a symmetric key that is then used with AES, or another symmetric cipher, for exchanging the data)
Another option is to use a hardware token that contains the encryption key (e.g. Yubikey). This can for instance be used to do mutual SSL authentication.

For your second part of your question:

This is highly debated, in general it depends on the use case of your application and how much data it encrypts. The more data it encrypts, the quicker you would need to rotate it. But this all depends on the algorithm etc. (e.g. AES GCM mode loses protection if more than 64 GB is encrypted on the same key. See NIST SP 800-38D section 5.2.1.1). So there's no single right answer. If you are going for the SSL option, every 365 days is probably your best bet.
Wether that variable is public or private does not matter. One thing to note is that rather than using String it should be char array (if using a managed language like Java or .NET) to prevent the key from being dumped to a memdump in case your machine crashes. The idea is that you load the key before each encryption/decryption and then overwrite the variable with 0's once you have finished the operation. This will reduce the likelihood of the key leaking.

Using SSL/TLS with certificate pinning in your application would be the easiest as you can actually use a different, mutually agreed symmetric key for each session you set up with your client.


PCI-DSS - key-based shell access to internal servers? In the following PCI 2.0 requirement, I am not sure how to interpret computer access to internal machines (not remotely accessible):

Requirement 8: Assign a unique ID to each person with computer access

8.2 In addition to assigning a unique ID, employ at least one of the
    following methods to authenticate all users:
    - Something you know, such as a password or passphrase
    - Something you have, such as a token device or smart card
    - Something you are, such as a biometric

In our system, we have a remotely accessible gateway machine and we authenticate users as per the PCI-DSS requirements.

But for various tasks, we need to access one or more internal machines and usually, this is fully automated (e.g. system upgrades). This is typically accomplished via SSH – using passwordless login.

The private key resides on the gateway server (either encrypted or non-encrypted).

My question is then if this is in violation with the 8.2 sub-requirement. The user is authenticated with the gateway machine, but does the requirement also apply for access to internal machines?

Note that the overall goal of requirement 8 is to uniquely identify computer access and not to put up "obscure security".

Every user should have a key for every machine he needs to work on. This key should password protected and NOT reside on the gateway server. You should not share keys among your different user. If this is too complicated you can have a look at centrify or SSO.  Don't  forget about accountability!


Is it possible for me to extract my own AES disk encryption key? I use Check Point Full Disk Encryption, but hope that this question can be answered generally.  Is it possible for me to get, or extract, my own 256-bit AES key?  By the way, I don't use any special password for the decryption itself, so this key must be based on my Windows login password alone (which you can assume is long enough to prevent cracking).

(Why?  It would be nice to write the key down in case some problem comes up.  I understand that the key can be pushed into "the cloud" and I could contact someone at the company if some problem ever came up, but there's some peace of mind in having it written down in my home.  And, I understand that this allows a thief to steal that note and my hard disk, thereby getting all of its information, but I don't want to start this philosophical discussion here.)

As I see it, Check Point could reveal the key within its pull-down menus if it wanted to but probably chooses not to.  Further, I would guess that the Windows 7 DPAPI prevents any other software from extracting the key even after I've logged in (and thereby given that software full permission to do anything, including physical access and decrypted access of the hard drive).

My goal here is really to confirm both sentences in the above paragraph.  More generally, I'm curious about whether DPAPI, using the login password alone, can truly prevent any mischievous application (with full permissions and physical hard disk access) from determining the protected data of any other application...but I guess that probably was Microsoft's design goal.

Yes, as a general rule Full Disk Encryption software - especially business products like Checkpoint - includes some way of backing a recovery key up. Check the documentation or ask your IT department.

By the way, it's not using your Windows logon. After all, windows is on the encrypted disk too, so it has to be unlocked long before you get to the logon prompt. If you are not being prompted for a password, it's likely using a TPM chip that automatically decrypts the drive whenever you power up the machine, so the key isn't even stored on the disk.


Should it be dangerous if I revealed part of a raw string of a hash? This is a theoretical question about hashes, where I would want to know if the hash(“XY”) would be at risk if I revealed ‘X’. Where X can be a substring. Considering the most perfect hashing algorithm (theoretically speaking).

For a perfect hashing algorithm there is absolutely no correlation between the input and an output.  Any change in input has a 50% chance of flipping each bit in the hash.  This means that information about any partial part of the plain text leaves no way to guess what the rest of the plain text is.  Even if you have a 500 character string and know the first 499 characters, nothing about the hash will help you determine what the last character is.

Therefore, for a perfect hash, the only way to guess the plain-text is by brute-force.  Of course it's worth a mention that brute force doesn't guarantee that you find the original text - only something that hashes to the same hash.  This is a result of the pigeonhole principle.  This often doesn't matter though.  For instance if you are trying to crack a password, you don't usually need to know the actual password, since any string that generates the same hash as the password will still allow you to login as the user.

Therefore, knowing part of the original text makes brute force easier.  Brute forcing a 10,000 character string hashed with SHA256 is effectively impossible.  However, it's obviously much easier if you know the first 9,999 characters, since you only need to brute force the last one.